Function at 0x423abc
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7b4
mov eax, 0x4ca498
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
call fcn.0049fef4
push 0x400
push 0
lea edx, [ebp - 0x444]
push edx
call fcn.0049fac0
add esp, 0xc
lea ecx, [ebp - 0x844]
push 0x400
push 0
push ecx
call fcn.0049fac0
add esp, 0xc
mov eax, dword [ebp - 0x3c]
shl eax, 3
mov edx, edi
shl edx, 2
add eax, edx
mov dword [ebp - 0x848], eax
fild dword [ebp - 0x848]
mov dword [ebp - 0x84c], ebx
fild dword [ebp - 0x84c]
fmul qword [0x423df4]
faddp st(1)
call fcn.004a6bd0
mov dword [ebp - 0x38], eax
shl edi, 3
mov edx, dword [ebp - 0x40]
shl edx, 2
add edi, edx
lea eax, [ebx + ebx*2]
add edi, eax
mov dword [ebp - 0x3c], edi
mov edi, dword [ebp - 0x40]
shl edi, 3
mov edx, dword [ebp - 0x44]
shl edx, 2
add edi, edx
add edi, eax
mov ecx, dword [ebp - 0x44]
shl ecx, 3
mov edx, ebx
shl edx, 2
add ecx, edx
add ecx, eax
mov dword [ebp - 0x40], ecx
mov ecx, ebx
shl ecx, 3
mov edx, dword [ebp - 0x3c]
shl edx, 2
add ecx, edx
add ecx, eax
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x38]
shl ecx, 3
mov edx, edi
shl edx, 2
add ecx, edx
add ecx, eax
mov ebx, ecx
mov dword [esi + 0x1d78], 0xffffffff
cmp byte [esi + 0x655], 1
jne 0x423ca3
lea eax, [ebp - 0x444]
push eax
push esi
call fcn.00429f1c
add esp, 8
cmp eax, 0xffffffff
jne 0x423c0e
mov word [ebp - 0x20], 8
mov edx, 0x4c6039
lea eax, [ebp - 4]
call fcn.004adb50
inc dword [ebp - 0x14]
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.004adc7c
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebp - 0x20], 0x14
push eax
lea eax, [ebp - 4]
dec dword [ebp - 0x14]
call fcn.004adc4c
pop eax
mov word [ebp - 0x20], 8
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x423dea
cmp eax, 0xfffffffe
jne 0x423c67
mov word [ebp - 0x20], 0x20
mov edx, 0x4c603a
lea eax, [ebp - 8]
call fcn.004adb50
inc dword [ebp - 0x14]
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
call fcn.004adc7c
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebp - 0x20], 0x2c
push eax
lea eax, [ebp - 8]
dec dword [ebp - 0x14]
call fcn.004adc4c
pop eax
mov word [ebp - 0x20], 0x20
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x423dea
test eax, eax
jne 0x423c74
mov byte [esi + 0x655], 0
jmp 0x423ca3
xor ebx, ebx
lea ecx, [ebp - 0x444]
movsx edi, byte [ecx]
mov eax, edi
mov edi, 9
xor eax, ebx
inc ebx
cdq
idiv edi
mov eax, edx
add eax, 0x30
mov byte [ecx], al
inc ecx
mov dword [esi + 0x1d78], 0x64
cmp ebx, 0x14
jl 0x423c7c
cmp byte [esi + 0x655], 0
jne 0x423d88
lea edx, [ebp - 0x844]
push 0x400
push edx
push 0
lea ecx, [ebp - 0x34]
push 0
push ecx
lea eax, [ebp - 0x444]
push 0x400
push eax
push 0x4c603b
call sub.KERNEL32.DLL_GetVolumeInformationA
mov dword [esi + 0x1d78], 0x64
mov eax, dword [ebp - 0x34]
xor edx, edx
mov ecx, 0x2c
div ecx
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x444]
shr eax, 1
add edx, eax
add edx, 0xbc5446
mov dword [ebp - 0x34], edx
mov edx, dword [ebp - 0x34]
push edx
push 0x4c603f
push ecx
call fcn.004a3230
add esp, 0xc
lea eax, [ebp - 0x444]
push eax
call fcn.0049fbf4
pop ecx
cmp eax, 3
jl 0x423d42
mov dl, byte [ebp - 0x442]
mov cl, byte [ebp - 0x444]
mov byte [ebp - 0x442], cl
mov byte [ebp - 0x444], dl
mov ebx, eax
lea ecx, [ebp + ebx - 0x444]
cmp ebx, 0x11
jge 0x423d6c
mov eax, dword [ebp - 0x34]
xor edx, edx
div ebx
xor edx, edx
mov esi, 0xa
div esi
add dl, 0x30
inc ebx
mov byte [ecx], dl
inc ecx
cmp ebx, 0x11
jl 0x423d50
mov byte [ebp - 0x433], 0x39
mov byte [ebp - 0x432], 0x39
mov byte [ebp - 0x431], 0x39
mov byte [ebp - 0x430], 0
movsx eax, byte [ebp - 0x444]
cmp eax, 0x30
jne 0x423d9b
mov byte [ebp - 0x444], 0x39
mov word [ebp - 0x20], 0x38
lea edx, [ebp - 0x444]
lea eax, [ebp - 0xc]
call fcn.004adb50
mov edx, eax
inc dword [ebp - 0x14]
mov eax, dword [ebp + 8]
call fcn.004adc7c
mov eax, dword [ebp + 8]
mov edx, 2
mov word [ebp - 0x20], 0x44
push eax
lea eax, [ebp - 0xc]
dec dword [ebp - 0x14]
call fcn.004adc4c
pop eax
mov word [ebp - 0x20], 0x38
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret