Function at 0x420e21
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x84
mov dword [esp], 0xba40ba1e
mov dword [esp + 4], 0xba5dbaa2
mov dword [esp + 8], 0xbaacba5e
mov dword [esp + 0xc], 0xbaa2ba70
mov dword [esp + 0x10], 0xba70baa3
mov dword [esp + 0x14], 0xbaa2ba54
mov dword [esp + 0x18], 0xba0dba56
lea eax, [esp + 0x1c]
mov word [esp + 0x1c], 0xba29
xor ecx, ecx
nop
nop
mov edx, ecx
and edx, 0xd
xor edx, 0x5cdd
mov esi, ecx
and esi, 2
sub esi, edx
xor si, word [esp + ecx*2]
add esi, 0xffffe6e8
mov word [esp + ecx*2], si
inc ecx
cmp ecx, 0xf
jne case.default.0x420e1a
lea ebp, [esp + 0x66]
mov edx, esp
mov edi, ebp
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x82]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0x4c]
push edi
push 0
push 0
push 0xe
push ebp
push 0
call dword [0x4452a8]
xor ecx, ecx
cmp eax, 0xc0000023
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x43ffcc]
mov ebx, dword [esp + 0x4c]
test ebx, ebx
jns 0x420e30
mov eax, 0xffffffff
jmp 0x420e33
lea eax, [ebx + ebx]
push eax
call fcn.00407fa0
add esp, 4
mov esi, eax
push edi
push ebx
push eax
push 0xe
push ebp
push 0
call dword [0x4452a8]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43ffd4]
xor ebx, ebx
jmp dword [0x43ffdc]
push esi
call fcn.00407fb0
add esp, 4
xor ebx, ebx
jmp case.0x420e1a.0
mov eax, dword [esp + 0x4c]
mov ecx, eax
add ecx, 9
jns 0x420e82
mov eax, 0xffffffff
jmp 0x420e89
lea eax, [eax*2 + 0x12]
push eax
call fcn.00407fa0
add esp, 4
mov edi, eax
mov dword [esp], 0xbd91bd9c
mov dword [esp + 4], 0xbda0bda3
mov dword [esp + 8], 0xbda4bdaf
mov dword [esp + 0xc], 0xbda2bda1
mov dword [esp + 0x10], 0xbdc9bdbb
xor eax, eax
nop
nop
nop
movzx ecx, word [esp + eax*2]
lea edx, [eax - 0x591a5c40]
xor edx, ecx
mov ecx, edx
or ecx, 0xfffe
add ecx, edx
not edx
and edx, 1
add ecx, edx
add ecx, 0xffffe201
mov word [esp + eax*2], cx
inc eax
cmp eax, 0xa
jne 0x420ec0
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x420f11
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x420f00
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x420f41
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x420f30
mov word [eax], 0
lea eax, [esp + 0x60]
push eax
push edi
call fcn.004398e0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43ffe4]
mov eax, dword [esp + 0x60]
shr eax, 2
and eax, 4
jmp dword [eax + 0x43ffec]
mov eax, dword [esp + 0x4c]
mov ecx, eax
add ecx, 0x25
jns 0x420f82
mov eax, 0xffffffff
jmp 0x420f89
lea eax, [eax*2 + 0x4a]
push eax
call fcn.00407fa0
add esp, 4
mov ebp, eax
mov dword [esp], 0x8d788d68
mov dword [esp + 4], 0x8c948c9f
mov dword [esp + 8], 0x8c968c8a
mov dword [esp + 0xc], 0x8c948c89
mov dword [esp + 0x10], 0x8c898c9a
mov dword [esp + 0x14], 0x8d688d62
mov dword [esp + 0x18], 0x8caf8ca9
mov dword [esp + 0x1c], 0x8cac8ca6
mov dword [esp + 0x20], 0x8cb68cb3
mov dword [esp + 0x24], 0x8d4a8d66
mov dword [esp + 0x28], 0x8ca08ca9
mov dword [esp + 0x2c], 0x8d578ca6
mov dword [esp + 0x30], 0x8ca28d40
mov dword [esp + 0x34], 0x8cae8cad
mov dword [esp + 0x38], 0x8d718cbc
mov dword [esp + 0x3c], 0x8cbc8d54
mov dword [esp + 0x40], 0x8cb18cb8
mov dword [esp + 0x44], 0x8ca58cb3
mov dword [esp + 0x48], 0x8d198cab
xor eax, eax
nop
nop
nop
movzx ecx, word [esp + eax*2]
lea edx, [eax + 0x6a498194]
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
add ecx, 0x74f4
mov word [esp + eax*2], cx
