Function at 0x41cf30
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x458cf8
push eax
mov dword fs:[0], esp
sub esp, 0x33c
push ebx
push ebp
mov ebp, ecx
xor ebx, ebx
push esi
push edi
mov dword [ebp + 0x520], ebx
mov dword [ebp + 0x1010], ebx
mov dword [ebp + 0x3227d], ebx
mov dword [ebp + 0x524], ebx
lea ecx, [ebp + 0x4e0]
lea eax, [ebp + 0x4a0]
mov esi, 6
mov edx, dword [ebp + 0x4a2]
mov edi, dword [eax]
xor edi, edx
add eax, 2
mov dword [ecx], edi
add ecx, 4
dec esi
jne 0x41cf7c
xor eax, eax
mov dword [esp + 0x10], eax
cmp dword [ebp + 0x1010], ebx
jl 0x41d5d9
push eax
lea eax, [esp + 0x84]
push str..PhysicalDrive_d
push eax
call fcn.004335a0
mov edx, dword [ebp + 0x1010]
mov edi, ebp
add esp, 0xc
mov ecx, 0x570
lea esi, [edx*8]
xor eax, eax
sub esi, edx
push ebx
push ebx
push 3
lea esi, [edx + esi*4]
push ebx
push 3
push 0xc0000000
lea esi, [esi + esi*2]
shl esi, 6
add edi, esi
lea edi, [edx + edi + 0x1014]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x98]
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp + 0x1010]
mov esi, ebp
lea edx, [ecx*8]
sub edx, ecx
lea edx, [ecx + edx*4]
lea edx, [edx + edx*2]
shl edx, 6
add esi, edx
mov dword [ecx + esi + 0x1014], eax
mov eax, dword [ebp + 0x1010]
lea ecx, [eax*8]
sub ecx, eax
lea ecx, [eax + ecx*4]
lea edx, [ecx + ecx*2]
mov ecx, ebp
shl edx, 6
add ecx, edx
mov edx, dword [ebp + 0x2df40]
mov dword [eax + ecx + 0x1028], edx
mov eax, dword [ebp + 0x1010]
lea ecx, [eax*8]
sub ecx, eax
lea ecx, [eax + ecx*4]
lea edx, [ecx + ecx*2]
mov ecx, ebp
shl edx, 6
add ecx, edx
lea edx, [eax + ecx + 0x1014]
push edx
call fcn.0040c1c0
add esp, 4
test al, al
je 0x41d30e
mov eax, dword [ebp + 0x1010]
lea ecx, [eax*8]
sub ecx, eax
lea ecx, [eax + ecx*4]
lea edx, [ecx + ecx*2]
mov ecx, ebp
shl edx, 6
add ecx, edx
mov edx, dword [esp + 0x10]
mov dword [eax + ecx + 0x1018], edx
mov eax, dword [ebp + 0x1010]
lea ecx, [eax*8]
sub ecx, eax
lea ecx, [eax + ecx*4]
lea edx, [ecx + ecx*2]
mov ecx, ebp
shl edx, 6
add ecx, edx
mov edx, dword [eax + ecx + 0x109c]
push edx
mov edx, dword [eax + ecx + 0x10c0]
lea esi, [eax + ecx]
mov eax, dword [eax + ecx + 0x1098]
mov ecx, dword [esi + 0x10c4]
push eax
push ecx
push edx
call fcn.00433600
cmp edx, ebx
jl 0x41d11c
jg 0x41d0f7
cmp eax, 0x3b9aca00
jbe 0x41d11c
push ebx
push 0x3b9aca00
push edx
push eax
call fcn.00433800
push edx
add esi, 0x1054
push eax
push esi
lea eax, [esp + 0x2f4]
push str._s___I64d_gB_
push eax
jmp 0x41d13f
push ebx
push 0xf4240
push edx
push eax
call fcn.00433800
push edx
add esi, 0x1054
push eax
push esi
lea ecx, [esp + 0x2f4]
push str._s___d_mB_
push ecx
call fcn.004335a0
mov eax, dword [ebp + 0x1010]
mov edx, dword [ebp + 0x2de5c]
add esp, 0x14
lea ecx, [eax*8]
sub ecx, eax
push edx
lea ecx, [eax + ecx*4]
lea edx, [ecx + ecx*2]
mov ecx, ebp
shl edx, 6
