Function at 0x1003def5
Capabilities:
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
pushfd
test byte [0x1003def4], 2
je 0x1003def5
mov eax, eax
sub al, 0x38
jbe 0x1003decb
or dword [edx - 0x10bf6976], edi
and eax, 0x13c41f79
cli
pop eax
test eax, 0xa53b8a87
shl bl, 1
add eax, 0x95740043
sub eax, 0x32a02811
in eax, 0xc6
pop esp
mov esp, 0xbe029850
pop edi
mov edx, 0x50fba3a7
or cx, word [esi]
movsd dword es:[edi], dword [esi]
insb byte es:[edi], dx
cmpsd dword gs:[esi], dword es:[edi]
leave
adc dword [ebp - 0x42], ecx
mov byte [eax + ebp*2], al
dec ecx
push ecx
outsd dx, dword [esi]
xor al, al
mov ebx, 0x54cadcd4
or byte [edx + 0x7b6346b1], dh
cmpsb byte [esi], byte es:[edi]
xor esp, dword [ecx + 0x11]
pop edi
in al, 0xce
test byte [eax + 0x3e187f47], 0xe4
push es
mov edi, 0x2d5e7fb5
and ch, dl
int3
aam 0xdc
retf 0x854
pushfd
mov ebp, 0xf5209665
int 0x50
popfd
mov eax, dword [0x10170c30]
xor eax, ebp
pushfd
test byte [0x1003dfd3], 0xaf
jne 0x1003dfd4
or byte [ebx + 0x10b7a61c], bh
fistp dword [ecx - 0x6c07a862]
out 0x1c, al
mov ah, 0x27
mov ch, 0x49
outsb dx, byte [esi]
pushal
imul ebx, dword [eax + 0x22], 0xffffff9d
or eax, 0x9a739c05
or byte [ecx], dh
test eax, 0xb3b1110d
add dh, byte [eax + 0x54568ceb]
inc esi
sbb bl, bh
repe scasd eax, dword es:[edi]
sub eax, 0x97b44044
mov ch, 0x9c
mov esp, 0xfa51ca8a
jne 0x1003df57
xor eax, 0xfe249b65
mov ecx, 0x76a7e3a4
or al, 0xf8
or bh, cl
mov dh, 0xcf
ja 0x1003deed
mov bl, 0xf4
push ebp
call 0xda9acd55
adc dword [edx], ebx
mov eax, 0x34db4958
sub byte [ebx + 0x3a4df302], al
arpl word [ebx], bx
pushal
clc
rol byte [ebx + 5], cl
insb byte es:[edi], dx
mov edx, cs
sub dh, dl
push ebp
inc eax
sub eax, 0x5991758
movsd dword es:[edi], dword [esi]
sbb bh, dh
invalid
jns 0x1003df69
pop edi
xor dl, byte [ebx - 0x73118597]
insb byte es:[edi], dx
bound ebp, qword [ecx]
inc ebp
lodsd eax, dword [esi]
lea edx, [esi + 0x2c]
xor al, 0xba
sti
leave
mov word [esi], cs
sahf
outsb dx, byte [esi]
cmp edx, dword [esi + 0x3094675d]
inc esi
dec esp
xchg ebx, eax
enter 0x20a4, 0x77
inc edi
and al, 0xf8
inc edi
or dl, byte [edx - 0x2d]
in al, dx
adc al, 0x5c
stosb byte es:[edi], al
sub bh, bh
inc esi
femms
pop ss
test ah, ch
inc eax
push eax
aam 0xd8
xchg edi, eax
pushfd
js 0x1003df87
lodsd eax, dword [esi]
cmp byte [edi], al
mov ch, 0x5e
xor byte [ecx - 0x77], ch
test byte [eax], 0x42
popfd
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
push 0x28
xor ebx, ebx
lea eax, [esi + 0x178]
push ebx
push eax
call fcn.1011df60
pushfd
test byte [0x1003e086], 0xf2
jne 0x1003e087
dec dword [0x5f69c00]
xchg al, ah
add edx, dword [eax]
bnd jne 0x1003e087
insb byte es:[edi], dx
push edi
fmul dword [eax - 0x3427280d]
cmp dh, bl
jns 0x1003e044
out 0xfa, eax
stosd dword es:[edi], eax
pop ds
mov dh, 0x90
scasd eax, dword es:[edi]
mov esi, 0x6c2a156d
xchg ecx, eax
