Function at 0x4215ac
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7a8
mov eax, 0x4c9ce8
push ebx
push esi
push edi
call fcn.0049fef4
push 0x400
push 0
lea edx, [ebp - 0x44c]
push edx
call fcn.0049fac0
add esp, 0xc
lea ecx, [ebp - 0x84c]
push 0x400
push 0
push ecx
call fcn.0049fac0
add esp, 0xc
push 0x64
call fcn.0049f2bc
pop ecx
mov dword [ebp - 0x48], eax
push 0x64
call sub.KERNEL32.DLL_GetTickCount
mov ecx, 0x2800
xor edx, edx
div ecx
add edx, 0x401025
push edx
mov eax, dword [ebp - 0x48]
push eax
call fcn.0049fa50
add esp, 0xc
shl ebx, 3
mov eax, dword [ebp - 0x3c]
shl eax, 2
add ebx, eax
mov dword [ebp - 0x850], ebx
fild dword [ebp - 0x850]
mov dword [ebp - 0x854], esi
fild dword [ebp - 0x854]
fmul qword [0x421a88]
faddp st(1)
call fcn.004a6bd0
mov dword [ebp - 0x38], eax
mov edx, edi
mov ecx, dword [ebp - 0x40]
mov ebx, dword [ebp - 0x3c]
shl ecx, 2
lea eax, [esi + esi*2]
shl edi, 3
add edi, ecx
mov ecx, esi
shl ebx, 3
add edi, eax
shl edx, 2
mov dword [ebp - 0x3c], edi
add ebx, edx
mov edi, dword [ebp - 0x40]
mov edx, esi
add ebx, eax
shl edx, 2
shl edi, 3
add edi, edx
mov edx, ebx
shl edx, 2
add edi, eax
shl ecx, 3
add ecx, edx
add ecx, eax
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
shl edx, 2
shl ecx, 3
add ecx, edx
add ecx, eax
mov eax, dword [ebp - 0x38]
add eax, ebx
mov esi, ecx
add eax, dword [ebp - 0x3c]
add edi, eax
add edi, dword [ebp - 0x40]
shl esi, 3
add edi, esi
xor esi, esi
mov dword [ebp - 0x44], edi
jmp 0x421722
lea eax, [esi - 0xa]
mov dword [ebp - 0x850], eax
fild dword [ebp - 0x850]
fmul qword [0x421a90]
mov edx, ebx
shl edx, 3
mov dword [ebp - 0x854], edx
fild dword [ebp - 0x854]
faddp st(1)
mov dword [ebp - 0x858], ebx
fild dword [ebp - 0x858]
faddp st(1)
call fcn.004a6bd0
mov ebx, eax
mov edx, dword [ebp - 0x48]
movsx ecx, byte [edx]
mov eax, ecx
add eax, eax
lea eax, [eax + eax*4]
add eax, 0x137d
cmp esi, eax
jne 0x421721
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x48]
add edx, 0xd0
mov dword [ecx + 0x1f78], edx
inc esi
mov eax, dword [ebp - 0x44]
mov ecx, 0x3e8
cdq
idiv ecx
add edx, 0x270f
cmp esi, edx
jl 0x4216bc
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x1d78], 0xffffffff
mov edx, dword [ebp + 0xc]
cmp byte [edx + 0x655], 1
jne 0x4218f0
lea ecx, [ebp - 0x44c]
push ecx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00429a40
add esp, 8
cmp eax, 0xffffffff
jne 0x4217c0
mov word [ebp - 0x20], 8
mov edx, 0x4c5faa
lea eax, [ebp - 4]
call fcn.004adb50
inc dword [ebp - 0x14]
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.004adc7c
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebp - 0x20], 0x14
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x14]
call fcn.004adc4c
pop eax
mov word [ebp - 0x20], 8
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x421a80
cmp eax, 0xfffffffe
jne 0x421819
mov word [ebp - 0x20], 0x20
mov edx, 0x4c5fbd
lea eax, [ebp - 8]
call fcn.004adb50
inc dword [ebp - 0x14]
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
call fcn.004adc7c
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebp - 0x20], 0x2c
push eax
lea eax, [ebp - 8]
dec dword [ebp - 0x14]
call fcn.004adc4c
pop eax
mov word [ebp - 0x20], 0x20
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x421a80
