Function at 0x4321b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get disk information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 8], 0xbbccb9d8
mov dword [esp + 0xc], 0xbfd0bdde
mov dword [esp + 0x10], 0xc3eec1d2
mov dword [esp + 0x14], 0xc7a8c5a6
mov dword [esp + 0x18], 0xcbc8c9aa
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x1f
ja 0x432249
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, 0x48
sub edx, eax
add eax, 0xb09425b7
xor edx, eax
and edx, ecx
xor edx, eax
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
dec al
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x20
jb 0x432210
lea esi, [esp + 8]
push esi
call fcn.00433870
add esp, 4
mov ecx, eax
mov dword [0x447078], eax
xor edx, edx
test eax, eax
sete dl
xor eax, eax
jmp dword [edx*4 + 0x43d224]
push 0x61ae2ca
push ecx
call fcn.00433e40
add esp, 8
mov dword [0x447080], eax
push 0x4ca0951f
push dword [0x447078]
call fcn.00433e40
add esp, 8
mov dword [0x447084], eax
push 0x36ebfd27
push dword [0x447078]
call fcn.00433e40
add esp, 8
mov dword [0x447088], eax
push 0x36d3e846
push dword [0x447078]
call fcn.00433e40
add esp, 8
mov dword [0x43f05c], eax
mov dword [esp + 8], 0x3377314b
mov dword [esp + 0xc], 0x37483546
mov dword [esp + 0x10], 0x2b56296d
mov dword [esp + 0x14], 0x2f7c2d7f
mov dword [esp + 0x18], 0x2366217e
mov dword [esp + 0x1c], 0x275a2558
mov word [esp + 0x20], 0x5958
mov dword [esp + 0x22], 0
mov dword [esp + 0x26], 0
mov dword [esp + 0x2a], 0
mov byte [esp + 0x2e], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x26
ja 0x432369
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, 0x57
sub edx, eax
add eax, 0xc9e23aa8
xor edx, eax
and edx, ecx
xor edx, eax
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
add al, 0x68
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x27
jb 0x432330
push esi
call fcn.00433870
add esp, 4
mov dword [0x43f054], eax
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x43d22c]
push 0xd060c378
push eax
call fcn.00433e40
add esp, 8
mov dword [0x43dd48], eax
push 0x22c0538
push dword [0x43f054]
call fcn.00433e40
add esp, 8
mov dword [0x43de4c], eax
push 0x6e21bb5b
push dword [0x43f054]
call fcn.00433e40
add esp, 8
mov dword [0x43f074], eax
call fcn.00432650
movzx ecx, al
xor eax, eax
jmp dword [ecx*4 + 0x43d244]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
call fcn.0042d120
movzx ecx, al
xor eax, eax
jmp dword [ecx*4 + 0x43d24c]
mov eax, dword [0x43dd48]
mov dword [esp + 8], 0xb840d73
mov dword [esp + 0xc], 0x7760981
mov dword [esp + 0x10], 0x34d0588
mov dword [esp + 0x14], 0x1f2c014e
mov dword [esp + 0x18], 0x1b6e1d60
mov dword [esp + 0x1c], 0x1716196c
mov dword [esp + 0x20], 0
mov word [esp + 0x24], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x1d
ja 0x43248b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
mov edi, 0x7d
sub edi, ecx
add ecx, 0x4a7c4582
xor edi, ecx
and edi, edx
xor edi, ecx
mov dword [esp + 4], edi
mov ecx, dword [esp + 4]
add cl, 0x72
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x1e
jb 0x432450
push 0x800
push 0
push esi
call eax
test eax, eax
je 0x43249e
mov dword [0x43f06c], eax
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x43d254]
xor eax, eax
jmp dword [0x43d264]
xor eax, eax
jmp dword [0x43d240]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
mov al, 1
jmp dword [0x43d274]
mov ecx, dword [case.0x43237e.5]
nop
nop
jmp ecx
xor ebx, ebx
test eax, eax
sete bl
jmp dword [ebx*4 + 0x43d29c]
xor ebx, ebx
test ecx, ecx
sete bl
jmp dword [ebx*4 + 0x43d2a4]
mov dword [edx], 0xebd4d5e6
mov dword [edx + 8], 0
mov dword [edx + 4], 0
mov dword [esi], 0
mov edi, dword [esi]
cmp edi, 0xb
ja 0x4325b2
nop
nop
nop
nop
nop
nop
mov edi, dword [esi]
