Function at 0x4238c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
push ebx
push esi
xor bh, bh
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x4238e3
push 0x15
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x4238e5
mov bh, 1
mov byte [ebp - 8], 0x33
xor edx, edx
mov byte [ebp - 7], 0xbd
mov esi, 0xf
mov byte [ebp - 6], 0xd8
mov byte [ebp - 5], 0x83
mov al, byte [ebp - 8]
mov dword [ebp - 4], edx
mov bl, byte [ebp + edx - 8]
mov ecx, edx
and ecx, esi
mov eax, 0x44fe157f
cmp ecx, esi
mov edx, 0xb74671c3
cmovae ecx, esi
shl ecx, 2
call fcn.00521900
mov edx, dword [ebp - 4]
mov cl, al
and cl, 0xf
lea eax, [edx + 0x7f]
xor cl, al
xor cl, bl
mov byte [ebp + edx - 8], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 4
jb 0x423902
push 0x105
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
push 0x105
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x423b55
mov byte [ebp - 0x17], 0x86
xor edx, edx
mov byte [ebp - 0x16], 0x97
mov byte [ebp - 0x15], 0xb7
mov byte [ebp - 0x14], 0xa4
mov byte [ebp - 0x13], 0x9e
mov byte [ebp - 0x12], 0xa6
mov byte [ebp - 0x11], 0xae
mov byte [ebp - 0x10], 0xd2
mov al, byte [ebp - 0x17]
mov dword [ebp - 4], edx
nop dword [eax + eax]
mov bl, byte [ebp + edx - 0x17]
mov ecx, edx
and ecx, esi
mov eax, 0xc58161d7
cmp ecx, esi
mov edx, 0x27f75b5d
cmovae ecx, esi
shl ecx, 2
call fcn.00521900
mov edx, dword [ebp - 4]
mov cl, al
and cl, 0xf
lea eax, [edx - 0x29]
xor cl, al
xor cl, bl
mov byte [ebp + edx - 0x17], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 8
jb 0x4239a0
lea ecx, [ebp - 0x17]
lea eax, [ebp - 0x138]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x423a04
test dl, dl
je 0x423a00
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x423a04
add eax, 2
add ecx, 2
test dl, dl
jne 0x4239e4
xor eax, eax
jmp 0x423a09
sbb eax, eax
or eax, 1
test eax, eax
je 0x423b4d
mov byte [ebp - 0xf], 0x26
xor edx, edx
mov byte [ebp - 0xe], 0x3f
mov byte [ebp - 0xd], 0x1c
mov byte [ebp - 0xc], 0xa
mov byte [ebp - 0xb], 0x2f
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x74
mov al, byte [ebp - 0xf]
mov dword [ebp - 4], edx
mov bl, byte [ebp + edx - 0xf]
mov ecx, edx
and ecx, esi
mov eax, 0xabb1e879
cmp ecx, esi
mov edx, 0xf353896d
cmovae ecx, esi
shl ecx, 2
call fcn.00521900
mov edx, dword [ebp - 4]
mov cl, al
and cl, 0xf
lea eax, [edx + 0x79]
xor cl, al
xor cl, bl
mov byte [ebp + edx - 0xf], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 7
jb 0x423a35
lea ecx, [ebp - 0xf]
lea eax, [ebp - 0x138]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x423aa0
test dl, dl
je 0x423a9c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x423aa0
add eax, 2
add ecx, 2
test dl, dl
jne 0x423a80
xor eax, eax
jmp 0x423aa5
sbb eax, eax
or eax, 1
test eax, eax
je 0x423b4d
mov byte [ebp - 0x21], 0x56
xor edx, edx
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x62
mov byte [ebp - 0x1e], 0x73
mov byte [ebp - 0x1d], 0x41
mov byte [ebp - 0x1c], 0x78
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x1a], 0x7c
mov byte [ebp - 0x19], 0x71
mov byte [ebp - 0x18], 0x1d
mov al, byte [ebp - 0x21]
mov dword [ebp - 4], edx
nop dword [eax]
mov bl, byte [ebp + edx - 0x21]
mov ecx, edx
and ecx, esi
mov eax, 0x1e1d1407
cmp ecx, esi
mov edx, 0x43f150da
cmovae ecx, esi
shl ecx, 2
call fcn.00521900
mov edx, dword [ebp - 4]
mov cl, al
and cl, 0xf
lea eax, [edx + 7]
xor cl, al
xor cl, bl
mov byte [ebp + edx - 0x21], cl
inc edx
mov dword [ebp - 4], edx
cmp edx, 0xa
jb 0x423ae0
lea ecx, [ebp - 0x21]
lea eax, [ebp - 0x138]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x423b44
test dl, dl
je 0x423b40
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x423b44
add eax, 2
add ecx, 2
test dl, dl
jne 0x423b24
xor eax, eax
jmp 0x423b49
sbb eax, eax
or eax, 1
test eax, eax
jne 0x423b55
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov al, bh
pop ebx
mov esp, ebp
pop ebp
ret