Function at 0x4258be
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x8c
mov dword [esp], 0x69a66b8f
mov dword [esp + 4], 0x6dcb6ff9
mov dword [esp + 8], 0x51fe53cb
mov dword [esp + 0xc], 0x55c65797
mov dword [esp + 0x10], 0x599e5bc4
mov dword [esp + 0x14], 0x5dca5fff
mov dword [esp + 0x18], 0x41a943fb
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x4740
mov ecx, 0xf0408997
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 0xfbf7669]
xor edx, ecx
neg edx
mov esi, edx
and esi, 0x74
add esi, esi
xor edx, 0x4ebd500b
lea edi, [edx + 1]
neg esi
add esi, edx
inc esi
and edi, 1
and esi, 0xfe
and edx, 1
or edx, esi
lea edx, [edx + edi*2]
mov byte [esp + ecx + 0xfbf7669], dl
inc ecx
cmp ecx, 0xf04089b7
jne 0x4257e0
lea ebp, [esp + 0x6e]
mov edx, esp
mov ecx, 7
mov edi, ebp
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x8a]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0x50]
push edi
push 0
push 0
push 0xe
push ebp
push 0
call dword [0x44d058]
mov dword [esp], 0xb9fafbd1
mov word [esp + 4], 0
mov ecx, 0xab
mov edx, 0x14
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
and esi, 0x10
mov ebx, ecx
and ebx, 0x8f
or ebx, esi
xor bl, byte [esp + ecx - 0xab]
xor bl, 0x30
add bl, 0xa9
mov byte [esp + ecx - 0xab], bl
inc ecx
dec edx
cmp ecx, 0xb1
jne case.default.0x4258b7
xor ecx, ecx
cmp eax, dword [esp]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x4474e8]
mov ebx, dword [esp + 0x50]
test ebx, ebx
jns 0x4258cd
mov eax, 0xffffffff
jmp 0x4258d0
lea eax, [ebx + ebx]
push eax
call fcn.004082b0
add esp, 4
mov esi, eax
push edi
push ebx
push eax
push 0xe
push ebp
push 0
call dword [0x44d058]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4474f0]
jmp dword [0x4474f8]
push esi
call fcn.004082c0
add esp, 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor ebx, ebx
jmp dword [0x44750c]
mov eax, dword [esp + 0x50]
mov ecx, eax
and ecx, 9
xor eax, 9
lea eax, [eax + ecx*2]
test eax, eax
jns 0x425932
mov eax, 0xffffffff
jmp 0x425934
add eax, eax
push eax
call fcn.004082b0
add esp, 4
mov edi, eax
mov dword [esp], 0x2372218c
mov dword [esp + 4], 0x27852585
mov dword [esp + 8], 0x3b9b3983
mov dword [esp + 0xc], 0x3f9b3d9b
mov dword [esp + 0x10], 0x33323183
mov word [esp + 0x14], 0
mov byte [esp + 0x16], 0
xor eax, eax
mov cl, 0xf7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax]
xor dl, cl
mov ch, 0xd7
sub ch, dl
mov byte [esp + eax], ch
inc eax
dec cl
cmp eax, 0x17
jne 0x425980
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x4259c1
lea edx, [esi + 2]
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4259b0
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x4259f1
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x4259e0
mov word [eax], 0
lea eax, [esp + 0x68]
push eax
push edi
call fcn.00440610
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x447510]
mov eax, dword [esp + 0x68]
mov ecx, eax
xor ecx, 0xffffffef
or eax, 0x10
xor edx, edx
test eax, ecx
setne dl
jmp dword [edx*4 + 0x447518]
mov eax, dword [esp + 0x50]
mov ecx, eax
add ecx, 0x25
jns 0x425a3c
mov eax, 0xffffffff
jmp 0x425a43
lea eax, [eax*2 + 0x4a]
push eax
call fcn.004082b0
add esp, 4
mov ebp, eax
mov dword [esp], 0x29f92bf8
mov dword [esp + 4], 0x2d8b2f87
mov dword [esp + 8], 0x3183339a
mov dword [esp + 0xc], 0x35873785
mov dword [esp + 0x10], 0x398e3b9e
mov dword [esp + 0x14], 0x3de73fe4
mov dword [esp + 0x18], 0x1b00393
mov dword [esp + 0x1c], 0x5b707a4
mov dword [esp + 0x20], 0x9bf0bbd
mov dword [esp + 0x24], 0xddd0fe8
mov dword [esp + 0x28], 0x11bd13ab
mov dword [esp + 0x2c], 0x15ca17bc
mov dword [esp + 0x30], 0x19ab1bd8
mov dword [esp + 0x34], 0x1db91fbd
mov dword [esp + 0x38], 0xe102e3b0
mov dword [esp + 0x3c], 0xe557e72a
mov dword [esp + 0x40], 0xe94eeb48
mov dword [esp + 0x44], 0xed58ef43
mov dword [esp + 0x48], 0xf1f2f359
mov word [esp + 0x4c], 0
mov eax, 0xc7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0xc7]
mov edx, eax
and edx, ecx
lea ebx, [eax - 0x73107e00]
or ebx, ecx
sub ebx, edx
mov ecx, ebx
and ecx, 1
xor ebx, 1
lea ecx, [ebx + ecx*2]
add cl, 0x1c
mov byte [esp + eax - 0xc7], cl
inc eax
cmp eax, 0x115
jne 0x425b00
movzx ecx, word [esi]
mov eax, ebp
test cx, cx
je 0x425b61
mov edx, esi
add edx, 2
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425b50
mov word [eax], 0
movzx ecx, word [esp]
test cx, cx
je 0x425b91
lea edx, [esp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425b80
mov word [eax], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea eax, [esp + 0x64]
push eax
push ebp
call fcn.00440610
add esp, 8
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x447520]
mov eax, dword [esp + 0x64]
shr eax, 2
and eax, 4
xor ebx, ebx
jmp dword [eax + 0x447528]
mov dword [esp + 0x54], 0xb764895e
mov dword [esp + 0x58], 0xb327b559
mov dword [esp + 0x5c], 0xbfbeb124
mov byte [esp + 0x60], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + ebx + 0x54]
lea ecx, [ebx + 0x4c351de]
mov edx, 0x21
sub edx, ebx
xor edx, ecx
and edx, eax
xor edx, ecx
add edx, 0xe82f66a9
mov eax, edx
and eax, 1
xor edx, 1
lea eax, [edx + eax*2]
mov byte [esp + ebx + 0x54], al
add ebx, 0x75feea4c
mov eax, ebx
and eax, 0x15
or ebx, 0x8a0115b5
add ebx, eax
cmp ebx, 0xd
jb 0x425bf0
mov dword [esp], 0x8f2f8955
mov dword [esp + 4], 0x833e8d35
mov dword [esp + 8], 0x87758137
mov dword [esp + 0xc], 0x9b23852f
mov dword [esp + 0x10], 0x9f3a992a
mov dword [esp + 0x14], 0x93199d2f
mov dword [esp + 0x18], 0x97769127
mov dword [esp + 0x1c], 0x6bcb9549
mov dword [esp + 0x20], 0x6fd269d1
mov dword [esp + 0x24], 0x63a36d8c
mov dword [esp + 0x28], 0x67d261dc
mov dword [esp + 0x2c], 0x7bcc65c1
mov dword [esp + 0x30], 0x7fdf79ca
mov dword [esp + 0x34], 0x73cb7dc8
mov dword [esp + 0x38], 0x77d371fa
mov word [esp + 0x3c], 0x7574
mov dword [esp + 0x3e], 0
mov byte [esp + 0x42], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xe2
xor cl, byte [esp + eax]
add cl, 0x96
mov byte [esp + eax], cl
inc eax
cmp eax, 0x43
jne 0x425cd0
lea eax, [esp + 0x54]
push 0
push 4
push 0xc00000
push eax
push ebp
lea eax, [esp + 0x14]
push eax
push dword [esp + 0xb8]
call fcn.00423910
add esp, 0x1c
mov ebx, eax
mov eax, dword [case.0x4258b7.19]
nop
nop
jmp eax
jmp dword [0x447540]
push ebp
call fcn.004082c0
add esp, 4
jmp dword [0x447548]
jmp dword [0x447550]
push esi
call fcn.004082c0
add esp, 4
mov eax, ebx
add esp, 0x8c
pop esi
pop edi
pop ebx
pop ebp
ret
jmp dword [0x447548]
push edi
call fcn.004082c0
add esp, 4
jmp dword [0x447550]
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], edi
mov dword [esp], 0x137b1185
mov dword [esp + 4], 0x1f8c1d7f
mov dword [esp + 8], 0x1b89198f
mov dword [esp + 0xc], 0x7680593
