Function at 0x100b97f2
Capabilities:
Encode data using xor
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, ecx
xor esi, esi
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebx]
sub ecx, esi
push ecx
mov ecx, dword [ebp + 8]
add ecx, esi
push ecx
mov ecx, ebx
call dword [eax + 8]
test eax, eax
jle 0x100b9645
and dword [ebp - 4], 0
push 0xa
add esi, eax
call edi
jmp 0x100b95a9
cmp dword [ebp - 4], 0
jne 0x100b9670
push 0x1f4
pushfd
test byte [0x100b9667], 0xa2
jne 0x100b9668
and cl, byte [edi - 0x48]
cmp bh, dh
or byte [edx], dh
pop ds
jl 0x100b966c
jne 0x100b96a0
mov dh, 0x5a
popfd
call edi
jmp 0x100b95a2
xor bh, bh
invalid
pop edi
pushfd
test byte [0x100b9756], 0x94
je 0x100b9757
add byte [esi + 0x67], cl
in eax, 0x8e
cmp byte [0xb41c1704], 0x14
mov es, word [edx + 0x1c17043d]
mov ah, 0x14
or ah, byte [ebp + 0x7c59e3ca]
out dx, eax
scasd eax, dword es:[edi]
xor byte [esi + ecx*4 + 0xe], dl
cld
xchg ecx, eax
add dh, byte [ebp + 0x3c]
add al, 0x6a
inc ecx
adc eax, 0xfe85c426
clc
jbe 0x100b96ec
xchg esp, eax
add dword [esp + eax*8 + 0x63], ebp
pop esp
inc esi
aam 0x53
jl 0x100b9683
stc
or al, 1
std
sbb ah, byte [esi + 0x7a6f253b]
mov al, 0x58
daa
dec edx
push cs
xor dword [esi + 0x33dfdc68], edi
mov esp, 0x767be47a
push ds
push ebp
fistp dword [edx - 0x38]
aam 0x30
fdiv dword [ecx + 0x46]
pop esi
int 0x56
cmp al, 0xb9
call 0x9d8e8065
jns 0x100b9670
pop esp
rol dl, cl
mov cl, 0xc5
cmp byte [esi - 0x3006050a], 0x1b
imul esp, edi, 0x3b
neg byte [eax + edx*8]
idiv dl
stc
iretd
sbb ebp, dword [ebx - 0x19]
cmp esi, esi
sbb al, 0xd0
fcmovnu st(0), st(7)
mov dword [0x2ead995], eax
and dword [ebp + ebx*2 - 0x2f], edi
scasd eax, dword es:[edi]
sub eax, dword [edx - 0xb752f9e]
xor esp, ebp
cmp ebx, eax
fcmovne st(0), st(1)
leave
mov dl, 0xa8
insb byte es:[edi], dx
imul ebx, eax, 0x77
dec edi
cld
push cs
int 0x2a
xor al, 0xf4
cmp dword [ebx + 0x28c6bd4a], 0x60a9425a
mov eax, dword [0x32cd34a]
sub byte [edx + 0x42], bl
test eax, 0xd34aa160
sub al, 3
sub ch, bh
test al, 0xd3
jb 0x100b9721
popal
sub byte [ebx], dh
clc
sbb al, 6
sbb dword [ecx - 0x5d94e551], 0x43b6c6
jg 0x100b96f0
add ebp, dword [ebx - 0x5c]
stc
lds edx, [esi]
lodsb al, byte [esi]
mov ebp, 0xe42788c8
mov al, byte [0xdaa693d2]
mov al, 0xfa
dec edx
popfd
mov eax, esi
pushfd
test byte [0x100b9795], 0x6f
jne 0x100b9796
fcmovnu st(0), st(1)
adc esi, ebp
mov ah, 0xc1
jns 0x100b97b4
adc al, 0x95
inc esp
xchg ebp, eax
and byte [eax], al
lodsb al, byte [esi]
fimul word [edi]
jnp 0x100b97eb
in al, 0x22
pop ecx
jecxz 0x100b970e
sbb al, 0x76
sub dword [ebx], 0x5fc7a4ed
imul byte [eax + 0x22]
mov dword [ebx + ebp - 0x37dd2320], 0x9e112829
or byte [esi - 0x40], bl
