Function at 0x10004c20
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2024
call fcn.1000cab0
mov eax, dword [0x10012040]
xor eax, esp
mov dword [esp + 0x2020], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [esp + 0xc], edx
mov al, byte [edi]
cmp al, 0xc3
jne 0x10004c7e
mov byte [edi], 0xc1
mov al, 0xc1
mov cl, byte [edi + 2]
cmp cl, 0xf4
jne 0x10004c99
push dword [esi]
push edi
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2020]
xor ecx, esp
call fcn.1000b9ff
mov esp, ebp
pop ebp
ret
cmp al, 0xc4
jne 0x10004c8c
mov cl, byte [edi + 3]
mov al, 0xc2
mov byte [edi], 0xc2
jmp 0x10004c58
cmp al, 0xc1
je 0x10004c55
cmp al, 0xc2
jne 0x10004c99
mov cl, byte [edi + 3]
jmp 0x10004c58
cmp al, 0xc1
je 0x10004cba
cmp al, 0xc3
je 0x10004cba
cmp al, 0xc2
je 0x10004ca9
cmp al, 0xc4
jne 0x10004cc0
movzx ecx, byte [edi + 1]
shl ecx, 8
mov dword [esi], ecx
movzx eax, byte [edi + 2]
or eax, ecx
jmp 0x10004cbe
movzx eax, byte [edi + 1]
mov dword [esi], eax
push dword [esi]
lea eax, [esp + 0x2c]
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
mov bl, byte [esp + 0x34]
add esp, 0xc
cmp bl, 0xc1
je 0x10004cf3
cmp bl, 0xc3
je 0x10004cf3
cmp bl, 0xc2
je 0x10004cec
cmp bl, 0xc4
je 0x10004cec
xor edi, edi
jmp 0x10004cf8
mov edi, 3
jmp 0x10004cf8
mov edi, 2
lea ecx, [esp + 0x28]
call fcn.10009370
movzx eax, ax
cmp bl, 0xc1
je 0x10004d24
cmp bl, 0xc3
je 0x10004d24
cmp bl, 0xc2
je 0x10004d1e
cmp bl, 0xc4
je 0x10004d1e
lea ebx, [esp + 0x28]
jmp 0x10004d28
lea ebx, [esp + 0x2b]
jmp 0x10004d28
lea ebx, [esp + 0x2a]
dec eax
movzx edx, ax
test dx, dx
je 0x10004d5f
lea ecx, [ebx + edx]
sub edi, ebx
nop word [eax + eax]
lea eax, [edi + ecx]
add edx, 0xffff
and eax, 0x1f
lea ecx, [ecx - 1]
mov al, byte [eax + 0x1000e76c]
xor al, byte [ecx]
xor byte [ecx + 1], al
test dx, dx
jne 0x10004d40
push dword [esi]
lea eax, [esp + 0x2c]
push eax
push eax
call sub.VCRUNTIME140.dll_memcpy
mov al, byte [esp + 0x34]
add esp, 0xc
mov cl, byte [esp + 0x2b]
cmp al, 0xc1
je 0x10004d90
cmp al, 0xc3
je 0x10004d90
cmp al, 0xc2
je 0x10004d8c
cmp al, 0xc4
je 0x10004d8c
or dl, 0xff
jmp 0x10004d94
mov dl, cl
jmp 0x10004d94
mov dl, byte [esp + 0x2a]
cmp al, 0xc1
je 0x10004dad
cmp al, 0xc3
je 0x10004dad
cmp al, 0xc2
je 0x10004da9
cmp al, 0xc4
je 0x10004da9
or cl, 0xff
jmp 0x10004dad
mov cl, byte [esp + 0x2c]
movzx eax, dl
add eax, 0xffffffe7
cmp eax, 0xda
ja case.0x10004dc5.26
movzx eax, byte [eax + 0x10005118]
jmp dword [eax*4 + 0x10005100]
movzx eax, cl
sub eax, 1
jne case.0x10004dc5.26
mov word [esp + 0x74], ax
xorps xmm0, xmm0
lea eax, [esp + 0x18]
mov byte [esp + 0x29], 0x52
push eax
movups xmmword [esp + 0x68], xmm0
call dword [sym.imp.RPCRT4.dll_UuidCreateSequential]
movzx eax, byte [esp + 0x27]
push eax
movzx eax, byte [esp + 0x2a]
push eax
movzx eax, byte [esp + 0x2d]
push eax
movzx eax, byte [esp + 0x30]
push eax
movzx eax, byte [esp + 0x33]
push eax
movzx eax, byte [esp + 0x36]
push eax
lea eax, [esp + 0x7c]
push str._02X:_02X:_02X:_02X:_02X:_02X
push eax
call fcn.10004a30
add esp, 0x20
mov dword [esp + 0x14], 0
lea eax, [esp + 0x14]
push 0xff
push 0
push 0
push 0
push eax
push 0xff
push 0
push 0x1000ea44
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x10004e5d
mov eax, dword [esp + 0x14]
movups xmm0, xmmword [0x10013d68]
mov dword [esp + 0x76], eax
mov ecx, 0x10013340
lea eax, [esp + 0x36]
push eax
lea eax, [esp + 0x30]
push eax
movups xmmword [esp + 0x5b], xmm0
call fcn.1000b2f0
mov dword [esi], 0x52
