Function at 0x70a41810
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x38c
mov eax, dword [esp + 0x3a8]
sar eax, 5
mov dword [esp + 0x14], eax
add eax, 6
mov dword [esp + 0x1c], eax
mov eax, dword [0x70a7121c]
test eax, eax
jne 0x70a41a32
mov byte [esp + 0x287], 1
mov byte [esp + 0x188], 1
mov byte [esp + 0x89], 0
xor edx, edx
mov eax, 3
nop
inc edx
cmp edx, 0xff
je 0x70a41894
mov byte [esp + edx + 0x287], al
mov byte [esp + edx + 0x188], al
mov byte [esp + eax + 0x88], dl
lea ecx, [eax + eax]
xor eax, ecx
cmp eax, 0xff
jle 0x70a4185c
xor eax, 0x11b
inc edx
cmp edx, 0xff
jne 0x70a41865
xor ecx, ecx
xor dl, dl
mov edi, 0xff
lea esi, [esi]
mov ebx, edx
shl ebx, 4
lea eax, [edx + edx]
lea esi, [edx*4]
xor eax, esi
xor eax, edx
shl edx, 3
xor eax, edx
xor eax, ebx
mov edx, eax
xor edx, 0x63
sar eax, 8
xor edx, eax
and edx, 0xff
mov byte [edx + 0x70a6f020], cl
mov byte [ecx + 0x70a70120], dl
inc ecx
cmp ecx, 0x100
je 0x70a418f5
movzx eax, byte [esp + ecx + 0x88]
mov edx, edi
sub edx, eax
movzx edx, byte [esp + edx + 0x188]
jmp 0x70a418a0
movzx ebp, byte [esp + 0x96]
movzx edi, byte [esp + 0x91]
movzx esi, byte [esp + 0x95]
movzx ebx, byte [esp + 0x93]
mov dword [esp + 8], ebx
xor edx, edx
nop
movzx eax, byte [edx + 0x70a6f020]
test al, al
je 0x70a41994
movzx ecx, byte [esp + eax + 0x88]
lea eax, [esp + 0x388]
add ecx, eax
movzx eax, byte [edi + ecx - 0x200]
shl eax, 8
movzx ebx, byte [esi + ecx - 0x200]
shl ebx, 0x10
or eax, ebx
movzx ebx, byte [ebp + ecx - 0x200]
or eax, ebx
mov ebx, dword [esp + 8]
movzx ecx, byte [ebx + ecx - 0x200]
shl ecx, 0x18
or eax, ecx
mov dword [edx*4 + 0x70a6f120], eax
mov ecx, eax
ror ecx, 0x18
mov dword [edx*4 + 0x70a6f520], ecx
mov ecx, eax
ror ecx, 0x10
mov dword [edx*4 + 0x70a6f920], ecx
ror eax, 8
mov dword [edx*4 + 0x70a6fd20], eax
inc edx
cmp edx, 0x100
jne 0x70a4191c
movzx ebp, byte [esp + 0x8a]
movzx edi, byte [esp + 0x89]
movzx esi, byte [esp + 0x8b]
xor eax, eax
nop
movzx edx, byte [eax + 0x70a70120]
test dl, dl
je 0x70a41a2a
movzx ecx, byte [esp + edx + 0x88]
lea edx, [esp + 0x388]
add ecx, edx
movzx ebx, byte [edi + ecx - 0x200]
mov edx, ebx
shl edx, 8
shl ebx, 0x10
or edx, ebx
movzx ebx, byte [ebp + ecx - 0x200]
or edx, ebx
movzx ecx, byte [esi + ecx - 0x200]
shl ecx, 0x18
or edx, ecx
mov dword [eax*4 + 0x70a70220], edx
mov ecx, edx
ror ecx, 0x18
mov dword [eax*4 + 0x70a70620], ecx
mov ecx, edx
ror ecx, 0x10
mov dword [eax*4 + 0x70a70a20], ecx
ror edx, 8
mov dword [eax*4 + 0x70a70e20], edx
inc eax
cmp eax, 0x100
jne 0x70a419bc
cmp dword [esp + 0x3a8], 0x80
je 0x70a41a5d
cmp dword [esp + 0x3a8], 0xc0
je 0x70a41a5d
cmp dword [esp + 0x3a8], 0x100
jne 0x70a41ddb
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x3a0]
mov dword [edi + 0x110], ebx
mov edi, dword [esp + 0x14]
shl edi, 2
mov dword [esp + 8], edi
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
mov edi, eax
mov esi, dword [esp + 0x3a4]
mov ecx, dword [esp + 8]
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x20], edi
mov edi, dword [esp + 0x3a0]
mov esi, dword [esp + 0x3a4]
mov ecx, dword [esp + 8]
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x14]
add eax, 7
mov dword [esp + 0x24], eax
shl eax, 4
mov dword [esp + 0x18], eax
cmp dword [esp + 8], eax
jge 0x70a41bb0
mov edx, dword [esp + 0x14]
dec edx
mov dword [esp + 0xc], edx
mov ebp, dword [esp + 8]
mov dword [esp + 0x10], 0
lea esi, [esi]
mov eax, dword [esp + 0xc]
movzx edx, byte [esp + eax*4 + 0x39]
mov cl, byte [edx + 0x70a70120]
xor ecx, dword [esp + 0x38]
mov byte [esp + 0x38], cl
movzx edx, byte [esp + eax*4 + 0x3a]
mov dl, byte [edx + 0x70a70120]
xor byte [esp + 0x39], dl
movzx edx, byte [esp + eax*4 + 0x3b]
mov dl, byte [edx + 0x70a70120]
xor byte [esp + 0x3a], dl
movzx edx, byte [esp + eax*4 + 0x38]
mov dl, byte [edx + 0x70a70120]
xor byte [esp + 0x3b], dl
mov edx, dword [esp + 0x10]
xor cl, byte [edx + 0x70a60068]
mov byte [esp + 0x38], cl
inc edx
mov dword [esp + 0x10], edx
cmp dword [esp + 0x14], 1
jle 0x70a41b8d
cmp dword [esp + 0x14], 8
je 0x70a41c30
movzx edi, byte [esp + 0x3b]
mov al, byte [esp + 0x3a]
mov bl, byte [esp + 0x39]
lea edx, [esp + 0x3c]
mov byte [esp + 3], bl
mov esi, ecx
mov cl, al
mov eax, edi
mov edi, dword [esp + 0x20]
mov bl, byte [edx]
xor esi, ebx
mov ebx, esi
mov byte [edx], bl
mov bl, byte [edx + 1]
xor byte [esp + 3], bl
mov bl, byte [esp + 3]
mov byte [edx + 1], bl
xor cl, byte [edx + 2]
mov byte [edx + 2], cl
xor al, byte [edx + 3]
mov byte [edx + 3], al
add edx, 4
cmp edx, edi
jne 0x70a41b64
mov edx, dword [esp + 0x3a0]
add edx, ebp
mov edi, edx
mov esi, dword [esp + 4]
mov ecx, dword [esp + 8]
rep movsb byte es:[edi], byte [esi]
add ebp, dword [esp + 8]
cmp ebp, dword [esp + 0x18]
jl 0x70a41adc
mov eax, dword [esp + 0x3ac]
test eax, eax
jne 0x70a41ca3
mov eax, dword [esp + 0x24]
sar eax, 1
test eax, eax
jle 0x70a41c21
mov ebx, dword [esp + 0x1c]
shl ebx, 4
add ebx, dword [esp + 0x3a0]
mov ebp, dword [esp + 0x3a0]
mov edx, dword [esp + 0x14]
shl edx, 4
lea edx, [ebp + edx + 0x60]
shl eax, 4
sub edx, eax
mov dword [esp + 8], edx
lea edx, [esp + 0x28]
mov eax, edx
mov edi, edx
mov esi, ebx
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov edi, ebx
mov esi, ebp
mov cl, 4
rep movsd dword es:[edi], dword [esi]
mov edx, eax
mov edi, ebp
mov esi, eax
mov cl, 4
rep movsd dword es:[edi], dword [esi]
sub ebx, 0x10
add ebp, 0x10
cmp ebx, dword [esp + 8]
jne 0x70a41bf8
xor eax, eax
add esp, 0x38c
pop ebx
pop esi
pop edi
pop ebp
ret
lea edx, [esp + 0x3c]
mov ecx, 2
jmp 0x70a41c60
mov bl, byte [edx - 4]
xor byte [edx], bl
mov al, byte [edx - 3]
xor byte [edx + 1], al
mov bl, byte [edx - 2]
xor byte [edx + 2], bl
mov al, byte [edx - 1]
xor byte [edx + 3], al
cmp ecx, 7
jg 0x70a41b8d
inc ecx
add edx, 4
cmp ecx, 5
jne 0x70a41c3c
movzx eax, byte [esp + 0x44]
mov al, byte [eax + 0x70a70120]
xor byte [esp + 0x48], al
movzx eax, byte [esp + 0x45]
mov al, byte [eax + 0x70a70120]
xor byte [esp + 0x49], al
movzx eax, byte [esp + 0x46]
mov al, byte [eax + 0x70a70120]
xor byte [esp + 0x4a], al
movzx eax, byte [esp + 0x47]
mov al, byte [eax + 0x70a70120]
xor byte [esp + 0x4b], al
jmp 0x70a41c5c
cmp dword [esp + 0x1c], 1
jle 0x70a41c21
mov ebx, dword [esp + 0x3a0]
mov ebp, 1
lea edi, [esp + 0x78]
mov dword [esp + 0xc], edi
lea eax, [esp + 0x58]
mov dword [esp + 8], eax
nop
lea esi, [ebx + 0x10]
mov edi, dword [esp + 0xc]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x70a70120
xor edx, edx
lea eax, [esp + 0x68]
call sym._subshift
movzx eax, byte [esp + 0x6d]
movzx edx, byte [esp + 0x68]
mov eax, dword [eax*4 + 0x70a6f520]
xor eax, dword [edx*4 + 0x70a6f120]
movzx edx, byte [esp + 0x72]
xor eax, dword [edx*4 + 0x70a6f920]
movzx edx, byte [esp + 0x77]
xor eax, dword [edx*4 + 0x70a6fd20]
mov dword [esp + 0x58], eax
movzx eax, byte [esp + 0x71]
movzx edx, byte [esp + 0x6c]
mov eax, dword [eax*4 + 0x70a6f520]
xor eax, dword [edx*4 + 0x70a6f120]
movzx edx, byte [esp + 0x76]
xor eax, dword [edx*4 + 0x70a6f920]
movzx edx, byte [esp + 0x6b]
xor eax, dword [edx*4 + 0x70a6fd20]
mov dword [esp + 0x5c], eax
movzx eax, byte [esp + 0x75]
movzx edx, byte [esp + 0x70]
mov eax, dword [eax*4 + 0x70a6f520]
xor eax, dword [edx*4 + 0x70a6f120]
movzx edx, byte [esp + 0x6a]
xor eax, dword [edx*4 + 0x70a6f920]
movzx edx, byte [esp + 0x6f]
xor eax, dword [edx*4 + 0x70a6fd20]
mov dword [esp + 0x60], eax
movzx eax, byte [esp + 0x69]
movzx edx, byte [esp + 0x74]
mov eax, dword [eax*4 + 0x70a6f520]
xor eax, dword [edx*4 + 0x70a6f120]
movzx edx, byte [esp + 0x6e]
xor eax, dword [edx*4 + 0x70a6f920]
movzx edx, byte [esp + 0x73]
xor eax, dword [edx*4 + 0x70a6fd20]
mov dword [esp + 0x64], eax
lea edi, [ebx + 0x10]
mov esi, dword [esp + 8]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
inc ebp
add ebx, 0x10
cmp dword [esp + 0x1c], ebp
jne 0x70a41ccc
jmp 0x70a41c21
mov eax, 0xffffffff
jmp 0x70a41c23