Function at 0x425ce0
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x90
mov dword [esp + 4], 0x6132675b
mov dword [esp + 8], 0x7d1f6311
mov dword [esp + 0xc], 0x790a7f1f
mov dword [esp + 0x10], 0x750a7b3b
mov dword [esp + 0x14], 0x712a7704
mov dword [esp + 0x18], 0x8dfe7313
mov dword [esp + 0x1c], 0x89b18fef
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x8b88
mov byte [esp + 0x24], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ecx + 4]
lea esi, [ecx - 0x27d48917]
xor esi, edx
mov edx, esi
or edx, 0x72
add edx, esi
not esi
or esi, 0x72
add edx, esi
add dl, 2
mov byte [esp + ecx + 4], dl
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
cmp ecx, 0x21
jb 0x425d40
lea ebp, [esp + 0x72]
lea edx, [esp + 4]
mov ecx, 7
mov edi, ebp
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x8e]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, esp
push eax
push 0
push 0
push 0xe
push ebp
push 0
call dword [0x44cd1c]
mov dword [esp + 4], 0x89cacb11
mov dword [esp + 8], 0
mov ecx, 0xb3
mov edi, 0x4c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0xaf]
mov ebx, ecx
xor ebx, edi
and ebx, esi
xor ebx, edi
mov dl, 0x80
sub dl, bl
mov byte [esp + ecx - 0xaf], dl
inc ecx
dec edi
cmp ecx, 0xbb
jne case.default.0x425e00
xor ecx, ecx
cmp eax, dword [esp + 4]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x44759c]
mov ebx, dword [esp]
test ebx, ebx
jns 0x425e15
mov eax, 0xffffffff
jmp 0x425e18
lea eax, [ebx + ebx]
push eax
call fcn.00408300
add esp, 4
mov esi, eax
mov eax, esp
push eax
push ebx
push esi
push 0xe
push ebp
push 0
call dword [0x44cd1c]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4475a4]
xor ebx, ebx
jmp dword [0x4475bc]
push esi
call fcn.00408310
add esp, 4
mov eax, ebx
add esp, 0x90
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp]
mov ecx, eax
add ecx, 9
jns 0x425e6e
mov eax, 0xffffffff
jmp 0x425e75
lea eax, [eax*2 + 0x12]
push eax
call fcn.00408300
add esp, 4
mov edi, eax
mov dword [esp + 4], 0x63d261cc
mov dword [esp + 8], 0x67c565c5
mov dword [esp + 0xc], 0x5bfb59c3
mov dword [esp + 0x10], 0x5ffb5dfb
mov dword [esp + 0x14], 0x535251c3
mov word [esp + 0x18], 0
mov byte [esp + 0x1a], 0
mov eax, 0x18
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x14]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x88
mov byte [esp + eax - 0x14], cl
inc eax
cmp eax, 0x2f
jne 0x425ec0
movzx ecx, word [esi]
mov eax, edi
test cx, cx
je 0x425f01
lea edx, [esi + 2]
mov eax, edi
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425ef0
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x425f31
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x425f20
mov word [eax], 0
lea eax, [esp + 0x6c]
push eax
push edi
call fcn.004406c0
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4475c4]
mov eax, dword [esp + 0x6c]
shr eax, 2
and eax, 4
jmp dword [eax + 0x4475cc]
mov eax, dword [esp]
mov ecx, eax
add ecx, 0x25
jns 0x425f71
mov eax, 0xffffffff
jmp 0x425f78
lea eax, [eax*2 + 0x4a]
push eax
call fcn.00408300
add esp, 4
mov ebp, eax
mov dword [esp + 4], 0x61316700
mov dword [esp + 8], 0x7d1f631b
mov dword [esp + 0xc], 0x790f7f0e
mov dword [esp + 0x10], 0x750b7bf5
mov dword [esp + 0x14], 0x71fa770a
mov dword [esp + 0x18], 0x8d1b7314
mov dword [esp + 0x1c], 0x89f88ff7
mov dword [esp + 0x20], 0x85fb8bf4
mov dword [esp + 0x24], 0x810b870d
mov dword [esp + 0x28], 0x9dd583a0
mov dword [esp + 0x2c], 0x99e59fff
mov dword [esp + 0x30], 0x95fe9bec
mov dword [esp + 0x34], 0x91e797c0
mov dword [esp + 0x38], 0xadf193ed
mov dword [esp + 0x3c], 0xa98eafd8
mov dword [esp + 0x40], 0xa5dbabf6
mov dword [esp + 0x44], 0xa1daa7d0
mov dword [esp + 0x48], 0xbdd0a3df
mov dword [esp + 0x4c], 0xb9bebf31
xor eax, eax
nop
nop
nop
mov edx, eax
and edx, 0x17
xor edx, 0x97
mov ecx, eax
and ecx, 0x68
sub ecx, edx
xor cl, byte [esp + eax + 4]
add cl, 0xf3
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 0x4c
jne 0x426020
movzx ecx, word [esi]
mov eax, ebp
test cx, cx
je 0x426071
mov edx, esi
add edx, 2
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x426060
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x4260a1
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x426090
mov word [eax], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea eax, [esp + 0x68]
push eax
push ebp
call fcn.004406c0
add esp, 8
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x4475d4]
mov eax, dword [esp + 0x68]
shr eax, 2
and eax, 4
xor ebx, ebx
jmp dword [eax + 0x4475dc]
jmp dword [0x4475e4]
push ebp
call fcn.00408310
add esp, 4
jmp dword [0x4475ec]
jmp dword [0x447604]
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], edi
mov dword [esp + 4], 0x239b219d
mov dword [esp + 8], 0x27942587
mov dword [esp + 0xc], 0x3b893987
mov dword [esp + 0x10], 0x3f983d83
mov dword [esp + 0x14], 0x33cc3184
mov dword [esp + 0x18], 0x378f3583
mov dword [esp + 0x1c], 0xbae09b6
mov dword [esp + 0x20], 0xfb90db3
mov dword [esp + 0x24], 0x3a101b3
mov dword [esp + 0x28], 0x7bb05bb
mov dword [esp + 0x2c], 0x1baf19a5
mov dword [esp + 0x30], 0x1fa71da2
mov dword [esp + 0x34], 0x13b311b3
mov dword [esp + 0x38], 0x17af15a0
mov dword [esp + 0x3c], 0xeb54e957
mov dword [esp + 0x40], 0xef4fed5f
mov dword [esp + 0x44], 0xe352e150
mov dword [esp + 0x48], 0xe71ce557
mov word [esp + 0x4c], 0xf9f8
mov dword [esp + 0x4e], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xc8
xor cl, byte [esp + eax + 4]
add cl, 0x18
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 0x4e
jne 0x4261b0
lea eax, [esp + 0x54]
push eax
push 0x427e20
lea eax, [esp + 0xc]
push eax
push edi
call fcn.00423d40
add esp, 0x10
mov ebx, eax
jmp dword [0x4475ec]
mov dword [esp + 0x64], edi
mov dword [esp + 0x54], 0x7724095e
mov dword [esp + 0x58], 0x73e775d9
mov dword [esp + 0x5c], 0x7f7e71e4
mov byte [esp + 0x60], 0
mov eax, 0x48394be
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x483946a]
xor edx, eax
mov ecx, edx
or ecx, 0xfe
add ecx, edx
not edx
and edx, 1
add ecx, edx
add cl, 0x4b
mov byte [esp + eax - 0x483946a], cl
inc eax
cmp eax, 0x48394cb
jne 0x426210
mov dword [esp + 4], 0xe105e733
mov dword [esp + 8], 0xfd16e31b
mov dword [esp + 0xc], 0xf9cfff71
mov dword [esp + 0x10], 0xf501fb11
mov dword [esp + 0x14], 0xf10af702
mov dword [esp + 0x18], 0x8d7bf301
mov dword [esp + 0x1c], 0x89ae8f01
mov dword [esp + 0x20], 0x85698b5f
mov dword [esp + 0x24], 0x8172877f
mov dword [esp + 0x28], 0x9d4183a0
mov dword [esp + 0x2c], 0x99129f68
mov dword [esp + 0x30], 0x95689b67
mov dword [esp + 0x34], 0x91759762