inc eax
cmp eax, 0x26
jne 0x421030
movzx ecx, word [esi]
mov eax, ebp
test cx, cx
je 0x421081
mov edx, esi
add edx, 2
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x421070
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x4210b1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4210a0
mov word [eax], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea eax, [esp + 0x5c]
push eax
push ebp
call fcn.004398e0
add esp, 8
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x43fff4]
mov eax, dword [esp + 0x5c]
shr eax, 2
and eax, 4
xor ebx, ebx
jmp dword [eax + 0x43fffc]
jmp dword [0x440004]
push ebp
call fcn.00407fb0
add esp, 4
jmp dword [0x44000c]
mov eax, ebx
add esp, 0x84
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 0x98]
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], edi
mov dword [esp], 0x6c206c25
mov dword [esp + 4], 0x6c396c29
mov dword [esp + 8], 0x6c3e6c23
mov dword [esp + 0xc], 0x6c296c21
mov dword [esp + 0x10], 0x6cff6c24
mov dword [esp + 0x14], 0x6c3a6c25
mov dword [esp + 0x18], 0x6c316c3a
mov dword [esp + 0x1c], 0x6c206c39
mov dword [esp + 0x20], 0x6c3a6c2b
mov dword [esp + 0x24], 0x6c366c35
mov dword [esp + 0x28], 0x6c286c31
mov dword [esp + 0x2c], 0x6c366c30
mov dword [esp + 0x30], 0x6c006c03
mov dword [esp + 0x34], 0x6c0a6c16
mov dword [esp + 0x38], 0x6c0b6c0b
mov dword [esp + 0x3c], 0x6c066c15
mov dword [esp + 0x40], 0x6c196c18
mov dword [esp + 0x44], 0x6cc16c19
mov word [esp + 0x48], 0x6cec
mov eax, 0xc4e62888
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [esp + eax*2 + 0x7633aef0]
mov edx, eax
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
add ecx, 0xffffbbc0
mov word [esp + eax*2 + 0x7633aef0], cx
inc eax
cmp eax, 0xc4e628ad
jne 0x4211e0
lea eax, [esp + 0x50]
push eax
push 0x422c50
lea eax, [esp + 8]
push eax
push edi
call fcn.0041f020
add esp, 0x10
mov ebx, eax
jmp dword [0x44000c]
mov dword [esp + 0x50], 0xc249c24c
mov dword [esp + 0x54], 0xc384c38d
mov dword [esp + 0x58], 0xc22bc386
movzx eax, word [esp + ebx*2 + 0x50]
lea ecx, [ebx + 0x7d8d7696]
xor ecx, eax
add ecx, 0x13944b4f
mov eax, ecx
and eax, 1
xor ecx, 1
lea eax, [ecx + eax*2]
mov word [esp + ebx*2 + 0x50], ax
lea eax, [ebx + ebx]
and eax, 2
xor ebx, 1
add ebx, eax
cmp ebx, 6
jb 0x421240
mov dword [esp], 0x235f22a0
mov dword [esp + 4], 0x234c2346
mov dword [esp + 8], 0x228d2342
mov dword [esp + 0xc], 0x234d22a4
mov dword [esp + 0x10], 0x2352234b
mov dword [esp + 0x14], 0x237f2348
mov dword [esp + 0x18], 0x22aa237a
mov dword [esp + 0x1c], 0x236d2296
mov dword [esp + 0x20], 0x23722374
mov dword [esp + 0x24], 0x228122af
mov dword [esp + 0x28], 0x2376237d
mov dword [esp + 0x2c], 0x23762366
mov dword [esp + 0x30], 0x2367237b
mov dword [esp + 0x34], 0x23612373
mov dword [esp + 0x38], 0x237f236f
mov word [esp + 0x3c], 0x22db
mov eax, 0x2b3e2055
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [esp + eax*2 - 0x567c40aa]
mov ecx, eax
or ecx, edx
and edx, eax
sub ecx, edx
mov edx, ecx
and edx, 0xa60efd57
or ecx, 0xa60efd57
add ecx, edx
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov word [esp + eax*2 - 0x567c40aa], cx
inc eax
cmp eax, 0x2b3e2074
jne 0x421300
lea eax, [esp + 0x50]
push 0
push 4
push 0xc00000
push eax
push ebp
lea eax, [esp + 0x14]
push eax
push dword [esp + 0xb0]
call fcn.0041ee60
add esp, 0x1c
mov ebx, eax
jmp dword [0x440004]
jmp dword [0x44000c]