out 0x61, al
dec ecx
jne 0x1003e08f
and dword [edx + 0x3d], ebp
test eax, 0x32119cf0
fsubr qword [eax]
call 0xdff8f852
mov esp, 0xbd766096
pushal
jbe 0x1003dfeb
je 0x1003dfe9
sbb al, 0x71
outsb dx, byte [esi]
outsb dx, byte [esi]
insb byte es:[edi], dx
pop eax
fsub dword [ebp - 0x6a4fdcb2]
lahf
cmpsb byte [esi], byte es:[edi]
fst qword [ebp + ebx*2 - 0x76]
push ds
jae 0x1003e02b
out 0xb6, al
dec eax
mov dh, 0x48
test byte [ecx - 0x6b035f8f], dl
push edx
mov esi, 0x58df983c
cmc
sub bl, byte [ecx - 0x2e]
out 0xb, al
daa
rcr dword [eax + edx*2 + 0x52de699e], 1
mov esp, 0x4c9a66ca
or eax, 0xbbd67206
test dword [0xa8c6c1b5], 0x962db325
sar byte [ebx - 0x7ae7c8bb], 1
xchg edi, eax
in eax, 0x1d
cmp eax, dword [edx + eax + 0x24]
fld st(2)
adc al, byte [edx - 0x71]
popfd
push 0x401
lea eax, [esi + 0x5a0]
push ebx
mov al, byte [0x53000005]
pushfd
test byte [0x1003e0a3], 0xb2
jne 0x1003e0a4
sbb dword [eax + 0x5c6e7a53], esp
popfd
push eax
call fcn.1011df60
push 0x2f
lea edi, [esi + 0x35f4]
push ebx
push edi
call fcn.1011df60
add esp, 0x24
lea eax, [ebp - 0x98]
push eax
pushfd
test byte [0x1003e0ff], 0x3e
jne 0x1003e200
push esp
add dh, dh
aam 0x68
mov bl, 0x9c
daa
mov es, word [eax + 0x7a8b9c43]
push edx
imul edi, dword [eax - 0x4cd71a69], 0xffffff86
mov eax, 0x953bfda3
test byte [edx], bl
push eax
fdivr qword [ebx + 0x5976289e]
imul edx, dword [esi], 0xc53d596f
xchg edi, eax
push 0x43ac67e8
mov ecx, 0x99ff5b95
in al, 0x64
fistp dword [0x337fda2]
out 0x5a, eax
jb 0x1003e123
out dx, eax
or ebp, dword [eax + esi]
pop ebx
in eax, 0x34
aad 0xf8
jo 0x1003e15e
out 0x47, al
inc ecx
sub byte [0xe1f362f9], bh
cmp eax, 0xe1f362f9
xchg ebp, eax
sbb eax, 0x45729078
imul ecx, dword [ebx + ecx - 0x7b26fbf9], 0xe77beab8
out 0x8b, eax
outsb dx, byte [esi]
cmp al, 0xc1
and dl, al
stc
jne 0x1003e193
cmp dh, byte [eax + edi*2 + 0x51]
inc ecx
int 0x4c
test eax, 0x1e1c7e1d
add eax, 0x87f66dae
adc dh, byte [esi - 0x50]
and byte [0x6e636ceb], ch
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
fsub qword [edx + 0x38]
mov ch, 0x1e
int 0x7a
cmp dword [ebp - 0x32], edx
xchg edx, eax
dec edx
add dword [edx + 0x4ea60696], esi
pop esi
stc
xchg edx, eax
mov dh, 0x91
cwde
loop 0x1003e1a0
dec edx
pop esi
push ebx
mov cl, 0x6d
aas
test al, 3
mov byte [ecx + ecx*4 + 0x68], dh
add ecx, dword [edx]
xlatb
xchg edi, eax
dec edx
salc
cwde
stc
cmpsb byte [esi], byte es:[edi]
xor dword [ebx], ebp
cmp byte [edi], 0x49
dec ecx
xor byte [ebx + 0x64a86617], bh
mov bh, 0xd3
fsub st(0), st(0)
and dword [esi - 0x72], ebp
mov ebp, 0x902f65cc
int 0xd7
pop es
or byte [esi + 0x2a6e6460], bl
pop edi
or edx, dword [ecx + 0x104c12a]
or dword [esi + 0x3138a520], ecx
nop
sub dword [eax - 0x411b5416], ebx
push ebp
push cs
pushal
pop ds
std
adc dword [esi], eax
stosb byte es:[edi], al
and dword [ebx - 0xda2a69c], 0xbd68a26b
dec ebp
int3
