Function at 0x433c50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov dword [esp + 8], 0x7b0c7918
mov dword [esp + 0xc], 0x7f007d1e
mov dword [esp + 0x10], 0x734e7102
mov dword [esp + 0x14], 0x77087516
mov dword [esp + 0x18], 0x8b88890a
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x1f
ja 0x433cfd
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx edx, byte [esp + ecx + 8]
lea esi, [eax + 0x158817ef]
and esi, edx
lea ecx, [eax + edx]
add ecx, 0x158817ef
add eax, 0xef
and eax, edx
add eax, esi
mov edx, ecx
not edx
and edx, eax
not eax
and eax, ecx
sub eax, edx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x77
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x20
jb 0x433cb0
lea edi, [esp + 8]
push edi
call fcn.004355f0
add esp, 4
mov dword [0x449d84], eax
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x43faec]
push 0xde118a15
push eax
call fcn.00435d20
add esp, 8
mov dword [0x449d8c], eax
push 0x9b1cb500
push dword [0x449d84]
call fcn.00435d20
add esp, 8
mov dword [0x449d90], eax
push 0xb3a80508
push dword [0x449d84]
call fcn.00435d20
add esp, 8
mov dword [0x449d94], eax
push 0x1f488771
push dword [0x449d84]
call fcn.00435d20
add esp, 8
mov dword [0x441d68], eax
mov dword [esp + 8], 0x531f5103
mov dword [esp + 0xc], 0x5f0a5d00
mov dword [esp + 0x10], 0x5b0c5911
mov dword [esp + 0x14], 0xa7d6a527
mov dword [esp + 0x18], 0xa3eca1d0
mov dword [esp + 0x1c], 0xaff8adf6
mov word [esp + 0x20], 0xa9ae
mov dword [esp + 0x22], 0
mov dword [esp + 0x26], 0
mov dword [esp + 0x2a], 0
mov word [esp + 0x2e], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x27
ja 0x433e3a
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx edx, byte [esp + ecx + 8]
lea esi, [eax + 0x31e03573]
lea ecx, [eax + edx]
add ecx, 0x31e03573
and esi, edx
add eax, 0x73
and eax, edx
add eax, esi
mov edx, eax
xor edx, ecx
not eax
and eax, ecx
add eax, eax
sub eax, edx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov ecx, eax
or ecx, 0xda
and eax, 0xda
add eax, ecx
inc al
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x28
jb 0x433de0
push edi
call fcn.004355f0
add esp, 4
mov dword [0x441d60], eax
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x43fb04]
push 0x2df68b61
push eax
call fcn.00435d20
add esp, 8
mov dword [0x440a54], eax
push 0xd4ed4ea7
push dword [0x441d60]
call fcn.00435d20
add esp, 8
mov dword [0x440b58], eax
push 0xe174828e
push dword [0x441d60]
call fcn.00435d20
add esp, 8
mov dword [0x441d80], eax
call fcn.00434430
movzx eax, al
jmp dword [eax*4 + 0x43fb1c]
mov ecx, dword [case.0x433e4f.4]
xor eax, eax
jmp ecx
xor eax, eax
jmp dword [0x43fb14]
mov ecx, dword [case.0x433e4f.4]
xor eax, eax
jmp ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor esi, esi
xor eax, eax
cmp esi, 0xb
setne al
mov ecx, 1
jmp dword [eax*4 + 0x43fb34]
mov dword [esp + 0x34], esi
mov eax, dword [esi*4 + 0x439e0c]
mov dword [esp + 0x3c], eax
mov dword [esp + 8], 0xb141546
lea eax, [esp + 0xc]
mov byte [eax + 4], 0
mov dword [eax], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 8
ja 0x433f77
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + 0x2d]
and edx, ecx
add eax, ecx
add edx, edx
sub eax, edx
add eax, 0x9586732d
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0xc5
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 9
jb 0x433f40
mov eax, dword [esp + 8]
mov esi, dword fs:[eax]
mov ebx, dword [esi + 0xc]
add ebx, 0xc
mov dword [esp + 0x38], esi
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, dword [ebx]
mov eax, dword [case.0x433e4f.16]
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
mov eax, dword [esi + 0xc]
add eax, 0xc
xor ecx, ecx
cmp ebx, eax
setne cl
jmp dword [ecx*4 + 0x43fb4c]
jmp dword [0x43fb68]
mov eax, dword [ebx + 0x30]
jmp dword [0x43fb70]
mov eax, dword [ebx + 0x30]
jmp dword [0x43fb70]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x43fb74]
xor eax, eax
movzx eax, al
jmp dword [eax*4 + 0x43fb7c]
mov eax, 1
xor ecx, ecx
jmp 0x434115
mov dword [esp + 8], 0x8b3b2c59
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xb
ja 0x43406e
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov eax, dword [esp]
movzx edx, byte [esp + eax + 8]
lea eax, [ecx + 0xe2]
and eax, edx
mov esi, 0x74b2661d
sub esi, ecx
or esi, edx
not esi
add esi, edx
sub esi, eax
mov dword [esp + 4], esi
mov eax, dword [esp + 4]
add al, 0xd2
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xc
jb 0x434030
mov eax, dword [esp + 8]
mov esi, dword [ebx + 0x30]
mov ecx, 0xfffffffe
nop
nop
nop
nop
nop
nop
cmp word [esi + ecx + 2], 0
lea ecx, [ecx + 2]
jne 0x434080
test ecx, ecx
je 0x4340fa
sar ecx, 1
lea edx, [ecx - 1]
mov edi, ecx
and edi, 3
mov dword [esp + 0x40], edx
je 0x4340b2
nop
dec ecx
movzx edx, word [esi]
add esi, 2
xor edx, eax
imul eax, edx, 0x1000193
dec edi
jne 0x4340a0
cmp dword [esp + 0x40], 3
jb 0x4340fa
xor edx, edx
nop
nop
nop
nop
nop
movzx edi, word [esi + edx*2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [esi + edx*2 + 2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [esi + edx*2 + 4]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [esi + edx*2 + 6]
xor edi, eax
imul eax, edi, 0x1000193
add edx, 4
cmp ecx, edx
jne 0x4340c0
xor ecx, ecx
cmp eax, dword [esp + 0x3c]
sete cl
mov esi, dword [esp + 0x38]
jmp dword [ecx*4 + 0x43fb7c]
xor eax, eax
mov ecx, 1
mov edx, dword [case.0x433e4f.34]
nop
nop
nop
nop
nop
jmp edx
jmp dword [ecx*4 + 0x43fb94]
jmp 0x433f90
mov ecx, dword [case.0x433e4f.22]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 4
jmp ecx
xor ecx, ecx
cmp eax, 4
sete cl
jmp dword [ecx*4 + 0x43fb9c]
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x43fba4]
xor eax, eax
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x43fba4]
xor eax, eax
jmp dword [ecx*4 + 0x43fbe4]