Function at 0x439340
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov dword [esp + 8], 0xbb2cb958
mov dword [esp + 0xc], 0xbf50bd5e
mov dword [esp + 0x10], 0xa38ea152
mov dword [esp + 0x14], 0xa748a546
mov dword [esp + 0x18], 0xaba8a94a
mov dword [esp + 0x1c], 0
mov byte [esp + 0x20], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x18
ja 0x4393ca
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + 0xe7]
add eax, 0x3aecb8e7
or edx, eax
and edx, ecx
or eax, ecx
sub eax, edx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0xaf
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x19
jb case.default.0x4393e7
lea ebx, [esp + 8]
push ebx
call fcn.0043b160
add esp, 4
mov ecx, eax
mov dword [0x450aec], eax
xor edx, edx
test eax, eax
sete dl
xor eax, eax
jmp dword [edx*4 + 0x4465b0]
jmp dword [0x4465b8]
jmp 0x439ad6
mov dword [esp + 0x3c], esi
jmp dword [0x446630]
mov ecx, dword [case.0x43411f.321]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
xor esi, esi
xor eax, eax
cmp esi, 0xb
setne al
jmp dword [eax*4 + 0x446608]
mov eax, dword [case.0x43411f.252]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x4465c8]
jmp dword [0x4465e0]
push 0x2df68b61
push eax
call fcn.0043b840
add esp, 8
mov dword [0x4477bc], eax
push 0xd4ed4ea7
push dword [0x448ac8]
call fcn.0043b840
add esp, 8
mov dword [0x4478c0], eax
push 0xe174828e
push dword [0x448ac8]
call fcn.0043b840
add esp, 8
mov dword [0x448ae8], eax
call fcn.00439d40
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x2df68b61
push dword [0x448ac8]
call fcn.0043b840
add esp, 8
mov dword [0x4477bc], eax
push 0xd4ed4ea7
push dword [0x448ac8]
call fcn.0043b840
add esp, 8
mov dword [0x4478c0], eax
push 0xe174828e
push dword [0x448ac8]
call fcn.0043b840
add esp, 8
mov dword [0x448ae8], eax
call fcn.00439d40
jmp dword [0x4465e8]
movzx ecx, al
xor eax, eax
jmp dword [ecx*4 + 0x4465f0]
jmp dword [0x4465fc]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
nop
nop
nop
nop
nop
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp dword [0x446600]
xor eax, eax
jmp dword [0x4465d8]
push 0xde118a15
push dword [0x450aec]
call fcn.0043b840
add esp, 8
mov dword [0x450af4], eax
push 0x9b1cb500
push dword [0x450aec]
call fcn.0043b840
add esp, 8
mov dword [0x450af8], eax
push 0xb3a80508
push dword [0x450aec]
call fcn.0043b840
add esp, 8
mov dword [0x450afc], eax
push 0x1f488771
push dword [0x450aec]
call fcn.0043b840
add esp, 8
mov dword [0x448ad0], eax
mov dword [esp + 8], 0x7b3f793b
mov dword [esp + 0xc], 0x7f227d28
mov dword [esp + 0x10], 0x732c7139
mov dword [esp + 0x14], 0x77467547
mov dword [esp + 0x18], 0x8bcc8948
mov dword [esp + 0x1c], 0x8fd08dd6
mov word [esp + 0x20], 0x818e
mov dword [esp + 0x22], 0
mov dword [esp + 0x26], 0
mov dword [esp + 0x2a], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x25
ja 0x439ac2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx edx, byte [esp + ecx + 8]
add eax, 0x237818ef
mov ecx, eax
and ecx, edx
mov esi, eax
xor esi, edx
lea ecx, [esi + ecx*2]
mov edi, edx
not edi
or edi, eax
add edi, edx
or eax, edx
xor eax, esi
add eax, edi
inc eax
mov edx, ecx
xor edx, eax
not eax
and eax, ecx
add eax, eax
sub eax, edx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x77
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x26
jb 0x439a70
push ebx
call fcn.0043b160
add esp, 4
mov dword [0x448ac8], eax
mov ecx, dword [0x450aec]
push 0xde118a15
push ecx
call fcn.0043b840
add esp, 8
mov dword [0x450af4], eax
push 0x9b1cb500
push dword [0x450aec]
call fcn.0043b840
add esp, 8
mov dword [0x450af8], eax
push 0xb3a80508
push dword [0x450aec]
call fcn.0043b840
add esp, 8
mov dword [0x450afc], eax
push 0x1f488771
push dword [0x450aec]
call fcn.0043b840
add esp, 8
mov dword [0x448ad0], eax
mov dword [esp + 8], 0x7b3f793b
mov dword [esp + 0xc], 0x7f227d28
mov dword [esp + 0x10], 0x732c7139
mov dword [esp + 0x14], 0x77467547
mov dword [esp + 0x18], 0x8bcc8948
mov dword [esp + 0x1c], 0x8fd08dd6
mov word [esp + 0x20], 0x818e
mov dword [esp + 0x22], 0
mov dword [esp + 0x26], 0
mov dword [esp + 0x2a], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x25
ja 0x439be2
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx edx, byte [esp + ecx + 8]
add eax, 0x237818ef
mov ecx, eax
and ecx, edx
mov esi, eax
xor esi, edx
lea ecx, [esi + ecx*2]
mov edi, edx
not edi
or edi, eax
add edi, edx
or eax, edx
xor eax, esi
add eax, edi
inc eax
mov edx, ecx
xor edx, eax
not eax
and eax, ecx
add eax, eax
sub eax, edx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x77
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x26
jb 0x439b90
push ebx
call fcn.0043b160
add esp, 4
mov dword [0x448ac8], eax
jmp dword [0x4465c4]