Function at 0x40907d
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
xor ebx, ebx
mov dword [ebp - 0x1d], 0x16747474
push esi
push edi
mov dword [ebp - 0x19], 0x1c131b1a
mov eax, ebx
mov dword [ebp - 0x15], 0x74747412
mov byte [ebp - 0x11], bl
xor byte [ebp + eax - 0x1d], 0x55
inc eax
cmp eax, 0xc
jb 0x4090a2
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrA]
lea eax, [ebp - 0x1d]
push eax
mov edi, 0x40e040
mov byte [ebp - 0x11], bl
push edi
call esi
test eax, eax
jne 0x409138
mov dword [ebp - 0x1f], 0x5747474
mov eax, ebx
mov dword [ebp - 0x1b], 0x2060614
mov dword [ebp - 0x17], 0x7411071a
mov word [ebp - 0x13], 0x7474
mov byte [ebp - 0x11], bl
xor byte [ebp + eax - 0x1f], 0x55
inc eax
cmp eax, 0xe
jb 0x4090e6
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x11], bl
push eax
push section..data
call esi
test eax, eax
jne 0x409138
push ecx
push ecx
mov edx, section..data
lea ecx, [ebp - 0x60]
call fcn.004023ec
mov eax, dword [0x40e020]
mov edx, edi
mov dword [ebp - 0x28], eax
mov eax, dword [0x40e024]
push 0x364f
push edi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], eax
call fcn.00402429
add esp, 0x10
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor edi, edi
mov ebx, eax
mov dword [ebp - 8], edi
cmp dword [ebp - 4], edi
jle 0x40922f
push 3
pop ecx
mov esi, dword [ebx]
cmp word [esi], 0x2f
jne 0x40921c
movzx eax, word [esi + 2]
cmp eax, 0x61
ja 0x4092b7
je 0x4092a6
cmp eax, 0x4e
ja 0x40925b
je 0x409383
cmp eax, 0x46
ja 0x409234
je 0x40930b
sub eax, 0x41
je 0x4092a6
dec eax
sub eax, 1
je 0x409375
sub eax, 1
je 0x40931c
sub eax, 1
jne 0x40921c
mov ecx, esi
call fcn.00409a5f
push 3
mov edi, eax
pop ecx
cmp edi, ecx
jle 0x40921a
push 0x3d
pop eax
cmp word [esi + 4], ax
jne 0x40921a
push 0x80
mov ecx, 0x411551
call fcn.00406c78
lea edx, [edi - 2]
mov eax, 0x80
add esp, 4
xor ecx, ecx
cmp edx, eax
cmovg edx, eax
test edx, edx
jle 0x409211
push 6
pop esi
mov eax, dword [ebx]
mov al, byte [esi + eax]
lea esi, [esi + 2]
mov byte [ecx + 0x411551], al
inc ecx
cmp ecx, edx
jl 0x4091fe
push 3
mov dword [0x41154d], ecx
pop ecx
xor edi, edi
mov esi, dword [ebp - 8]
add ebx, 4
inc esi
mov dword [ebp - 8], esi
cmp esi, dword [ebp - 4]
jl 0x40915f
pop edi
pop esi
pop ebx
leave
ret
sub eax, 0x49
je 0x4092fa
sub eax, ecx
je 0x4092e9
sub eax, 1
jne 0x40921c
mov ecx, esi
call fcn.00409037
mov dword [0x41166f], eax
jmp 0x4093b3
sub eax, 0x4f
je 0x4093e5
sub eax, ecx
je 0x4093d7
sub eax, 1
je 0x4093c9
sub eax, 1
je 0x4093bb
dec eax
sub eax, 1
je 0x4093a7
sub eax, 1
je 0x409399
sub eax, ecx
jne 0x40921c
mov ecx, esi
call fcn.00409037
mov dword [0x411657], eax
jmp 0x4093b3
mov ecx, esi
call fcn.00409037
mov dword [0x411687], eax
jmp 0x4093b3
cmp eax, 0x6e
ja 0x409391
je 0x409383
sub eax, 0x63
je 0x409375
sub eax, 1
je 0x40931c
sub eax, 1
je 0x4091bd
sub eax, 1
je 0x40930b
sub eax, ecx
jmp 0x409237
mov ecx, esi
call fcn.00409037
mov dword [0x411663], eax
jmp 0x4093b3
mov ecx, esi
call fcn.00409037
mov dword [0x411683], eax
jmp 0x4093b3
mov ecx, esi
call fcn.00409037
mov dword [0x41166b], eax
jmp 0x4093b3
mov ecx, esi
call fcn.00409a5f
push 3
pop ecx
cmp eax, ecx
jle 0x40921c
push 0x3d
pop edx
cmp word [esi + 4], dx
jne 0x40921c
lea edx, [eax - 2]
mov dword [ebp - 0x10], edi
cmp edx, ecx
mov word [ebp - 0xc], di
cmovg edx, ecx
mov ecx, edi
test edx, edx
jle 0x409363
add esi, 6
mov ax, word [esi]
lea esi, [esi + 2]
mov word [ebp + ecx*2 - 0x10], ax
inc ecx
cmp ecx, edx
jl 0x409353
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov word [0x411655], ax
jmp 0x4093b3
mov ecx, esi
call fcn.00409037
mov dword [0x41165b], eax
jmp 0x4093b3
mov ecx, esi
call fcn.00409037
mov dword [0x411667], eax
jmp 0x4093b3
sub eax, 0x6f
jmp 0x40925e
mov ecx, esi
call fcn.00409037
mov dword [str.1DoI], eax
jmp 0x4093b3
mov ecx, esi
call fcn.00409037
mov dword [0x41168b], eax
push 3
pop ecx
jmp 0x40921c
mov ecx, esi
call fcn.00409037
mov dword [0x411673], eax
jmp 0x4093b3
mov ecx, esi
call fcn.00409037
mov dword [0x41167b], eax
jmp 0x4093b3
mov ecx, esi
call fcn.00409037
mov dword [0x411677], eax
jmp 0x4093b3
mov ecx, esi
call fcn.00409037
mov dword [0x41167f], eax
jmp 0x4093b3