Function at 0x428880
Capabilities:
Encode data using xor
Get disk information
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x7c
mov eax, dword [0x451f5c]
mov dword [esp + 4], 0xe152e7bb
mov dword [esp + 8], 0xdd7fe371
mov dword [esp + 0xc], 0xd94adf7f
mov dword [esp + 0x10], 0xd54adb9b
mov dword [esp + 0x14], 0xd16ad744
mov dword [esp + 0x18], 0xcd5ed373
mov dword [esp + 0x1c], 0xc991cf6f
mov dword [esp + 0x20], 0xcbc8
mov ecx, 0x59
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx - 0x55]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0x43
mov byte [esp + ecx - 0x55], dl
inc ecx
cmp ecx, 0x79
jne 0x4288e0
lea edx, [esp + 0x54]
lea ecx, [esp + 4]
push edx
push 0
push 0
push 0xe
push ecx
push 0
call eax
mov eax, dword [esp + 0x54]
test eax, eax
mov dword [esp + 0x58], eax
jns 0x428926
mov eax, 0xffffffff
jmp 0x428928
add eax, eax
push eax
call fcn.0040cad0
add esp, 4
mov dword [esp + 0x5c], eax
mov eax, dword [0x451f5c]
mov dword [esp + 0x74], eax
mov dword [esp + 4], 0x95e0b37
mov dword [esp + 8], 0x57b0779
mov dword [esp + 0xc], 0x176037b
mov dword [esp + 0x10], 0x1d6e1f5f
mov dword [esp + 0x14], 0x19461b6c
mov dword [esp + 0x18], 0x159a1767
mov dword [esp + 0x1c], 0x1129136b
mov dword [esp + 0x20], 0x2f10
xor ecx, ecx
mov edi, ecx
and edi, 3
mov eax, ecx
and eax, 0xfffffffc
sub edi, eax
movzx eax, byte [esp + ecx + 4]
mov dword [esp], eax
mov ebp, ecx
xor ebp, 0x32c7a403
lea ebx, [ecx + edi]
lea esi, [ebx + ebp]
and esi, eax
mov edx, esi
and edx, 0xfffffffd
mov eax, esi
or eax, 0xfffffffd
inc eax
imul eax, edx
add ebp, dword [esp]
mov edx, esi
or edx, 2
shr esi, 1
and esi, 1
imul esi, edx
add esi, esi
mov edx, ecx
sub edx, esi
add eax, edi
add ebx, ebp
add eax, ebp
add eax, edx
and ebx, 1
or eax, 1
add eax, ebx
add al, 0xf0
mov byte [esp + ecx + 4], al
inc ecx
cmp ecx, 0x20
jne 0x428980
lea eax, [esp + 0x54]
push eax
push dword [esp + 0x5c]
mov esi, dword [esp + 0x64]
push esi
push 0xe
lea eax, [esp + 0x14]
push eax
push 0
call dword [esp + 0x8c]
mov eax, dword [esp + 0x54]
mov ecx, eax
add ecx, 9
jns 0x428a14
mov eax, 0xffffffff
jmp 0x428a1b
lea eax, [eax*2 + 0x12]
push eax
call fcn.0040cad0
add esp, 4
mov edi, eax
mov dword [esp + 4], 0x1766197c
mov dword [esp + 8], 0x138d1575
mov dword [esp + 0xc], 0xf6f1187
mov dword [esp + 0x10], 0xb970d97
mov dword [esp + 0x14], 0x7060987
mov word [esp + 0x18], 0
mov byte [esp + 0x1a], 0
xor eax, eax
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 4]
lea edx, [eax + 6]
and edx, ecx
add ecx, eax
add edx, edx
sub ecx, edx
mov edx, 0xb165f034
sub edx, ecx
add ecx, 0x4e9a100b
and edx, 0xe4
and ecx, 0x1b
sub ecx, edx
inc cl
mov byte [esp + eax + 4], cl
mov ecx, eax
xor ecx, 1
and eax, 1
lea eax, [ecx + eax*2]
cmp eax, 0x17
jb 0x428a60
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x428ac1
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428ab0
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x428af1
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x428ae0
mov word [eax], 0
lea eax, [esp + 0x78]
push eax
push edi
call fcn.00445bf0
add esp, 8
not eax
shr eax, 0x1f
mov dword [esp + 0x58], edi
jmp dword [eax*4 + 0x44d4cc]