invalid
popfd
mov byte [edi], 1
mov dword [esi + 0x35fd], 0x10025
add edi, eax
xchg ch, bh
xor eax, 0x250000
add dword [eax], eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
adc eax, sym.imp.KERNEL32.dll_GetVersionExA
mov eax, dword [ebp - 0x94]
shl eax, 0x10
or eax, dword [ebp - 0x90]
push 0x10172218
pushfd
test byte [0x1003e2bf], 0x7d
jne 0x1003e2c0
loop 0x1003e219
mov dword [ebp + ecx*4 + 0x20ea57d3], esp
jns 0x1003e2ab
mov eax, dword [0xcd85b1d0]
cmp esp, esi
lea edx, [edi]
or eax, 0xdca3b70
push es
add eax, 0x27
mov al, byte [0x956b08d8]
insd dword es:[edi], dx
js 0x1003e203
mov esp, edx
and ecx, eax
xor byte [edx - 0x57050c2c], 0x1f
test dword [eax - 0x71], 0x5157fbf8
cmc
push ecx
xchg ecx, eax
inc ebx
push ebx
xchg edi, eax
jns 0x1003e23a
add byte [ebp + 0x38f6b8b], dh
imul esp, dword [eax + 0x30], 0xffffff91
lodsd eax, dword [esi]
adc al, byte [esi - 0x1fa67258]
pop eax
push ebp
xlatb
fidivr word [eax]
test dword [ebp - 0x11db411f], ebp
push esi
aam 0xd2
movsd dword es:[edi], dword [esi]
or al, 0x82
xor eax, 0xb402e337
dec edi
test al, 0x4d
pop ds
push ss
cmpsd dword [esi], dword es:[edi]
sub esp, esi
mov al, 0xd7
into
cmp dh, dh
aad 0xaa
sbb edx, esi
mov esi, 0xbde24cf6
movsb byte es:[edi], byte [esi]
call dword [edi]
popfd
mov dword [esi + 0x35f9], eax
call fcn.1011e6dd
pop ecx
mov ecx, esi
call fcn.10011582
cmp eax, 1
jne 0x1003e2e5
mov eax, dword [esi + 0x3624]
mov dword [esi + 0x35f5], eax
push 0x20
lea edi, [esi + 0x3728]
push ebx
push edi
mov dword [esi + 0x35f0], ebx
call fcn.1011df60
push str.12345678
push edi
call fcn.1011f120
mov edi, 0x104
push edi
lea ebx, [esi + 0x3750]
push 0
push ebx
call fcn.1011df60
add esp, 0x20
push ebx
push edi
pushfd
test byte [0x1003e343], 0
je 0x1003e344
out dx, al
adc al, 0x1e
add dh, byte [ecx]
ja 0x1003e3a8
cmp byte [eax], cl
in al, dx
xor byte [esi + edx*2 + 2], ch
pop ds
sub al, 0x6a
pop ebp
jge 0x1003e39a
jno 0x1003e396
std
mov edx, 0x8d3c037
popfd
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x101467b0
pushfd
test byte [0x1003e444], 0xed
jne 0x1003e445
salc
xor dword [edx - 0x32], eax
inc edx
pop esp
cli
into
add eax, 0x36d0462c
out 0xe3, eax
mov esp, dword [eax - 0x41]
jg 0x1003e3e0
pushfd
pop es
shl dword [esi + 0x378768c3], cl
popal
and eax, 0x2830471
push 0xffffffffffffff97
dec esi
cmp al, 0x84
lodsb al, byte [esi]
or eax, 0xa1269240
mov cl, 0x67
stosd dword es:[edi], eax
adc eax, 0x69480ddb
push dword [eax + 0x5798f67f]
mov al, 0x7f
neg byte [eax + 0x56191657]
pop esi
push edi
push ss
sbb dword [esi + 0x5e], edx
cli
mov ch, 0x42
aaa
push esp
popal
cmp al, 0x24
xor al, 0x19
xor al, 0x19
mov al, 0x98
push ecx
adc byte [0xdde3ba3b], dl
push dword [ebx + 0x7491ef9b]
xacquire xchg byte [ebx], cl
movsb byte es:[edi], byte [esi]
pop eax
xchg ecx, eax
jne 0x1003e3ce
lds esi, [ecx]
pop esp
cmpsb byte [esi], byte es:[edi]
