Function at 0x420278
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x8c
mov dword [esp + 4], 0xed20ebcf
mov dword [esp + 8], 0x9173ef01
mov dword [esp + 0xc], 0x95789373
mov dword [esp + 0x10], 0x99089757
mov dword [esp + 0x14], 0x9d589b0a
mov dword [esp + 0x18], 0x81149f7f
mov dword [esp + 0x1c], 0x85a18363
lea eax, [esp + 0x20]
mov word [esp + 0x20], 0x8786
xor ecx, ecx
nop
mov edx, ecx
add dl, 0x3a
xor dl, byte [esp + ecx + 4]
add dl, 0x30
mov byte [esp + ecx + 4], dl
mov edx, ecx
not edx
or edx, 1
mov esi, ecx
and esi, 1
sub edx, esi
lea ecx, [edx + ecx*2]
add ecx, 2
cmp ecx, 0x1e
jb case.default.0x420271
lea ebp, [esp + 0x6e]
lea esi, [esp + 4]
mov edx, esi
mov edi, ebp
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x8a]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0x60]
push edi
push 0
push 0
push 0xe
push ebp
push 0
call dword [0x444994]
xor ecx, ecx
cmp eax, 0xc0000023
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x43f2b0]
mov ebx, dword [esp + 0x60]
test ebx, ebx
jns 0x420287
mov eax, 0xffffffff
jmp 0x42028a
lea eax, [ebx + ebx]
push eax
call fcn.00408310
add esp, 4
push edi
push ebx
mov dword [esp + 8], eax
push eax
push 0xe
push ebp
push 0
call dword [0x444994]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43f2b8]
xor ebx, ebx
jmp dword [0x43f2c0]
push dword [esp]
call fcn.00408320
add esp, 4
xor ebx, ebx
jmp case.0x420271.3
mov eax, dword [esp + 0x60]
mov ecx, eax
add ecx, 9
jns 0x4202dd
mov eax, 0xffffffff
jmp 0x4202e4
lea eax, [eax*2 + 0x12]
mov ebp, dword [esp + 0xa0]
push eax
call fcn.00408310
add esp, 4
mov edi, eax
mov dword [esp + 4], 0x2998279a
mov dword [esp + 8], 0x2d8f2b8b
mov dword [esp + 0xc], 0x11b12f85
mov dword [esp + 0x10], 0x15b113b5
mov dword [esp + 0x14], 0x19181785
mov eax, 0x5e37b496
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x5e37b492]
xor edx, eax
add edx, 0xe425b4f
mov ecx, edx
and ecx, 0x2e
add ecx, ecx
xor edx, 0x51
sub ecx, edx
add cl, 0x52
mov byte [esp + eax - 0x5e37b492], cl
inc eax
cmp eax, 0x5e37b4aa
jne 0x420330
mov eax, dword [esp]
movzx ecx, word [eax]
mov eax, edi
test cx, cx
je 0x420391
mov eax, dword [esp]
lea edx, [eax + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x420380
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x4203c1
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4203b0
mov word [eax], 0
lea eax, [esp + 0x68]
push eax
push edi
call fcn.00439240
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x43f2c8]
mov eax, dword [esp + 0x68]
shr eax, 2
and eax, 4
jmp dword [eax + 0x43f2d0]
mov eax, dword [esp + 0x60]
mov ecx, eax
add ecx, 0x25
jns 0x420402
mov eax, 0xffffffff
jmp 0x420409
lea eax, [eax*2 + 0x4a]
push eax
call fcn.00408310
add esp, 4
mov dword [esp + 0x50], eax
mov dword [esp + 4], 0xd39fd18c
mov dword [esp + 8], 0xd7b5d5bd
mov dword [esp + 0xc], 0xdbb5d9aa
mov dword [esp + 0x10], 0xdfb1ddaf
mov dword [esp + 0x14], 0xe396e186
mov dword [esp + 0x18], 0xe7b1e5b8
mov dword [esp + 0x1c], 0xeb84e981
mov dword [esp + 0x20], 0xef81ed88
mov dword [esp + 0x24], 0xf381f187
mov dword [esp + 0x28], 0xf7bbf5d4
mov dword [esp + 0x2c], 0xfb93f999
mov dword [esp + 0x30], 0xffa2fd90
mov dword [esp + 0x34], 0x36d014c
mov dword [esp + 0x38], 0x7670567
mov dword [esp + 0x3c], 0xb2a0964
mov dword [esp + 0x40], 0xf610d4a
mov dword [esp + 0x44], 0x1376117c
mov dword [esp + 0x48], 0x17641571
mov dword [esp + 0x4c], 0x1b1a196b
xor ebp, ebp
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 4]
mov eax, ebp
and eax, 0xa0
mov edx, ecx
xor edx, 0xcad43950
add edx, eax
xor edx, ebx
mov eax, edx
not eax
and eax, 0xcc
and edx, 0x33
sub edx, eax
add dl, 0x4c
mov byte [esp + ecx + 4], dl
inc ecx
add ebp, 2
cmp ecx, 0x4c
jne 0x4204c0
mov eax, dword [esp]
movzx ecx, word [eax]
mov ebx, dword [esp + 0x50]
mov eax, ebx
test cx, cx
je 0x420521
mov edx, dword [esp]
add edx, 2
mov eax, ebx
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x420510
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
mov ebp, dword [esp + 0xa0]
je 0x420551
lea edx, [esp + 6]
