Function at 0xe86eab
Capabilities:
Encode data using xor

Disassembly:
pushfd
pushfd
pop dword [esp]
jmp 0xe86e40
jmp 0xe87138
cmp dl, 0x61
jmp 0xe86cee
call 0xe86cae
or eax, 0xdef6ef9c
jnp 0xe520e6
and byte [eax + ebp*8], bl
jle 0xe52029
popfd
ror dword [edx - 0x1b], cl
adc al, 0xe8
mov ecx, 0xe100034c
and byte [ebx - 0x20], ah
call 0xe86d4f
loope 0xe520b8
arpl ax, sp
lodsb al, byte [esi]
retf 0xdd7c
and edi, dword [ecx + reloc.gdiplus.dll_GdipAlloc]
call 0x529d63ce
leave
jmp 0xe52116
push edi
add eax, dword [eax]
push es
mov cl, 0xb0
mov bl, 0xd
and eax, 0xb89723b
cmp eax, 0x4380ec19
cli
aad 0xe9
mov dword [ebp + 3], edx
add byte [edx - 0x17988b3b], ch
and dword [eax + 0x20], 0x1c
jno 0xe52111
jmp 0xe87688
push ss
push ds
int1
ljmp 0x8ee5
jge 0xe5211f
jmp 0xe520fa
sbb dword [eax + 0x5b], edi
wait
or edi, 0xfffffff1
pushfd
jb 0xe52134
jb 0xe52134
add ecx, dword [ecx]
and byte [edx + 0x64e9a54b], ch
mov ecx, dword [eax]
add cl, bl
jmp 0xe70b7e
mov esp, 0x8cc9fb8f
push cs
cdq
int 0xf6
xor ch, ah
inc esi
jno 0xe52177
xor edx, edx
jmp 0xe876ef
shr cl, cl
movsd dword es:[edi], dword [esi]
push ebp
add eax, dword [eax]
push ss
add dword [eax + 3], 0x723d95ed
mov dword [ebx], esi
xchg edi, eax
mov dh, byte [ecx + 0x3b]
enter 0xffffffffffffe673, 0xf
cmp byte [edi + 0x55], 3
add byte [edx + 0x61b70495], bh
cmp ecx, eax
jae 0xe52143
jb 0xe876e2
mov edx, 0x61b70495
mov al, 0x5f
imul ebx, ebx, 0xffffffdf
jne 0xe521bf
xchg esi, eax
xchg ebx, eax
mov ecx, 0x8b786643
aaa
mov cl, 0x2a
pushal
jmp 0xe87733
push eax
jmp 0xe8782f
cmp esi, 0x34
push eax
lea esp, [esp]
jmp 0xe87793
xor ecx, ecx
call 0xe877e6
push esi
add eax, dword [eax]
in al, 0x4a
pop ds
and dword [reloc.gdiplus.dll_GdipAlloc], 0x5126cfb5
rcl byte [ebx - 0x18]
sti
push ebp
add eax, dword [eax]
call 0xe877d1
cmp esi, eax
jae 0xe521bb
mov cx, 0x2051
jmp 0xe877de
mov byte [edx + 2], 0x3d
jmp 0xe873ed
push 0x3e
cmp eax, edx
cmc
jmp 0xe8766d
cmp edi, 0x34
call 0xe52243
movsb byte es:[edi], byte [esi]
push word [esp + 2]
pop word [esp]
jmp 0xe878ad
jmp 0xe87633
jmp 0xe87931
mov byte [edx + 2], cl
jmp 0xe873ed
pushal
xor ecx, ecx
sub esp, 0x1c
jmp 0xe878d3
push ebp
jmp 0xe87454
cmp cl, 0x61
jmp 0xe86efe
cmp dl, 0x3d
jmp 0xe8662a
jne 0xe869fb
mov dword [edi], 1
jmp 0xe86768
call 0xe86dbd
inc esp
fisttp qword [ebp + 0x14]
out 0x53, eax
mov dh, 0x2e
mov esp, 0xbf8636db
xchg byte [ecx], dh
xor byte [ebx], dh
jmp 0xe86ec6
cmp cl, 0x39
jmp 0xe86deb
jmp 0xe86f42
ja 0xe8672e
movzx eax, al
call fcn.00e86f65
in eax, 0x7a
call 0xc6b6e13e
pop edi
iretd
pop eax
jmp 0xe866d1
jmp 0xe86711
push 0x3e
jmp 0xe86963
push 0x3f
jmp 0xe86963
pushfd
push word [esp + 3]
push si
jmp 0xe86f1e
sub eax, 0x47
jmp 0xe866d1
push esi
cmp bl, 0x2b
jne 0xe86744
jmp 0xe866d3
cmp al, 0x5a
