Function at 0x4256b7
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x90
mov dword [esp], 0x69a66b8f
mov dword [esp + 4], 0x6dcb6ff9
mov dword [esp + 8], 0x51fe53cb
mov dword [esp + 0xc], 0x55c65797
mov dword [esp + 0x10], 0x599e5bc4
mov dword [esp + 0x14], 0x5dca5fff
mov dword [esp + 0x18], 0x41a943fb
lea eax, [esp + 0x1c]
mov word [esp + 0x1c], 0x4740
mov dword [esp + 0x1e], 0
mov byte [esp + 0x22], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
movzx esi, byte [esp + edx]
mov edi, ecx
and edi, 0x2e
mov ebx, edx
xor ebx, 0xb4dafd97
add ebx, edi
mov edi, ebx
and edi, esi
add edi, edi
sub ebx, edi
add ebx, esi
mov esi, 1
sub esi, ebx
not esi
and esi, 1
or ebx, 1
add ebx, esi
add bl, 0xc
mov byte [esp + edx], bl
inc edx
add ecx, 2
cmp edx, 0x23
jne 0x4255d0
lea ebp, [esp + 0x72]
mov edx, esp
mov edi, ebp
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x8e]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0x50]
push edi
push 0
push 0
push 0xe
push ebp
push 0
call dword [0x44dd10]
mov dword [esp], 0xbf7e795f
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx]
lea edx, [ecx + 0xd87b012]
mov ebx, 0xe2784fed
sub ebx, ecx
and ebx, 0xe0384a28
and edx, 0x8812017
sub edx, ebx
xor edx, esi
add edx, 0x3693d26d
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [esp + ecx], dl
mov edx, ecx
xor edx, 0xfffffffe
or ecx, 1
and edx, ecx
add ecx, edx
cmp ecx, 7
jb case.default.0x4256b0
xor ecx, ecx
cmp eax, dword [esp]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x448548]
mov ebx, dword [esp + 0x50]
test ebx, ebx
jns 0x4256c6
mov eax, 0xffffffff
jmp 0x4256c9
lea eax, [ebx + ebx]
push eax
call fcn.00408ac0
add esp, 4
mov esi, eax
push edi
push ebx
push eax
push 0xe
push ebp
push 0
call dword [0x44dd10]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x448550]
xor ebx, ebx
jmp dword [0x448558]
push esi
call fcn.00408ad0
add esp, 4
mov eax, ebx
add esp, 0x90
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 0x50]
mov ecx, eax
and ecx, 9
xor eax, 9
lea eax, [eax + ecx*2]
test eax, eax
jns 0x425726
mov eax, 0xffffffff
jmp 0x425728
add eax, eax
push eax
call fcn.00408ac0
add esp, 4
mov ebp, eax
mov dword [esp], 0x33623154
mov dword [esp + 4], 0x3f5d3d5d
mov dword [esp + 8], 0x3b5b3953
mov dword [esp + 0xc], 0x472b452b
mov dword [esp + 0x10], 0x43424133
xor eax, eax
nop
nop
nop
nop
movzx edx, byte [esp + eax]
lea ecx, [eax + 0x34]
and ecx, edx
add ecx, ecx
add edx, eax
add edx, 0xc9ffe834
mov edi, ecx
xor edi, edx
not ecx
and ecx, edx
add ecx, ecx
sub ecx, edi
add cl, 0xfc
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x14
jb 0x425760
movzx ecx, word [esi]
mov eax, ebp
test cx, cx
je 0x4257c1
lea edx, [esi + 2]
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4257b0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x4257f1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4257e0
mov word [eax], 0
lea eax, [esp + 0x6c]
push eax
push ebp
call fcn.00440d50
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x448560]
mov eax, dword [esp + 0x6c]
mov ecx, eax
xor ecx, 0xffffffef
or eax, 0x10
xor edx, edx
test eax, ecx
setne dl
jmp dword [edx*4 + 0x448568]
mov eax, dword [esp + 0x50]
mov ecx, eax
and ecx, 0x25
xor eax, 0x25
lea eax, [eax + ecx*2]
test eax, eax
jns 0x425844
mov eax, 0xffffffff
jmp 0x425846
add eax, eax
push eax
call fcn.00408ac0
add esp, 4
mov ebx, eax
mov dword [esp], 0x81d18720
mov dword [esp + 4], 0x8d2f832b
mov dword [esp + 8], 0x893f8f3e
mov dword [esp + 0xc], 0x953b8b35
mov dword [esp + 0x10], 0x912a973a
mov dword [esp + 0x14], 0x9dcb9334
mov dword [esp + 0x18], 0x99289f37
mov dword [esp + 0x1c], 0xe52b9b34
mov dword [esp + 0x20], 0xe15be75d
mov dword [esp + 0x24], 0xedb5e380
mov dword [esp + 0x28], 0xe945ef4f
mov dword [esp + 0x2c], 0xf54eeb5c
mov dword [esp + 0x30], 0xf147f7a0
mov dword [esp + 0x34], 0xfd51f35d
mov dword [esp + 0x38], 0xf99eff48
mov dword [esp + 0x3c], 0xc54bfbb6
mov dword [esp + 0x40], 0xc16ac770
mov dword [esp + 0x44], 0xcd70c36f
mov dword [esp + 0x48], 0xc9cecf71
mov dword [esp + 0x4c], 0
mov eax, 0x21
mov ecx, 0xde
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x21]
mov edi, eax
or edi, edx
not edx
or edx, ecx
and edx, edi
add dl, 0x5b
mov byte [esp + eax - 0x21], dl
inc eax
dec ecx
cmp eax, 0x71
jne 0x425900
movzx ecx, word [esi]
mov eax, ebx
test cx, cx
je 0x425941
mov edx, esi
add edx, 2
mov eax, ebx
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425930
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x425971
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425960
mov word [eax], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea eax, [esp + 0x68]
push eax
mov dword [esp + 0x58], ebx
push ebx
call fcn.00440d50
add esp, 8
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x448570]