mov dword [esp + 0x10], 0x354019c
mov dword [esp + 0x14], 0xf670d93
mov dword [esp + 0x18], 0xb66099e
mov dword [esp + 0x1c], 0x37a935a3
mov dword [esp + 0x20], 0x335131a3
mov dword [esp + 0x24], 0x3fab3dab
mov dword [esp + 0x28], 0x3ba739ad
mov dword [esp + 0x2c], 0x274f25b2
mov dword [esp + 0x30], 0x23432143
mov dword [esp + 0x34], 0x2f472db0
mov dword [esp + 0x38], 0x2bbc29bf
mov dword [esp + 0x3c], 0x573755c7
mov dword [esp + 0x40], 0x53c251c0
mov dword [esp + 0x44], 0x5f745dcf
mov word [esp + 0x48], 0x5958
mov dword [esp + 0x4a], 0
mov eax, 0xab45cefc
mov ecx, 0x54ba3104
nop
movzx ebx, byte [esp + ecx - 0x54ba3104]
mov edx, ecx
or edx, 0x95fabc6e
mov ebp, ecx
and ebp, 0x40000191
add edx, eax
or edx, ebp
xor edx, ebx
xor edx, 0x95fabc6e
lea ebx, [edx + 0x585d0aeb]
mov ebp, ebx
xor ebp, 0x7e
or ebx, 1
and ebx, ebp
lea ebp, [edx*2 - 0x4f45ea2a]
and ebp, 2
sub edx, ebp
lea edx, [edx + ebx*2]
add dl, 0xec
mov byte [esp + ecx - 0x54ba3104], dl
dec eax
inc ecx
cmp eax, 0xab45ceae
jne 0x425e10
lea eax, [esp + 0x54]
push eax
push 0x427af0
lea eax, [esp + 8]
push eax
push edi
call fcn.00423d70
add esp, 0x10
mov ebx, eax
jmp dword [0x447548]
mov dword [esi], 0xff16f90c
mov dword [esi + 4], 0xe370fd69
mov dword [esi + 8], 0xe703e104
mov dword [esi + 0xc], 0xeb0ce572
mov dword [esi + 0x10], 0xef78e901
mov dword [esi + 0x14], 0x9392ed08
mov word [esi + 0x18], 0
mov byte [esi + 0x1a], 0
mov edx, 0x884e292a
nop
nop
movzx edi, byte [esi + edx + 0x77b1d6d6]
mov ebx, edi
and ebx, edx
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0x7d
mul cl
mov ecx, eax
mov eax, edi
add cl, al
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, edx
add al, 0x2e
mov byte [esi + edx + 0x77b1d6d6], al
inc edx
cmp edx, 0x884e2945
jne 0x426060
push 0
push 0
push esi
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.00421790
add esp, 0x14
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
mov eax, dword [case.0x4258b7.29]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
push dword [ebp - 0x10]
call fcn.004082c0
add esp, 4
pop eax
inc edx
add byte [esi], dh
pop ebp
inc edx
add ch, dh
pop eax
inc edx
add byte [eax], bl
pop ecx
inc edx
add bl, bh
pop eax
inc edx
add byte [eax], dl
pop ecx
inc edx
add byte [eax], dl
pop ecx
inc edx
add byte [eax], dl
pop ecx
inc edx
add byte [eax], dl
pop ecx
inc edx
add byte [esi], dh
pop ebp
inc edx
add byte [edx], ch
pop edx
inc edx
add byte [eax], dl
pop edx
inc edx
add byte [edx], ch
pop edx
inc edx
add byte [eax + 0x5d], bl
inc edx
add byte [ecx], cl
pop ebp
inc edx
add byte [eax + 0x900425b], bh
pop ebp
inc edx
add dl, cl
pop ebx
inc edx
add byte [eax], dl
pop ebp
inc edx
add byte [eax], dl
pop ebp
inc edx
add byte [edx], dl
pop ebp
inc edx
add byte [eax], dl
pop ebp
inc edx
add byte [eax], bl
pop ebp
inc edx
add byte [ebx + 0x5d], al
inc edx
add byte [ecx + 0x5d], cl
inc edx
add byte [edi], ah
pop ebp
inc edx
add byte [0x3600425d], ch
pop ebp
inc edx
add al, ah
pop edi
inc edx
add byte [ebx + 0x72004261], al
popal
inc edx
add byte [eax], ah
pushal
inc edx
add al, al
pushal
inc edx
add byte [esi], ah
pushal
inc edx
add al, al
pushal
inc edx
add byte [esi + 0x61], bl
inc edx
add byte [eax + 0x61], dh
inc edx
add byte [eax + 0x61], dh
inc edx
add byte [eax + 0x61], dh
inc edx
add byte [edx + 0x61], dh
inc edx
add byte [eax + 0x61], bh
inc edx
add byte [ebx + 0x7b004261], al
bound eax, qword [edx]
test eax, 0xa9004262
bound eax, qword [edx]
mov al, 0x62
inc edx
add byte [edx], ah
js 0x4475e5
add cl, ah
bound eax, qword [edx]
fidivr word [edx + 0x42]
add byte [ebx], bh
js 0x4475f1
add byte [eax + 0x77], dl
inc edx
add byte [edx - 0x75ffbd89], cl
ja 0x4475fd
add al, al
ja 0x447601
add byte [edx], al
js 0x447605
add ah, cl
ja 0x447609
add cl, dh
ja 0x44760d
add al, dh
bound eax, qword [edx]
adc byte [edi + 0x42], ch
add dh, dl
outsd dx, dword [esi]
inc edx
add al, al
outsd dx, dword [esi]
inc edx
add bl, dh
jo 0x447621
add byte [ebx], ah
jno 0x447625
add byte [eax + 0x71], dl
inc edx
jno 0x447629
add byte [eax - 0x3cffbd8b], ah
jno 0x447631
add cl, ah
jno 0x447635
add al, dh
jno 0x447639
add dh, cl
jb 0x44763d
add byte [eax - 0x7fffbd8d], dh
jae 0x447641
add byte [eax - 0x20ffbd8f], al
jno 0x447645
add bh, bl
jb 0x447649
add byte [esp + esi*2], ah
inc edx
je 0x44764d
add byte [0xe0004274], ch
je 0x447651
add al, ah
jne 0x447655
add byte [esi - 0x79ffbd8a], al
jbe 0x44765d
inc edx
add byte [esi - 0x2fffbd8a], al
add al, dl
jo 0x447661
add byte [eax], al
js 0x447665
add byte [eax], al
js 0x447669
add byte [edx], al
js 0x44766d
add byte [eax], al
js 0x447671
add byte [eax], cl
js 0x447675
add al, dl
bound eax, qword [edx]
sar dword [edx + 0x42], 1
jp 0x44767d
add dh, bl
jp 0x447681
add byte [eax + 0x4c00427e], dl
jle 0x447685
add byte [esi + edi*2 + 0x42], cl
jle 0x447689
add byte [edi - 0x68ffbd82], dl
jle 0x44768d
add byte [edi - 0x7fffbd82], dl
jle 0x447691
add byte [eax + 0x48004280], al
add byte [edx], 0x48
add byte [edx], 0x63
xchg dword [edx], eax
mov al, byte [0x63004280]
add byte [edx], 0x63
xchg dword [edx], eax
add byte [ecx - 0x7e2effbe], al
inc edx
add byte [eax], dh
add dword [edx], case.0x4258b7.95
xor byte [edx - 0x7d9fffbe], al
inc edx
add byte [edi], ah
add dword [edx], case.0x4258b7.96
pushal
add byte [edx], 0x60
add byte [edx], 0x27
add dword [edx], 0x25
add dword [edx], 0x55
add byte [edx], 0x25
add byte [edx], 0x26
test byte [edx], al
pop ecx
test byte [edx], al
rol byte [ecx - 0x7e3fffbe], 0x42
add byte [esi - 128], dh
add dword [edx], case.0x42831e.2
jbe 0x447616
add dword [edx], case.0x4258b7.106
rol byte [edx + eax*2 + 0x4284b100], 1
inc edx
add al, dl
test byte [edx], al
mov cl, 0x84
inc edx
add al, dl
test byte [edx], al
add byte [eax - 0x789cffbe], 0x42
add byte [eax - 1879031170], al
jle 0x4476f5
add byte [esi + edi*2 + 0x42], cl
add byte [eax + 0x7e], ah
inc edx
add byte [eax], bl
xchg dword [edx], eax
and eax, 0x30004287
xchg dword [edx], eax
xor al, byte [edi - 0x78cdffbe]
inc edx
add byte [ebp - 0x79], al
inc edx
add byte [edi + eax*4 + 0x42], dl
add byte [eax - 0x7c], dl
inc edx
add byte [eax], dh
xchg dword [edx], eax
cmp al, 0x87
inc edx
add byte [ebp - 0x73], ch
inc edx
add byte [ecx - 0x73], dl
inc edx
add byte [ebp - 0x73], ch
inc edx
add byte [ebx - 0x73], dh
inc edx
add byte [edx + 0x66004292], ch
mov es, word [edx]
xchg edi, eax
xchg ebx, eax
inc edx
add byte [ebp - 0xeffbd72], dh
xchg edx, eax
inc edx
add byte [esi - 0x72], ah
inc edx
add byte [edi - 0x4affbd6d], dl
mov es, word [edx]
int1
mov es, word [edx]
push eax
pop dword [edx]
cmp byte [edi - 0x70c7ffbe], cl
inc edx
add byte [ebp - 0x71], bl
inc edx
add byte [edi - 0x5fffbd71], bl
pop dword [edx]
iretd