jmp 0xe86f7b
cmp bl, 0x2f
jne 0xe8689a
jmp 0xe866da
lea esp, [esp + 4]
pop esi
jmp 0xe8681a
jmp 0xe86f37
push ebp
push dword [esp + 3]
pop word [esp + 3]
lea esp, [esp + 2]
jmp 0xe8710d
sub esi, 0x47
jmp 0xe8681a
cmp dl, 0x2f
jne 0xe867e8
call fcn.00e87067
lea esp, [esp + 4]
push 0x3f
jmp 0xe867fe
cmp bl, 0x5a
jmp 0xe87003
jmp 0xe86803
call 0xe8709a
pushfd
mov byte [esp + 1], cl
jmp 0xe87084
jmp 0xe86fed
push bp
mov word [esp], dx
lea esp, [esp + 2]
jmp 0xe86850
jmp 0xe870c9
sub edx, 0x41
jmp 0xe86866
sub edx, 0x47
jmp 0xe86866
call 0xe870f7
stosb byte es:[edi], al
or byte [esi + 0x258f08f9], bl
movsd dword es:[edi], dword [esi]
xor eax, 0x541daf5c
invalid
or eax, esi
lea esi, [ecx + edi]
jmp 0xe868e1
push sp
lea esp, [esp + 1]
lea esp, [esp + 1]
jmp 0xe870bb
jmp 0xe8715c
pop ecx
jmp 0xe868dc
shl eax, 6
jmp 0xe86884
shl eax, 0xc
sub esp, 0xc
mov si, 0x16ee
jmp 0xe87255
call 0xe8737b
lea esp, [esp + 4]
jne 0xe869c7
je 0xe8733d
stosb byte es:[edi], al
cmp byte [esi - 0x7b03c737], ch
adc eax, 0xdf1fec85
add al, 0x9c
pushfd
mov byte [esp + 1], dl
jmp 0xe8674f
call 0xe87287
les ebx, [esi - 0x34]
stosd dword es:[edi], eax
fdiv dword [esi]
mov bl, 0x23
inc esi
mov ch, 5
and dword ss:[eax - 0x5d], esp
fimul dword [ebp + reloc.gdiplus.dll_GdipAlloc]
lea esp, [esp + 0x1c]
push ecx
call fcn.00e869b1
das
mov ch, 0x25
dec esp
mov edi, 0x34a63f0d
push ebx
scasb al, byte es:[edi]
sbb al, 0x4b
fisttp dword [ebx + 0x2e]
fstp qword [edi]
mov esi, 0xe9db3389
sbb eax, dword [eax + eax]
add byte [0xaa5f38aa], dh
push ds
push ebp
iretd
xor ebx, ebx
jmp 0xe86e1d
pushfd
jmp 0xe87344
jb 0xe5207b
cmp dl, 0x7a
jbe 0xe52091
ja 0xe5207b
mov byte [esp + 2], dh
jmp 0xe86d20
lea esp, [esp + 4]
cmp dl, 0x3d
pushfd
mov dword [esp], esp
pushfd
jmp 0xe86d65
lea esp, [esp + 8]
jne 0xe51ff6
je 0xe52091
cmp cl, 0x41
jb 0xe86609
cmp cl, 0x5a
jmp 0xe86fe1
cmp dl, 0x5a
jbe 0xe52091
ja 0xe52038
cmp cl, 0x2b
jmp 0xe86dcb
je 0xe86621
call 0xe86e7b
sub dword [ebx + reloc.gdiplus.dll_GdipAlloc], ebp
inc ecx
int3
jbe 0xe86621
ja 0xe86650
xchg dword [ecx - 8], ebx
invalid
je 0xe86621
jne 0xe51ff6
jl 0xe86df2
jge 0xe86e0b
div dword [edi]
jl 0xe86e5a
salc
inc ecx
pushfd
lea esp, [esp + 4]
je 0xe86621
cmp cl, 0x3d
jmp 0xe86df7
sub esp, 0xa
pop dword [esp]
lea esp, [esp + 2]
lea esp, [esp + 4]
cmp cl, 0x3d
jmp 0xe86e64
mov eax, 0x403
lea esp, [esp + 4]
jmp 0xe86c82
fisttp qword [edx - 0x28]
mov edi, 0x826bfe4a
cmp eax, 0x6653660c
mov dword [esp], esp
push bx
mov word [esp], sp
call fcn.00e86e4e
mov dword [ebx], esp
mov bl, 0xd6
and eax, 0x9011e6e7
adc ecx, dword [edx + reloc.gdiplus.dll_GdipAlloc]
lea esp, [esp + 4]
cmp cl, 0x2f
jmp 0xe86e0d
jmp 0xe86eda
pushal
lea esp, [esp + 0x20]
cmp cl, 0x30
jb 0xe86650
jae 0xe8666b
lea esp, [esp + 0x2c]
