Function at 0x424095
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x90
mov dword [esp + 4], 0x49be4b97
mov dword [esp + 8], 0x45db47d9
mov dword [esp + 0xc], 0x41d643db
mov dword [esp + 0x10], 0x7dee7fbf
mov dword [esp + 0x14], 0x79867bec
mov dword [esp + 0x18], 0x75fa77e7
mov dword [esp + 0x1c], 0x71a973eb
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x6f70
xor ecx, ecx
mov dl, 0x6c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dh, byte [esp + ecx + 4]
xor dh, dl
mov bl, 0x20
sub bl, dh
mov byte [esp + ecx + 4], bl
inc ecx
dec dl
cmp ecx, 0x20
jne 0x423c90
lea ebp, [esp + 0x72]
lea edx, [esp + 4]
mov edi, ebp
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x8e]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, esp
push eax
push 0
push 0
push 0xe
push ebp
push 0
call dword [0x44d264]
mov edi, eax
mov dword [esp + 4], 0x579699c7
mov dword [esp + 8], 0
mov esi, 0xa6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + esi - 0xa2]
mov ebx, ecx
and ebx, esi
mov eax, ebx
or al, 0xfd
inc al
mov edx, ebx
and dl, 0xad
mul dl
mov edx, eax
add dl, cl
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub dl, al
movzx eax, dl
add eax, esi
add al, 0xc2
mov byte [esp + esi - 0xa2], al
inc esi
cmp esi, 0xae
jne case.default.0x423d4e
xor eax, eax
cmp edi, dword [esp + 4]
setne al
xor ebx, ebx
jmp dword [eax*4 + 0x447714]
mov ebx, dword [esp]
test ebx, ebx
jns 0x423d63
mov eax, 0xffffffff
jmp 0x423d66
lea eax, [ebx + ebx]
push eax
call fcn.00408250
add esp, 4
mov esi, eax
mov eax, esp
push eax
push ebx
push esi
push 0xe
push ebp
push 0
call dword [0x44d264]
mov ecx, dword [case.0x423d4e.3]
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44772c]
xor ebx, ebx
jmp dword [0x447734]
push esi
call fcn.00408260
add esp, 4
mov eax, ebx
add esp, 0x90
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp]
mov ecx, eax
add ecx, 9
jns 0x423dcd
mov eax, 0xffffffff
jmp 0x423dd4
lea eax, [eax*2 + 0x12]
push eax
call fcn.00408250
add esp, 4
mov dword [esp + 0x54], eax
mov dword [esp + 4], 0x8f5e8924
mov dword [esp + 8], 0x83258d2d
mov dword [esp + 0xc], 0x8727813f
mov dword [esp + 0x10], 0x9b3f853f
mov dword [esp + 0x14], 0x9f9e992f
mov byte [esp + 0x18], 0
mov eax, 0x62
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x5e]
mov ebx, eax
and ebx, edx
mov edi, ebx
and edi, 0xfffffffd
mov ebp, ebx
and ebp, 2
mov ecx, ebx
or ecx, 0xfffffffd
inc ecx
imul ecx, edi
or ebx, 2
imul ebx, ebp
add ecx, edx
sub ecx, ebx
add ecx, eax
add ecx, 0xfe1f7615
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov byte [esp + eax - 0x5e], cl
inc eax
cmp eax, 0x77
jne 0x423e20
movzx ecx, word [esi]
mov edi, dword [esp + 0x54]
mov eax, edi
test cx, cx
je 0x423e91
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x423e80
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x423ec1
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x423eb0
mov word [eax], 0
lea eax, [esp + 0x6c]
push eax
push edi
call fcn.004406a0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44773c]
jmp dword [0x447750]
mov eax, dword [esp + 0x6c]
shr eax, 2
and eax, 4
jmp dword [eax + 0x447754]
jmp dword [0x447764]
mov eax, dword [esp]
mov ecx, eax
add ecx, 0x25
jns 0x423f17
mov eax, 0xffffffff
jmp 0x423f1e
lea eax, [eax*2 + 0x4a]
push eax
call fcn.00408250
add esp, 4
mov ebp, eax
mov dword [esp + 4], 0xb743896c
mov dword [esp + 8], 0xb35db55d
mov dword [esp + 0xc], 0xbf2db12e
mov dword [esp + 0x10], 0xbb29bd23
mov dword [esp + 0x14], 0xa73ab952
mov dword [esp + 0x18], 0xa359a540
mov dword [esp + 0x1c], 0xaf3ca149
mov dword [esp + 0x20], 0xab39ad40
mov dword [esp + 0x24], 0x57c9a933
mov dword [esp + 0x28], 0x53a75574
mov dword [esp + 0x2c], 0x5fb751b1
mov dword [esp + 0x30], 0x5bbe5dc8
mov dword [esp + 0x34], 0x47d559ac
mov dword [esp + 0x38], 0x43a345ab
mov dword [esp + 0x3c], 0x4f6e41d4
mov dword [esp + 0x40], 0x4bd94d86
mov dword [esp + 0x44], 0x779a49dc
mov dword [esp + 0x48], 0x73ec7599
mov dword [esp + 0x4c], 0x7f7e71ef
mov byte [esp + 0x50], 0
mov eax, 0x5e
mov ecx, 0xa1
movzx ebx, byte [esp + eax - 0x5a]
mov edx, ecx
xor edx, eax
and edx, ebx
xor edx, eax
add dl, 0x2a
mov byte [esp + eax - 0x5a], dl
inc eax
dec ecx
cmp eax, 0xab
jne 0x423fd0
movzx ecx, word [esi]
mov eax, ebp
test cx, cx
je 0x424011
mov edx, esi
add edx, 2
mov eax, ebp
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424000
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x424041
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424030
mov word [eax], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea eax, [esp + 0x68]
push eax
push ebp
call fcn.004406a0
add esp, 8
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x44776c]
mov eax, dword [esp + 0x68]
shr eax, 2
and eax, 4
xor ebx, ebx
jmp dword [eax + 0x447774]
jmp dword [0x44777c]
push ebp
call fcn.00408260
add esp, 4
jmp dword [0x447784]
jmp dword [0x44778c]
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], edi
mov dword [esp + 4], 0x13ab11a5
mov dword [esp + 8], 0x6fdc6dcf
mov dword [esp + 0xc], 0x6bd969df
mov dword [esp + 0x10], 0x67d865d3
mov dword [esp + 0x14], 0x631461ec
mov dword [esp + 0x18], 0x7fc77df3
mov dword [esp + 0x1c], 0x7bc679ce
mov dword [esp + 0x20], 0x77f975c3
mov dword [esp + 0x24], 0x73d171c3
mov dword [esp + 0x28], 0x4ffb4dfb
mov dword [esp + 0x2c], 0x4bc749fd
mov dword [esp + 0x30], 0x47ff45f2
mov dword [esp + 0x34], 0x43e341e3
mov dword [esp + 0x38], 0x5fe75dd0
mov dword [esp + 0x3c], 0x5bec59ef
mov dword [esp + 0x40], 0x57f755e7
mov dword [esp + 0x44], 0x53e251e0
mov dword [esp + 0x48], 0xafd4ad1f
mov word [esp + 0x4c], 0xa9a8
mov byte [esp + 0x50], 0
mov word [esp + 0x4e], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 4]
lea edx, [eax + 0xbc]
and edx, ecx
mov edi, edx
and edi, 2
mov ebx, edx
or ebx, 0xfffffffd
inc ebx
mov ebp, edx
and ebp, 0xfffffffd
imul ebp, ebx
or edx, 2
imul edx, edi
sub ebp, edx
add ecx, eax
lea edx, [ecx + ebp]
add ecx, ebp
add ecx, 0x6f2b190f
lea edx, [edx*2 - 0x21a9cde2]
and edx, 2
sub ecx, edx
inc ecx
mov edi, ecx
and edi, edx
xor ecx, edx
lea ecx, [ecx + edi*2]
mov byte [esp + eax + 4], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x4d
jb 0x424150
lea eax, [esp + 0x58]
push eax
push 0x4263e0
lea eax, [esp + 0xc]