mov dword [esp + 0x38], 0xad69931c
mov dword [esp + 0x3c], 0xa951af22
mov word [esp + 0x40], 0xaba8
mov dword [esp + 0x42], 0
mov word [esp + 0x46], 0
mov eax, 0xe811a6a9
mov ecx, 0x56
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x17ee595b]
lea edi, [edx + edx]
not edi
add edi, edx
mov ebx, edi
xor ebx, edx
not ebx
add ebx, edi
and edi, edx
sub ebx, edi
and ebx, eax
and edx, ecx
or edx, ebx
mov edi, edx
and edi, 1
xor edx, 1
lea edx, [edx + edi*2]
add dl, 0xb2
mov byte [esp + eax + 0x17ee595b], dl
inc eax
dec ecx
cmp eax, 0xe811a6ed
jne 0x4262e0
lea eax, [esp + 0x54]
push 0
push 4
push 0xc00000
push eax
push ebp
lea eax, [esp + 0x18]
push eax
push dword [esp + 0xbc]
call fcn.00423890
add esp, 0x1c
mov ebx, eax
mov edi, dword [esp + 0x64]
jmp dword [0x4475e4]
jmp dword [0x4475ec]
push edi
call fcn.00408310
add esp, 4
jmp dword [0x447604]
not eax
shr eax, 0x1f
lea esi, [esp + 4]
jmp dword [eax*4 + 0x447634]
xor ebx, ebx
jmp dword [0x44763c]
mov dword [esp + 4], 0x57fe4914
mov dword [esp + 8], 0x53e055e9
mov dword [esp + 0xc], 0x5ff351fc
mov dword [esp + 0x10], 0x5bf45de2
mov dword [esp + 0x14], 0xa71859f1
mov dword [esp + 0x18], 0xa3a2a508
mov dword [esp + 0x1c], 0
xor eax, eax
nop
nop
nop
nop
mov edx, eax
and edx, 0x12
xor edx, 0x9452692
mov ecx, eax
and ecx, 0xd
sub ecx, edx
lea edx, [ecx + ecx]
not edx
add edx, ecx
and edx, 0x99
and ecx, 0x66
or ecx, edx
xor cl, byte [esp + eax + 4]
xor cl, 0x99
add cl, 0xda
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 0x1c
jne 0x4265d0
push 0
push 0
push esi
push edi
push dword [esp + 0xac]
call fcn.00421c90
add esp, 0x14
mov ebx, eax
jmp dword [0x44763c]
push edi
call fcn.00408310
add esp, 4
pop esi
inc edx
add byte [eax + 0x5e], dl
inc edx
add byte [edi], bh
pop esi
inc edx
add byte [ebp + 0x5e], bl
inc edx
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [edi], bh
pop esi
inc edx
add byte [edi + 0x5e], al
inc edx
add byte [eax + 0x5e], dl
inc edx
add byte [eax + 0x5f], ah
inc edx
add byte [eax + 0x5f], dl
inc edx
add byte [eax + 0x5f], ah
inc edx
add ch, dh
pushal
inc edx
add dl, bl
pushal
inc edx
add al, cl
pushal
inc edx
add dl, bl
pushal
inc edx
add dh, ah
popal
inc edx
add al, ah
pushal
inc edx
add byte [esi + 0x63], cl
inc edx
add byte [ebx + 0x42], dl
add bh, ch
pushal
inc edx
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add bh, ch
pushal
inc edx
add byte [ecx], al
add byte [eax], al
add byte [edi + 0x5e], al
inc edx
add byte [eax + 0x5e], dl
inc edx
add byte [eax], cl
inc edx
add byte [esi], ch
inc dx
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], cl
inc edx
add byte [0x65200042], bl
inc edx
add byte [edx + 0x65], bh
inc edx
add byte [eax], ah
inc edx
add byte [edx - 0x6dffbd9b], cl
inc edx
add byte [0x2e004266], ah
inc dx
add byte [ebx], ah
inc edx
add byte [ecx + 0x67], dl
inc edx
add byte [ecx + 0x67], dl
inc edx
add byte [eax + 0x67], bl
inc edx
add byte [edi + 0x42], dh
add cl, al
inc edx
add byte [eax], dl
jle 0x4476a1
add byte [ebp + 0x1004267], cl
push 0x68100042
inc edx
add byte [edx], bl
push 0x68300042
inc edx
add byte [eax + ebp*2 + 0x42], cl
add byte [eax], dh
push 0x685c0042
inc edx
add byte [eax + 0x68], dh
inc edx
add byte [eax + 0x74], dl
je 0x4476c9
jbe 0x4476e5
add byte [edx - 0x3fffbd8a], ah