test eax, eax
jne 0x42182c
mov ecx, dword [ebp + 0xc]
mov byte [ecx + 0x655], 0
jmp 0x4218f0
xor esi, esi
jmp 0x4218d7
lea eax, [esi - 0xa]
mov dword [ebp - 0x850], eax
fild dword [ebp - 0x850]
fmul qword [0x421a90]
mov edx, dword [ebp - 0x3c]
shl edx, 3
mov dword [ebp - 0x854], edx
fild dword [ebp - 0x854]
faddp st(1)
fild dword [ebp - 0x3c]
faddp st(1)
call fcn.004a6bd0
mov dword [ebp - 0x3c], eax
movsx edx, byte [ebp - 0x44c]
add edx, 0x3fe
cmp esi, edx
jne 0x42187e
add dword [ebp - 0x3c], 2
mov eax, dword [ebp - 0x48]
mov ecx, 0x64
cdq
idiv ecx
add edx, 0x1790
cmp esi, edx
jne 0x4218d6
mov eax, dword [ebp - 0x48]
xor ebx, ebx
mov edx, eax
lea ecx, [ebp - 0x44c]
mov dword [ebp - 0x4c], edx
movsx edi, byte [ecx]
mov eax, edi
mov edi, 9
xor eax, ebx
inc ebx
cdq
idiv edi
mov eax, edx
mov edx, dword [ebp - 0x4c]
add eax, 0x30
mov byte [edx], al
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
inc ecx
mov dword [eax + 0x1d78], 0x64
add dword [ebp - 0x4c], 3
cmp ebx, 0x14
jl 0x4218a3
inc esi
mov eax, dword [ebp - 0x44]
mov ecx, 0x3e8
cdq
idiv ecx
add edx, 0x270f
cmp esi, edx
jl 0x421833
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0x655], 0
jne 0x421a1e
lea edx, [ebp - 0x84c]
push 0x400
push edx
push 0
lea ecx, [ebp - 0x34]
push 0
push ecx
lea eax, [ebp - 0x44c]
push 0x400
push eax
push 0x4c5fc8
call sub.KERNEL32.DLL_GetVolumeInformationA
mov edx, dword [ebp + 0xc]
mov ecx, 0x2c
mov dword [edx + 0x1d78], 0x64
mov eax, dword [ebp - 0x34]
xor edx, edx
div ecx
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x44c]
shr eax, 1
add edx, eax
add edx, 0xbc5446
mov dword [ebp - 0x34], edx
mov edx, dword [ebp - 0x34]
push edx
push 0x4c5fcc
push ecx
call fcn.004a3230
add esp, 0xc
lea eax, [ebp - 0x44c]
push eax
call fcn.0049fbf4
pop ecx
cmp eax, 3
jl 0x421995
mov dl, byte [ebp - 0x44a]
mov cl, byte [ebp - 0x44c]
mov byte [ebp - 0x44a], cl
mov byte [ebp - 0x44c], dl
xor ebx, ebx
mov edx, dword [ebp - 0x48]
mov ecx, edx
lea esi, [ebp - 0x44c]
cmp eax, ebx
jle 0x4219b3
mov dl, byte [esi]
mov byte [ecx], dl
inc ebx
add ecx, 3
inc esi
cmp eax, ebx
jg 0x4219a6
mov ebx, eax
lea eax, [ebx + ebx*2]
mov edx, dword [ebp - 0x48]
lea ecx, [edx + eax]
lea esi, [ebp + ebx - 0x44c]
cmp ebx, 0x11
jge 0x4219ed
mov eax, dword [ebp - 0x34]
xor edx, edx
div ebx
xor edx, edx
mov edi, 0xa
div edi
add dl, 0x30
inc ebx
mov byte [esi], dl
mov al, byte [esi]
inc esi
mov byte [ecx], al
add ecx, 3
cmp ebx, 0x11
jl 0x4219ca
mov al, 0x39
mov byte [ebp - 0x43b], al
mov edx, dword [ebp - 0x48]
mov byte [edx + 0x33], al
mov al, 0x39
mov byte [ebp - 0x43a], al
mov edx, dword [ebp - 0x48]
mov byte [edx + 0x36], al
mov al, 0x39
mov byte [ebp - 0x439], al
mov edx, dword [ebp - 0x48]
mov byte [edx + 0x39], al
mov byte [ebp - 0x438], 0
movsx ecx, byte [ebp - 0x44c]
cmp ecx, 0x30
jne 0x421a31
mov byte [ebp - 0x44c], 0x39
mov word [ebp - 0x20], 0x38
lea edx, [ebp - 0x44c]
lea eax, [ebp - 0xc]
call fcn.004adb50
mov edx, eax
inc dword [ebp - 0x14]
mov eax, dword [ebp + 8]
call fcn.004adc7c
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebp - 0x20], 0x44
push eax
lea eax, [ebp - 0xc]
dec dword [ebp - 0x14]
call fcn.004adc4c
pop eax
mov word [ebp - 0x20], 0x38
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret