Function at 0x439010
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov dword [esp + 0x10], 0x63f661ce
mov dword [esp + 0x14], 0x67ca65c0
mov dword [esp + 0x18], 0x6b0469c4
mov dword [esp + 0x1c], 0x6fc26dc8
mov dword [esp + 0x20], 0x535251fc
mov dword [esp + 0x24], 0
mov byte [esp + 0x28], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x18
ja 0x4390c2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x10]
mov edx, ecx
and edx, 0x244212d0
xor ecx, 0x244212d0
lea ecx, [ecx + edx*2]
mov edx, ecx
and edx, eax
mov esi, ecx
xor esi, eax
not ecx
or eax, ecx
add ecx, esi
add eax, edx
sub ecx, eax
lea eax, [ecx + edx*2]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 0x50
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x19
jb 0x439070
lea edi, [esp + 0x10]
push edi
call fcn.0043ac10
add esp, 4
mov dword [0x4509e8], eax
xor ecx, ecx
test eax, eax
sete cl
mov dword [esp + 0xc], 0
jmp dword [ecx*4 + 0x4465fc]
push 0xde118a15
push eax
call fcn.0043b2c0
add esp, 8
mov dword [0x4509f0], eax
push 0x9b1cb500
push dword [0x4509e8]
call fcn.0043b2c0
add esp, 8
mov dword [0x4509f4], eax
push 0xb3a80508
push dword [0x4509e8]
call fcn.0043b2c0
add esp, 8
mov dword [0x4509f8], eax
push 0x1f488771
push dword [0x4509e8]
call fcn.0043b2c0
add esp, 8
mov dword [0x4489cc], eax
mov dword [esp + 0x10], 0x7bbf79bb
mov dword [esp + 0x14], 0x7fa27da8
mov dword [esp + 0x18], 0x73ac71b9
mov dword [esp + 0x1c], 0x77867587
mov dword [esp + 0x20], 0x4b8c4988
mov dword [esp + 0x24], 0x4f904d96
mov word [esp + 0x28], 0x414e
mov dword [esp + 0x2a], 0
mov dword [esp + 0x2e], 0
mov word [esp + 0x32], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x23
ja 0x4391e3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x10]
add eax, 0xdea4c70f
xor eax, ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 0x97
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x24
jb 0x4391b0
push edi
call fcn.0043ac10
add esp, 4
mov dword [0x4489c4], eax
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x446604]
push 0x2df68b61
push eax
call fcn.0043b2c0
add esp, 8
mov dword [0x4476b8], eax
push 0xd4ed4ea7
push dword [0x4489c4]
call fcn.0043b2c0
add esp, 8
mov dword [0x4477bc], eax
push 0xe174828e
push dword [0x4489c4]
call fcn.0043b2c0
add esp, 8
mov dword [0x4489e4], eax
call fcn.00439920
movzx eax, al
mov dword [esp + 0xc], 0
jmp dword [eax*4 + 0x44661c]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
nop
mov eax, dword [case.0x4391f8.10]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
xor ecx, ecx
cmp dword [esp + 0xc], 0xb
setne cl
mov eax, 2
jmp dword [ecx*4 + 0x446634]
mov eax, dword [esp + 0xc]
mov eax, dword [eax*4 + 0x43fe3c]
mov dword [esp + 0x44], eax
mov dword [esp + 0x10], 0x636261b0
lea eax, [esp + 0x14]
mov byte [eax + 8], 0
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xc
ja 0x439311
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x10]
mov edx, 0xef
sub edx, eax
add eax, ecx
not ecx
or edx, ecx
lea eax, [eax + edx*2]
add eax, 0xe79f9112
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 0x90
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xd
jb 0x4392d0
mov eax, dword [esp + 0x10]
mov esi, dword fs:[eax]
mov eax, dword [esi + 0xc]
mov edi, dword [eax + 0xc]
mov eax, dword [case.0x4391f8.16]
xor ecx, ecx
movzx ecx, cl
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], esi
jmp eax
mov eax, dword [case.0x4391f8.20]
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
mov eax, dword [esi + 0xc]
add eax, 0xc
xor ecx, ecx
cmp edi, eax
setne cl
mov eax, 4
jmp dword [ecx*4 + 0x44665c]
jmp dword [0x446664]
mov eax, dword [edi + 0x30]
jmp dword [0x446670]
mov eax, dword [edi + 0x30]
jmp dword [0x446670]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x446674]
mov eax, dword [esp + 0x3c]
jmp dword [eax*4 + 0x44667c]
mov dword [esp + 0x10], 0x2b637285
lea eax, [esp + 0x14]
mov word [eax + 8], 0
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xd
ja 0x43941e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax - 0x414e3503]
lea esi, [eax + 0xfd]
mov ebx, esi
and ebx, edx
and ebx, ecx
xor esi, edx
and esi, ecx
add eax, ecx
add eax, 0xbeb1cafd
lea ecx, [esi + ebx*2]
sub eax, ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 0x15
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xe
jb 0x4393d0
mov esi, dword [esp + 0x10]
mov ecx, dword [edi + 0x30]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x439430
test eax, eax
je 0x4394aa
sar eax, 1
lea edx, [eax - 1]
mov dword [esp + 0x48], edx
mov edx, eax
and edx, 3
je 0x439462
nop
dec eax
movzx ebx, word [ecx]
add ecx, 2
xor ebx, esi
imul esi, ebx, 0x1000193
dec edx
jne 0x439450
cmp dword [esp + 0x48], 3
jb 0x4394aa
xor edx, edx
nop
nop
nop
nop
nop
movzx ebx, word [ecx + edx*2]
xor ebx, esi
imul esi, ebx, 0x1000193
movzx ebx, word [ecx + edx*2 + 2]
xor ebx, esi
imul esi, ebx, 0x1000193
movzx ebx, word [ecx + edx*2 + 4]
xor ebx, esi
imul esi, ebx, 0x1000193
movzx ebx, word [ecx + edx*2 + 6]
xor ebx, esi
imul esi, ebx, 0x1000193
add edx, 4
cmp eax, edx
jne 0x439470
xor eax, eax
cmp esi, dword [esp + 0x44]
sete al
mov esi, dword [esp + 0x40]
jmp dword [eax*4 + 0x44667c]
jmp dword [0x44669c]
mov eax, 1
xor ecx, ecx
jmp dword [0x446690]
jmp dword [ecx*4 + 0x4466b4]
mov ecx, dword [0x4466d4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
mov eax, dword [case.0x4391f8.5]
mov dword [esp + 0xc], 0
jmp eax
mov ecx, dword [0x446750]
jmp ecx
mov eax, dword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret