Function at 0x10030f40
Capabilities:
Encode data using xor
Get disk information
Get storage device properties
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100e1916
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x34c4
call fcn.100c4030
mov eax, dword [0x1010bb90]
xor eax, esp
mov dword [esp + 0x34c0], eax
push ebx
push esi
push edi
mov eax, dword [0x1010bb90]
xor eax, esp
push eax
lea eax, [esp + 0x34d8]
mov dword fs:[0], eax
xor edi, edi
cmp dword [0x1019eb9c], edi
je 0x10030f99
mov eax, dword [0x1019eba0]
jmp 0x100316c3
push 0x114
lea eax, [esp + 0x490]
push edi
push eax
mov dword [0x1019eb9c], 1
call fcn.100c44c0
add esp, 0xc
lea ecx, [esp + 0x48c]
push ecx
mov dword [esp + 0x490], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x49c], 2
jne 0x100314ec
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], edi
jmp 0x10030ff2
xor edi, edi
push 0x100
lea edx, [esp + 0x6b0]
push edi
push edx
call fcn.100c44c0
lea eax, [esp + 0x5c]
push eax
call fcn.1002ff10
mov edi, eax
push 0
push 0x20
push 0x1f
push 0x1e
push 0x1d
push 0x1c
push 0x1b
push 0x1a
push 0x19
push 0x18
push 0x17
push 0x16
push 0x15
push 0x14
push 0x13
push 0x12
push 0x11
mov ebx, 0x10
push ebx
push 0xf
push 0xe
push 0xd
push 0xc
push 0xb
push 0xa
push 9
push 8
push 7
push 6
push 5
push 0x68
push 0x28
push 0x75
push 0x26
lea esi, [esp + 0xc8]
mov dword [esp + 0x3574], 0
call fcn.10070600
add esp, 0x94
cmp dword [edi + 0x18], ebx
jb 0x1003107e
mov edi, dword [edi + 4]
jmp 0x10031081
add edi, 4
cmp dword [eax + 0x18], ebx
jb 0x1003108b
mov eax, dword [eax + 4]
jmp 0x1003108e
add eax, 4
mov ecx, dword [esp + 0x10]
push ecx
push edi
push eax
lea edx, [esp + 0x6b8]
push edx
call fcn.100c029c
add esp, 0x10
cmp dword [esp + 0x4c], ebx
jb 0x100310b8
mov eax, dword [esp + 0x38]
push eax
call fcn.100c14d4
add esp, 4
xor edi, edi
mov dword [esp + 0x34e0], 0xffffffff
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], edi
mov byte [esp + 0x38], 0
cmp dword [esp + 0x68], ebx
jb 0x100310e9
mov ecx, dword [esp + 0x54]
push ecx
call fcn.100c14d4
add esp, 4
push edi
push edi
push 3
push edi
push 3
push edi
lea edx, [esp + 0x6c4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1003122a
xor eax, eax
mov dword [esp + 0x470], eax
mov dword [esp + 0x474], eax
push 0x2710
mov dword [esp + 0x47c], eax
lea eax, [esp + 0xdc0]
push edi
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x47c], edi
mov dword [esp + 0x480], edi
call fcn.100c44c0
add esp, 0xc
push edi
lea ecx, [esp + 0x24]
push ecx
push 0x2710
lea edx, [esp + 0xdc8]
push edx
push 0xc
lea eax, [esp + 0x484]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x10031219
push 0x3e8
lea ecx, [esp + 0x7b0]
push edi
push ecx
call fcn.100c44c0
mov eax, dword [esp + 0xde0]
lea edi, [esp + 0x7b8]
lea ecx, [esp + 0xdc8]
call fcn.1002fcf0
movsx edx, byte [esp + 0x7b8]
push edx
call fcn.100c2b25
add esp, 0x10
test eax, eax
jne 0x100311d1
movsx eax, byte [esp + 0x7bf]
push eax
call fcn.100c2b25
add esp, 4
test eax, eax
je 0x10031217
lea edi, [esp + 0x14]
mov dword [esp + 0x1c], 1
call fcn.10010540
lea eax, [esp + 0x7ac]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100311f0
sub eax, edx
mov ecx, eax
lea edx, [esp + 0x7ac]
lea eax, [esp + 0x14]
call fcn.10010580
mov ecx, dword [esp + 0x14]
not ecx
mov dword [0x1019eba0], ecx
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x1c], edi
jne 0x10030f8f
mov eax, dword [esp + 0x10]
inc eax
cmp eax, ebx
mov dword [esp + 0x10], eax
jl 0x10030ff0
mov dword [esp + 0x14], 0
push 0x100
lea edx, [esp + 0x6b0]
push 0
push edx
call fcn.100c44c0
lea eax, [esp + 0x5c]
push eax
call fcn.1002ff10
mov edi, eax
push 0
push 0x20
push 0x1f
push 0x1e
push 0x1d
push 0x1c
push 0x1b
push 0x1a
push 0x19
push 0x18
push 0x17
push 0x16
push 0x15
push 0x14
push 0x13
push 0x12
push 0x11
push ebx
push 0xf
push 0xe
push 0xd
push 0xc
push 0xb
push 0xa
push 9
push 8
push 7
push 6
push 5
push 0x68
push 0x28
push 0x75
push 0x26
lea esi, [esp + 0xc8]
mov dword [esp + 0x3574], 1
call fcn.10070600
add esp, 0x94
cmp dword [edi + 0x18], ebx
jb 0x100312cb
mov edi, dword [edi + 4]
jmp 0x100312ce
add edi, 4
cmp dword [eax + 0x18], ebx
jb 0x100312d8
mov eax, dword [eax + 4]
jmp 0x100312db
add eax, 4
mov ecx, dword [esp + 0x14]
push ecx
push edi
push eax
lea edx, [esp + 0x6b8]
push edx
call fcn.100c029c
add esp, 0x10
cmp dword [esp + 0x4c], ebx
jb 0x10031305
mov eax, dword [esp + 0x38]
push eax
call fcn.100c14d4
add esp, 4
xor esi, esi
mov dword [esp + 0x34e0], 0xffffffff
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], esi
mov byte [esp + 0x38], 0
cmp dword [esp + 0x68], ebx
jb 0x10031336
mov ecx, dword [esp + 0x54]
push ecx
call fcn.100c14d4
add esp, 4
push esi
push esi
push 3
push esi
push 7
push 0xc0000000
lea edx, [esp + 0x6c4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [esp + 0x2c], edi
cmp edi, 0xffffffff
je 0x100314d7
xor eax, eax
push esi
mov dword [esp + 0x474], eax
mov dword [esp + 0x478], eax
mov dword [esp + 0x47c], eax
mov dword [esp + 0x480], eax
mov dword [esp + 0x484], eax
mov dword [esp + 0x488], eax
lea eax, [esp + 0x24]
push eax
push 0x18
lea ecx, [esp + 0x47c]
push ecx
push esi
push esi
push 0x74080
mov dword [esp + 0x3c], esi
mov esi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push edi
call esi
test eax, eax
je 0x100314d7
push 0x221
call fcn.100c2c2a
add esp, 4
push 0
lea edx, [esp + 0x28]
push edx
push 0x221
mov ebx, eax
push ebx
push 0x21
push ebx
push 0x7c088
mov byte [ebx + 0xa], 0xec
push edi
mov dword [esp + 0x44], 0
call esi
test eax, eax
je 0x100314b7
xor eax, eax
movzx ecx, word [ebx + eax*2 + 0x10]
mov dword [esp + eax*4 + 0x6c], ecx
inc eax
cmp eax, 0x100
jl 0x100313f4
push 0x400
lea edx, [esp + 0x7b0]
push 0
push edx
call fcn.100c44c0
lea esi, [esp + 0x7b8]
lea eax, [esp + 0x78]
call fcn.1002fe40
movsx eax, byte [esp + 0x7b8]
push eax
call fcn.100c2b25
add esp, 0x10
test eax, eax
jne 0x10031453
movsx ecx, byte [esp + 0x7bf]
push ecx
call fcn.100c2b25
add esp, 4
test eax, eax
je 0x100314b7
lea edi, [esp + 0x10]
mov dword [esp + 0x1c], 1
