Function at 0x14001ef60
Capabilities:
Encode data using xor
Get disk information

Disassembly:
mov dword [rsp + 0x10], edx
mov byte [rsp + 8], cl
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov edx, dword [0x140042b38]
mov ebx, 0x2f0
mov eax, dword [0x140042b48]
mov edi, 0x1c
sar edx, 0x1f
mov ecx, 0x23d
lea r13d, [rbx + 0x77]
nop word [rax + rax]
and eax, edx
sub rcx, 1
jne 0x14001efa0
movzx edx, byte [0x140042a62]
movzx r8d, byte [0x140042a86]
mov ecx, dword [0x140042b4c]
xor r8b, 1
mov dword [0x140042b48], eax
movzx eax, byte [0x140042b54]
sub al, 0x79
mov byte [0x140042a86], r8b
add dl, al
mov eax, dword [0x140042b60]
add eax, 0x93
mov dword [0x140042b60], 0
and eax, 0x28f
and dword [0x140042b3c], eax
xor eax, eax
shl eax, cl
mov ecx, 0xe6
cmp dword [0x140042b34], eax
sete al
and r8b, 0xf0
or dl, al
mov byte [0x140042b56], r8b
movzx eax, byte [0x140042b88]
mov byte [0x140042a62], dl
movzx edx, byte [0x140042b44]
sub dl, 0xa
nop
xor al, dl
sub rcx, 1
jne 0x14001f030
mov byte [0x140042b88], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x140042b2c]
xor r9d, r9d
mov ebp, dword [0x140042b28]
mov ecx, 0x83
mov r15d, dword [0x140042b58]
mov r8d, 0x1ce
movsx r12d, byte [0x140042b56]
mov r10d, dword [0x140042b68]
lea eax, [rdx + 1]
movzx r11d, byte [0x140042b55]
mov dword [rsp + 0x88], eax
movzx eax, byte [0x140042a86]
xor eax, ecx
movzx ecx, byte [0x140042b57]
or eax, 0x28
sub ebp, eax
movsx eax, byte [0x140042b64]
cmp edx, 0x28f
sete r9b
xor esi, esi
cmp edx, 0x28f
setne sil
xor r14d, r14d
cmp eax, 0x493
sete r14b
and r15d, 0x28f
jmp 0x14001f0d7
mov ebp, dword [rsp + 0x90]
cmp esi, r9d
jne 0x14001f118
cmp ebx, edi
sete al
and dword [0x140042b6c], 1
and al, 0x18
xor al, byte [0x140042b66]
or al, r10b
add r11b, al
movzx eax, byte [0x140042b80]
lea edi, [rax + rax*4]
mov eax, 0xcccccccd
shl edi, 5
mul edi
shr edx, 2
lea eax, [rdx + rdx*4]
mov edx, dword [0x140042b2c]
sub edi, eax
xor eax, eax
test edx, edx
setne al
xor ebp, eax
lea eax, [r10 - 0x16]
cmp eax, r13d
mov dword [rsp + 0x90], ebp
mov ebp, r14d
sete al
xor cl, al
test r10d, r10d
jne 0x14001f144
lea eax, [rdx + 1]
add eax, 0x28
je 0x14001f149
mov eax, 1
or ebp, eax
mov ebx, r12d
mov eax, 0xcccccccd
or r10d, r15d
mul edi
shr edx, 2
lea eax, [rdx + rdx*4]
mov edx, dword [0x140042b2c]
sub ebx, eax
add ebx, edi
sub r8, 1
jne 0x14001f0d0
movzx r14d, byte [0x140042b38]
mov edx, 0x165
mov eax, dword [0x140042b84]
xor r14b, 0x1d
movzx r13d, byte [0x140042b54]
add eax, 2
mov r9d, dword [0x140042b4c]
mov r12d, r13d
mov r15d, dword [0x140042b78]
movzx r8d, byte [0x140042b82]
mov esi, dword [0x140042a64]
mov dword [rsp + 0x98], eax
mov eax, 0x367
mov byte [0x140042b57], cl
movzx ecx, byte [0x140042b83]
mov dword [0x140042b68], r10d
mov byte [0x140042b64], r14b
nop word [rax + rax]
add eax, r12d
sete al
and r8b, al
movzx eax, r8b
or al, 0x17
xor cl, al
test r15d, r15d
setne al
sub esi, r9d
or r11b, al
xor eax, eax
sub rdx, 1
jne 0x14001f1e0
mov r12d, dword [rsp + 0x98]
mov byte [0x140042b83], cl
mov dword [rsp + 0x80], eax
movzx eax, sil
and al, 0x8f
mov byte [0x140042b82], r8b
lea ecx, [r12 + 0x60]
mov byte [0x140042b55], r11b
not cl
mov dword [0x140042a64], esi
and cl, byte [0x140042b81]
xor cl, al
mov eax, edi
mov byte [0x140042b81], cl
lea ecx, [rdi + rbx]
shr eax, cl
or eax, r15d
je 0x14001f262
cmp dword [0x140042b2c], edx
je 0x14001f262
lea eax, [rdx + 1]
jmp 0x14001f264
xor eax, eax
add byte [0x140042b56], al
xor ecx, ecx
cmp byte [0x140042a62], cl
mov edx, dword [0x140042b60]
mov r11d, dword [0x140042b2c]
sete cl
xor eax, eax
cmp ecx, dword [0x140042b34]
mov ecx, dword [rsp + 0x88]
sete al
add ecx, dword [rsp + 0x80]
sub r9d, eax
shl edx, cl
movzx eax, byte [0x140042b88]
and r11d, 0xa0
sar al, 0xa0
or r11d, ebx
mov ebx, dword [0x140042b2c]
mov ecx, 0x16
sub ecx, dword [0x140042b44]
sar edx, cl
mov ecx, 0x80
movsx r15d, al
add r13b, dl
movzx eax, byte [rsp + 0x80]
lea edx, [r9 - 0x83]
add al, byte [0x140042a88]
shl al, 7
shl ebx, 0x18
add r13b, al
mov dword [rsp + 0x20], edx
mov eax, dword [0x140042b48]
mov edx, dword [0x140042b30]
mov byte [0x140042b54], r13b
mov dword [0x140042b4c], r9d
nop
sub eax, r11d
or edx, r15d
add eax, ebx
add ecx, 0xffffffff
jne 0x14001f310
mov dword [0x140042b48], eax
mov ecx, r12d
movzx eax, r8b
mov r8d, dword [0x140042b7c]
xor eax, 0x28
and ebp, eax
mov dword [0x140042b30], edx
mov dword [0x140042b3c], ebp
mov edx, 0x2c5
shl r9d, cl
nop word [rax + rax]
test r9d, r9d
jne 0x14001f364
mov eax, 0xffffffad
movzx ecx, r14b
sar al, cl
test al, al
je 0x14001f36d
or r8d, 1
test r9d, r9d
jne 0x14001f380
mov eax, 0xffffffad
movzx ecx, r14b
sar al, cl
test al, al
jne 0x14001f380
xor eax, eax
jmp 0x14001f385
mov eax, 1
or r8d, eax
sub rdx, 1
jne 0x14001f350
mov r11d, dword [0x140042b34]
mov ecx, dword [0x140042b58]
mov eax, dword [rsp + 0x20]
and ecx, 0xfffffe11
add eax, ecx
mov dword [0x140042b7c], r8d
mov ecx, dword [rsp + 0x90]
lea r9d, [r11*4 + 0x18]
mov dword [0x140042b78], eax
mov eax, r11d
xor eax, 0x2e1
or ecx, eax
mov eax, 0xcccccccd
mul r9d
mov dword [0x140042b28], ecx
shr edx, 2
lea eax, [rdx + rdx*4]
sub r9d, eax
je 0x14001f464
sub r9d, 1
je 0x14001f43a
sub r9d, 1
je 0x14001f41d
sub r9d, 1
jne 0x14001f477
mov edx, r12d
mov ecx, r10d
shr edx, cl
cmp dword [0x140042b2c], r9d
sete al
and dl, al
and esi, 1
mov byte [0x140042b56], dl
mov dword [0x140042a64], esi
jmp 0x14001f477
xor ecx, ecx
lea eax, [r11 + 0x275]
cmp r8d, 0x9b
sete cl
or ecx, eax
mov dword [0x140042b3c], ecx
jmp 0x14001f477
cmp dword [0x140042b5c], 0
jne 0x14001f457
cmp dword [rsp + 0x88], 0
jne 0x14001f457
xor eax, eax
add dword [0x140042b6c], eax
jmp 0x14001f477
mov eax, 1
add dword [0x140042b6c], eax
jmp 0x14001f477
movzx eax, byte [0x140042a86]
xor eax, r8d
xor eax, 1
mov dword [0x140042b7c], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov r15d, dword [0x140042b4c]
mov eax, 0xcccccccd
imul r15d, dword [rsp + 0x88]
mov ecx, edi
mul r15d
shr edx, 2
lea eax, [rdx + rdx*4]
sub r15d, eax
mov eax, dword [0x140042a8c]
sar eax, 0x1f
or byte [0x140042b57], al
mov eax, dword [0x140042b68]
add eax, 0x221
mov dword [rsp + 0x88], r15d
shl eax, cl
or dword [0x140042b30], eax
movsx eax, byte [0x140042a62]
imul r13d, eax, 0x221
shr r13d, 2
call qword [sym.imp.KERNEL32.dll_GetACP]
mov ebp, dword [0x140042b7c]
mov esi, 0xffffffe7
movzx r11d, byte [rsp + 0x80]
sub sil, r13b
xor r11b, byte [0x140042b78]
mov ecx, 0xf3
mov r12d, dword [0x140042b34]
or r11b, 0x28
mov eax, dword [0x140042b40]
lea ebx, [rbp + 0x7d]
or sil, byte [0x140042b60]
sub eax, ebx
movzx r10d, byte [0x140042b54]
inc r12d
movzx edx, byte [0x140042b56]
cmp eax, edi
movzx r8d, byte [0x140042b88]
mov r15d, 0x83
movzx r9d, byte [0x140042b82]
sete r14b
xor r15d, 1
movzx eax, bl
or al, r10b
mov dword [0x140042b58], r15d
xor r8b, al
or dl, sil
sub r9b, r14b
movzx r10d, r11b
add ecx, 0xffffffff
jne 0x14001f550
movzx eax, byte [0x140042b84]
lea ecx, [r13 - 0x13]
add byte [0x140042a63], al
and ecx, 0x28
mov esi, dword [rsp + 0x98]
mov r10d, 0x2dc
mov byte [0x140042b56], dl
mov edx, dword [0x140042b38]
mov byte [0x140042b88], r8b
mov r8d, dword [0x140042b6c]
mov dword [rsp + 0x90], r15d
mov r15d, dword [rsp + 0x88]
lea eax, [rdx + 0x493]
mov dword [0x140042b44], eax
xor eax, eax
sar edx, cl
add r8d, edx
mov byte [0x140042b82], r9b
cmp dword [0x140042b3c], eax
setne al
and ebp, 0xa0
mov dword [0x140042b4c], eax
lea eax, [r15 + 0x2f7]
or eax, esi
xor eax, dword [rsp + 0x90]
imul eax, eax, 0x2dc
add dword [0x140042a8c], eax
nop dword [rax]
mov ecx, r8d
mov eax, 0xaaaaaaab
imul ecx, r12d
mul ecx
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
xor eax, eax
test ebp, ebp
setne al
sub r8d, eax
sub r10, 1
jne 0x14001f610
movzx eax, r9b
or eax, ecx
mov dword [0x140042b6c], r8d
or eax, 0xa0
xor dword [0x140042a64], eax
test r12d, r12d
setne al
add r9b, al
mov byte [0x140042b54], r9b
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov r8d, dword [0x140042b58]
mov ecx, esi
mov eax, edi
shr eax, cl
test eax, eax
movzx eax, r8b
setne cl
shl al, cl
sub byte [0x140042b66], al
mov ecx, dword [0x140042b84]
mov eax, ecx
or eax, 0x2f7
sub ecx, eax
movzx eax, byte [0x140042a87]
mov dword [0x140042b84], ecx
lea ecx, [r13 - 0x3d]
xor ecx, eax
movzx eax, byte [0x140042a86]
and dword [0x140042a64], ecx
xor eax, 0x2f7
mov eax, dword [rsp + 0x80]
jne 0x14001f6c6
test eax, eax
jne 0x14001f6c6
xor edx, edx
jmp 0x14001f6cb
mov edx, 1
sar dword [0x140042b60], 1
lea ecx, [rax + 0x28]
movsx eax, byte [0x140042b88]
xor ecx, eax
lea eax, [r8 - 0x28]
and dword [0x140042b3c], eax
xor eax, eax
sub dword [0x140042b48], ecx
cmp dword [0x140042b2c], eax
sete al
xor edx, eax
lea eax, [rbx - 0x7d]
or al, 0x28
mov dword [0x140042b6c], edx
and al, byte [0x140042a88]
xor byte [0x140042b83], al
cmp dword [0x140042b68], 0
jne 0x14001f726
xor eax, eax
cmp ebx, 1
setb al
cmp eax, esi
jae 0x14001f7a4
cmp dword [0x140042b28], 0
je 0x14001f745
test r15d, r15d
je 0x14001f745
sub edi, esi
cmp edi, dword [0x140042b5c]
jne 0x14001f745
mov eax, 1
jmp 0x14001f747
xor eax, eax
add dword [0x140042b7c], eax
mov ecx, r13d
xor eax, eax
shl eax, cl
cmp eax, 0xffffffad
jne 0x14001f766
cmp byte [0x140042b65], 0
jne 0x14001f766
xor eax, eax
jmp 0x14001f76b
mov eax, 1
sub dword [0x140042b4c], eax
mov eax, dword [0x140042b78]
or eax, 0x2e7
cmp byte [0x140042b57], 0
mov dword [0x140042b28], eax
jne 0x14001f79a
mov dword [0x140042b40], 0
test r15d, r15d
je 0x14001f7a4
mov dword [0x140042b40], 1
call fcn.14001e590
xor eax, eax
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret