Function at 0x4386b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 8], 0x38c01b0
mov dword [esp + 0xc], 0x1fa81dbe
mov dword [esp + 0x10], 0x1b6e19aa
mov dword [esp + 0x14], 0x17a015a6
mov dword [esp + 0x18], 0x131011a2
mov dword [esp + 0x1c], 0
mov word [esp + 0x20], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x19
ja 0x438750
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
and edx, 0xde2e662b
xor eax, 0x5e2e662b
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
add al, 0xd3
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x1a
jb 0x438710
lea esi, [esp + 8]
push esi
call fcn.00439fe0
add esp, 4
mov dword [0x44f870], eax
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x44548c]
jmp dword [0x4454a8]
push 0x47a22cca
push eax
call fcn.0043a6c0
add esp, 8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x47a22cca
push dword [0x44f870]
call fcn.0043a6c0
add esp, 8
jmp dword [0x4454b0]
mov dword [0x44f878], eax
push 0x3a61ef1f
push dword [0x44f870]
call fcn.0043a6c0
add esp, 8
mov dword [0x44f87c], eax
jmp dword [0x4454b8]
push 0xc832a727
push dword [0x44f870]
call fcn.0043a6c0
add esp, 8
mov dword [0x44f880], eax
push 0x6a191246
push dword [0x44f870]
call fcn.0043a6c0
add esp, 8
mov dword [0x447854], eax
mov dword [esp + 8], 0x9b679963
mov dword [esp + 0xc], 0x97609566
mov dword [esp + 0x10], 0x9366916d
mov dword [esp + 0x14], 0x8f5c8d5f
mov dword [esp + 0x18], 0x8b76895e
mov dword [esp + 0x1c], 0x87728570
mov word [esp + 0x20], 0x8180
mov dword [esp + 0x22], 0
mov dword [esp + 0x26], 0
mov dword [esp + 0x2a], 0
mov word [esp + 0x2e], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x27
ja 0x4388a6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax - 0x2c00f6bc]
add eax, 0x44
and eax, ecx
or edx, ecx
sub edx, eax
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
add al, 0x24
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x28
jb 0x438870
push esi
call fcn.00439fe0
add esp, 4
mov dword [0x44784c], eax
jmp case.0x438769.11
push esi
call fcn.00439fe0
add esp, 4
mov dword [0x44784c], eax
jmp dword [0x4454c0]
push 0xc832a727
push dword [0x44f870]
call fcn.0043a6c0
add esp, 8
mov dword [0x44f880], eax
push 0x6a191246
push dword [0x44f870]
call fcn.0043a6c0
add esp, 8
mov dword [0x447854], eax
mov dword [esp + 8], 0x9b679963
mov dword [esp + 0xc], 0x97609566
mov dword [esp + 0x10], 0x9366916d
mov dword [esp + 0x14], 0x8f5c8d5f
mov dword [esp + 0x18], 0x8b76895e
mov dword [esp + 0x1c], 0x87728570
mov word [esp + 0x20], 0x8180
mov dword [esp + 0x22], 0
mov dword [esp + 0x26], 0
mov dword [esp + 0x2a], 0
mov word [esp + 0x2e], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x27
ja 0x4388c0
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax - 0x2c00f6bc]
add eax, 0x44
and eax, ecx
or edx, ecx
sub edx, eax
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
add al, 0x24
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x28
jb 0x438970
jmp 0x4388c0
mov ecx, dword [case.0x438769.4]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
mov ecx, eax
xor edx, edx
test eax, eax
sete dl
xor eax, eax
jmp dword [edx*4 + 0x4454c4]
push 0x84f29178
push ecx
call fcn.0043a6c0
add esp, 8
mov dword [0x446540], eax
push 0x9372af38
push dword [0x44784c]
call fcn.0043a6c0
add esp, 8
mov dword [0x446644], eax
push 0x22b3895b
push dword [0x44784c]
call fcn.0043a6c0
add esp, 8
mov dword [0x44786c], eax
call fcn.00438e10
movzx ecx, al
xor eax, eax
jmp dword [ecx*4 + 0x4454cc]
jmp dword [0x4454d8]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
call fcn.00432f90
nop
nop
nop
nop
nop
nop
nop
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
call fcn.00432f90
jmp dword [0x4454e0]
movzx ecx, al
xor eax, eax
jmp dword [ecx*4 + 0x4454e4]
jmp dword [0x4454f0]
mov eax, dword [0x446540]
mov dword [esp + 8], 0xc370c163
mov dword [esp + 0xc], 0xc776c57d
mov dword [esp + 0x10], 0xcb39c97c
mov dword [esp + 0x14], 0xcf20cd3e
mov dword [esp + 0x18], 0xd37ed174
mov dword [esp + 0x1c], 0xd7d6d578
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x1f
ja 0x438afd
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea edi, [ecx + edx]
add edi, 0x6273a320
add ecx, 0x6273a320
and ecx, edx
add ecx, ecx
sub edi, ecx
mov dword [esp + 4], edi
mov ecx, dword [esp + 4]
add cl, 0x20
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x20
jb 0x438ac0
push 0x800
push 0
push esi
call eax
test eax, eax
je case.0x438769.25
mov dword [0x447864], eax
jmp case.0x438769.25
jmp dword [0x4454f4]
mov eax, dword [0x446540]
mov dword [esp + 8], 0xc370c163
mov dword [esp + 0xc], 0xc776c57d
mov dword [esp + 0x10], 0xcb39c97c
mov dword [esp + 0x14], 0xcf20cd3e
mov dword [esp + 0x18], 0xd37ed174
mov dword [esp + 0x1c], 0xd7d6d578
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x1f
ja 0x438bbd
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea edi, [ecx + edx]
add edi, 0x6273a320
add ecx, 0x6273a320
and ecx, edx
add ecx, ecx
sub edi, ecx
mov dword [esp + 4], edi
mov ecx, dword [esp + 4]
add cl, 0x20
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x20
jb 0x438b80
push 0x800
push 0
push esi
call eax
test eax, eax
je 0x438b20
mov dword [0x447864], eax
jmp 0x438b20
mov ecx, dword [case.0x438769.4]
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
mov ecx, dword [case.0x433a66.236]
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx