Function at 0x424953
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x90
mov dword [esp], 0x194e1b77
mov dword [esp + 4], 0x65cb67a9
mov dword [esp + 8], 0x61d663cb
mov dword [esp + 0xc], 0x6dde6f2f
mov dword [esp + 0x10], 0x69266bdc
mov dword [esp + 0x14], 0x75ca77c7
mov dword [esp + 0x18], 0x711973db
lea eax, [esp + 0x1c]
mov word [esp + 0x1c], 0x7f70
mov dword [esp + 0x1e], 0
mov word [esp + 0x22], 0
xor ecx, ecx
nop
nop
nop
movzx edx, byte [esp + ecx]
lea esi, [ecx - 0x64a6e345]
lea edi, [ecx + 0xbb]
and edi, edx
mov ebx, esi
and ebx, edx
xor esi, edx
lea edx, [esi + ebx*2]
add edi, edi
sub edx, edi
mov edi, 1
sub edi, esi
and edi, 1
or edx, 1
sub edx, edi
add dl, 0x59
mov byte [esp + ecx], dl
mov edx, ecx
and edx, 1
mov esi, ecx
or esi, 0xfffffffe
not ecx
or ecx, 1
and ecx, esi
not ecx
lea ecx, [ecx + edx*2]
cmp ecx, 0x24
jb 0x424860
lea esi, [esp + 0x72]
mov edx, esp
mov edi, esi
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x8e]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0x50]
push eax
push 0
push 0
push 0xe
push esi
push 0
call dword [0x44cd18]
mov dword [esp], 0x8f4e492f
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
nop
nop
nop
nop
movzx edi, byte [esp + ecx]
lea edx, [ecx + 0x72]
mov ebp, edi
not ebp
or ebp, 0xee21a77
add ebp, edi
inc ebp
and edi, 0xffffff88
xor edi, 0xf11de588
mov ebx, edi
xor ebx, ebp
not ebp
and ebp, edi
add ebx, edi
sub ebx, ebp
xor ebx, edx
xor bl, 0x88
add bl, 0xc6
mov byte [esp + ecx], bl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 7
jb case.default.0x42494c
xor ecx, ecx
cmp eax, dword [esp]
setne cl
jmp dword [ecx*4 + 0x44732c]
mov ebp, dword [esp + 0x50]
test ebp, ebp
jns 0x424972
mov eax, 0xffffffff
jmp 0x424979
mov eax, dword [case.0x42494c.5]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
jmp eax
lea eax, [ebp*2]
push eax
call fcn.004086e0
add esp, 4
mov ebx, eax
lea eax, [esp + 0x50]
push eax
push ebp
push ebx
push 0xe
push esi
push 0
call dword [0x44cd18]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x447344]
mov eax, ebx
xor ebx, ebx
jmp dword [0x44734c]
mov eax, dword [esp + 0x50]
mov ecx, eax
and ecx, 9
xor eax, 9
lea eax, [eax + ecx*2]
test eax, eax
jns 0x4249d6
mov eax, 0xffffffff
jmp 0x4249d8
add eax, eax
push eax
call fcn.004086e0
add esp, 4
mov edi, eax
mov dword [esp], 0x13e211f4
mov dword [esp + 4], 0x1ffd1dfd
mov dword [esp + 8], 0x1bfb19f3
mov dword [esp + 0xc], 0x7eb05eb
mov dword [esp + 0x10], 0x3020193
mov word [esp + 0x14], 0
mov byte [esp + 0x16], 0
xor eax, eax
mov cl, 0x3b
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax]
xor dl, cl
mov ch, 0x2b
sub ch, dl
mov byte [esp + eax], ch
inc eax
dec cl
cmp eax, 0x17
jne 0x424a20
movzx ecx, word [ebx]
mov eax, edi
test cx, cx
je 0x424a61
lea edx, [ebx + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424a50
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x424a91
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424a80
mov word [eax], 0
lea eax, [esp + 0x6c]
push eax
push edi
call fcn.00440ba0
add esp, 8
not eax
shr eax, 0x1f
mov dword [esp + 0x64], ebx
jmp dword [eax*4 + 0x447354]
mov eax, ebx
add esp, 0x90
pop esi
pop edi
pop ebx
pop ebp
ret