Function at 0x41b55c
Capabilities:
Check os version
Encode data using xor
Get disk information
Get system information on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x614
mov ebx, dword [esp + 0x624]
mov dword [esp + 0x608], 0x1040
xor eax, eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov word [ebx + 0xc], ax
mov byte [ebx + 0xe], al
mov byte [ebx], 1
lea eax, [esp + 0x45c]
push 0x94
push 0
push eax
call fcn.0041d778
add esp, 0xc
xor eax, eax
mov dword [esp + 0x4f0], eax
mov dword [esp + 0x4f4], eax
mov dword [esp + 0x4f8], eax
mov dword [esp + 0x4fc], eax
mov dword [esp + 0x500], eax
mov dword [esp + 0x504], eax
mov dword [esp + 0x508], eax
mov dword [esp + 0x50c], eax
mov dword [esp + 0x510], eax
mov dword [esp + 0x514], eax
mov dword [esp + 0x518], eax
mov dword [esp + 0x51c], eax
mov dword [esp + 0x520], eax
mov dword [esp + 0x524], eax
mov dword [esp + 0x528], eax
mov dword [esp + 0x52c], eax
mov dword [esp + 0x530], eax
mov dword [esp + 0x534], eax
mov dword [esp + 0x538], eax
mov dword [esp + 0x53c], eax
mov dword [esp + 0x540], eax
mov dword [esp + 0x544], eax
mov dword [esp + 0x548], eax
mov dword [esp + 0x54c], eax
mov dword [esp + 0x550], eax
mov dword [esp + 0x554], eax
mov dword [esp + 0x558], eax
mov dword [esp + 0x55c], eax
mov dword [esp + 0x560], eax
mov dword [esp + 0x564], eax
mov dword [esp + 0x568], eax
mov dword [esp + 0x56c], eax
mov dword [esp + 0x45c], 0x9c
lea eax, [esp + 0x45c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
lea ecx, [esp + 0x570]
call fcn.004138b4
mov eax, dword [esp + 0x460]
mov edx, dword [esp + 0x464]
mov ecx, dword [esp + 0x468]
mov esi, dword [esp + 0x46c]
mov dword [esp + 0x588], eax
mov dword [esp + 0x580], 0x80
lea eax, [esp + 0x4f0]
mov dword [esp + 0x584], 0
lea edi, [esp + 0x570]
mov dword [esp + 0x5c8], 0x10
mov dword [esp + 0x58c], edx
mov dword [esp + 0x590], ecx
mov dword [esp + 0x594], esi
push edi
push eax
call fcn.00412f90
add esp, 8
lea ecx, [esp + 0x4f0]
movzx eax, byte [ebx + 1]
mov edx, 1
add ecx, 1
movzx esi, byte [ecx - 1]
xor eax, esi
movzx eax, al
add edx, 1
cmp edx, 0x10
jbe 0x41b72a
mov byte [ebx + 1], al
lea eax, [esp + 0x5cc]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
lea ecx, [esp + 0x570]
call fcn.004138b4
mov eax, dword [esp + 0x5e4]
mov edx, dword [esp + 0x5e8]
movzx ecx, word [esp + 0x5ec]
movzx esi, word [esp + 0x5ee]
mov dword [esp + 0x588], eax
mov dword [esp + 0x580], 0x80
lea eax, [esp + 0x4f0]
mov dword [esp + 0x5c8], 0x10
mov dword [esp + 0x58c], edx
mov dword [esp + 0x590], ecx
mov dword [esp + 0x594], esi
lea edi, [esp + 0x570]
push edi
push eax
call fcn.00412f90
add esp, 8
lea esi, [esp + 0x4f0]
movzx edx, byte [ebx + 2]
movzx eax, byte [ebx + 3]
mov ecx, 1
movzx edi, byte [esi]
xor edx, edi
movzx edx, dl
mov byte [ebx + 2], dl
movzx edi, byte [esi + 1]
xor eax, edi
movzx eax, al
mov byte [ebx + 3], al
add esi, 2
add ecx, 1
cmp ecx, 0x10
jbe 0x41b7d7
push 0x4f8820
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x41b8d1
push 0x4f882c
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x4903c8], eax
push 0x20
call eax
lea edx, [esp]
push edx
mov edi, dword [eax]
xor ecx, ecx
push ecx