mov ebx, dword [esi]
movzx ebx, byte [edx + ebx]
mov ecx, 0xa2
sub ecx, edi
add edi, 0x1506c65d
xor ecx, edi
and ecx, ebx
xor ecx, edi
mov dword [esi + 4], ecx
mov ecx, dword [esi + 4]
add cl, 0x75
mov edi, dword [esi]
mov byte [edx + edi], cl
inc dword [esi]
mov ecx, dword [esi]
cmp ecx, 0xc
jb 0x432580
mov ecx, dword [edx]
mov edx, dword fs:[ecx]
mov edx, dword [edx + 0x18]
mov edi, dword [0x43d2d4]
mov ecx, dword [ebp + 0xc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp edi
push ecx
call fcn.00430d60
jmp 0x4325f2
push eax
call fcn.00430e10
add esp, 4
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
and eax, dword [ebx]
shl byte [ebx + eax*2], 0
shl byte [ebx + eax*2], 0
shl byte [ebx + eax*2], 0
shl byte [ebx + eax*2], 0
enter 17188, 0
enter 17188, 0
fldenv [ebx]
inc ebx
add al, dh
and eax, dword [ebx]
enter 0x4324, 0
mov al, 36
inc ebx
add al, dl
and al, 0x43
add byte [eax - 0x4fffbcdc], dh
and al, 0x43
add al, bl
and al, 0x43
add byte [eax - 0x2fffbcdc], dh
and al, 0x43
add al, dl
and al, 0x43
add al, bl
and al, 0x43
add al, dl
and al, 0x43
add al, ah
and al, 0x43
add al, ah
and al, 0x43
add al, ah
and al, 0x43
add al, cl
and al, 0x43
add byte [eax], dh
and eax, 0x25300043
inc ebx
add byte [0x30004325], bh
and eax, 0x254b0043
inc ebx
add bh, bl
and eax, 0x25590043
inc ebx
add bh, ah
and eax, 0x10043
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add dword [eax], eax
add byte [eax], al
mov bh, 0x25
inc ebx
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add al, dl
and eax, 0x10043
add byte [eax], al
shl byte [0x25d00043], 1
inc ebx
add dl, dl
and eax, 0x25d00043
inc ebx
add byte [eax], al
add byte [eax], al
add byte [eax + 0x26], dh
inc ebx
add byte [ebp - 0x62ffbcda], bl
inc ebx
add dh, ah
inc ebx
add byte [eax], cl
daa
inc ebx
add byte [edi], cl
daa
inc ebx
add byte [ecx], al
add byte [eax], al
add byte [edi], cl
daa
inc ebx
add byte [eax], al
sub byte [ebx], al
add byte [eax], ch
inc ebx
add byte [esi], al
sub byte [ebx], al
push es
sub byte [ebx], al
push es
sub byte [ebx], al
and ah, byte [edi]
inc ebx
add byte [eax + 0x14004327], bl
sub byte [ebx], al
outsb dx, byte [esi]
sub byte [ebx], al
xor ch, byte [eax]
inc ebx
add byte [edx - 0x33ffbccf], ah
xor byte [ebx], al
xor dword gs:[ebx], eax
xor dword gs:[ebx], eax
mov byte [0xa0004331], al
xor dword [ebx], eax
sub byte [0x2d280043], ch
inc ebx
add byte [eax], ch
sub eax, 0x2d280043
inc ebx
add byte [edx + ebp], dh
inc ebx
add byte [edx], ch
sub eax, dword [ebx]
pop ebp
sub eax, dword [ebx]
sub ebp, dword [ecx]
inc ebx
add byte [ebx + ebp + 0x2b570043], al
inc ebx
add byte [edx + 0x7000432c], bh
sub eax, dword [ebx]
jo 0x43d39d
inc ebx
add byte [eax + 0x2b], dh
inc ebx
add byte [esi + 0x2b], dh
inc ebx
add byte [esi + 0x2b], dh
inc ebx
add byte [edi - 0x4dffbcd5], cl
sub dword [ebx], eax
test byte [ebx], ch
inc ebx
add byte [ebx + ebp + 0x31a20043], al
inc ebx
add byte [edi + ebp + 0x2b950043], cl
inc ebx
add byte [ebp - 0x6affbcd5], dl
sub eax, dword [ebx]
xchg ebp, eax
sub eax, dword [ebx]
xchg ebp, eax
sub eax, dword [ebx]
dec ebp
inc ebx
add byte [edi + ebp + 0x43], dl
add byte [eax + 0x2e], bl
inc ebx
add byte [esi + 0x2e], dh
inc ebx
add byte [edx + 0x2f], al
inc ebx
add byte [eax + 0x2f], dl
inc ebx
add byte [edi + ebp + 0x43], dl
add byte [edi + ebp + 0x43], dl
add byte [eax], cl
daa
inc ebx
add byte [eax + 0x26], dh
inc ebx
add byte [ecx], al
add byte [eax], al
add byte [eax], al
sub byte [ebx], al
push ss
xor dword [ebx], eax
mov al, byte [0x10004331]
sub al, byte [ebx]
pop esi
sub al, 0x43
add byte [eax + 0x2b], dh
inc ebx
add byte [eax + 0x29], al
inc ebx
add byte [edx], dh
xor byte [ebx], al
push eax
das
inc ebx
add cl, al
xor dword [ebx], eax
invalid