push eax
mov edi, dword [esp + 0x60]
push edi
call fcn.00421e90
add esp, 0x10
mov ebx, eax
jmp dword [0x447784]
mov dword [esp + 0x58], 0x1364116a
mov dword [esp + 0x5c], 0x6fdb6dd1
mov dword [esp + 0x60], 0x6b6a69dc
mov word [esp + 0x64], 0
lea eax, [esp + 0x58]
mov ecx, 0x26deac3
nop
nop
nop
nop
nop
movzx edi, byte [eax]
mov edx, ecx
or edx, edi
lea ebx, [ecx - 0x26dea00]
and ebx, edi
not edx
or edx, ebx
mov ebx, edx
xor ebx, 0x2c
or edx, 0xd3
and ebx, edx
add ebx, edx
inc bl
mov byte [eax], bl
inc eax
dec ecx
cmp ecx, 0x26deab5
jne 0x424200
mov dword [esp + 4], 0x93339125
mov dword [esp + 8], 0x9f0a9d35
mov dword [esp + 0xc], 0x9bcd990b
mov dword [esp + 0x10], 0x872f853b
mov dword [esp + 0x14], 0x832e8116
mov dword [esp + 0x18], 0x8f118d1b
mov dword [esp + 0x1c], 0x8bea891b
mov dword [esp + 0x20], 0xf757f541
mov dword [esp + 0x24], 0xf366f159
mov dword [esp + 0x28], 0xffbffd9c
mov dword [esp + 0x2c], 0xfb66f96c
mov dword [esp + 0x30], 0xe774e549
mov dword [esp + 0x34], 0xe343e176
mov dword [esp + 0x38], 0xef47ed70
mov dword [esp + 0x3c], 0xeb47e976
mov dword [esp + 0x40], 0xd5d4
mov eax, 0xef483aa4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x10b7c560]
lea edi, [eax + 0x40000000]
mov ebx, edx
xor ebx, 0x2840283a
and edi, 0x2840283a
or edi, 0x3a10044
mov ecx, eax
and ecx, 0xc70812c5
xor ecx, edi
mov edi, edx
xor edi, 0xc5
xor edx, 0xc70812c5
or edx, edi
mov edi, ecx
xor edi, 0x81
and edi, ebx
xor ecx, 0x2bf56c7e
and ecx, edx
or ecx, edi
add ecx, 0x5396dacb
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov byte [esp + eax + 0x10b7c560], cl
inc eax
cmp eax, 0xef483ae4
jne 0x4242c0
lea eax, [esp + 0x58]
push 0
push 4
push 0xc00000
push eax
push ebp
lea eax, [esp + 0x18]
push eax
push dword [esp + 0xbc]
call fcn.00421d10
add esp, 0x1c
mov ebx, eax
mov edi, dword [esp + 0x54]
jmp dword [0x44777c]
jmp dword [0x447784]
push edi
call fcn.00408260
add esp, 4
jmp dword [0x44778c]
mov ebp, dword [esp]
test ebp, ebp
jns 0x424532
mov eax, 0xffffffff
jmp 0x424539
mov eax, dword [case.0x423d4e.35]
xor ebx, ebx
nop
jmp eax
lea eax, [ebp*2]
push eax
call fcn.00408250
add esp, 4
mov edi, eax
mov eax, esp
push eax
push ebp
push edi
push 0x1e
push esi
push 0
call dword [0x44d264]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4477ac]
xor ebx, ebx
jmp dword [0x4477b4]
mov dword [esp + 4], 0x61fe67c8
mov dword [esp + 8], 0x5df463ef
mov dword [esp + 0xc], 0x59c15fc0
mov dword [esp + 0x10], 0x55f85bca
mov dword [esp + 0x14], 0x51c457cf
mov dword [esp + 0x18], 0x4d5253cc
mov dword [esp + 0x1c], 0
mov eax, 0xf0b64a19
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0xf49b5eb]
xor ecx, eax
mov edx, ecx
and edx, 2
xor ecx, 0x82
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax + 0xf49b5eb], cl
inc eax
cmp eax, 0xf0b64a35
jne 0x4245b0
push 0
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0xac]
call fcn.0041fde0
add esp, 0x14
mov ebx, eax
jmp dword [0x4477b4]
push edi
call fcn.00408260
add esp, 4
mov eax, dword [case.0x423d4e.35]
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
mov eax, ebx
add esp, 0x88
pop esi
pop edi
pop ebx
pop ebp
ret