push ecx
push eax
call dword [edi + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea ecx, [esp + 0x570]
call fcn.004138b4
mov eax, dword [esp + 0x428]
mov edx, dword [esp + 0x42c]
mov ecx, dword [esp + 0x430]
mov esi, dword [esp + 0x434]
mov dword [esp + 0x588], eax
mov dword [esp + 0x580], 0x80
lea eax, [esp + 0x4f0]
mov dword [esp + 0x5c8], 0x10
mov dword [esp + 0x58c], edx
mov dword [esp + 0x590], ecx
mov dword [esp + 0x594], esi
lea edi, [esp + 0x570]
push edi
push eax
call fcn.00412f90
add esp, 8
lea ecx, [esp + 0x4f0]
movzx eax, byte [ebx + 4]
mov edx, 1
add ecx, 1
movzx esi, byte [ecx - 1]
xor eax, esi
movzx eax, al
add edx, 1
cmp edx, 0x10
jbe 0x41b8ba
mov byte [ebx + 4], al
movzx eax, byte [0x48e774]
test eax, eax
jne 0x41b935
push 0x4f883c
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41b935
push 0x36d8
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov esi, eax
push 0x4f884c
push edi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x4903cc], eax
lea edx, [esp + 0x608]
push edx
push esi
call eax
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov eax, dword [esi + 0x1a0]
cmp eax, 6
je 0x41bae7
push esi
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
mov byte [esp + 0x611], 0x3a
xor eax, eax
mov byte [esp + 0x613], al
mov byte [esp + 0x612], 0x5c
mov dword [esp + 0x5fc], eax
mov byte [esp + 0x610], 0x63
mov dword [esp + 0x600], eax
mov dword [esp + 0x604], eax
mov dword [esp + 0x60c], eax
lea eax, [esp + 0x610]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
cmp eax, 3
je 0x41bdc0
movzx eax, byte [esp + 0x610]
shl eax, 0x18
add eax, 0x1000000
sar eax, 0x18
cmp eax, 0x7a
mov byte [esp + 0x610], al
jle 0x41b972
xor eax, eax
mov dword [esp + 0x60c], eax
mov eax, dword ss:[esp + 0x60c]
bswap eax
mov dword ss:[esp + 0x60c], eax
lea ecx, [esp + 0x570]
call fcn.004138b4
mov eax, dword [esp + 0x60c]
mov dword [esp + 0x580], 0x20
xor edx, edx
mov dword [esp + 0x5c8], 4
mov dword [esp + 0x588], eax
mov dword [esp + 0x58c], edx
mov dword [esp + 0x590], edx
mov dword [esp + 0x594], edx
lea esi, [esp + 0x4f0]
lea ecx, [esp + 0x570]
push ecx
push esi
call fcn.00412f90
add esp, 8
lea esi, [esp + 0x4f0]
movzx edx, byte [ebx + 0xa]
movzx eax, byte [ebx + 0xb]
mov ecx, 1
movzx edi, byte [esi]
xor edx, edi
movzx edx, dl
mov byte [ebx + 0xa], dl
movzx edi, byte [esi + 1]
xor eax, edi
movzx eax, al
mov byte [ebx + 0xb], al
add esi, 2
add ecx, 1
cmp ecx, 0x10
jbe 0x41ba36
movzx eax, byte [0x48e774]
test eax, eax
jne 0x41bad9
movzx eax, byte [esp + 0x610]
xor esi, esi
mov dword [esp + 0x5f0], esi
mov dword [esp + 0x5f4], esi
mov dword [esp + 0x5f8], esi
shl eax, 0x18
add eax, 0x1000000
sar eax, 0x18
mov byte [esp + 0x610], al
cmp eax, 0x7a
jg 0x41bacf
lea eax, [esp + 0x610]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
cmp eax, 3
je 0x41bd7d
movzx eax, byte [esp + 0x610]
shl eax, 0x18
add eax, 0x1000000
sar eax, 0x18
cmp eax, 0x7a
mov byte [esp + 0x610], al
jle 0x41ba99
xor eax, eax
test eax, eax
jne 0x41bb81
mov byte [ebx + 0xe], 0
add esp, 0x614
pop ebx
pop esi
pop edi
ret
lea ecx, [esp + 0x570]
call fcn.004138b4
mov dword [esp + 0x58c], 0
lea edx, [esi + 0x194]
mov eax, dword [edx]