jmp case.0x10004dc5.26
cmp cl, 3
jne case.0x10004dc5.26
mov ax, word [esp + 0x34]
movq xmm0, qword [esp + 0x2c]
mov word [0x1001336c], ax
mov al, byte [esp + 0x36]
movq qword [0x10013364], xmm0
mov byte [0x1001336f], al
jmp case.0x10004dc5.26
movzx eax, cl
sub eax, 1
jne case.0x10004dc5.26
mov dword [esp + 0x34], eax
xorps xmm0, xmm0
mov dword [esp + 0x40], eax
mov eax, dword [0x10013374]
mov dword [esp + 0x44], eax
mov eax, dword [0x10013378]
mov dword [esp + 0x48], eax
mov eax, dword [0x1001337c]
mov dword [esp + 0x4c], eax
mov eax, dword [0x10013380]
mov dword [esp + 0x50], eax
mov al, byte [0x10013344]
xor al, 0xfc
movq qword [esp + 0x2c], xmm0
mov byte [esp + 0x2c], al
mov al, byte [0x10013345]
xor al, 0xcf
movq qword [esp + 0x38], xmm0
mov byte [esp + 0x2d], al
mov al, byte [0x10013346]
xor al, 0xab
mov byte [esp + 0x29], 0x45
mov byte [esp + 0x2e], al
mov al, byte [0x10013347]
xor al, 0xfc
mov byte [esp + 0x2f], al
mov al, byte [0x10013348]
movups xmm0, xmmword [0x10013d68]
xor al, 0xcf
mov byte [esp + 0x30], al
mov al, byte [0x10013349]
xor al, 0xab
mov byte [esp + 0x31], al
mov al, byte [0x1001334a]
xor al, 0xfc
mov byte [esp + 0x32], al
mov al, byte [0x1001334b]
xor al, 0xcf
mov byte [esp + 0x33], al
mov al, byte [0x1001334c]
xor al, 0xab
mov byte [esp + 0x34], al
mov al, byte [0x1001334d]
xor al, 0xfc
movups xmmword [esp + 0x5d], xmm0
mov byte [esp + 0x35], al
movq xmm0, qword [0x10013364]
mov ax, word [0x1001336c]
movq qword [esp + 0x38], xmm0
mov word [esp + 0x40], ax
mov dword [esi], 0x45
jmp case.0x10004dc5.26
call fcn.10005bd0
test al, al
je case.0x10004dc5.26
mov dword [esi], 0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2020]
xor ecx, esp
call fcn.1000b9ff
mov esp, ebp
pop ebp
ret
call fcn.10005bd0
test al, al
jne 0x10004fac
cmp byte [0x100120d4], al
je 0x10005007
push 1
push 4
mov ecx, 0x100120c8
call fcn.10001540
test al, al
jne 0x10005007
mov edx, 5
mov dword [esp + 0xc], 0xccf305c1
lea ecx, [esp + 0xc]
mov byte [esp + 0x10], 1
call fcn.1000a760
jmp 0x10004fac
call fcn.10005f30
mov ecx, dword [esi]
mov dword [esp + ecx + 0x28], eax
lea eax, [ecx + 4]
add byte [esp + 0x29], 4
mov dword [esi], eax
lea ecx, [esp + 0x28]
call fcn.100092b0
cmp dword [esp + 0xc], 0
je 0x10004fac
cmp dword [esi], 3
jb 0x10004fac
mov ebx, dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
nop dword [eax + eax]
call ebx
mov edi, eax
and edi, 0x80000007
jns 0x10005051
dec edi
or edi, 0xfffffff8
inc edi
call ebx
mov edx, eax
and edx, 0x80000007
jns 0x10005062
dec edx
or edx, 0xfffffff8
inc edx
cmp dword [0x100120c4], edi
je 0x10005040
cmp dword [0x100120c0], edx
je 0x10005040
mov ebx, dword [esp + 0xc]
mov al, byte [edi + 0x1000e7d8]
mov dword [0x100120c4], edi
mov dword [0x100120c0], edx
mov byte [ebx], al
mov al, byte [edx + 0x1000e7d0]
mov byte [ebx + 1], al
mov cl, byte [0x10015e8c]
mov al, cl
inc al
mov byte [0x10015e8c], al
lea eax, [edi*8]
sub cl, byte [eax + edx + 0x1000e790]
xor edi, edi
mov dword [esp + 0xc], eax
mov byte [ebx + 2], cl
mov eax, dword [esi]
test eax, eax
je 0x100050e4
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov dl, byte [edx + eax + 0x1000e790]
nop dword [eax]
mov al, byte [esp + ecx + 0x28]
inc edi
sub al, dl
mov byte [ecx + ebx + 3], al
mov eax, dword [esi]
movzx ecx, di
cmp ecx, eax
jb 0x100050d0
mov ecx, dword [esp + 0x202c]
add eax, 3
pop edi
mov dword [esi], eax
pop esi
pop ebx
xor ecx, esp
call fcn.1000b9ff
mov esp, ebp
pop ebp
ret