Function at 0x1004dd6a
Capabilities:
Encode data using xor

Disassembly:
cwde
mov ah, 0x7b
popfd
xor ecx, ebp
pop esi
call fcn.1011e48a
leave
ret
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x10170c30]
xor eax, ebp
mov dword [ebp - 4], eax
pushfd
test byte [0x1004de0b], 0xf7
jne 0x1004de0c
int1
xlatb
and esp, edx
loop 0x1004ddc7
inc ebx
jecxz 0x1004dd93
call [edi + 0x6922c47d]
dec edi
lahf
jge 0x1004dd5b
and ch, byte [ecx + 0x4f]
lahf
shl byte [eax + 0x16], 0x9d
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
arpl word [eax - 0x3c0e7b31], si
aam 0x39
xor byte [ecx - 0x36], ah
popal
out 0x47, al
add al, byte [ebx + 0x12079d6c]
nop
pop es
mov al, 0x4d
push es
xchg byte [eax - 0x58], ch
jb 0x1004de0b
xchg ebx, eax
dec ebx
bound esp, qword [0x274ee05a]
test al, 0x12
stosd dword es:[edi], eax
push ds
rcl dword [0x1feb6b26]
and bl, byte [eax + 0x15289558]
dec edi
push ss
xchg ecx, eax
in al, 0x30
sub eax, 0xbec06eae
push eax
xchg ecx, eax
lds esi, [ecx + 0x16]
pushal
salc
or edi, edx
jne 0x1004ddfa
mov ah, 0xc2
dec eax
movsd dword es:[edi], dword [esi]
aam 0xa6
invalid
jae 0x1004ddfd
xchg edx, eax
in al, 0xab
pop edi
xor ebp, dword [edx - 0x7937e19]
xchg ecx, eax
mov esi, 0xcac2924
or al, 0x9d
popfd
push esi
pushfd
test byte [0x1004de85], 0x44
jne 0x1004df86
mov al, byte es:[0x137e725b]
test byte [eax], 0x5e
adc eax, 0x10970e6
cmp al, 0xf6
or eax, 0xd6b28fb2
mov ch, 0x22
mov ah, 0xf1
push 0xc9d09287
add eax, 0x3a10c39
push ecx
std
mov al, 0xe2
mov esi, 0xf9d29193
push ebp
or ah, byte ss:[ebp + 0x31309d69]
movsd dword es:[edi], dword [esi]
imul ebx, dword [ebp + 0x1f2e3130], 0x15a945f1
mov dl, 0x81
retf
pop ds
int1
inc ebp
test eax, 0xcb81b215
cmp al, 0xd8
movsb byte es:[edi], byte [esi]
je 0x1004ded3
inc esp
cdq
je 0x1004dec0
fstp dword [edi + ebx*4 + 0x33]
jnp 0x1004de4c
out 0xc9, eax
fdiv qword [esi - 0x46]
shr dh, 0xdf
std
cmp eax, 0x78724271
adc eax, 0x18bac6b8
pushal
into
push ecx
jge 0x1004dec9
mov esi, 0xa558ef72
add dword [ecx - 0x655e259b], edx
xor dword [eax], ecx
sar al, cl
mov ds, word [edi - 0x36fcc6e3]
sub dword [ebx - 0x4b], esp
adc eax, 0x5df51d94
dec ebp
push cs
sbb al, 0xb7
and esp, dword [ecx]
cld
dec edx
or eax, 0x58c44a76
pop ebx
xchg edx, eax
xchg edx, ecx
outsd dx, dword [esi]
push ss
cmp eax, 0xa2de8996
xchg ebx, eax
cmp dword [esi - 0x4f], 0xb329216f
and al, 0x1d
push esi
adc eax, 0xb3344632
sbb eax, 0x46321556
xor al, 0xb3
jbe 0x1004de51
sahf
in eax, 0x9c
push es
xchg esp, eax
xor dword [ebp + ebp*8 - 0x3a21fef], esi
pop ebp
cld
arpl word [esi + eax*8 + 4], dx
mov dl, 0x77
sar byte [eax], cl
or eax, 0x648d3973
cmp bh, byte [edi - 0x7fc98cf2]
lodsd eax, dword [esi]
and dword [edx + 0x51], ebp
adc byte [edx - 0x5d], 0x11
rcr dword [ebx + 0x4db38605], cl