mov dword [esp + 0x588], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x58c], ecx
mov dword [esp + 0x580], 0x30
lea ecx, [esp + 0x4f0]
xor eax, eax
mov dword [esp + 0x5c8], 6
mov dword [esp + 0x590], eax
mov dword [esp + 0x594], eax
lea edx, [esp + 0x570]
push edx
push ecx
call fcn.00412f90
add esp, 8
lea ecx, [esp + 0x4f0]
movzx eax, byte [ebx + 6]
mov edx, 1
add ecx, 1
movzx edi, byte [ecx - 1]
xor eax, edi
movzx eax, al
add edx, 1
cmp edx, 0x10
jbe 0x41bb65
mov byte [ebx + 6], al
jmp 0x41b92d
mov dword [esp + 0x60c], eax
mov eax, dword ss:[esp + 0x60c]
bswap eax
mov dword ss:[esp + 0x60c], eax
lea ecx, [esp + 0x570]
call fcn.004138b4
mov eax, dword [esp + 0x60c]
mov dword [esp + 0x580], 0x20
xor edx, edx
mov dword [esp + 0x5c8], 4
mov dword [esp + 0x588], eax
mov dword [esp + 0x58c], edx
mov dword [esp + 0x590], edx
mov dword [esp + 0x594], edx
lea esi, [esp + 0x4f0]
lea ecx, [esp + 0x570]
push ecx
push esi
call fcn.00412f90
add esp, 8
lea ecx, [esp + 0x4f0]
movzx eax, byte [ebx + 0xc]
mov edx, 1
add ecx, 1
movzx esi, byte [ecx - 1]
xor eax, esi
movzx eax, al
add edx, 1
cmp edx, 0x10
jbe 0x41bc09
mov byte [ebx + 0xc], al
movzx eax, byte [esp + 0x610]
xor esi, esi
mov dword [esp + 0x450], esi
shl eax, 0x18
mov dword [esp + 0x454], esi
mov dword [esp + 0x458], esi
add eax, 0x1000000
sar eax, 0x18
mov byte [esp + 0x610], al
cmp eax, 0x7a
jg 0x41bc8c
lea eax, [esp + 0x610]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
cmp eax, 3
je 0x41bd3a
movzx eax, byte [esp + 0x610]
shl eax, 0x18
add eax, 0x1000000
sar eax, 0x18
cmp eax, 0x7a
mov byte [esp + 0x610], al
jle 0x41bc56
xor eax, eax
test eax, eax
je 0x41bad9
mov dword [esp + 0x60c], eax
mov eax, dword ss:[esp + 0x60c]
bswap eax
mov dword ss:[esp + 0x60c], eax
lea ecx, [esp + 0x570]
call fcn.004138b4
mov eax, dword [esp + 0x60c]
mov dword [esp + 0x580], 0x20
xor edx, edx
mov dword [esp + 0x5c8], 4
mov dword [esp + 0x588], eax
mov dword [esp + 0x58c], edx
mov dword [esp + 0x590], edx
mov dword [esp + 0x594], edx
lea esi, [esp + 0x4f0]
lea ecx, [esp + 0x570]
push ecx
push esi
call fcn.00412f90
add esp, 8
lea ecx, [esp + 0x4f0]
movzx eax, byte [ebx + 0xd]
mov edx, 1
add ecx, 1
movzx esi, byte [ecx - 1]
xor eax, esi
movzx eax, al
add edx, 1
cmp edx, 0x10
jbe 0x41bd1e
mov byte [ebx + 0xd], al
jmp 0x41bad9
lea edi, [esp + 0x610]
lea ecx, [esp + 0x450]
lea edx, [esp + 0x454]
lea eax, [esp + 0x458]
mov esi, 0x104
push esi
push 0x4e0d00
push eax
push edx
push ecx
push esi
push 0x4e0e20
push edi
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
mov eax, dword [esp + 0x450]
jmp 0x41bc8e
lea edi, [esp + 0x610]
lea ecx, [esp + 0x5f0]
lea edx, [esp + 0x5f4]
lea eax, [esp + 0x5f8]
mov esi, 0x104
push esi
push 0x4e0d00
push eax
push edx
push ecx
push esi
push 0x4e0e20
push edi
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
mov eax, dword [esp + 0x5f0]
jmp 0x41bad1
lea edi, [esp + 0x610]
lea ecx, [esp + 0x5fc]
lea edx, [esp + 0x600]
lea eax, [esp + 0x604]
mov esi, 0x104
push esi
push 0x4e0d00
push eax
push edx
push ecx
push esi
push 0x4e0e20
push edi
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
mov eax, dword [esp + 0x5fc]
jmp 0x41b9aa