call fcn.10010540
lea eax, [esp + 0x7ac]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10031470
sub eax, edx
lea edx, [esp + eax + 0x7ac]
lea ecx, [esp + 0x7ac]
mov eax, ecx
cmp eax, edx
mov eax, dword [esp + 0x10]
jae 0x100314ac
movzx edi, byte [ecx]
movzx esi, al
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x101143e0]
inc ecx
cmp ecx, edx
jb 0x10031491
mov dword [esp + 0x10], eax
mov edi, dword [esp + 0x2c]
not eax
mov dword [0x1019eba0], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.100c0517
add esp, 4
cmp dword [esp + 0x1c], 0
jne 0x10030f8f
mov ebx, 0x10
mov eax, dword [esp + 0x14]
inc eax
cmp eax, ebx
mov dword [esp + 0x14], eax
jl 0x10031243
xor edi, edi
jmp 0x100314f1
mov ebx, 0x10
push 0x104
lea ecx, [esp + 0xbb0]
push edi
push ecx
call fcn.100c44c0
push edi
push 0x20
push 0x1f
push 0x1e
push 0x1d
push 0x1c
push 0x1b
push 0x1a
push 0x19
push 0x18
push 0x17
push 0x16
push 0x15
push 0x14
push 0x13
push 0x12
push 0x11
push ebx
push 0xf
push 0xe
push 0xd
push 0xc
push 0xb
push 0xa
push 9
push 8
push 7
push 6
push 5
push 4
push 0x32
push 0x3c
push 0x44
lea esi, [esp + 0xe0]
mov dword [esp + 0xa8], edi
mov dword [esp + 0xb8], edi
mov dword [esp + 0xc0], edi
call fcn.10070600
add esp, 0x90
cmp dword [eax + 0x18], ebx
jb 0x10031575
mov eax, dword [eax + 4]
jmp 0x10031578
add eax, 4
push 0x104
lea edx, [esp + 0xcb8]
push edx
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0x28]
push ecx
push 0x104
lea edx, [esp + 0xbc4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov esi, eax
cmp dword [esp + 0x68], ebx
jb 0x100315bd
mov eax, dword [esp + 0x54]
push eax
call fcn.100c14d4
add esp, 4
cmp esi, edi
je 0x100316c1
push 0x104
lea ecx, [esp + 0x5a8]
push edi
push ecx
call fcn.100c44c0
push edi
push 0x20
push 0x1f
push 0x1e
push 0x1d
push 0x1c
push 0x1b
push 0x1a
push 0x19
push 0x18
push 0x17
push 0x16
push 0x15
push 0x14
push 0x13
push 0x12
push 0x11
push ebx
push 0xf
push 0xe
push 0xd
push 0xc
push 0xb
push 0xa
push 9
push 8
push 7
push 6
push 5
push 4
push 3
push 0x7a
push 0x26
lea esi, [esp + 0x500]
call fcn.10070600
add esp, 0x90
cmp dword [eax + 0x18], ebx
jb 0x10031634
mov eax, dword [eax + 4]
jmp 0x10031637
add eax, 4
mov edx, dword [esp + 0x18]
push edx
push eax
lea eax, [esp + 0x5ac]
push eax
call fcn.100c029c
add esp, 0xc
cmp dword [esp + 0x488], ebx
jb 0x10031666
mov ecx, dword [esp + 0x474]
push ecx
call fcn.100c14d4
add esp, 4
lea edi, [esp + 0x18]
call fcn.10010540
lea eax, [esp + 0x5a4]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10031680
sub eax, edx
lea edx, [esp + eax + 0x5a4]
lea ecx, [esp + 0x5a4]
mov eax, ecx
cmp eax, edx
mov eax, dword [esp + 0x18]
jae 0x100316b8
movzx edi, byte [ecx]
movzx esi, al
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x101143e0]
inc ecx
cmp ecx, edx
jb 0x100316a1
not eax
mov dword [0x1019eba0], eax
jmp 0x100316c3
xor eax, eax
mov ecx, dword [esp + 0x34d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x34c0]
xor ecx, esp
call fcn.100bfcbc
mov esp, ebp
pop ebp
ret