Function at 0x1000af90
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x10012040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1001338d], 0
push ebx
push esi
push edi
jne 0x1000b1db
movzx eax, byte [0x10013344]
xor al, 0xfc
mov byte [0x1001338d], 1
mov byte [ebp - 0x6c], al
movzx eax, byte [0x10013345]
xor al, 0xcf
mov dword [ebp - 0x70], 0x1f152c1
mov byte [ebp - 0x6b], al
movzx eax, byte [0x10013346]
xor al, 0xab
mov word [ebp - 0x74], 0xcffc
mov byte [ebp - 0x6a], al
movzx eax, byte [0x10013347]
xor al, 0xfc
mov byte [ebp - 0x72], 0xab
mov byte [ebp - 0x69], al
movzx eax, byte [0x10013348]
xor al, 0xcf
mov byte [ebp - 0x68], al
movzx eax, byte [0x10013349]
xor al, 0xab
mov byte [ebp - 0x67], al
movzx eax, byte [0x1001334a]
xor al, 0xfc
mov byte [ebp - 0x66], al
movzx eax, byte [0x1001334b]
xor al, 0xcf
mov byte [ebp - 0x65], al
movzx eax, byte [0x1001334c]
xor al, 0xab
mov byte [ebp - 0x64], al
movzx eax, byte [0x1001334d]
xor al, 0xfc
xor esi, esi
mov byte [ebp - 0x63], al
lea ebx, [esi + 3]
lea edi, [esi + 2]
nop dword [eax + eax]
mov eax, 0xaaaaaaab
mov ecx, esi
mul esi
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [ebp + ecx - 0x74]
lea ecx, [edi - 1]
xor al, byte [esi + 0x1001334f]
mov byte [ebp + esi - 0x62], al
mov eax, 0xaaaaaaab
mul ecx
mov ecx, esi
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [ebp + ecx - 0x73]
mov ecx, esi
xor al, byte [esi + 0x10013350]
mov byte [ebp + esi - 0x61], al
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [ebp + ecx - 0x72]
mov ecx, esi
xor al, byte [edi + 0x1001334f]
add edi, 5
mov byte [ebp + ebx - 0x63], al
mov eax, 0xaaaaaaab
mul ebx
add ebx, 5
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [ebp + ecx - 0x71]
lea ecx, [esi + 4]
xor al, byte [esi + 0x10013352]
mov byte [ebp + esi - 0x5f], al
mov eax, 0xaaaaaaab
mul ecx
mov ecx, esi
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
movzx eax, byte [ebp + ecx - 0x70]
xor al, byte [esi + 0x10013353]
mov byte [ebp + esi - 0x5e], al
add esi, 5
cmp edi, 0x16
jl 0x1000b050
call dword [sym.imp.KERNEL32.dll_GetTickCount]
movups xmm0, xmmword [0x10013d68]
mov dword [ebp - 0x4e], eax
movzx eax, byte [0x1826e38]
dec al
mov byte [ebp - 0x4a], al
movzx eax, byte [0x1826e39]
sub al, 2
mov byte [ebp - 0x49], al
movzx eax, byte [0x1826e3a]
sub al, 3
mov byte [ebp - 0x48], al
movzx eax, byte [0x1826e3b]
sub al, 4
mov byte [ebp - 0x47], al
movzx eax, byte [0x1826e3c]
sub al, 5
mov byte [ebp - 0x35], 0
mov byte [ebp - 0x46], al
lea eax, [ebp - 0x14]
movups xmmword [ebp - 0x45], xmm0
mov word [ebp - 0x24], 0
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x34], xmm0
call dword [sym.imp.RPCRT4.dll_UuidCreateSequential]
movzx eax, byte [ebp - 5]
push eax
movzx eax, byte [ebp - 6]
push eax
movzx eax, byte [ebp - 7]
push eax
movzx eax, byte [ebp - 8]
push eax
movzx eax, byte [ebp - 9]
push eax
movzx eax, byte [ebp - 0xa]
push eax
lea eax, [ebp - 0x34]
push str._02X:_02X:_02X:_02X:_02X:_02X
push eax
call fcn.10004a30
add esp, 0x20
mov dword [ebp - 0x74], 0
lea eax, [ebp - 0x74]
push 0xff
push 0
push 0
push 0
push eax
push 0xff
push 0
push 0x1000ea44
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x1000b1cc
mov eax, dword [ebp - 0x74]
movzx edx, byte [ebp - 0x6f]
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x22], eax
call fcn.1000a760
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000b9ff
mov esp, ebp
pop ebp
ret