dec ebp
fld xword [eax + 0x752447d7]
add al, 0x31
mov dl, 0x59
lahf
jl 0x1004df21
xor ecx, dword [eax]
mov edi, 0xd1386023
cmp al, 0xc9
fsubr qword [edx - 0x39eb1e73]
dec ebx
pop ds
aas
lahf
mov dword [ecx - 0x5c18de0b], ebx
dec ecx
mov ebx, 0x90171a8e
mov ds, word [edx]
pop ss
nop
cmp ah, bl
dec eax
sbb dword [ebp + 0x3f], ecx
sub eax, 0x43141f83
mov ecx, 0x534a25f8
sbb dword [esi - 0x38d237b7], esp
mov al, byte [0xe3211782]
sbb edi, dword [edx + 0x62597a9f]
imul ecx, dword [edi + 0x5f6114c3], 0x76
mov cl, 0x9f
add eax, 0xdb55c861
mov dword [eax + 0x38815f2a], ebp
in eax, dx
push ds
dec esi
dec edi
test al, 0x2a
pop edi
cmp dword [eax], 0x4f4e1eed
clc
mov bh, 0xda
mov ebp, 0xbacaab27
mov esp, 0xf742a87
and ebx, ebp
xor dword [esi + 0xa], ebp
inc edx
jno 0x1004df15
lahf
mov dword [0x4cf42bac], eax
xor eax, dword [eax + 0x6d]
mov edi, 0x6742725f
push es
dec ecx
arpl word [edx + 0x51], dx
popfd
mov esi, dword [ebp + 8]
pushfd
test byte [0x1004e00b], 0x6f
add eax, 0x1004e00b
outsd dx, dword [esi]
jne 0x1004e00c
xchg ebx, eax
imul ecx, eax, 0x382ec0d6
je 0x1004df55
fcom qword [ecx]
push esp
inc ebp
sbb byte [ecx], dl
mov dword [0xf4cc2c59], eax
inc edi
scasd eax, dword es:[edi]
dec eax
add eax, 0x5eb125c5
fsub qword [eax - 0x551ed531]
fld xword [ecx - 0x1921844f]
jo 0x1004df8c
fnstsw word [edi + 0x5c6372db]
xor byte [ebp + 0xc], bh
std
stc
stosd dword es:[edi], eax
mov bh, 0x27
dec ecx
sbb al, 0x14
xchg edi, eax
fcomp qword [ebx - 0x34]
xchg ebx, eax
dec edi
shl dword [eax + 0x79], cl
sbb bh, byte [edi - 0x14]
lea esi, [esi]
inc ebx
test eax, 0x977e1dbd
cmc
dec ebx
mov edx, 0x7f35c0e6
int 2
rol esi, 0x8e
sub eax, 0x9ce93057
insb byte es:[edi], dx
dec esp
imul ebx, dword [esi + ecx*8], 0x7a
imul ebp, dword [ebx + ebx*4 - 0x52], 0x6a
shl dword [edi + 0x4b727e7c], 1
sbb al, 0xce
jp 0x1004e068
insb byte es:[edi], dx
wait
scasb al, byte es:[edi]
push 0xffffffffffffffd1
cmpsd dword [esi], dword es:[edi]
jl 0x1004e083
jb 0x1004e052
jb 0x1004e032
inc ecx
xor ecx, ebx
popfd
push edi
pushfd
test byte [0x1004e032], 0x5f
jne 0x1004e033
jae 0x1004e028
insd dword es:[edi], dx
out dx, eax
lodsb al, byte [esi]
add dword [edi + edx*8 - 0xf336fd2], esp
jnp 0x1004e02b
pushal
jnp 0x1004dff9
rcl byte [esi + edx*2 - 0x2a817c13]
jns 0x1004e0a2
xchg esp, eax
push esi
in eax, dx
cmp dword [esi - 0x2b], 0x79
jno 0x1004e01c
ljmp 0x680c:0x7d8b9d53
push ebx
popfd
mov edi, dword [ebp + 0xc]
push 0x103
lea eax, [ebp - 0x107]
push 0
pushfd
test byte [0x1004e08e], 0xd1
jne 0x1004e08f
pop ebp
mov dl, byte [edx + 0x34a393a1]
adc edx, ebp
test edi, ebx
scasb al, byte es:[edi]
cwde
adc ah, byte [ebx - 0x64b2a754]
xchg ebx, eax
mov dword [0x85d51334], eax
fild qword [esi - 0x535ced68]
pop eax
dec ebp
wait
cmpsb byte [esi], byte es:[edi]
