Function at 0x423912
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x8c
mov dword [esp + 4], 0x49be4b97
mov dword [esp + 8], 0x45db47d9
mov dword [esp + 0xc], 0x41d643db
mov dword [esp + 0x10], 0x7dee7fbf
mov dword [esp + 0x14], 0x79867bec
mov dword [esp + 0x18], 0x75fa77e7
mov dword [esp + 0x1c], 0x71a973eb
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x6f70
mov ecx, 0x172be413
mov edx, 0x48d41bec
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0x172be40f]
mov edi, edx
and edi, 0x48c011ab
mov ebx, ecx
and ebx, 0x1701e414
or ebx, edi
xor ebx, esi
mov esi, ebx
xor esi, 0xcb
add ebx, ebx
and ebx, 0x3e
xor ebx, 0x16
sub ebx, esi
inc bl
mov byte [esp + ecx - 0x172be40f], bl
inc ecx
dec edx
cmp ecx, 0x172be433
jne 0x423810
lea esi, [esp + 0x6e]
lea edx, [esp + 4]
mov edi, esi
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x8a]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, esp
push eax
push 0
push 0
push 0xe
push esi
push 0
call dword [0x44bcd8]
mov dword [esp + 4], 0x519e9ff9
mov word [esp + 8], 0
xor ecx, ecx
xor ebp, ebp
nop
nop
nop
nop
movzx ebx, byte [esp + ebp + 4]
mov esi, ecx
and esi, 0xa
mov edx, ebp
xor edx, 0xde59c2a5
add edx, esi
lea edi, [ebx + ebx]
not edi
add edi, ebx
and edi, edx
not ebx
or ebx, edx
lea esi, [ebx + ebx]
not esi
add esi, ebx
or esi, edi
lea edi, [esi + 6]
mov edx, 0x57c0cd39
sub edx, esi
and esi, 1
mov ebx, edx
not ebx
and edx, 0xd1
and edi, 0x2e
or edi, edx
and ebx, 1
or ebx, edi
xor ebx, 0xd0
add ebx, esi
mov byte [esp + ebp + 4], bl
inc ebp
add ecx, 2
cmp ebp, 6
jne case.default.0x42390b
xor ecx, ecx
cmp eax, dword [esp + 4]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x446340]
mov ebx, dword [esp]
test ebx, ebx
jns 0x423920
mov eax, 0xffffffff
jmp 0x423923
lea eax, [ebx + ebx]
push eax
call fcn.004095d0
add esp, 4
mov esi, eax
mov eax, esp
push eax
push ebx
push esi
push 0xe
lea eax, [esp + 0x7e]
push eax
push 0
call dword [0x44bcd8]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x446348]
jmp dword [0x446350]
push esi
call fcn.004095e0
add esp, 4
mov eax, dword [case.0x42390b.0]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
mov eax, dword [esp]
mov ecx, eax
add ecx, 9
jns 0x423983
mov eax, 0xffffffff
jmp 0x42398a
lea eax, [eax*2 + 0x12]
push eax
call fcn.004095d0
add esp, 4
mov ebp, eax
mov dword [esp + 4], 0x316e3f50
mov dword [esp + 8], 0x35573353
mov dword [esp + 0xc], 0x49553749
mov dword [esp + 0x10], 0x4d2d4b31
mov dword [esp + 0x14], 0x414e4f39
mov word [esp + 0x18], 0
mov byte [esp + 0x1a], 0
mov eax, 0x53cddab5
nop
nop
movzx ecx, byte [esp + eax - 0x53cddab1]
xor ecx, eax
add ecx, 0x5cfaba76
mov edi, ecx
xor edi, 0xfffffffe
mov edx, ecx
or edx, 1
and edx, edi
mov edi, edx
and edi, 2
mov ebx, edx
or edx, 2
imul edx, edi
xor edi, 2
and ebx, 0xfd
imul ebx, edi
xor ecx, 1
add ecx, edx
add ecx, ebx
mov byte [esp + eax - 0x53cddab1], cl
inc eax
cmp eax, 0x53cddacc
jne 0x4239d0
movzx ecx, word [esi]
mov eax, ebp
test cx, cx
je 0x423a41
lea edx, [esi + 2]
mov eax, ebp
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x423a30
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x423a71
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x423a60
mov word [eax], 0
lea eax, [esp + 0x68]
push eax
push ebp
call fcn.0043f420
add esp, 8
not eax
shr eax, 0x1f
mov dword [esp + 0x60], ebp
jmp dword [eax*4 + 0x446368]
mov eax, ebx
add esp, 0x8c
pop esi
pop edi
pop ebx
pop ebp
ret