xlatb
sti
inc eax
xlatb
push cs
mov ebp, 0x2868e964
pop ebp
sub byte [esi], ah
pop ebp
jae 0x1003e3e9
rcl dword [esi - 0x4e], 3
dec eax
scasb al, byte es:[edi]
pop ecx
pop es
jno 0x1003e40c
sti
sahf
mov ebx, 0x31487a9c
xchg byte [ebp + edi*2 + 0x55], cl
pop esp
pushfd
jp 0x1003e42b
xor dword [esi + 0x5c557d4c], eax
popfd
inc edx
inc eax
jae 0x1003e40c
dec ebx
push eax
xor eax, 0x520553fd
inc esp
jl 0x1003e3f1
std
push ebx
add eax, 0xf97c4452
insb byte es:[edi], dx
cmc
mov eax, dword [0x373e1c84]
movsb byte es:[edi], byte [esi]
test byte [eax - 0x6ff36429], cl
xchg byte [ebx - 0x2919bb2a], bh
salc
pop edi
nop
pop ebp
lodsb al, byte [esi]
test eax, 0x1ec6fb20
loopne 0x1003e3be
idiv byte [ecx - 0x80]
and eax, 0x9d5e5f14
into
or bl, byte [edi - 0x46]
loop 0x1003e493
fisttp dword [ebp + 0x9917703]
cmc
or ebp, esi
call [ebp + 0x7e20323e]
xor ebx, dword [edi + 0x75]
mov ebx, 0x77eeebac
inc cl
enter 0xffffffffffffc812, 0xffffffffffffff8f
cmpsd dword [esi], dword es:[edi]
push cx
popfd
push ebx
pushfd
test byte [0x1003e47e], 0x9c
jne 0x1003e47f
and dh, dh
in eax, 0x82
dec eax
dec ebp
aaa
fisub word [eax]
xor byte [ebx - 0x17], ah
inc ebp
jl 0x1003e45f
jmp [ebp + edx + 0x8c1fbce]
lodsb al, byte [esi]
adc eax, 0x8c1fbce
mov dh, byte [edx + 0x12]
lodsb al, byte [esi]
inc ebx
mov bh, 5
dec ecx
push edi
lodsb al, byte [esi]
fidivr dword [edx]
mov dl, 0x96
sahf
adc byte [esi + edx*4], dh
stc
div dword [ecx]
dec ecx
or byte [ecx + 0x7c], al
popfd
call fcn.1011f130
push str.c_90866.tmp
push ebx
call fcn.1011f130
add esp, 0x10
mov ecx, esi
call fcn.10039cf1
pushfd
test byte [0x1003e4cc], 0x3b
jne 0x1003e5cd
lodsb al, byte [esi]
mov esi, 0xbe15300b
fisttp dword [edx - 0x6d]
and al, 0x78
insd dword es:[edi], dx
pop edx
cwde
aam 0x94
stosb byte es:[edi], al
add eax, 0x646dc11a
xchg ecx, eax
mov ecx, 0x345d6b7f
or ebx, eax
push 0xbbcf0061
add al, 0xf7
pop eax
xor ebx, esi
xor eax, 0x20942ed4
push ebp
stosb byte es:[edi], al
cdq
dec esp
mov bh, 0x54
lodsb al, byte [esi]
add eax, 0xcfa431cf
cmpsb byte [esi], byte es:[edi]
scasb al, byte es:[edi]
mov edx, 0x64736a2a
dec eax
cvtpi2ps xmm4, qword [esi + ebp*4]
enter 0xffffffffffff9211, 0xffffffffffffffc8
sub esp, dword [0xb0e50bde]
lodsd eax, dword [esi]
aaa
xchg esi, eax
ficomp word [ebx - 0x21ff5776]
adc dword [eax], ebp
jae 0x1003e4fa
pop es
pop eax
pop ss
imul ebp, dword [eax - 0x4ca91ae2], 0x67
sub al, 0x1a
dec eax
sub eax, 0x9e3b2a9c
cld
mov ecx, 0x57b86722
inc edx
cld
ja 0x1003e543
pop ecx
or ch, byte [ecx + 0xe98c1db]
pop ecx
sahf
jbe 0x1003e5a2
adc al, 0x59
jae 0x1003e5ae
jp 0x1003e572
cmp eax, 0x9dd07c31
xor dword [eax + edx*8 - 0x63], edi
sbb ebp, edx
push eax
pushal
ja 0x1003e522
ja 0x1003e552
jo 0x1003e533
out dx, eax
je 0x1003e5b2
xchg edx, eax
insd dword es:[edi], dx
adc dword [edi + ebp*8], 0x4102e4d2
pop edx
stc
xlatb
out dx, eax
mov dword [ebp + ecx + 0x35], ebx
rol byte [ebx - 0x33], cl
rcr byte [esi + 0x59], 1
int 0xd0
pop esi
pop ecx
push ss
mov esp, 0x38d89b25
add dword [ebx + 0xe], ebp
pop esp
jnp 0x1003e5b9
cmp al, 0x65
add al, 0xdc
int 0xbd
and esi, dword [ebp + 0x35d5ab44]
mov ch, 0x44
stosd dword es:[edi], eax
aad 0x35
mov esp, 0x825666cf
xor al, 0x94
fnstcw word [edx - 0xc45d4bb]
mov edi, esi
into
in al, 0xec
mov dl, 0x2c
in eax, 6
jo 0x1003e5e8
pop esp
mov ebx, 0x5cf87506
salc
mov byte [ecx - 0x7c], 0x48
and esp, edx
sub dword [ebx], eax
xchg esi, eax
jns 0x1003e559
aam 0x29
add edx, dword [esi - 0x25104887]
test al, 0x75
cmp edx, dword [edi]
pop ecx
out dx, eax
fisubr dword [eax + 0x59173b75]
mul edi
xlatb
arpl cx, dx
aam 0xe8
pop ss
jb 0x1003e59c
jmp 0x7388ad39
add bh, 0x84
arpl bx, bx
mov eax, dword [0xeed8a269]
bound esp, qword [0xfff2bb1c]
imul esp, dword [edx + 0x2562eed8], 0xfff2bb1c
sbb ebp, esi
pop es
sahf
shl byte [edi - 0x1037ac3f], 1
enter 0xffffffffffff9def, 0xffffffffffffff83
or byte [eax], al
popfd
and dword [esi + 8], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1011e48a
leave
ret
adc byte [edx + 0x10e850f], dl
add byte [eax], al
cmpsb byte [esi], byte es:[edi]
xchg esi, eax
mov cl, 0xff
stosb byte es:[edi], al
mov ebp, fs
cmc
les ebp, [eax - 0x69]
sub esp, esi
mov ch, 0xb3
push ecx
mov ebx, 0xb1c37140
or cl, bh
stc
jbe 0x1003e5cb
call 0xc11269cb
inc ebp
inc eax
mov al, byte [0x13153f39]
lodsd eax, dword [esi]
cmpsd dword [esi], dword es:[edi]
cmpsb byte [esi], byte es:[edi]
loop 0x1003e620
dec ecx
test eax, 0xa749972f
mov eax, 0x4d35b267
stosb byte es:[edi], al
pushfd
shl dh, 1
insd dword es:[edi], dx
cmp ah, cl
xor ebx, eax
pop ss
xchg ecx, eax
jno 0x1003e606
cdq
push es
dec esi
call 0x9a9f2456
jl 0x1003e64e
xchg edi, eax
mov dword [0x35e3573], eax
jne 0x1003e6aa
jae 0x1003e69d
dec edx
adc eax, 0x7cee2794
mov edi, 0x9a98f714
adc dh, byte [eax]
stc
neg dword [eax - 0x6cfed66]
jle 0x1003e5f4
push ds
sbb edx, ecx
ja 0x1003e616
or eax, 0x205d6478
jge 0x1003e61b
les esi, [eax + 0x24]
push esi
inc edx
inc edx
pop ds
cmp bh, byte [esi]
mov eax, 0xf6e1f730
sbb eax, 0xc039b847
int3
or eax, esi
pop edx
push edi
mov dword [ecx + 0xedf15f6], 0x8520d8e9
outsd dx, dword [esi]
sbb eax, 0x8a462b5d
xchg edx, eax
in al, dx
into
adc byte [edx - 0x66], ch
mov dh, 0x46
sub dword [esi - 0xa], ebx
imul edx, dword [edx - 0x4d], 0xa6052aa0
sub al, 0xbf
imul ebp, dword [ebx], 0xffffffbd
test byte [0x37461620], bh
cmp eax, 0x37461620
nop
jl 0x1003e67b
xor dword [eax + 0x76], ecx
dec ebp
cdq
adc byte [ecx - 0x5d], al
inc esp
xor esp, dword [ebx + 0x3eb6e97a]
dec ebx
push eax
xchg dword [ebp + 0x56], esi
jl 0x1003e660
fbld tbyte [0x42ddaff6]
test dword [edi + esi*2], ecx
pop esp
and edi, dword [ebx - 0x7bfa92f3]
adc dl, cl
imul esp, dword [bx + si], 0x1e
and byte [eax - 0x64], 0x1c
push ebp
int3