popfd
pop esi
pop ebx
leave
ret 8
test al, 0x7b
add eax, 0xcf7b9094
push ds
scasb al, byte es:[edi]
cmpsb byte [esi], byte es:[edi]
dec ebp
adc byte [0x9717c76d], cl
sbb eax, 0x61417139
xchg ebx, eax
lodsb al, byte [esi]
scasb al, byte es:[edi]
cmpsb byte [esi], byte es:[edi]
mov eax, dword [0xf7906e7a]
pop ss
in eax, 0x10
inc edx
test al, 0x6f
pop es
movsb byte es:[edi], byte [esi]
xor byte [ebx - 0x13], cl
or al, 0xd9
in eax, 0x15
push ds
fldenv [edx + ebx + 0x52]
xor byte [esi], 0xeb
salc
jno 0x100b9828
test dword [0x59ea2d34], edx
popfd
push ebp
mov ebp, esp
pushfd
test byte [0x100b9876], 0x50
jne 0x100b9877
mov al, byte [0x91f9b30c]
sar dword [ebp + 0x32049d64], 0xde
test al, 0x41
aad 5
aaa
dec ebx
xlatb
and dh, byte [edi + 8]
and eax, edx
push 0x29d1898c
neg edx
int3
inc edi
in al, 0xcb
pop ss
dec ebp
xchg ebx, eax
loop 0x100b9859
xchg ebx, eax
inc ebp
adc eax, 0x82449e59
inc esi
je 0x100b9852
cmp dword [edx], esp
in al, 0x7a
xor eax, 0x8fcefc48
dec esp
fldcw word [ecx - 0x23]
sal byte [ecx], cl
bound ecx, qword [edx + 0x6f]
xchg ecx, eax
ja 0x100b9823
push eax
aas
push cs
adc dl, bh
clc
xor byte [ecx + 0x7b401133], ch
das
das
xor eax, 0x4678b0f4
movsb byte es:[edi], byte [esi]
or dword [ebx - 0x2046c226], 0xfffffff4
invalid
popfd
push ebx
pushfd
test byte [0x100b98dc], 0xfa
jne 0x100b98dd
pop edx
pop ds
pop ebx
pop ebp
jge 0x100b98c2
mov ebp, 0xfeb8c301
pushal
je 0x100b98a6
dec edx
psadbw mm6, mm2
pop ss
stosb byte es:[edi], al
mov dl, 1
or ebp, dword [eax + 0x35416ba1]
mov cl, 0xb9
push 0x6b
mov eax, 0xcdc8bd9d
and ecx, dword [ecx + 0xbf1a073]
scasd eax, dword es:[edi]
mov es, ebx
xchg esi, eax
push esp
int 0x23
mov dword [ebx - 0x60], esi
int1
or ebp, dword [edi + 0x5496c38e]
or ax, 0x1f2
cli
jecxz 0x100b98ea
ror bl, 0x45
push edx
pop edi
int3
arpl word [edi], dx
inc ebx
loopne 0x100b9943
or byte [ebx], ah
push esi
stosd dword es:[edi], eax
js 0x100b98ce
xor dword ss:[0x51281c04], edi
xor dword [0x51281c04], edi
pop esp
cmp ebp, dword [ebx - 0x2c499d26]
jle 0x100b9882
popfd
mov ebx, dword [ebp + 8]
pushfd
test byte [0x100b9901], 0x6e
jne 0x100b9a02
test dword [ebx], edx
add dword [eax], eax
add byte [edx], dl
mov edx, 0x780146a4
adc bh, byte [edx + 0x780146a4]
neg ecx
mov edi, 0x28227d9
jno 0x100b9960
dec edx
inc ebp
pop ecx
push ecx
mov word [eax + 0x49], fs
dec ebp
into
cmc
mov ah, 0xa9
rcr dword [ebp + 0x38], 0xfe
mov al, byte [0xf74192f3]
out 0xd, eax
adc edx, ebp
mov bh, ch
pop eax
sbb dword [ecx - 0x1b], edx
out 0xd1, al
sub eax, 0xdc5d2b05
idiv ecx
adc edx, dword [esi + 0x2d]
shl word [eax], 0x9d
daa
jecxz 0x100b999c
sub dl, byte [ebp + 0x2cffdae4]
sar bh, cl
mov dword [0x3dd5b498], eax
sub byte [esi + 0x269da7a2], dl
mov edx, 0x4247965f
mov bl, 0x82
pushfd
cmp bh, byte [edx + ebx*4 + 0x49950e33]
add byte [ecx - 5], ah
sal dh, cl
xor eax, 0xee1a4dad
mov bl, 0xbf
or ebp, dword [edi - 0x68e7c2df]
cmp al, 0xfb
scasd eax, dword es:[edi]
and dword [0xfb3c9718], edi
sub byte [ecx - 0x36], dl
in eax, dx
cmp byte [0xada515a1], 0x1f
adc al, dh
scasd eax, dword es:[edi]
xlatb
in al, 0xc6
mov dl, byte [0xca02c1f8]
pushfd
dec edi
jge 0x100b9948
adc edi, dword [edi + 0x63bfc5c1]
dec edi
xchg esi, eax
cdq
mov dword [0xf1700ab4], eax
sbb byte [0x59e38170], ah
rcl dword [edi - 0x6363e704], 0xa3
cld
aas
test byte [edi - 0x35], bh
pop eax
fld xword [edx]
mov ebp, 0xf4ed36a8
inc ecx
or eax, 0xe3d46dd1
jno 0x100b99b8
pushfd
pushfd
mov dword [0x7f843ffc], eax
retf
ja 0x100b99d6
add esp, esi
mov dword [0xf523f842], eax
push edx
insd dword es:[edi], dx
inc esp
adc bl, byte [ebp - 0x75a8806b]
lahf
adc dword cs:[esi - 0x3e70bfd8], esi
xor al, 0x57
pop eax
aad 0x11
pop ss
push 0x34
or dh, cl
xor al, 8
into
out dx, al
pop edx
aas
inc esi
dec edi
pop esp
xchg ecx, eax
or dword [ecx - 0x23], ebx
in eax, 0xe8
test cl, ch
xchg ebp, eax
ror dword ss:[edi + 0x11c16434], 1
loopne 0x100b9a58
dec edx
pop ecx
cmp dword [eax - 0x48e5cb91], edx
cmp al, 0xa0
mov esp, 0x58892f85
stosb byte es:[edi], al
stosd dword es:[edi], eax
popfd
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
push edi
mov esi, ecx
pushfd
test byte [0x100b9af3], 0x35
jne 0x100b9af4
out 0xd5, eax
sti
sti
aam 0x7e
popfd
pop es
aas
adc al, 0x17
xchg edi, eax
in eax, dx
dec edx
fsubr st(3), st(0)
cmpsd dword [esi], dword es:[edi]
cmp byte [ebx - 0x5667a8e8], dl
push 0xeb7b8610
inc esi
nop
adc al, 0x82
pop esp
push 0x12f5180c
adc dh, al
xlatb
add al, 0x8e
shr byte [esi + 0x38eb09e5], 0xd6
xor al, byte [edx - 0x74df3a11]
salc
lds esp, [eax]
mov edx, esi
xlatb
dec ebp
or ebp, dword [ebx - 0x64bea74d]
inc ecx
jns 0x100b9a08
jo 0x100b9a7a
pushfd
mov ebp, 0x585d3fcf
ja 0x100b9ab7
iretd
dec esp
push esi
adc ch, byte [ebp + 0xd]
and byte [ebp + 0x68], bh
cli
pop ebx
pop esp
mov dl, 0x18
push es
jae 0x100b9a6b
pop esi
adc eax, 0x54db6382
add eax, 0x295d5501
fadd dword [edx - 0x33]
or byte [eax + 0x39fdc111], cl
mov byte [ecx], dl
sar ebp, 0x39
push cs
movsb byte es:[edi], byte [esi]
sti
inc ebp
dec edi
cmp eax, 0xb4234ef
adc byte [eax], bh
lodsb al, byte [esi]
imul ebp, dword [ebx + 0x5ebba926], 0xf
add al, 0x13
sub eax, 0xe5dbb144
add edi, dword [esi + 0x22fae303]
out dx, al
inc esi
fdiv st(1), st(0)
call edx
jns 0x100b9ade
jno 0x100b9a4b
fmul qword [esp + ebp]
mov edx, dword [ecx]
lodsd eax, dword [esi]
push 0xffffffffffffffba
mov ch, 0xb3
inc edx
enter 0x36c9, 0xffffffffffffffc1
