Function at 0x102590e0
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x102b82b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x102bd9ad], 0
push ebx
push esi
push edi
jne 0x10259406
movzx eax, byte [0x102bd964]
xor al, 0xfc
mov byte [0x102bd9ad], 1
mov byte [ebp - 0x12c], al
movzx eax, byte [0x102bd965]
xor al, 0xcf
mov dword [ebp - 0x130], 0x1f1f2c1
mov byte [ebp - 0x12b], al
movzx eax, byte [0x102bd966]
xor al, 0xab
mov word [ebp - 0x134], 0xcffc
mov byte [ebp - 0x12a], al
movzx eax, byte [0x102bd967]
xor al, 0xfc
mov byte [ebp - 0x132], 0xab
mov byte [ebp - 0x129], al
movzx eax, byte [0x102bd968]
xor al, 0xcf
mov byte [ebp - 0x128], al
movzx eax, byte [0x102bd969]
xor al, 0xab
mov byte [ebp - 0x127], al
movzx eax, byte [0x102bd96a]
xor al, 0xfc
mov byte [ebp - 0x126], al
movzx eax, byte [0x102bd96b]
xor al, 0xcf
mov byte [ebp - 0x125], al
movzx eax, byte [0x102bd96c]
xor al, 0xab
mov byte [ebp - 0x124], al
movzx eax, byte [0x102bd96d]
xor al, 0xfc
xor esi, esi
mov byte [ebp - 0x123], al
lea ebx, [esi + 3]
lea edi, [esi + 2]
mov eax, 0xaaaaaaab
mov ecx, esi
mul esi
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [ebp + ecx - 0x134]
lea ecx, [edi - 1]
xor al, byte [esi + 0x102bd96f]
mov byte [ebp + esi - 0x122], al
mov eax, 0xaaaaaaab
mul ecx
mov ecx, esi
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [ebp + ecx - 0x133]
mov ecx, esi
xor al, byte [esi + 0x102bd970]
mov byte [ebp + esi - 0x121], al
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [ebp + ecx - 0x132]
mov ecx, esi
xor al, byte [edi + 0x102bd96f]
add edi, 5
mov byte [ebp + ebx - 0x123], al
mov eax, 0xaaaaaaab
mul ebx
add ebx, 5
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [ebp + ecx - 0x131]
lea ecx, [esi + 4]
xor al, byte [esi + 0x102bd972]
mov byte [ebp + esi - 0x11f], al
mov eax, 0xaaaaaaab
mul ecx
mov ecx, esi
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [ebp + ecx - 0x130]
xor al, byte [esi + 0x102bd973]
mov byte [ebp + esi - 0x11e], al
add esi, 5
cmp edi, 0x16
jl 0x102591c2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10e], eax
movzx eax, byte [0x1826e38]
dec al
mov byte [ebp - 0x10a], al
movzx eax, byte [0x1826e39]
sub al, 2
mov byte [ebp - 0x109], al
movzx eax, byte [0x1826e3a]
sub al, 3
mov byte [ebp - 0x108], al
movzx eax, byte [0x1826e3b]
sub al, 4
mov byte [ebp - 0x107], al
movzx eax, byte [0x1826e3c]
sub al, 5
mov byte [ebp - 0x106], al
mov edx, edx
mov ebp, ebp
mov ebp, ebp
mov ebx, ebx
mov edx, edx
mov eax, eax
mov edx, edx
mov eax, eax
mov ecx, ecx
lea eax, [ebp - 0x24]
call fcn.1007456c
push eax
call fcn.1000a640
movups xmm0, xmmword [ebp - 0x24]
add esp, 8
movups xmmword [ebp - 0x105], xmm0
mov ebx, ebx
mov ecx, ecx
mov eax, eax
mov edx, edx
mov ebp, ebp
mov eax, eax
mov esi, esi
mov edi, edi
mov ecx, ecx
xorps xmm0, xmm0
mov word [ebp - 0xe4], 0
lea eax, [ebp - 0x34]
mov byte [ebp - 0xf5], 0
movups xmmword [ebp - 0xf4], xmm0
push eax
movups xmmword [ebp - 0xf4], xmm0
mov byte [ebp - 0xe4], 0
call dword [sym.imp.RPCRT4.dll_UuidCreateSequential]
movzx eax, byte [ebp - 0x25]
push eax
movzx eax, byte [ebp - 0x26]
push eax
movzx eax, byte [ebp - 0x27]
push eax
movzx eax, byte [ebp - 0x28]
push eax
movzx eax, byte [ebp - 0x29]
push eax
movzx eax, byte [ebp - 0x2a]
push eax
lea eax, [ebp - 0xf4]
push str._02X:_02X:_02X:_02X:_02X:_02X
push eax
call fcn.10008d60
add esp, 0x20
mov dword [ebp - 0x134], 0
lea eax, [ebp - 0x134]
push 0xff
push 0
push 0
push 0
push eax
push 0xff
push 0
push 0x102b3184
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push dword [0x102bcdbc]
neg eax
push dword [0x102bcdb8]
sbb eax, eax
and eax, dword [ebp - 0x134]
push 0x102b319c
mov dword [ebp - 0x134], eax
mov dword [ebp - 0xe2], eax
lea eax, [ebp - 0xde]
push 0xffffffffffffffff
push eax
call fcn.1000a660
movzx edx, byte [ebp - 0x12f]
lea ecx, [ebp - 0x130]
add esp, 0x14
call fcn.102585b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102825af
mov esp, ebp
pop ebp
ret