inc ebx
push bp
lea esp, [esp + 2]
inc ebx
call fcn.00e86ead
cmp al, 0xa2
xor byte [edi - 0x5e], dl
jle 0xe86eda
ja 0xe86f07
loope 0xe86f52
test byte [eax], bl
mov gs, ecx
sbb byte [ebp + 0x62820ff5], ch
idiv edi
inc dword [eax - reloc.gdiplus.dll_GdipAlloc]
adc al, 0xf7
invalid
jb 0xe86666
cmp cl, 0x7a
jbe 0xe86621
ja 0xe86666
lea esp, [esp + 4]
push 0x3e
jmp 0xe866bb
lea esp, [esp + 8]
cmp al, 0x2f
jmp 0xe86f58
cmp al, 0x2b
jne 0xe866f6
pushfd
jmp 0xe86f13
cmp al, 0x39
jmp 0xe8669a
pop ebx
mov dh, 8
aas
push es
mov cl, 0xf
test dword [edi], esi
idiv edi
jmp [edx + 0x3f]
jne 0xe86695
push 0x3f
jmp 0xe866bb
movzx eax, al
push cx
lea esp, [esp + 2]
jmp 0xe86fb9
ja 0xe8670c
call 0xe86fa3
lea esp, [esp + 4]
sub eax, 0x41
jmp 0xe866d1
jbe 0xe86621
ja 0xe86609
push ebp
jmp 0xe87027
ja 0xe8679b
sub esi, 0x41
jmp 0xe8681a
jb 0xe8677e
jae 0xe87048
das
je 0xe87018
insd dword es:[edi], dx
hlt
mov ebp, edi
mov edi, dword [ebp]
pop ebp
cmp edi, 2
jmp 0xe87011
jne 0xe867b1
je 0xe8707d
pop edx
rol dword [ecx + 0x20], 1
rcl dword [edx], cl
fcom qword [edx - 0x40]
cmpsd dword [esi], dword es:[edi]
push edx
loop 0xe8709a
retf 0xfa80
cmp dl, 0x2b
jmp 0xe87032
add esi, 4
jmp 0xe8681a
push 0x3e
jmp 0xe867fe
lea esp, [esp + 4]
cmp dl, 0x39
jmp 0xe870a4
lea esp, [esp + 4]
pop edx
jmp 0xe86866
ja 0xe86846
push si
add esp, 1
lea esp, [esp + 1]
jmp 0xe870e9
movzx esi, bl
cmp bl, 0x39
ja 0xe867d2
jbe 0xe8705f
cmp dl, 0x5a
movzx edx, dl
ja 0xe86830
jbe 0xe8684b
push cs
popfd
or eax, 0x7866a754
out dx, al
jl 0xe87100
test byte [edi + 0x7f], 0x46
inc edi
jg 0xe8712f
movzx edx, dl
sub esp, 0
add edx, 4
jmp 0xe86866
xor byte [ebx - 0x3b], 0xe6
jb 0xe870e6
xchg dword [edx - 0x4a], esi
ljmp 0x8df8
mov edx, dword [ebp - 8]
lea esp, [esp + 4]
jmp 0xe86866
mov ebx, 0xce9b2dde
pop ecx
mov eax, 0x648df29b
and al, 3
lea esp, [esp + 3]
lea esp, [esp + 8]
cmp dl, 0x41
jb 0xe52038
jae 0xe86d98
jne 0xe868b0
push 0x3f
jmp 0xe868c6
cmp cl, 0x39
call fcn.00e8719b
cmc
insd dword es:[edi], dx
std
test byte [edi - 0x35], dh
in eax, 0x7e
in al, dx
mov eax, dword [esi - reloc.gdiplus.dll_GdipAlloc]
cmpsb byte [esi], byte es:[edi]
push ebp
jecxz 0xe871cd
pushal
pop dword [esp + 3]
lea esp, [esp + 0x1c]
cmp cl, 0x2f
jmp 0xe8714f
lodsb al, byte [esi]
pop edi
jmp 0x8ec76918
or eax, edx
jmp 0xe87238
jb 0xe86945
pushfd
mov byte [esp], dl
shl edx, 6
jmp 0xe87213
lea esp, [esp + 4]
jmp 0xe86945
lea esp, [esp + 0xc]
pop esi
cmp edi, 2
jmp 0xe87229
or eax, ecx
jmp 0xe869c7
lea esp, [esp + 4]
pop edi
mov ebx, dword [esp]
lea ebx, [eax + ebx]
mov bx, dx
jmp 0xe8747e
mov byte [edx + 3], cl
jmp 0xe87403
call 0xe87915
cmp dword [edx + reloc.gdiplus.dll_GdipAlloc], ebp
mov ecx, 0x7bb4829
sbb byte [ebx + 0x52], bh
int 0x5c
pop edi
xchg si, bx
jmp 0xe8740d
pop esi
lea ebx, [ebx + edi]
mov bl, byte [esp]
mov ebp, 0x2ff813b3
jmp 0xe879bb
xlatb
xor ecx, ecx
cmc
jmp 0xe879b3
mov ebp, esp
call 0xe87468
jle 0xe87427
jbe 0xe8745a
loopne 0xe8746f
sbb byte [0x9127d48d], 0xec
inc esi
mov ax, word [esp]
mov eax, dword [esp]
sub esp, 0xb
lea esp, [esp + 3]
lea esp, [esp + 8]
and al, 0x83
in al, dx
or ecx, dword [ebp - reloc.gdiplus.dll_GdipAlloc]
and al, 8
jmp 0xe8743e
add ch, bl
xor eax, 0x61f16f
inc esp
jo 0xe874ed
push 0xffffffffffffff85
xor al, 0x27
pop ebx
leave
ret
invalid
mov ebx, dword [ebp + 0xc]
jmp 0xe52224
and eax, edx
bswap ebx
mov bh, byte [esp]
mov ebx, eax
jmp 0xe52224
pop eax
cmp ecx, 0x1a
call 0xe87657
outsb dx, byte [esi]
cli
push 0x4c3efa0f
fisttp word [edi + 0x2a]
fst dword [edi - 0x4e]
lodsd eax, dword [esi]
mov esp, 0x8381168f
jge 0xe87697
cmp dword [ebp + 0xc], 3
jne 0xe52262
add ecx, dword [edi]
test eax, edx
stosd dword es:[edi], eax
cld
jmp dword [esi + 0xf]
bt bx, bp
mov bx, 0xccf
jmp 0xe87649
mov ebx, 0xadeb0ccf
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0xe876cf
lea edx, [ecx + 0x47]
jmp 0xe52179
cmp ecx, 0x34
jae 0xe52159
mov dx, word [esp]
mov dx, 0xdf53
jmp 0xe876b4
mov dl, bh
lea edx, [eax + ebp]
lea edx, [ecx - 4]
jmp 0xe52179
stc
cmp ecx, eax
call 0xe8774d
popal
std
insd dword es:[edi], dx
hlt
mov ecx, dword [ebp + 8]
call fcn.00e877c8
mov al, 0x2c
mov byte [0xa68134c5], al
cmp dword [ecx - reloc.gdiplus.dll_GdipAlloc], ebp
sti
ror byte [ebp - 0x24], cl
das
lea esp, [esp + 4]
setne dl
call fcn.00e87731
lea esp, [esp + 4]
jae 0xe521a5
bswap ecx
mov cl, byte [esp]
jmp 0xe877a9
lea esp, [esp + 4]
jae 0xe521d1
pushfd
mov ecx, eax
jmp 0xe877b1
lea ecx, [esi + 0x41]
jmp 0xe5218f
lea esp, [esp + 4]
lea ecx, [esi + 0x47]
jmp 0xe5218f
lea ecx, [esi - 4]
jmp 0xe5218f
lea esp, [esp + 4]
cmp dword [ebp + 0xc], 2
mov edx, eax
not edx
call fcn.00e87879
mov edx, dword [ebp + 8]
pushal
jmp 0xe87863
lea esp, [esp + 0x24]
mov byte [edx + 1], cl
jmp 0xe87894
mov ecx, eax
setne ch
lea ecx, reloc.gdiplus.dll_GdipAlloc
jmp 0xe878a5
jb 0xe52209
cmp edi, 0x1a
jae 0xe5223a
jb 0xe8787d
lea ecx, [edi + 0x41]
jmp 0xe5228e
lea esp, [esp + 4]
jae 0xe52278
lea ecx, [edi + 0x47]
jmp 0xe5228e
cmp edi, eax
lea esp, [esp + 0x3c]
setne cl
call fcn.00e87913
stosd dword es:[edi], eax
and eax, 0x9a2fdcb5
fist dword [esi - 0x3c]
mov dword [reloc.gdiplus.dll_GdipAlloc], eax
pop ebx
int 0xf
out dx, al
stc
lea ecx, [edi - 4]
jmp 0xe5228e
cmp edi, eax
jae 0xe522a4
mov ch, ah
lea ecx, reloc.gdiplus.dll_GdipAlloc
mov ecx, ebx
jmp 0xe878f5
lea esp, [esp + 4]
lea ecx, [ecx*4 + 0x2b]
jmp 0xe873d6
cmp ebx, eax
setne cl
pushfd
jmp 0xe8799d
pop ebx
mov ebp, 0xb2598382
not ebp
lea ebp, reloc.gdiplus.dll_GdipAlloc
jmp 0xe879de
lea ebp, [edx*4]
pop ebp
ret