add ecx, edx
lea edx, [eax + ecx + 0x1014]
push edx
call fcn.0040ea70
mov eax, dword [ebp + 0x1010]
lea ecx, [eax*8]
sub ecx, eax
lea ecx, [eax + ecx*4]
lea edx, [ecx + ecx*2]
mov ecx, ebp
shl edx, 6
add ecx, edx
mov dword [eax + ecx + 0x11ec], 0x1000
mov eax, dword [ebp + 0x1010]
lea edx, [eax*8]
sub edx, eax
lea ecx, [eax + edx*4]
mov edx, ebp
lea ecx, [ecx + ecx*2]
shl ecx, 6
add edx, ecx
lea eax, [eax + edx + 0x1014]
push eax
call fcn.0040df40
mov al, byte [ebp + 0x2e3af]
add esp, 0xc
cmp al, bl
je 0x41d1f7
mov eax, dword [ebp + 0x1010]
lea ecx, [eax*8]
sub ecx, eax
lea ecx, [eax + ecx*4]
lea edx, [ecx + ecx*2]
mov ecx, ebp
shl edx, 6
add ecx, edx
mov dword [eax + ecx + 0x25c1], ebx
mov eax, dword [ebp + 0x1010]
lea edx, [eax*8]
sub edx, eax
lea ecx, [eax + edx*4]
mov edx, ebp
lea ecx, [ecx + ecx*2]
shl ecx, 6
add edx, ecx
mov ecx, dword [eax + edx + 0x25c1]
add eax, edx
cmp ecx, ebx
je 0x41d23a
mov edx, dword [ebp + 0x3227d]
add eax, 0x1014
inc edx
push eax
mov ecx, ebp
mov dword [ebp + 0x3227d], edx
call fcn.0041d660
mov eax, dword [ebp + 0x1010]
push eax
lea ecx, [eax*8]
sub ecx, eax
lea ecx, [eax + ecx*4]
lea edx, [ecx + ecx*2]
mov ecx, ebp
shl edx, 6
add ecx, edx
lea edx, [eax + ecx + 0x1054]
mov ecx, ebp
push edx
call fcn.0041cec0
mov ecx, dword [ebp + 0x1010]
mov esi, ebp
lea edx, [ecx*8]
sub edx, ecx
lea edx, [ecx + edx*4]
lea edx, [edx + edx*2]
shl edx, 6
add esi, edx
mov dword [ecx + esi + 0x101c], eax
mov eax, dword [ebp + 0x1010]
lea ecx, [eax*8]
sub ecx, eax
lea ecx, [eax + ecx*4]
lea edx, [ecx + ecx*2]
mov ecx, ebp
shl edx, 6
add ecx, edx
add eax, ecx
mov ecx, dword [eax + 0x101c]
cmp ecx, ebx
jne 0x41d2dc
lea edi, [eax + 0x1054]
lea edx, [eax + 0x102c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x41d2f8
inc ecx
push ecx
lea ecx, [eax + 0x1054]
push ecx
add eax, 0x102c
push str._s___d_
push eax
call fcn.004335a0
add esp, 0x10
mov edx, dword [ebp + 0x1010]
push 1
push edx
mov ecx, ebp
call fcn.0041d790
inc dword [ebp + 0x1010]
mov eax, dword [esp + 0x10]
cmp eax, 3
je 0x41d320
cmp eax, 4
jne 0x41d5d9
lea edi, [ebp + 0x498]
lea eax, [ebp + 0x4e0]
push 0xc
push eax
mov ecx, edi
call fcn.00401840
xor eax, eax
xor ecx, ecx
mov al, byte [ebp + 0x2df2b]
mov cl, byte [ebp + 0x2df2c]
shl eax, 8
add eax, ecx
xor edx, edx
mov dl, byte [ebp + 0x2df2d]
xor ecx, ecx
mov cl, byte [ebp + 0x2df2e]
push 8
shl eax, 8
add eax, edx
xor edx, edx
mov dl, byte [ebp + 0x2df2f]
shl eax, 8
add eax, ecx
xor ecx, ecx
mov cl, byte [ebp + 0x2df31]
mov dword [esp + 0x18], eax
xor eax, eax
mov al, byte [ebp + 0x2df30]
shl edx, 8
add edx, eax
xor eax, eax
mov al, byte [ebp + 0x2df32]
shl edx, 8
add edx, ecx
lea ecx, [esp + 0x20]
shl edx, 8
add edx, eax
push ecx
mov dword [esp + 0x20], edx
lea edx, [esp + 0x1c]
push edx
mov ecx, edi
call fcn.00401970
xor eax, eax
mov cl, byte [eax + ebp + 0x4a0]
mov dl, byte [esp + eax + 0x1c]
xor dl, cl
mov byte [esp + eax + 0x1c], dl
inc eax
cmp eax, 8
jl 0x41d3b1
lea edx, [esp + 0x1e]
mov byte [esp + 0x24], bl
push edx
call fcn.00432f6f
mov esi, eax
push 2
lea eax, [esp + 0x24]
push 0x4724ec
push eax
call fcn.00433fa0
add esp, 0x10
test eax, eax
jne 0x41d4c1
movsx ecx, byte [esp + 0x1e]
push ecx
call fcn.0043351d
add esp, 4
test eax, eax
je 0x41d4c1
movsx edx, byte [esp + 0x1f]
push edx
call fcn.0043351d
add esp, 4
test eax, eax
je 0x41d4c1
movsx eax, byte [esp + 0x20]
push eax
call fcn.0043351d
add esp, 4
test eax, eax
je 0x41d4c1
movsx ecx, byte [esp + 0x21]
push ecx
call fcn.0043351d
add esp, 4
test eax, eax
je 0x41d4c1
movsx edx, byte [esp + 0x22]
push edx
call fcn.0043351d
add esp, 4
test eax, eax
je 0x41d4c1
movsx eax, byte [esp + 0x23]
push eax
call fcn.0043351d
add esp, 4
test eax, eax
je 0x41d4c1
cmp esi, 0x15a6
jl 0x41d4c1
cmp esi, 0x1a56
je 0x41d4c1
cmp esi, 0x1bf5
je 0x41d4c1
cmp esi, 0x1d08
je 0x41d4c1
cmp esi, 0x1e90
je 0x41d4c1
cmp esi, 0x1d99
je 0x41d4c1
cmp esi, 0x1ee5
je 0x41d4c1
cmp esi, 0x20c7
je 0x41d4c1
mov dword [ebp + 0x520], 1
mov dword [ebp + 0x524], ebx
jmp 0x41d5d9
cmp dword [esp + 0x10], 3
jne 0x41d5cc
push ebx
lea ecx, [esp + 0xc4]
call fcn.0041aad0
lea ecx, [ebp + 0x2de38]
mov dword [esp + 0x354], ebx
mov dword [esp + 0x2a0], ecx
lea ecx, [esp + 0xc0]
mov dword [esp + 0x2a4], edi
call fcn.0044bc16
cmp eax, 1
je 0x41d514
mov ecx, ebp
call fcn.0044bf19
mov dword [ebp + 0x1010], ebx
jmp 0x41d524
mov dword [ebp + 0x520], 1
mov dword [ebp + 0x524], ebx
lea ecx, [esp + 0x29c]
mov dword [esp + 0x354], 7
call fcn.0044a78e
lea ecx, [esp + 0x298]
mov byte [esp + 0x354], 6
call fcn.0044a78e
lea ecx, [esp + 0x24c]
mov byte [esp + 0x354], 5
call fcn.00410270
lea ecx, [esp + 0x200]
mov byte [esp + 0x354], 4
call fcn.00410270
lea ecx, [esp + 0x1b4]
mov byte [esp + 0x354], 3
call fcn.00410270
lea ecx, [esp + 0x168]
mov byte [esp + 0x354], 2
call fcn.00410270
lea ecx, [esp + 0x11c]
mov byte [esp + 0x354], 1
call fcn.00410270
lea ecx, [esp + 0xc0]
mov dword [esp + 0x354], 0xffffffff
call fcn.0044b8e9
jmp 0x41d5d9
mov ecx, ebp
call fcn.0044bf19
mov dword [ebp + 0x1010], ebx
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x20
mov dword [esp + 0x10], eax
jl 0x41cf97
mov eax, dword [ebp + 0x1010]
xor edx, edx
cmp eax, ebx
jle 0x41d619
lea eax, [ebp + 0x7f4]
lea ecx, [ebp + 0x1014]
mov dword [eax], ecx
mov esi, dword [ebp + 0x1010]
inc edx
add eax, 4
add ecx, 0x15c1
cmp edx, esi
jl 0x41d603
mov eax, dword [ebp + 0x1010]
cmp eax, ebx
mov dword [ebp + 0x7f0], eax
jle 0x41d63f
cmp dword [ebp + 0x2e060], ebx
je 0x41d63f
mov ecx, ebp
call fcn.0041e990
mov ecx, ebp
call fcn.0041ea70
mov ecx, dword [esp + 0x34c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x348
ret