outsd dx, dword [esi]
mov eax, 0xcfe88e22
outsb dx, byte [esi]
push es
ja 0x1004e08f
adc eax, 0x72fee003
loop 0x1004e086
add esp, eax
invalid
add byte [eax], dl
mov ebx, 0x9318c6d6
pushal
cmp al, byte [eax + 0x67]
xor eax, 0x741480a6
call 0xf33c00f8
dec byte [ecx]
outsb dx, byte [esi]
xor ah, ch
je 0x1004e06d
outsd dx, dword [esi]
and byte [edi], dh
jecxz 0x1004e088
or dword [esi + 0x30], ebp
in al, dx
in al, dx
popfd
push eax
mov byte [ebp - 0x108], 0
call fcn.1011df60
lea eax, [ebp - 0x108]
push eax
pushfd
call dword [eax - 0x64]
test byte [0x1004e1a6], 0xf9
jne 0x1004e1a7
jbe 0x1004e103
pop edi
mov esp, 0xcaac93fa
mov dword [esi + 0x1830ec58], edx
aas
mov al, 0x4a
and bl, byte [esi - 0x3327d314]
outsd dx, dword [esi]
and eax, 0xe7b0d5c1
clc
ja 0x1004e061
or ebx, dword [edi - 0x6f456f43]
js 0x1004e11e
push es
stosb byte es:[edi], al
or bh, cl
or eax, 0x7e368cc4
in al, dx
xchg dword [ebp + 0x7fb6442f], esp
bound edi, qword [eax - 0x49afe464]
push edi
in al, dx
test byte [ebp - 0x42], bl
into
add dword [esi + 0x4a], esp
jne 0x1004e0c1
cld
mov si, 0x278c
mov esi, 0x73cb5043
popfd
and cl, byte [ebp + 0x34ac389f]
dec edi
and byte [ebx + 0x50aa9620], cl
push eax
retf
mov esp, dword [eax]
xchg esi, eax
stosb byte es:[edi], al
push eax
fisttp dword [edi - 0x1da2f11e]
inc esp
dec ebp
sahf
loopne 0x1004e124
not esi
pushal
int3
fist dword [ecx + 3]
inc ebx
cdq
xor bh, byte [ecx]
sub esp, dword cs:[eax + 0x2c]
jns 0x1004e10e
mov ah, 0x2b
mov al, 0x26
mov dword [0x8d407169], eax
push eax
cwde
dec esp
mov esp, 0x35a89b85
xor dl, ah
jg 0x1004e102
outsd dx, dword [esi]
test eax, 0x6de5423c
dec ebp
sbb esi, dword [edi]
jg 0x1004e18b
pop esi
add eax, 0xd33c5c9a
movsb byte es:[edi], byte [esi]
jnp 0x1004e19c
loop 0x1004e1db
test word [edi], sp
dec ecx
xlatb
cmp byte [ebp + 0x1b2f67c4], 0x28
push edx
and dword [ebp - 0x689c2807], edi
jno 0x1004e120
inc edi
mov edi, edi
inc edx
aas
mov edx, 0x76993618
xlatb
clc
or byte [eax], ch
imul esp, dword [ebp - 0x4862b1a], 0xf2bf3c31
or byte [ebx], ah
mov esi, 0x5bbaaf14
cli
outsb dx, byte [esi]
arpl word [edx], cx
mov ah, dl
pop edx
stc
js 0x1004e1ea
add byte [esi - 0x1c], ah
pop edx
mov byte [ecx - 0x575273c0], bl
cmpsd dword [esi], dword es:[edi]
popfd
call fcn.100475f5
pushfd
test byte [0x1004e1ed], 0x37
jne 0x1004e1ee
sahf
mov edi, 0xb7c0ac84
nop
mov cl, 0x34
mov ebx, 0x18bd1162
jnp 0x1004e239
sub edx, dword [esi + 0x38]
aam 0xfd
inc esi
sub eax, 0xc550fcc3
lodsd eax, dword [esi]
push 0x9eabf402
test dword [ebx + 0x31], eax
sar dword [ebp - 0x16], cl
inc ebx
xor ebx, edx
jge 0x1004e1ca
lds esp, [ebx]
adc byte [ebx], dl
push 0x191759c9
xor eax, 0xc2bdbbf1
int1
mov ebx, 0x839dc2bd
les edx, [eax]
popfd
add esp, 0x10
test eax, eax
jne 0x1004e20c
