Function at 0x425825
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x8c
mov dword [esp], 0x29e62bcf
mov dword [esp + 4], 0x2d8b2f99
mov dword [esp + 8], 0x319e338b
mov dword [esp + 0xc], 0x358637f7
mov dword [esp + 0x10], 0x39fe3b84
mov dword [esp + 0x14], 0x3d8a3f9f
mov dword [esp + 0x18], 0x1e9039b
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x700
mov byte [esp + 0x20], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 0xe
mov ebx, edx
xor ebx, 0x47
add ebx, esi
xor bl, byte [esp + edx]
add bl, 0x9d
mov byte [esp + edx], bl
inc edx
add ecx, 2
cmp edx, 0x21
jne 0x425790
lea ebp, [esp + 0x6e]
mov edx, esp
mov edi, ebp
mov ecx, 7
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x8a]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0x50]
push edi
push 0
push 0
push 0xe
push ebp
push 0
call dword [0x44f2b0]
mov dword [esp], 0xd19e9f79
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xe5
xor dl, byte [esp + ecx]
add dl, 0x87
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 7
jne case.default.0x42581e
xor ecx, ecx
cmp eax, dword [esp]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x4495bc]
mov ebx, dword [esp + 0x50]
test ebx, ebx
jns 0x425834
mov eax, 0xffffffff
jmp 0x425837
lea eax, [ebx + ebx]
push eax
call fcn.00408640
add esp, 4
mov esi, eax
push edi
push ebx
push eax
push 0xe
push ebp
push 0
call dword [0x44f2b0]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4495c4]
xor ebx, ebx
jmp dword [0x4495cc]
push esi
call fcn.00408650
add esp, 4
xor ebx, ebx
jmp case.0x42581e.4
mov eax, dword [esp + 0x50]
mov ecx, eax
add ecx, 9
jns 0x425886
mov eax, 0xffffffff
jmp 0x42588d
lea eax, [eax*2 + 0x12]
push eax
call fcn.00408640
add esp, 4
mov edi, eax
mov dword [esp], 0x73a271d4
mov dword [esp + 4], 0x7fdd7ddd
mov dword [esp + 8], 0x7bdb79d3
mov dword [esp + 0xc], 0x47eb45eb
mov dword [esp + 0x10], 0x434241f3
mov word [esp + 0x14], 0
mov byte [esp + 0x16], 0
xor eax, eax
nop
nop
nop
mov ecx, eax
add cl, 0x14
xor cl, byte [esp + eax]
add cl, 0x9c
mov byte [esp + eax], cl
inc eax
cmp eax, 0x17
jne 0x4258d0
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x425911
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425900
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x425941
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425930
mov word [eax], 0
lea eax, [esp + 0x68]
push eax
push edi
call fcn.00442b70
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4495d4]
mov eax, dword [esp + 0x68]
shr eax, 2
and eax, 4
jmp dword [eax + 0x4495dc]
mov eax, dword [esp + 0x50]
mov ecx, eax
add ecx, 0x25
jns 0x425982
mov eax, 0xffffffff
jmp 0x425989
lea eax, [eax*2 + 0x4a]
push eax
call fcn.00408640
add esp, 4
mov ebp, eax
mov dword [esp], 0x61d167c0
mov dword [esp + 4], 0x5dff63fb
mov dword [esp + 8], 0x59cf5fce
mov dword [esp + 0xc], 0x55cb5bd5
mov dword [esp + 0x10], 0x51da57ca
mov dword [esp + 0x14], 0x4dfb53f4
mov dword [esp + 0x18], 0x49d84fd7
mov dword [esp + 0x1c], 0x45db4bd4
mov dword [esp + 0x20], 0x41cb47cd
mov dword [esp + 0x24], 0x3df543a0
mov dword [esp + 0x28], 0x39a53f9f
mov dword [esp + 0x2c], 0x359e3bac
mov dword [esp + 0x30], 0x31a73780
mov dword [esp + 0x34], 0x2d9133ad
mov dword [esp + 0x38], 0x29ce2fb8
mov dword [esp + 0x3c], 0x25bb2b96
mov dword [esp + 0x40], 0x21ba27b0
mov dword [esp + 0x44], 0x1db023bf
mov dword [esp + 0x48], 0x191e1f91
mov word [esp + 0x4c], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax]
lea ecx, [eax + 0x31ac299]
mov ebx, 0x6ce53d66
sub ebx, eax
and ebx, 0x11e
and ecx, 0x30a42e1
or ecx, ebx
xor ecx, edx
mov edx, ecx
xor edx, 0x9010811e
mov ebx, ecx
xor ebx, 0x6fef7ee1
or ebx, 2
add ebx, edx
xor ecx, 0x9010811c
lea ecx, [ecx + ebx*2]
add cl, 3
mov byte [esp + eax], cl
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
cmp eax, 0x4e
jb 0x425a40
movzx ecx, word [esi]
mov eax, ebp
test cx, cx
je 0x425ac1
mov edx, esi
add edx, 2
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425ab0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x425af1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425ae0
mov word [eax], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea eax, [esp + 0x64]
push eax
push ebp
call fcn.00442b70
add esp, 8
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x4495e4]
mov eax, dword [case.0x42581e.0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
mov eax, ebx
add esp, 0x8c
pop esi
pop edi
pop ebx
pop ebp
ret