Function at 0x1004d750
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [0x100c42d8]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [0x100c39a8]
imul eax, dword [0x100c39ac]
or eax, 0xd362780d
xor eax, 0xfb9f9bff
mov ecx, 0xb0a88a10
xor edx, edx
div ecx
or eax, 0xdb683c36
or eax, 0x3540638f
imul eax, eax, 0x2027aa80
imul eax, eax, 0x34135b3a
xor eax, 0x6c9ce77c
mov ecx, 0x479f90a5
xor edx, edx
div ecx
mov ecx, 0xbb3345b1
xor edx, edx
div ecx
imul eax, eax, 0x1ca24261
sub eax, 0xfcc2b1a
add eax, 0xc9b4e56f
and eax, 0x7c3be9b3
sub eax, 0x1370acf9
mov ecx, 0x2cbc0236
xor edx, edx
div ecx
sub eax, 0x406ba518
imul eax, eax, 0x34080cd1
sub eax, 0x56b6ab43
imul eax, eax, 0x58b19408
mov ecx, 0x4ad54e9b
xor edx, edx
div ecx
and eax, 0xc8f8d04d
sub eax, 0xba3f5e10
mov ecx, 0xfa851554
xor edx, edx
div ecx
sub eax, 0x95eab6a5
add eax, 0xbd663456
mov ecx, 0xce5b69f7
xor edx, edx
div ecx
and eax, 0x6bc0fe7b
xor eax, 0x281227b0
xor eax, 0x522f918a
mov ecx, 0xd028fccf
xor edx, edx
div ecx
sub eax, 0xceabd578
imul eax, eax, 0x89427208
sub eax, 0x7158b8c5
sub eax, 0xc28a1ca
xor eax, 0x70396a01
and eax, 0x9775f3d9
mov ecx, 0xa423511d
xor edx, edx
div ecx
sub eax, 0x73439e29
add eax, 0xa4d76c14
imul eax, eax, 0xd3760a0a
and eax, 0x5613f6b0
mov ecx, 0x498b0a1
xor edx, edx
div ecx
imul eax, eax, 0x15307cd3
imul eax, eax, 0xa3bd133a
or eax, 0x31e502
or eax, 0x68bc27f9
sub eax, 0x8c5e45a5
add eax, 0x2a4c1934
sub eax, 0x8e59baf8
sub eax, 0xb703bb77
xor eax, 0x184fc6e8
imul eax, eax, 0x8a36885f
imul eax, eax, 0xf50a2616
xor eax, 0x78ca6d0f
sub eax, 0xa898994a
sub eax, 0x941ac89c
or eax, 0x2f2b50c1
add eax, 0x4c7e9152
imul eax, eax, 0x81f7e440
mov ecx, 0x84c2092a
xor edx, edx
div ecx
sub eax, 0x99543160
or eax, 0xde64daa8
imul eax, eax, 0xdfbe9b32
and eax, 0x590ef452
and eax, 0x3790053b
and eax, 0xc98348ed
sub eax, 0xf433f141
xor eax, 0x7b9fc4aa
add eax, 0xca5243e
xor eax, 0x47925668
mov ecx, 0xd82070f8
xor edx, edx
div ecx
cmp eax, 0x86240391
jae 0x1004e18b
mov edx, dword [ebp - 0x10]
mov eax, 0xfffff6ff
mov dword [ebp - 0x14], eax
push eax
mov ecx, esp
mov dword [ebp - 0x30], ecx
sub esp, 0x1c
mov eax, esp
push eax
mov esi, esp
mov dword [ebp - 0x2c], esi
push eax
mov edi, esp
mov dword [ebp - 0x1c], edi
push eax
mov edi, esp
mov dword [ebp - 0x18], edi
push eax
mov edi, esp
mov dword [ebp - 0x28], edi
push eax
mov edi, esp
mov dword [ebp - 0x24], edi
sub esp, 0x104
mov edi, esp
mov dword [ebp - 0x20], edi
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1a
call fcn.1006f6e0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov edi, eax
mov eax, dword [ebp - 0x14]
mov dword [esi], edi
mov byte [edx], 0
mov dword [ecx], 0
cmp eax, 0xada578e9
je 0x1004d924
jmp 0x1004d9b1
mov eax, dword [0x100c39b8]
or eax, dword [0x100c39bc]
and eax, 0xf26e0a1a
add eax, 0xaa6a3327
or eax, 0xf0d9eb00
xor eax, 0x11bcfc33
or eax, 0xbae29104
imul eax, eax, 0x7e347c4
imul eax, eax, 0x4a202494
imul eax, eax, 0x9ba9270d
sub eax, 0xce0816de
or eax, 0x9e9bcb0d
