Function at 0x140013ea0
Capabilities:
Encode data using xor
Get disk information

Disassembly:
mov byte [rsp + 8], cl
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov dword [rsp + 0xb8], 0x11a
mov edi, 6
mov dword [rsp + 0x20], 0x160
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx r15d, byte [0x140042b81]
lea eax, [rdi + 0x56]
mov r11d, dword [0x140042a8c]
xor r14d, r14d
mov r13d, dword [0x140042b48]
mov edx, r14d
movsx ecx, byte [0x140042b66]
cmp r13d, 0x1e8
mov r8d, dword [0x140042b5c]
lea r10d, [r15 - 6]
mov r9d, dword [0x140042b84]
sete dl
mov esi, dword [0x140042b6c]
or ecx, 1
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x28], r11d
mov byte [0x140042b55], r11b
nop
xor r8d, r10d
and r9d, edx
sub esi, ecx
sub rax, 1
jne 0x140013f30
movzx eax, byte [0x140042b80]
mov ecx, 0xb1
mov edx, dword [0x140042b60]
mov ebx, 1
imul r10d, eax, 0xfffffffe
mov dword [0x140042b5c], r8d
lea ebp, [rax + 0xa2]
and r10d, 3
nop word [rax + rax]
test r14d, r14d
je 0x140013f80
cmp dword [0x140042a64], r14d
mov eax, ebx
jne 0x140013f83
mov eax, r14d
and edx, eax
sub rcx, rbx
jne 0x140013f70
mov eax, r14d
mov dword [0x140042b60], edx
mov r12d, r11d
xor r12d, 0xc
cmp r10d, 0xffffffeb
mov dword [0x140042b7c], r12d
sete al
xor eax, edi
movzx ecx, al
mov eax, r12d
shl eax, cl
mov ecx, dword [0x140042a88]
and ecx, eax
lea eax, [r13*2 - 4]
mov dword [rsp + 0xb0], ecx
mov dword [0x140042a88], ecx
and eax, 7
je 0x140014031
sub eax, ebx
je 0x140014012
movzx r11d, byte [0x140042a87]
sub eax, ebx
je 0x140014006
cmp eax, ebx
je 0x140013fed
xor r11b, bl
jmp 0x140014057
imul r9d, dword [0x140042b40], 0x11a
shr r9d, 2
mov dword [rsp + 0xb8], r9d
jmp 0x14001405d
movzx eax, byte [0x140042b54]
imul edi, eax, 0xfffffff9
jmp 0x140014057
test r9d, 0xffffffeb
jne 0x140014023
xor edx, 0x44
mov eax, r14d
je 0x140014025
mov eax, ebx
xor r12d, eax
mov dword [0x140042b7c], r12d
jmp 0x14001404f
cmp r11b, 0xeb
sete cl
cmp ebp, 0x41a
sete al
and cl, al
and cl, byte [0x140042b38]
add byte [0x140042b65], cl
movzx r11d, byte [0x140042a87]
mov r9d, 0x11a
movzx ecx, byte [0x140042a86]
mov eax, ecx
mov byte [rsp + 0xa0], cl
neg eax
and eax, ebx
je 0x1400140d0
sub eax, ebx
je 0x1400140c5
mov r14d, dword [0x140042b78]
sub eax, ebx
je 0x140014099
cmp eax, ebx
jne 0x1400140ff
and r8d, edi
and r8d, 0x41a
xor byte [0x140042b83], 0xc
jmp 0x140014106
test r14d, r14d
jne 0x1400140ac
test bl, r10b
jne 0x1400140ac
test r15b, r15b
jne 0x1400140ac
xor eax, eax
jmp 0x1400140ae
mov eax, ebx
xor r14d, eax
movzx eax, byte [0x140042b65]
and al, 0x1c
add cl, al
mov byte [rsp + 0xa0], cl
jmp 0x1400140ff
mov r12d, ebx
mov dword [0x140042b7c], ebx
jmp 0x1400140f8
cmp dword [0x140042b2c], r14d
setne byte [0x140042b88]
test ebp, ebp
jne 0x1400140ed
mov eax, r14d
test edi, 0x4ea
je 0x1400140ef
mov eax, ebx
and al, byte [0x140042b30]
add r11b, al
mov r14d, dword [0x140042b78]
mov r8d, dword [0x140042b4c]
mov eax, dword [0x140042b34]
lea ecx, [rdi + 0x1e8]
mov r15d, dword [0x140042b38]
shr eax, cl
xor dword [0x140042b2c], eax
mov eax, r15d
xor eax, 0x1e8
je 0x14001413b
mov eax, 0x3fe
mov dword [0x140042a8c], ebx
cmp eax, r13d
jne 0x140014145
mov dword [0x140042a8c], 0
mov eax, r15d
mov ecx, edi
sub ecx, dword [rsp + 0xb0]
and eax, 0x1e8
xor ecx, r10d
or ecx, eax
mov eax, dword [0x140042b44]
and eax, ecx
mov dword [rsp + 0x24], eax
mov eax, 0x31
nop dword [rax]
sub rax, rbx
jne 0x140014170
mov eax, 0xcccccccd
mul edi
mov eax, dword [rsp + 0x24]
mov ebp, edx
shr ebp, 2
add ebp, r15d
lea ecx, [rax + rax*2]
mov eax, 0xaaaaaaab
shl ecx, 2
mul ecx
mov eax, edx
movzx edx, byte [0x140042b54]
shr eax, 1
mov dword [rsp + 0x34], eax
test r13d, r13d
setne al
sub dl, al
mov eax, dword [0x140042a64]
test edi, edi
mov byte [0x140042b54], dl
setne cl
shr eax, cl
mov ecx, dword [rsp + 0x24]
and ecx, eax
mov eax, r12d
sub eax, ebp
mov dword [rsp + 0x24], ecx
mov dword [0x140042b44], ecx
test al, 0x57
jne 0x1400141e9
movsx eax, byte [0x140042b66]
xor eax, r9d
jne 0x1400141e9
xor r9b, r9b
jmp 0x1400141ed
movzx r9d, bl
mov r13d, dword [0x140042b68]
movzx eax, r10b
sub al, sil
add r13d, 2
add byte [0x140042b82], al
mov eax, dword [0x140042b34]
shr eax, 1
mov dword [rsp + 0x38], eax
mov dword [0x140042b48], eax
mov dword [rsp + 0x2c], r13d
test dl, dl
je 0x14001423b
mov ecx, 0xffffffe8
mov edx, 0xc
sub cl, byte [rsp + 0xb8]
sar dl, cl
test dl, dl
je 0x14001423b
mov eax, ebx
jmp 0x14001423d
xor eax, eax
and r8d, eax
lea eax, [r15 + 0x15e]
lea ecx, [rax + rax*2]
mov dword [0x140042b4c], r8d
mov eax, 0xcccccccd
mul ecx
shr edx, 3
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
mov eax, dword [0x140042b3c]
mov dword [rsp + 0x3c], eax
je 0x140014337
sub ecx, ebx
je 0x140014318
sub ecx, ebx
je 0x1400142e5
movzx r10d, byte [0x140042b57]
sub ecx, ebx
je 0x1400142bb
mov eax, dword [0x140042b40]
mov r13d, 0x160
add eax, 0x1d
imul ecx, r14d, 0x41a
mov dword [rsp + 0xb8], eax
mov eax, 0xcccccccd
mul ecx
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
jmp 0x14001436d
test r10b, r10b
jne 0x1400142c9
test r13d, r13d
jne 0x1400142c9
xor eax, eax
jmp 0x1400142cb
mov eax, ebx
movzx ecx, byte [0x140042b80]
mov r13d, 0x160
xor cl, al
mov byte [0x140042b80], cl
jmp 0x140014374
cmp dword [rsp + 0xb0], 0
jne 0x1400142fe
mov ecx, dword [0x140042b58]
mov eax, r13d
shl eax, cl
test eax, eax
je 0x140014300
mov eax, ebx
mov ecx, dword [rsp + 0x28]
mov r13d, 0x160
sub cl, al
mov dword [rsp + 0x28], ecx
mov byte [0x140042b55], cl
jmp 0x140014365
mov edi, r10d
movzx eax, r15b
and edi, 3
xor al, r13b
add edi, dword [rsp + 0x24]
mov r13d, 0x160
or byte [0x140042b54], al
jmp 0x140014365
imul r13d, r14d, 0xffffffeb
shr r13d, 2
mov dword [rsp + 0x20], r13d
test eax, eax
je 0x140014359
test r13d, r13d
je 0x140014359
mov dword [rsp + 0x38], ebx
mov dword [0x140042b48], ebx
jmp 0x140014365
xor eax, eax
mov dword [rsp + 0x38], eax
mov dword [0x140042b48], eax
movzx r10d, byte [0x140042b57]
movzx ecx, byte [0x140042b80]
movzx edx, cl
sub edx, ebp
sub edx, dword [rsp + 0xb8]
test r15d, r15d
je 0x14001438d
