Function at 0x4238c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
push ebx
push esi
xor bh, bh
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x4238e3
push 0x15
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x4238e5
mov bh, 1
mov byte [ebp - 8], 0x73
xor edx, edx
mov byte [ebp - 7], 0xf
mov esi, 0xf
mov byte [ebp - 6], 0x6e
mov byte [ebp - 5], 0x35
mov al, byte [ebp - 8]
mov dword [ebp - 4], edx
mov bl, byte [ebp + edx - 8]
mov ecx, edx
and ecx, esi
mov eax, 0xb431d535
cmp ecx, esi
mov edx, 0xbaee67fc
cmovae ecx, esi
shl ecx, 2
call fcn.00522040
mov edx, dword [ebp - 4]
mov cl, al
and cl, 0xf
lea eax, [edx + 0x35]
xor cl, al
xor cl, bl
mov byte [ebp + edx - 8], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 4
jb 0x423902
push 0x105
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
push 0x105
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x423b55
mov byte [ebp - 0x17], 0x76
xor edx, edx
mov byte [ebp - 0x16], 0x66
mov byte [ebp - 0x15], 0x4a
mov byte [ebp - 0x14], 0x57
mov byte [ebp - 0x13], 0x6b
mov byte [ebp - 0x12], 0x56
mov byte [ebp - 0x11], 0x5f
mov byte [ebp - 0x10], 0x21
mov al, byte [ebp - 0x17]
mov dword [ebp - 4], edx
nop dword [eax + eax]
mov bl, byte [ebp + edx - 0x17]
mov ecx, edx
and ecx, esi
mov eax, 0xd2e67225
cmp ecx, esi
mov edx, 0xdc11f89e
cmovae ecx, esi
shl ecx, 2
call fcn.00522040
mov edx, dword [ebp - 4]
mov cl, al
and cl, 0xf
lea eax, [edx + 0x25]
xor cl, al
xor cl, bl
mov byte [ebp + edx - 0x17], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 8
jb 0x4239a0
lea ecx, [ebp - 0x17]
lea eax, [ebp - 0x138]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x423a04
test dl, dl
je 0x423a00
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x423a04
add eax, 2
add ecx, 2
test dl, dl
jne 0x4239e4
xor eax, eax
jmp 0x423a09
sbb eax, eax
or eax, 1
test eax, eax
je 0x423b4d
mov byte [ebp - 0xf], 6
xor edx, edx
mov byte [ebp - 0xe], 0x15
mov byte [ebp - 0xd], 0x3a
mov byte [ebp - 0xc], 0x26
mov byte [ebp - 0xb], 5
mov byte [ebp - 0xa], 0x14
mov byte [ebp - 9], 0x5a
mov al, byte [ebp - 0xf]
mov dword [ebp - 4], edx
mov bl, byte [ebp + edx - 0xf]
mov ecx, edx
and ecx, esi
mov eax, 0xfd43a651
cmp ecx, esi
mov edx, 0xf26376ea
cmovae ecx, esi
shl ecx, 2
call fcn.00522040
mov edx, dword [ebp - 4]
mov cl, al
and cl, 0xf
lea eax, [edx + 0x51]
xor cl, al
xor cl, bl
mov byte [ebp + edx - 0xf], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 7
jb 0x423a35
lea ecx, [ebp - 0xf]
lea eax, [ebp - 0x138]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x423aa0
test dl, dl
je 0x423a9c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x423aa0
add eax, 2
add ecx, 2
test dl, dl
jne 0x423a80
xor eax, eax
jmp 0x423aa5
sbb eax, eax
or eax, 1
test eax, eax
je 0x423b4d
mov byte [ebp - 0x21], 0x46
xor edx, edx
mov byte [ebp - 0x20], 0x5d
mov byte [ebp - 0x1f], 0x7c
mov byte [ebp - 0x1e], 0x50
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x50
mov byte [ebp - 0x1b], 0x48
mov byte [ebp - 0x1a], 0x59
mov byte [ebp - 0x19], 0x51
mov byte [ebp - 0x18], 0x22
mov al, byte [ebp - 0x21]
mov dword [ebp - 4], edx
nop dword [eax]
mov bl, byte [ebp + edx - 0x21]
mov ecx, edx
and ecx, esi
mov eax, 0xee7c8c1d
cmp ecx, esi
mov edx, 0xf6febf40
cmovae ecx, esi
shl ecx, 2
call fcn.00522040
mov edx, dword [ebp - 4]
mov cl, al
and cl, 0xf
lea eax, [edx + 0x1d]
xor cl, al
xor cl, bl
mov byte [ebp + edx - 0x21], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 0xa
jb 0x423ae0
lea ecx, [ebp - 0x21]
lea eax, [ebp - 0x138]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x423b44
test dl, dl
je 0x423b40
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x423b44
add eax, 2
add ecx, 2
test dl, dl
jne 0x423b24
xor eax, eax
jmp 0x423b49
sbb eax, eax
or eax, 1
test eax, eax
jne 0x423b55
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov al, bh
pop ebx
mov esp, ebp
pop ebp
ret