add eax, 0x302a3d05
and eax, 0xf9afa177
mov ecx, 0xa8fb238c
xor edx, edx
div ecx
sub eax, 0xbd001a8a
imul eax, eax, 0xa7c2cbd1
xor eax, 0x5fdbd096
imul eax, eax, 0x6e18d2f0
xor eax, 0xba83ef76
add eax, 0x494a00e3
imul eax, eax, 0xda380b38
and eax, 0xa386a80b
and eax, 0x53390a8f
sub eax, 0x38c50679
or eax, 0xf63dcf61
xor eax, 0x3f60317b
add eax, 0xcaf0134a
or eax, 0xbda8a334
mov ecx, 0x32e746d5
xor edx, edx
div ecx
xor eax, 0xcb05fa6b
xor eax, 0xc4b5972d
mov ecx, 0xa9e8150b
xor edx, edx
div ecx
or eax, 0xe2931569
mov ecx, 0x2fa05e75
xor edx, edx
div ecx
mov ecx, 0xf39aa2f8
xor edx, edx
div ecx
and eax, 0xa2dcc893
mov ecx, 0xc8f3f52b
xor edx, edx
div ecx
or eax, 0xbde7eafc
imul eax, eax, 0xd3bce80e
mov ecx, 0x4d75e058
xor edx, edx
div ecx
xor eax, 0x6fe89e49
imul eax, eax, 0xf15f91d0
mov ecx, 0x7ff7581a
xor edx, edx
div ecx
or eax, 0x6c01c5f5
imul eax, eax, 0x695fd58a
add eax, 0xd3aa9c90
mov ecx, 0x25bf7a7
xor edx, edx
div ecx
and eax, 0x5975bdec
mov ecx, 0x906d503b
xor edx, edx
div ecx
imul eax, eax, 0x8740f846
add eax, 0x2d3c8a
sub eax, 0xf00415e5
xor eax, 0x978df797
mov ecx, 0x90a3ca17
xor edx, edx
div ecx
xor eax, 0xb1ba09da
or eax, 0x30ddcd96
add eax, 0xcceaf011
and eax, 0x6c41ba02
imul eax, eax, 0x59b8814e
imul eax, eax, 0x96dc34b2
xor eax, 0x260318ce
mov ecx, 0xbe116b57
xor edx, edx
div ecx
and eax, 0xb198e59e
add eax, 0xadb89e2c
mov ecx, 0x36641827
xor edx, edx
div ecx
add eax, 0x8d1eb8c8
xor eax, 0xe8f19bc1
imul eax, eax, 0x3e2334a2
and eax, 0xcdb75769
mov ecx, 0x24da5063
xor edx, edx
div ecx
and eax, 0x76c2660f
add eax, 0x2ce0971e
add eax, 0x2a49a076
cmp eax, 0xb595436a
jae 0x1004e1eb
mov ecx, dword [ebp - 0x18]
mov eax, dword [0x100c39c0]
and eax, dword [0x100c39c4]
mov esi, 0x61572a41
xor edx, edx
div esi
add eax, 0x946f6797
mov esi, 0x2a93bb98
xor edx, edx
div esi
mov esi, 0xa9023415
xor edx, edx
div esi
sub eax, 0x2d8c27b1
and eax, 0xbbd92646
imul eax, eax, 0x7146c28
mov esi, 0x1a0ae72c
xor edx, edx
div esi
xor eax, 0xd82c4372
add eax, 0x697ec82
and eax, 0x6553f744
or eax, 0x19f6c4fa
sub eax, 0xd968b006
or eax, 0x9134ed47
and eax, 0xe488a34b
and eax, 0x28018826
and eax, 0xfbe0280e
mov esi, 0xf3e025b1
xor edx, edx
div esi
or eax, 0x429246f3
xor eax, 0xb4f2fbde
add eax, 0x18e692a1
xor eax, 0xccad0787
mov esi, 0x339b02a1
xor edx, edx
div esi
add eax, 0x424bca3d
sub eax, 0x82e91f8d
or eax, 0x1f25a1bc
sub eax, 0xe47dcc6e
xor eax, 0x6ae71a16
mov esi, 0x1d9d6294
xor edx, edx
div esi
or eax, 0x5f39e22b
or eax, 0x31e7ee6c
imul eax, eax, 0x32dc145
mov esi, 0x5038e1c6
xor edx, edx
div esi
xor eax, 0xb1c29524
or eax, 0xe0ddfb87
mov esi, 0xef729a02
xor edx, edx
div esi
or eax, 0xea268a73
and eax, 0x6c75327f
or eax, 0x4d9ea785
sub eax, 0x8b6328bc
and eax, 0xb4d0cd89
or eax, 0x10e65083
and eax, 0xe28a6581
or eax, 0xb01ec3d7
or eax, 0x9a7ae0f
xor eax, 0xd56cfd7
and eax, 0xa57064ab
and eax, 0x5df80381
sub eax, 0x8f0c049b
or eax, 0x5d6014c9
and eax, 0xcfe1080c
add eax, 0xbc593337
xor eax, 0x10ff6cea
imul eax, eax, 0xbb972119