push str.GetAppDataDir_Error_
push eax
push eax
call fcn.10049c0c
add esp, 0xc
xor eax, eax
jmp 0x1004e3d4
lea eax, [ebp - 0x108]
push str.wuauserv.ini
push eax
call fcn.1011f130
pop ecx
pushfd
test byte [0x1004e2c7], 0x2f
jne 0x1004e2c8
bound ebp, qword [ebx - 0x74]
mul byte [ecx + ecx*2]
adc ch, byte [ecx]
stc
push esp
fild qword [eax]
mov dh, byte [eax]
pop edi
push eax
xor byte [edi + 0x50], bl
sbb al, 0xe1
push esi
cmp byte [edx + 0x59], dh
and dl, byte [edx + 0xb]
cmp eax, 0x1fea0c3
adc ecx, dword [ecx + 1]
test al, 0x66
xchg edx, eax
mov ah, 0xdd
push eax
mov dword [ecx + ebp + 0x7b], esi
scasd eax, dword es:[edi]
js 0x1004e26b
mov ecx, 0xa21598a3
sbb dword [edi], esp
cmp eax, 0x41d03ef9
xchg ecx, eax
mov eax, 0x56d1874a
push esi
dec dword [edi]
mov al, 0xe0
mov al, byte [0xd24cb2b8]
dec esi
push esp
dec ebx
add al, 0xdd
push es
das
sti
cmp dword [ecx], ebx
pop esp
inc eax
mov byte [ecx], ch
xchg esp, eax
add al, 0x3e
stc
jecxz 0x1004e27c
inc ebp
xlatb
salc
sahf
daa
cmp ecx, dword [esi + 0x5d]
into
pushal
cld
sbb dword [ebx], esi
lea edx, [ebp - 0x4c43e6a0]
or dh, al
push ss
salc
sbb eax, eax
xchg ebp, eax
push ebp
sti
clc
je 0x1004e32a
push ebx
mul esi
out 0x42, al
inc edx
stosd dword es:[edi], eax
movsb byte es:[edi], byte [esi]
aas
int3
popfd
pop ecx
lea eax, [ebp - 0x108]
push eax
push esi
push edi
pushfd
test byte [0x1004e3c4], 0xe1
jne 0x1004e3c5
xor ebp, dword [esi - 0x5087c1c7]
and eax, 0x80c1c5cb
cmp ebx, esp
out dx, al
jge 0x1004e28d
leave
fcom dword [esi + eax*8 - 0x6da2579]
fxam
pushal
or eax, 0x83062d2
movsd dword es:[edi], dword [esi]
pop esi
cli
add esp, esp
lahf
fidiv word [ebx - 0x3741125d]
jnp 0x1004e2af
sub bh, byte [ecx + 2]
into
sub dword [esi], ebx
outsd dx, dword [esi]
sti
inc eax
pop eax
fdiv dword [ebp + 0x979392]
inc ecx
in al, 0x9b
not byte [edx + ebx]
pop esi
stc
push 0xbe518b81
mov edx, dword [ecx - 0x42]
jmp [ecx - 0x1f]
fcomp qword cs:[eax - 0x356280e3]
or eax, 0xc4b7e34a
xor dword [esi], edx
mov edi, 0xc21d754f
lea esp, [eax]
cdq
inc edx
or al, byte [ecx - 0x436df4c5]
cmp al, 0xc7
and byte [ecx + 0x3b810a42], bl
or edx, dword [edx - 0x38c3d144]
sub al, 0x70
int 0x77
pop ecx
stosd dword es:[edi], eax
jbe 0x1004e37b
dec ebx
sbb byte [ecx], al
xchg esi, eax
imul edx, dword [0x7efb3918], 0x24f58fe1
pop esp
dec esp
in al, 0x18
add edi, ecx
add bl, byte [eax + 0x28d3eb79]
push ebp
add dword [edi - 0x60116e74], eax
add dword [esi + 0x39181569], edx
sti
jle 0x1004e390
invalid
popfd
push str.wuauserv
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pushfd
test byte [0x1004e475], 0x38
jne 0x1004e476
cwde
ror dword [ecx - 0x78], 0x14
insd dword es:[edi], dx
out 0x62, al
jle 0x1004e3a6
push es
int3
popfd
xor ecx, ebp
pop esi
call fcn.1011e48a
leave
ret