sbb esi, dword [edx - 0x65]
mov al, byte [0x851451e5]
popal
neg dh
leave
push esp
mov esi, 0x9554055c
mov ah, 0x94
pop esp
add eax, 0x94b49554
xchg esi, eax
enter 0xffffffffffffabc5, 0xffffffffffffff94
pushal
arpl word ss:[edx + 0x52], ax
xchg esi, eax
jbe 0x100b9a90
inc ebp
jae 0x100b9b5b
popfd
push ebx
push dword [esi + 0xc]
pushfd
test byte [0x100b9b8c], 0xcc
jne 0x100b9b8d
xlatb
add eax, 0xa8aaafaf
sbb dl, byte [ebx]
add cl, byte [edi - 0x634b68fb]
dec ebx
push es
xchg byte [edi + eax*2 - 0x25], bh
insb byte es:[edi], dx
sbb dword [ebp + 0x5aa24f75], edi
ror bl, 1
jbe 0x100b9b78
cmp dh, ah
adc dh, 6
inc esi
cmp al, 0x63
xor al, 0xd
mov bl, 0xce
movsd dword es:[edi], dword fs:[esi]
add dword [ebp + 0x3e396f0d], 0x30
pushal
pop ds
cmp dword [esi], edi
xor byte [eax + 0x1f], ah
in eax, dx
mov ch, 0x77
sub eax, 0x5b8508af
cmp byte [ebx], 0x95
sub eax, dword [ebx - 0x6b]
cmp al, 0xe5
cmc
leave
ror byte [ecx + 0x5cfb162c], cl
mov edi, 0x2832ed91
sub al, dl
or dword [edi], ebp
ror byte [ecx], 1
das
int1
xor al, 0xf1
push ss
mov ah, 0xc4
out 0x10, eax
mov ebx, 0x73390229
xor eax, dword [eax + 0x66e17ed9]
mov dh, 5
push ebx
scasd eax, dword es:[edi]
loop 0x100b9b38
mov ch, 0x28
jnp 0x100b9bbb
sub byte [ebx + 0x40], bh
test eax, 0x29137445
pop ds
dec edi
inc edx
mov al, 0x45
or edx, dword [0xfba6c22c]
popfd
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
adc al, 0x10
test eax, eax
jne 0x100b9ba0
or eax, 0xffffffff
jmp 0x100b9cfa
cmp dword [ebp + 0xc], edi
pushfd
test byte [0x100b9bee], 0x3d
je 0x100b9bef
sbb ax, 0xfbe6
imul esi, dword [ebx + 0x6c83d619], 0x1e
aam 0x56
scasd eax, dword es:[edi]
jns 0x100b9b92
dec eax
inc edx
mov byte [edi], dh
call 0xbed00a79
outsd dx, dword [esi]
push eax
aad 0x8c
adc dword [ebx - 0x7c], ebp
imul edi, esi, 0xffffffc4
cmp dh, byte [edx - 0x585158]
push ebp
cmp esp, dword [ecx]
int 0x9d
dec eax
adc byte [0x8e85b55f], 0xa3
imul eax, eax, 0x25ba2390
out dx, eax
popal
and eax, dword [eax]
popfd
jb 0x100b9bf6
dec edi
mov dword [ebp + 0xc], edi
cmp dword [ebp + 0xc], 0
je 0x100b9c89
pushfd
test byte [0x100b9c6c], 0x42
add eax, 0x100b9c6c
inc edx
jne 0x100b9c6d
xor byte [esi + ecx*4], cl
js 0x100b9c02
sub al, 0xb
sti
mov al, byte [0x3b9f9704]
pop ss
mov dh, 0x46
loopne 0x100b9c96
inc esi
xchg edi, eax
not dword [edi - 0x32]
adc dl, byte [ecx - 0x7f]
mov ah, 0x93
add bh, byte [ebp + esi*2 + 0x5c8d62fe]
push es
mov al, 0x44
mov dword [0xf052398], eax
xchg esp, eax
mov dh, byte [ecx - 0x3318edb4]
pop edi
dec eax
mov eax, 0xace1051c
jge 0x100b9c33
add eax, 0x8a943e0f
mov cl, 0x4c
adc ah, bh
int3
xchg ebp, eax
pushal
adc al, 0x49
in eax, 0xcb
daa
and esp, edx
and dh, byte [esi + 0x67]
fnstenv [ecx]
mov edx, 0xe7191a62
adc edi, dword [edx - 0x56]
out dx, al
ror cl, cl
dec ecx
push ss
out dx, al
adc ebx, esp
add eax, 0x3c4c8a07
test al, 0x3f
push ebp
inc esp
popfd
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
push ebx
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100b9b98
mov eax, dword [ebp + 8]
test eax, eax
je 0x100b9cf7
mov byte [ebx + eax], 0
pushfd
test byte [0x100b9cf5], 0x1b
jne 0x100b9cf6
add eax, 0x100b9cf5
sbb esi, dword [ebp + 0x58]
outsd dx, dword [esi]
int1
xchg esi, eax
aas
pop ds
xchg esi, eax
mov dword [0x46f240d0], eax
pop esi
enter 0x1ae6, 0xffffffffffffffea
and dword [esi], esp
popal
sub ebp, dword [ebx - 0x2e0e287f]
inc ebp
leave
pop ebx
call 0xec6161f8
mov dl, 0x83
xchg ebp, eax
sbb ebp, dword [edi + ebx*2 - 0x261e980e]
pop edi
push eax
in al, dx
adc bl, byte [esp + ebx*8 + 0x67]
xlatb
mov al, 0xe2
cmp dword [esi - 0x5dd43a00], 0x43
push esi
jbe 0x100b9ce4
sti
int3
pop esi
mov eax, dword [0x71d464d6]
push edx
mov byte [edi], dl
salc
mov eax, dword [0xad7a81ff]
test al, 0xf0
popfd
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pushfd
test byte [0x100b9dbc], 0x57
jne 0x100b9dbd
cli
xchg ecx, eax
dec esp
xchg ecx, eax
xchg ecx, eax
mov eax, 0xa682c0f4
in al, dx
dec esi
jae 0x100b9d60
cmp ah, 0xfc
sub al, 0x15
sar dword [edx + 9], cl
test al, 0xdc
aas
into
jb 0x100b9cf7
cdq
insd dword es:[edi], dx
sbb ebp, esp
stosb byte es:[edi], al
mov dword [esi], ebx
aam 0xc9
mov ecx, dword [edi]
leave
adc dword [esi - 0x28], eax
pop ss
adc dword [edx - 0x1638c5fb], 0x582a427c
xchg ecx, eax
popal
jg 0x100b9dbe
invalid
jb 0x100b9d4f
fstp st(7)
dec edi
test al, 0x7f
mov edx, esp
loop 0x100b9d82
xor al, al
enter 0x4993, 0x6e
ror al, 0x93
dec ecx
outsb dx, byte [esi]
jo 0x100b9d6a
movsb byte es:[edi], byte [esi]
movsd dword es:[edi], dword [esi]
push ebp
add byte [ebp + esi*2 + 0x1d], 0x8a
sbb ebx, esp
add esi, dword [edi + 0x47]
jecxz 0x100b9d65
ja 0x100b9dab
cld
int 0x8d
push edi
call 0x9bfdb291
stc
loop 0x100b9d4e
adc eax, 0xe2f98bf2
fsubp st(4)
in al, dx
enter 0x3be4, 0xffffffffffffff98
xchg dword [eax + 0x6f], ebx
pop eax
outsd dx, dword [esi]
pop ecx
jle 0x100b9dd5
xchg edx, eax
xchg esp, eax
push esi
sub bl, byte [ebp - 6]
cli
jnp 0x100b9d8c
jb 0x100b9daa
adc bh, dh
stosd dword es:[edi], eax
sub al, 0xee
leave
push 0x55943cb9
jbe 0x100b9dbb
mov byte [ebx - 6], 0x49
add al, 0x5b
cmp bl, dh
cmpsb byte [esi], byte es:[edi]
sbb dl, cl
loop 0x100b9d77
jo 0x100b9d7d
cdq
sbb bl, byte [ebp + 0x1e5afd28]
mov cl, 0x1f
pop ds
jecxz 0x100b9d3b
xchg ebp, eax
dec edx
push ss
xchg byte [esi], ch
fld dword [ecx + 0x51]
fild word [esi]
mov cl, bl
out 0x95, al
xchg ebp, eax