xor eax, 0xc9c9f5b5
mov esi, 0xc6700141
xor edx, edx
div esi
add eax, 0xe01cba23
or eax, 0xc32f95c1
imul eax, eax, 0xe1de209f
xor eax, 0xfabd6ae2
sub eax, 0xa1970a35
or eax, 0x5f76c623
sub eax, 0xc8f33a7f
sub eax, 0x822832f5
imul eax, eax, 0xe3974be4
sub eax, 0x7555d667
and eax, 0x9e5a1563
or eax, 0xd0a7ccf
and eax, 0xd112de08
imul eax, eax, 0x539c397e
and eax, 0xc981f144
or eax, 0x22bcd8fa
cmp dword [ecx], 0x1a
setl cl
mov byte [ebp - 0x31], cl
cmp eax, 0x4472c7f6
jb 0x1004db74
mov al, byte [ebp - 0x31]
test al, 1
jne 0x1004dd3c
jmp 0x1004e16a
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
and eax, 1
cmp eax, 1
jne 0x1004e151
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx]
add edx, 0x41
mov byte [ecx], dl
mov cl, byte [ecx]
mov byte [eax], cl
mov byte [eax + 1], 0x3a
mov byte [eax + 2], 0x5c
mov byte [eax + 3], 0
sub esp, 8
mov dword [esp], 0xc
mov dword [esp + 4], 0x12
call fcn.10025170
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.1008ca20
mov ecx, dword [ebp - 0x20]
add esp, 8
lea eax, [0x100b7491]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1008ca30
mov ecx, dword [ebp - 0x30]
add esp, 8
mov eax, dword [ebp - 0x20]
mov ecx, dword [ecx]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1004d240
add esp, 8
cmp eax, 0
je 0x1004e14c
mov eax, dword [0x100c39c8]
sub eax, dword [0x100c39cc]
add eax, 0x6bf41035
imul eax, eax, 0xa165c244
add eax, 0x977e10df
or eax, 0xb2151fb4
xor eax, 0xa0773493
or eax, 0x8da192e3
imul eax, eax, 0x907afa57
sub eax, 0xbac6ea21
xor eax, 0x53b5a7d8
and eax, 0x3426bcd5
imul eax, eax, 0xcbf83399
and eax, 0xbe8ad7f7
imul eax, eax, 0x8c360060
xor eax, 0x2d0862da
xor eax, 0x70071447
sub eax, 0x3bfc4f94
xor eax, 0x2ffce198
and eax, 0x86e282c7
add eax, 0x6c1adaa
xor eax, 0x80b7699e
and eax, 0xd9d2948b
add eax, 0x3d402873
add eax, 0x2bc5b97e
imul eax, eax, 0xd46fa5b3
or eax, 0x4bd4ddc1
sub eax, 0x82815c2f
mov ecx, 0xaa9929f9
xor edx, edx
div ecx
add eax, 0xd0c710a0
imul eax, eax, 0xcb308317
imul eax, eax, 0x9fb69387
or eax, 0x5c68a333
or eax, 0xfa40dcdd
or eax, 0x53560cef
add eax, 0x5a521e95
imul eax, eax, 0x89fdd28f
imul eax, eax, 0x9605988f
add eax, 0xf48ad61
xor eax, 0x9bb2ba87
add eax, 0xd7e51a77
mov ecx, 0xedc97dc0
xor edx, edx
div ecx
and eax, 0x827b3c55
and eax, 0x9047c1eb
or eax, 0xe2047264
and eax, 0x8bfe8d40
mov ecx, 0xc8c563b
xor edx, edx
div ecx
and eax, 0x7be188a0
and eax, 0x504020b4
sub eax, 0x79178ee4
mov ecx, 0xf5dd1b30
xor edx, edx
div ecx
xor eax, 0x5d856886
or eax, 0x663137a9
xor eax, 0xa7b516cc
and eax, 0x43933e0a
sub eax, 0xa668b710
mov ecx, 0x224c9c53
xor edx, edx
div ecx
imul eax, eax, 0x126dbfab
imul eax, eax, 0x6f524a61
and eax, 0x8083d57
mov ecx, 0xf7ce8bba
xor edx, edx
div ecx
sub eax, 0xc280fd6f
imul eax, eax, 0xbb91695b
mov ecx, 0xcc74e7d5
xor edx, edx
div ecx
mov ecx, 0x226e1714
xor edx, edx
div ecx
mov ecx, 0x2829077a
xor edx, edx
div ecx
and eax, 0xba426378
mov ecx, 0xa79bf910
xor edx, edx
div ecx
and eax, 0xa2bed33c
sub eax, 0x16286056
add eax, 0x6daf0dda
or eax, 0xa011bf68
mov ecx, 0x834a94fb
xor edx, edx
div ecx
and eax, 0x27f56aeb
cmp eax, 0x682ee57a
je 0x1004e1f0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [0x100c39d0]
and eax, dword [0x100c39d4]
or eax, 0xf9b353db
mov esi, 0x7376c1bf
xor edx, edx
div esi
add eax, 0xfe37c9f5
and eax, 0x547cc00c
xor eax, 0x2b56f8ae
or eax, 0x93b16aa2
sub eax, 0x99594c3e
sub eax, 0x3bc5c23a
imul eax, eax, 0x1966394a
add eax, 0x42c9958
or eax, 0x210c2b34
xor eax, 0x876b4147
or eax, 0x8338508f
or eax, 0x9b1c4d9a
imul eax, eax, 0x4dc182c4
sub eax, 0x8c439316
imul eax, eax, 0xfcb5f1ee
and eax, 0x672bf782
mov esi, 0xae696396
xor edx, edx
div esi
xor eax, 0xc6b33f40
sub eax, 0xb825e9a8
or eax, 0xed424a95
mov esi, 0x4b68227f
xor edx, edx
div esi
add eax, 0x8e0d2fa7
sub eax, 0x1555c255
and eax, 0x935efbd2
mov esi, 0xa493353e
xor edx, edx
div esi
add eax, 0x20fb716f
sub eax, 0x3c91c0d0
and eax, 0x7164b1c5
or eax, 0x37d93616
imul eax, eax, 0xe4bb58cb
mov esi, 0x493e0062
xor edx, edx
div esi
add eax, 0xe56bbeae
sub eax, 0x6cb23529
or eax, 0x36460c5f
add eax, 0x7df8d120
add eax, 0xf1581e43
imul eax, eax, 0x743a9236
sub eax, 0xa69605dd
and eax, 0xa1fcf044
and eax, 0x329682e2
or eax, 0xf67e2410
sub eax, 0x66541bca
and eax, 0xe6c39dbc
mov esi, 0x4ea9b130
xor edx, edx
div esi
and eax, 0x48a80ff3
imul eax, eax, 0x78ae5d45
xor eax, 0x4e4616d5
imul eax, eax, 0x82e4b2ef
add eax, 0x44db568b
add eax, 0xd75d2b72
sub eax, 0x38e2340a
xor eax, 0x1eaaf87f
imul eax, eax, 0xa81113a5
mov esi, 0xc7b343ee
xor edx, edx
div esi
and eax, 0xeb7806bb
imul eax, eax, 0x21fcaaf4
mov esi, 0xf728d7af
xor edx, edx
div esi
sub eax, 0x167a0e99
mov esi, 0xb4c9e152
xor edx, edx
div esi
or eax, 0x10248ceb
mov esi, 0x9b8e0fc0
xor edx, edx
div esi
imul eax, eax, 0x230860fc
add eax, 0x21ea4f93
xor eax, 0xb02006ec
sub eax, 0xe378fdbc
and eax, 0xcf4a6bc5
add eax, 0x34f60d10
xor eax, 0xe2f42d74
mov esi, 0x12122d90
xor edx, edx
div esi
and eax, 0xa838fa6a
mov byte [ecx], 1
cmp eax, 0x109964be
ja 0x1004e1f0
jmp 0x1004e16a
jmp 0x1004e151
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
shr ecx, 1
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
add ecx, 1
mov dword [eax], ecx
jmp 0x1004d9b1
mov eax, dword [ebp - 0x1c]
mov al, byte [eax]
and al, 1
movzx eax, al
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1006bd1f
mov eax, dword [ebp - 0x38]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp - 0x10]
push eax
mov ecx, esp
sub esp, 0x1c
mov eax, esp
push eax
mov esi, esp
mov dword [ebp - 0x44], esi
push eax
mov esi, esp
mov dword [ebp - 0x40], esi
push eax
mov esi, esp
mov dword [ebp - 0x3c], esi
mov dword [ecx], edx
xor ecx, ecx
sub esp, 0xc
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x1a
call fcn.1006f6e0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
mov esi, eax
mov eax, dword [ebp - 0x3c]
mov dword [edx], esi
mov byte [ecx], 0
mov dword [eax], 0
jmp 0x1004d924
jmp 0x1004db74
mov eax, dword [ebp - 0x1c]
mov byte [eax], 1
jmp 0x1004df8d