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x420540
mov word [eax], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea eax, [esp + 0x64]
push eax
push ebx
call fcn.00439240
add esp, 8
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x43f2e8]
jmp dword [0x43f2fc]
mov eax, dword [esp + 0x64]
shr eax, 2
and eax, 4
xor ebx, ebx
jmp dword [eax + 0x43f300]
jmp dword [0x43f308]
jmp dword [0x43f2d8]
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], edi
mov dword [esp + 4], 0x51f96fc3
mov dword [esp + 8], 0x55c653f1
mov dword [esp + 0xc], 0x59cb57f9
mov dword [esp + 0x10], 0x5dfa5bf5
mov dword [esp + 0x14], 0x41ae5fca
mov dword [esp + 0x18], 0x45ed43d5
mov dword [esp + 0x1c], 0x49ec47e8
mov dword [esp + 0x20], 0x4ddb4be5
mov dword [esp + 0x24], 0x31934fdd
mov dword [esp + 0x28], 0x3599339d
mov dword [esp + 0x2c], 0x39ad379b
mov dword [esp + 0x30], 0x3d953b94
mov dword [esp + 0x34], 0x21813f9d
mov dword [esp + 0x38], 0x258d23b6
mov dword [esp + 0x3c], 0x29862789
mov dword [esp + 0x40], 0x2d8d2bb9
mov dword [esp + 0x44], 0x11802fbe
mov dword [esp + 0x48], 0x15fe1381
mov word [esp + 0x4c], 0x1716
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x9e
xor cl, byte [esp + eax + 4]
add cl, 0x10
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 0x4a
jne 0x420650
lea eax, [esp + 0x54]
push eax
push 0x4221f0
push esi
push edi
call fcn.0041e500
add esp, 0x10
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], edi
mov dword [esp + 4], 0x51f96fc3
mov dword [esp + 8], 0x55c653f1
mov dword [esp + 0xc], 0x59cb57f9
mov dword [esp + 0x10], 0x5dfa5bf5
mov dword [esp + 0x14], 0x41ae5fca
mov dword [esp + 0x18], 0x45ed43d5
mov dword [esp + 0x1c], 0x49ec47e8
mov dword [esp + 0x20], 0x4ddb4be5
mov dword [esp + 0x24], 0x31934fdd
mov dword [esp + 0x28], 0x3599339d
mov dword [esp + 0x2c], 0x39ad379b
mov dword [esp + 0x30], 0x3d953b94
mov dword [esp + 0x34], 0x21813f9d
mov dword [esp + 0x38], 0x258d23b6
mov dword [esp + 0x3c], 0x29862789
mov dword [esp + 0x40], 0x2d8d2bb9
mov dword [esp + 0x44], 0x11802fbe
mov dword [esp + 0x48], 0x15fe1381
mov word [esp + 0x4c], 0x1716
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x9e
xor cl, byte [esp + eax + 4]
add cl, 0x10
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 0x4a
jne 0x420730
lea eax, [esp + 0x54]
push eax
push 0x4221f0
push esi
push edi
call fcn.0041e500
add esp, 0x10
mov ebx, eax
jmp dword [0x43f2e0]
mov dword [esp + 0x54], 0x9db29bb0
mov dword [esp + 0x58], 0x816d9f7b
mov dword [esp + 0x5c], 0x8584836e
mov eax, 0xb00b60ca
nop
movzx ecx, byte [esp + eax + 0x4ff49f8a]
xor ecx, eax
add ecx, 0x7fa4f9af
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov byte [esp + eax + 0x4ff49f8a], cl
inc eax
cmp eax, 0xb00b60d6
jne 0x420780
mov dword [esp + 4], 0xe383e1ad
mov dword [esp + 8], 0xe78ae58d
mov dword [esp + 0xc], 0xebc5e99b
mov dword [esp + 0x10], 0xef87edbb
mov dword [esp + 0x14], 0xf396f19e
mov dword [esp + 0x18], 0xf781f59b
mov dword [esp + 0x1c], 0xfbdaf98b
mov dword [esp + 0x20], 0xff9ffdb1
mov dword [esp + 0x24], 0x36e0169
mov dword [esp + 0x28], 0x7470524
mov dword [esp + 0x2c], 0xb7e0964
mov dword [esp + 0x30], 0xf7c0d69
mov dword [esp + 0x34], 0x1373117e
mov dword [esp + 0x38], 0x177f1560
mov dword [esp + 0x3c], 0x1b7f196e
mov word [esp + 0x40], 0x1d1c
mov eax, 0xe0
mov ecx, 0x1f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0xdc]
mov ebx, edx
not ebx
or ebx, ecx
or edx, eax
and edx, ebx
mov byte [esp + eax - 0xdc], dl
inc eax
dec ecx
cmp eax, 0x11e
jne 0x420840
lea eax, [esp + 0x54]
push 0
push 4
push 0xc00000
push eax
push dword [esp + 0x60]
push esi
push ebp
call fcn.0041e110
add esp, 0x1c
mov ebx, eax
jmp dword [0x43f308]
push dword [esp + 0x50]
call fcn.00408320
add esp, 4
jmp dword [0x43f310]
jmp dword [0x43f318]
jmp dword [0x43f310]
push edi
call fcn.00408320
add esp, 4
jmp dword [0x43f318]
push dword [esp]
call fcn.00408320
add esp, 4
nop
nop
jmp dword [0x43f32c]
mov eax, dword [0x43f33c]
nop
nop
nop
nop
nop
jmp eax
mov eax, ebx
add esp, 0x8c
pop esi
pop edi
pop ebx
pop ebp
ret