test edi, edi
je 0x14001438d
mov eax, ebx
jmp 0x14001438f
xor eax, eax
add r14d, eax
mov ecx, 0xff
movzx eax, r10b
mov dword [rsp + 0x30], eax
nop
test r8d, r8d
je 0x1400143b3
test r13d, r13d
je 0x1400143b3
test r15d, r15d
je 0x1400143b3
mov eax, ebx
jmp 0x1400143b5
xor eax, eax
sub r9b, al
sub rcx, rbx
jne 0x1400143a0
mov r13d, dword [0x140042a8c]
mov eax, dword [rsp + 0xb0]
add r13d, 0x15
mov r15d, dword [rsp + 0x2c]
sub eax, r15d
or eax, r13d
mov ebp, dword [rsp + 0x20]
je 0x1400143e4
test ebp, ebp
jne 0x1400143f1
cmp dword [0x140042a64], 0
jne 0x1400143f1
xor eax, eax
jmp 0x1400143f3
mov eax, ebx
xor esi, eax
lea ecx, [r15 + 0x57]
movsx eax, byte [0x140042b88]
mov r15d, dword [0x140042b40]
cmp ecx, eax
mov dword [0x140042b6c], esi
mov ecx, r13d
sete al
and esi, ebp
mov ebp, dword [rsp + 0x3c]
add edx, esi
sub ebp, dword [rsp + 0xb8]
add r10b, 0x16
xor al, r10b
mov dword [rsp + 0x40], edx
xor esi, esi
mov byte [rsp + 0xa8], al
shr esi, cl
mov r10d, 0x8a
and ebp, 0xffffffeb
mov byte [0x140042b64], al
mov dword [0x140042b30], ebp
mov dword [0x140042b84], edx
cmp r15d, esi
je 0x140014463
test r11b, r11b
jne 0x140014463
xor eax, eax
jmp 0x140014465
mov eax, ebx
mov ecx, dword [0x140042a64]
sub r11b, al
mov eax, 0xcccccccd
mul edi
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
add edi, ecx
sub r10, rbx
jne 0x140014455
movzx ecx, byte [rsp + 0x34]
movsx eax, byte [rsp + 0x28]
add ecx, 0xfffffdce
mov esi, dword [rsp + 0xb8]
add ecx, ebp
and ecx, dword [rsp + 0x24]
or dword [0x140042b34], ecx
mov ecx, dword [rsp + 0x2c]
shl eax, cl
sar eax, 0x1f
mov byte [0x140042b56], al
movsx eax, r9b
and eax, esi
mov byte [0x140042a87], r11b
xor eax, 0x4ea
jne 0x1400144d8
movzx eax, byte [0x140042b65]
cmp eax, 0x1e8
jne 0x1400144dc
movzx r10d, bl
imul r15d, dword [rsp + 0x40], 0x4ea
mov ecx, edi
imul ebp, dword [rsp + 0xb0], 0x4ea
mov eax, 0xaaaaaaab
mul r15d
shr edx, 1
lea eax, [rdx + rdx*2]
movzx edx, byte [rsp + 0x34]
sub r15d, eax
xor eax, eax
shl eax, cl
mov ecx, r8d
shl eax, cl
and dword [0x140042b40], eax
movzx eax, byte [0x140042b38]
lea ecx, [r15 + 0x4ea]
shl dl, cl
movzx ecx, byte [rsp + 0xa0]
sub al, dl
xor cl, al
mov eax, 0xaaaaaaab
mul ebp
mov byte [0x140042a86], cl
mov ecx, dword [rsp + 0x44]
shr edx, 1
add ecx, 0xffffffeb
lea eax, [rdx + rdx*2]
mov edx, esi
sub ebp, eax
shl edx, cl
xor eax, eax
cmp dword [0x140042b2c], r13d
sete al
xor edx, eax
or r14d, edx
cmp dword [rsp + 0x24], 0
mov dword [0x140042b78], r14d
jne 0x140014586
mov ecx, r15d
mov eax, 0x4ea
shl eax, cl
mov ecx, dword [rsp + 0x20]
shl eax, cl
test eax, eax
jne 0x14001458a
jmp 0x14001458c
mov ecx, dword [rsp + 0x20]
mov eax, ebx
sub r10b, al
imul r14d, ecx
movsx eax, byte [0x140042a8c]
movsx edi, r13b
imul edi, eax
mov eax, 0xaaaaaaab
mov byte [0x140042b65], r10b
mul r14d
mov r14d, dword [rsp + 0x3c]
xor eax, eax
and dil, 3
mov esi, edx
shr esi, 1
cmp dword [0x140042a8c], eax
setne al
xor r14d, eax
cmp byte [rsp + 0xa8], 0
jne 0x1400145ed
mov edx, dword [rsp + 0x2c]
mov eax, edx
mov ecx, dword [rsp + 0x30]
shl eax, cl
test eax, eax
je 0x1400145e9
test edx, edx
jne 0x1400145ed
xor eax, eax
jmp 0x1400145ef
mov eax, ebx
and r14d, eax
mov eax, 0xcccccccd
mov dword [0x140042b3c], r14d
mov r14d, dword [rsp + 0xb0]
lea ecx, [r14 - 0x15]
imul r14d, r15d
xor ecx, dword [0x140042a64]
xor ecx, 0x1e8
mov dword [0x140042a64], ecx
mul r14d
mov eax, dword [rsp + 0x30]
add r10b, al
shr edx, 2
lea ecx, [rdx + rdx*4]
sub r14d, ecx
mov ecx, eax
imul ecx, r15d
mov eax, 0xaaaaaaab
mov dword [rsp + 0xb0], r14d
mul ecx
mov eax, 0x14d
mov r14d, edx
shr r14d, 1
or r9b, r10b
sub rax, rbx
jne 0x140014653
mov eax, dword [rsp + 0x2c]
mov byte [0x140042b67], r9b
and eax, ebx
je 0x140014753
sub eax, ebx
je 0x14001472b
sub eax, ebx
je 0x1400146d3
cmp eax, ebx
je 0x1400146b9
movzx ecx, byte [0x140042b83]
xor edx, edx
movsx eax, byte [rsp + 0xb0]
cmp ecx, eax
mov ecx, dword [rsp + 0x28]
sete dl
cmp edx, ebp
sete al
or al, r12b
mov r12d, dword [rsp + 0xb0]
or al, byte [rsp + 0x34]
sub cl, al
mov byte [0x140042b55], cl
jmp 0x140014775
mov r12d, dword [rsp + 0xb0]
movsx eax, r12b
and eax, r8d
mov dword [0x140042b58], eax
jmp 0x140014775
mov edx, dword [rsp + 0x20]
mov ecx, ebp
sar edx, cl
mov ecx, dword [0x140042b38]
movzx eax, r11b
and edx, eax
movzx eax, byte [0x140042b54]
sub eax, dword [rsp + 0x30]
sub ecx, edx
add eax, r13d
mov dword [0x140042b38], ecx
test dword [rsp + 0x20], eax
je 0x140014717
test ecx, ecx
je 0x140014717
mov r12d, dword [rsp + 0xb0]
mov dword [0x140042a88], ebx
jmp 0x140014775
mov r12d, dword [rsp + 0xb0]
mov dword [0x140042a88], 0
jmp 0x140014775
mov eax, dword [rsp + 0x28]
movzx ecx, sil
shr r12d, cl
mov ecx, dword [rsp + 0xb8]
shl r12b, cl
add al, r12b
mov r12d, dword [rsp + 0xb0]
mov byte [0x140042b55], al
jmp 0x140014775
mov eax, dword [rsp + 0x38]
and byte [0x140042a63], al
mov r12d, dword [rsp + 0xb0]
movsx eax, r12b
and eax, dword [0x140042a8c]
xor dword [0x140042b40], eax
call qword [sym.imp.KERNEL32.dll_GetACP]
movzx eax, byte [0x140042b82]
movzx ecx, dil
shr al, cl
xor byte [0x140042b56], al
cmp byte [0x140042a86], 0
jne 0x14001479f
test ebp, ebp
jne 0x14001479f
xor eax, eax
jmp 0x1400147a1
mov eax, ebx
add dword [0x140042b60], eax
mov ebp, dword [rsp + 0xb8]
mov edi, dword [rsp + 0x2c]
movsx eax, r12b
lea ecx, [rdi + rbp]
xor ecx, eax
mov eax, dword [0x140042b28]
or ecx, dword [0x140042a88]
or eax, ebp
mov dword [0x140042b68], ecx
jne 0x1400147d6
test r14d, r14d
je 0x1400147d8
mov eax, ebx
add dword [0x140042b5c], eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov r8d, dword [0x140042b30]
mov ecx, ebp
movzx eax, byte [0x140042b80]
mov edx, r8d
sub edx, r15d
shl r8d, cl
sub edx, dword [rsp + 0x20]
or dword [0x140042b34], r8d
and edx, 0x4ea
xor edx, eax
mov dword [0x140042b3c], edx
cmp r13d, dword [rsp + 0x30]
je 0x140014821
test edi, edi
jne 0x140014823
xor ebx, ebx
movzx eax, byte [0x140042b57]
sub eax, ebx
mov dword [0x140042b28], eax
call fcn.1400139c0
movzx eax, sil
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret