Function at 0x438870
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 8], 0x33a631ae
mov dword [esp + 0xc], 0x37aa3550
mov dword [esp + 0x10], 0x2b7429b4
mov dword [esp + 0x14], 0x2fb22d48
mov dword [esp + 0x18], 0x232221bc
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x1b
ja 0x438913
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
add edx, 0x1fa10b28
add eax, 0x28
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0xe8
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x1c
jb 0x4388d0
lea esi, [esp + 8]
push esi
call fcn.0043a3a0
add esp, 4
mov ecx, eax
mov dword [0x44f780], eax
xor edx, edx
test eax, eax
sete dl
xor eax, eax
jmp dword [edx*4 + 0x445460]
push 0xde118a15
push ecx
call fcn.0043aaf0
add esp, 8
mov dword [0x44f788], eax
push 0x9b1cb500
push dword [0x44f780]
call fcn.0043aaf0
add esp, 8
mov dword [0x44f78c], eax
push 0xb3a80508
push dword [0x44f780]
call fcn.0043aaf0
add esp, 8
mov dword [0x44f790], eax
push 0x1f488771
push dword [0x44f780]
call fcn.0043aaf0
add esp, 8
mov dword [0x447764], eax
mov dword [esp + 8], 0x431f4113
mov dword [esp + 0xc], 0x5f0a5d10
mov dword [esp + 0x10], 0x5b0c5901
mov dword [esp + 0x14], 0x57665517
mov dword [esp + 0x18], 0x530c5160
mov dword [esp + 0x1c], 0x6f386d06
mov word [esp + 0x20], 0x696e
mov dword [esp + 0x22], 0
mov dword [esp + 0x26], 0
mov dword [esp + 0x2a], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x25
ja 0x438a38
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + 0xcb]
and edx, ecx
add eax, ecx
add edx, edx
sub eax, edx
add eax, 0xdbb9d9cb
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x73
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
mov eax, dword [esp]
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
mov dword [esp], eax
mov eax, dword [esp]
cmp eax, 0x26
jb case.default.0x438a51
push esi
call fcn.0043a3a0
add esp, 4
mov ecx, eax
mov dword [0x44775c], eax
xor edx, edx
test eax, eax
sete dl
xor eax, eax
jmp dword [edx*4 + 0x445468]
push 0x2df68b61
push ecx
call fcn.0043aaf0
add esp, 8
mov dword [0x446450], eax
push 0xd4ed4ea7
push dword [0x44775c]
call fcn.0043aaf0
add esp, 8
mov dword [0x446554], eax
push 0xe174828e
push dword [0x44775c]
call fcn.0043aaf0
add esp, 8
mov dword [0x44777c], eax
call fcn.00438dd0
movzx ecx, al
xor eax, eax
jmp dword [ecx*4 + 0x445470]
jmp dword [0x445478]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
nop
nop
nop
nop
nop
nop
nop
nop
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp dword [0x445480]
jmp dword [0x445488]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
call fcn.00433330
call fcn.00433330
jmp dword [0x445490]
movzx ecx, al
xor eax, eax
jmp dword [ecx*4 + 0x445498]
mov eax, dword [0x446450]
mov dword [esp + 8], 0x6be46df3
mov dword [esp + 0xc], 0x67f669e1
mov dword [esp + 0x10], 0x63ad65e8
mov dword [esp + 0x14], 0x5f8c61ae
mov dword [esp + 0x18], 0x5bce5dc0
mov dword [esp + 0x1c], 0x575659cc
mov dword [esp + 0x20], 0
mov dword [esp + 0x23], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x1e
ja 0x438b8a
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
lea edi, [ecx + 0x60f90292]
add ecx, 0x92
and ecx, edx
or edi, edx
sub edi, ecx
mov dword [esp + 4], edi
mov ecx, dword [esp + 4]
add cl, 2
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x1f
jb 0x438b50
push 0x800
push 0
push esi
call eax
test eax, eax
je 0x438b9d
mov dword [0x447774], eax
xor ecx, ecx
test eax, eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x4454a0]
mov al, 1
mov ecx, dword [case.0x438a51.1]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
mov ecx, dword [case.0x438a51.22]
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
mov ecx, dword [case.0x438a51.26]
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
mov edx, dword [case.0x438a51.37]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp edx
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x445500]
push ecx
call fcn.00437460
add esp, 4
mov ecx, dword [case.0x438a51.33]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret