Function at 0x10006db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [ebp + 8]
push ebx
lea ecx, [eax + 0x352]
push esi
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], ecx
cmp eax, ecx
ja 0x10006e3e
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x18]
jmp 0x10006de0
mov edi, dword [ebp + 0x14]
mov ecx, dword [esp + 0x14]
cmp eax, 0x7a16
ja 0x100072cf
je 0x100072be
cmp eax, 0x4c4a
ja 0x10006f9e
je 0x100072b3
add eax, 0xffffb43e
cmp eax, 0x66
ja case.0x10006e1e.19395
movzx eax, byte [eax + 0x10007454]
jmp dword [eax*4 + 0x10007440]
xor edx, edx
cmp esi, edx
jne 0x10006e58
mov ecx, 0x5423
mov eax, ecx
sub eax, 0x5423
je 0x10006e49
sub eax, 0x36
jne 0x10006e4d
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x10], edx
add ecx, 0x36
cmp ecx, 0x5459
jbe 0x10006e30
mov ecx, dword [0x1006d550]
test ecx, ecx
je case.0x10006e1e.19395
call fcn.1003ad80
jmp case.0x10006e1e.19395
mov edx, dword [ebx]
not edx
mov dword [ebx], edx
cmp dword [edi], 8
jb case.0x10006e1e.19395
nop
xor ecx, ecx
lea edx, [ecx + 6]
cmp ecx, 0xe1
ja case.0x10006e94.1
movzx eax, byte [ecx + 0x100074cc]
jmp dword [eax*4 + 0x100074bc]
movzx edi, byte [esi]
mov eax, dword [ebx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1006eb80]
mov dword [ebx], eax
movzx edi, byte [esi + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1006eb80]
add esi, 2
jmp 0x10006eec
add dword [edi], 0xfffffff8
jmp case.0x10006e94.1
movzx edi, byte [esi]
mov eax, dword [ebx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x1006eb80]
inc esi
mov edi, dword [ebp + 0x14]
mov dword [ebx], eax
add ecx, 0x2d
dec edx
jne 0x10006e85
cmp dword [edi], 8
jae 0x10006e80
jmp case.0x10006e1e.19395
cmp dword [edi], 0
je case.0x10006e1e.19395
lea ebx, [ebx]
movzx ecx, byte [esi]
mov eax, dword [ebx]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x1006eb80]
inc esi
mov dword [ebx], eax
dec dword [edi]
jne 0x10006f10
jmp case.0x10006e1e.19395
mov ecx, 0x7d78
jmp 0x10006f40
mov eax, ecx
sub eax, 0x7d78
je 0x10006f86
sub eax, 0x3f
jne 0x10006f8e
cmp byte [esp + 0x28], al
je 0x10006f6d
mov eax, 0x109
cmp eax, eax
je 0x100073f4
add eax, 0x35
cmp eax, 0x109
jbe 0x10006f5b
jmp 0x10006f8e
mov eax, 0x4411
cmp eax, eax
je 0x1000740b
add eax, 0x5d
cmp eax, 0x4411
jbe 0x10006f74
jmp 0x10006f8e
mov dword [esp + 0x28], 1
add ecx, 0x3f
cmp ecx, 0x7db7
jbe 0x10006f40
jmp case.0x10006e1e.19395
cmp eax, 0x4c6c
je 0x1000729c
cmp eax, 0x5f1d
je 0x100070b0
cmp eax, 0x79f4
jne case.0x10006e1e.19395
xor esi, dword [ebp - 0x749404bb]
push es
cmp eax, 0x7f
jg 0x10006ffc
mov ecx, 0x12ae
mov eax, ecx
sub eax, 0x12ae
je 0x10006fe4
sub eax, 8
jne 0x10006fec
mov dword [esp + 0x1c], eax
jmp 0x10006fec
mov dword [esp + 0x14], 0
add ecx, 8
cmp ecx, 0x12b6
jbe 0x10006fd0
jmp case.0x10006e1e.19395
cmp eax, 0x7ff
jg 0x10007030
mov eax, 0x592
cmp eax, eax
jne 0x10007021
out 5, eax
stosd dword es:[edi], eax
scasd eax, dword es:[edi]
lahf
mov dword [esp + 0x14], 1
mov dword [esp + 0x1c], 0xc0
add eax, 0x40
cmp eax, 0x592
jbe 0x1000700a
jmp case.0x10006e1e.19395
cmp eax, 0xffff
jg 0x10007077
mov ecx, 0x6b2c
mov edx, 2
mov eax, ecx
sub eax, 0x6b2c
je 0x1000705e
sub eax, 0x16
jne 0x10007067
pop edi
add eax, 0xc7d2c83c
inc esp
and al, 0x1c
loopne 0x1000705a
add byte [eax], al
jmp 0x10007067
pop esi
sbb byte [edi - 0x59], ch
sbb eax, 0x14245489
add ecx, 0x16
cmp ecx, 0x6b42
jbe 0x10007041
jmp case.0x10006e1e.19395
mov ecx, 0x437d
lea esp, [esp]
mov eax, ecx
sub eax, 0x437d
je 0x10007098
sub eax, 0x4e
jne 0x100070a0
mov dword [esp + 0x1c], 0xf0
jmp 0x100070a0
mov dword [esp + 0x14], 3
add ecx, 0x4e
cmp ecx, 0x43cb
jbe 0x10007080
jmp case.0x10006e1e.19395
mov eax, dword [edi]
inc eax
cmp eax, 0x3f
ja case.0x100070c3.0
movzx edx, byte [eax + 0x100075c8]
jmp dword [edx*4 + 0x100075b0]
mov eax, 0x732f
cmp eax, eax
je 0x10007259
add eax, 0x45
cmp eax, 0x732f
jbe 0x100070d1
mov edi, 0x36e3
mov eax, edi
sub eax, 0x3718
je 0x100070fa
sub eax, 0x35
je 0x10006e3e
jmp 0x1000710e
push 0x3f
mov eax, ebx
call fcn.1002b7a0
add esp, 4
mov dword [esp + 0x10], 2
add byte [ebx - 0x7eca39], al
dec ebp
aaa
add byte [eax], al
add edi, 0x35
cmp edi, 0x374d
jbe 0x100070e6
mov edi, 0x241d
mov eax, edi
sub eax, 0x241d
je 0x1000714b
sub eax, 4
je 0x10007141
sub eax, 4
jne 0x10007157
jns 0x1000710d
push esi
push esi
inc esi
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x10], 2
jmp 0x10007157
push 0x40
mov eax, ebx
call fcn.1002b7a0
add esp, 4
add edi, 4
cmp edi, 0x2425
jbe 0x1000711e
xor edi, edi
cmp edi, 0xe4
ja case.0x10007173.1
movzx eax, byte [edi + 0x1000761c]
jmp dword [eax*4 + 0x10007608]
jl 0x100071eb
mov byte [edx + 0xc458baf], ah
mov ecx, ebx
mov byte [esi + 0x80], 1
call fcn.10031800
jmp case.0x10007173.1
in al, dx
inc ebp
pop ss
push 0x2444c7da
adc byte [eax], al
add byte [eax], al
add bl, ch
adc al, 0x6a
push 0x27
push 0x27
push ebx
call fcn.1003afd0
push 0
mov eax, ebx
call fcn.1002b7a0
add esp, 0xc
add edi, 0x4c
lea ecx, [edi + 0x26d9]
cmp ecx, 0x27bd
jbe 0x10007164
mov edi, 0x2f0
cmp edi, 0x374
ja 0x10007210
je 0x10007204
mov eax, edi
sub eax, 0x2f0
je 0x100071f7
sub eax, 0x42
jne 0x10007231
push eax
mov eax, ebx
call fcn.1002b7a0
add esp, 4
mov byte [esi + 0x80], 1
jmp 0x10007231
push 0x22
push ebx
call fcn.1003afd0
add esp, 8
jmp 0x10007231
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.10031800
jmp 0x10007231
mov eax, edi
sub eax, 0x3b6
je 0x10007224
sub eax, 0x42
je 0x10006e3e
jmp 0x10007231
push ecx
cmp eax, 0xc7b50aa0
inc esp
and al, 0x10
add byte [eax], al
add byte [eax], al
add edi, 0x42
cmp edi, 0x3f8
jbe 0x100071cb
mov edi, 0x1b5c
mov eax, edi
sub eax, 0x1b5c
je 0x10007273
sub eax, 0x30
je 0x10007265
sub eax, 0x30
jne 0x1000728c
stosb byte es:[edi], al
aam 0x65
daa
mov eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebp, 0xe906023c
mov byte [esi + 0x80], 1
jmp 0x1000728c
xchg ecx, eax
mov al, byte [0x6a4434a5]
and edx, dword [ebx - 0x18]
push eax
cmp eax, 0x426a0003
mov eax, ebx
call fcn.1002b7a0
add esp, 0xc
add edi, 0x30
cmp edi, 0x1bbc
jbe 0x10007241
jmp case.0x10006e1e.19395
mov eax, 0x2e15
cmp eax, eax
je 0x10007432
add eax, 0x39
cmp eax, 0x2e15
jbe 0x100072a3
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
jmp case.0x10006e1e.19395
inc ecx
push ecx
mov ecx, edi
call fcn.1001cf70
add esp, 4
jmp case.0x10006e1e.19395
cmp eax, 0x7fed
ja 0x10007392
je 0x10007367
sub eax, 0x7a38
je 0x1000734d
sub eax, 0x22
je 0x10007306
sub eax, 0x571
jne case.0x10006e1e.19395
mov eax, dword [ebx + 8]
add eax, 0x38
mov dword [esp + 0x18], eax
jmp case.0x10006e1e.19395
les ebx, [ebx - 0x1d]
sbb al, 0xd
mov edi, dword [esp + 0x14]
dec edi
js case.0x10006e1e.19395
mov eax, dword [ebp + 0x14]
lea ecx, [edi + edi*2]
add ecx, ecx
mov dword [esp + 0x20], ecx
mov edx, dword [esi]
sar edx, cl
mov ecx, dword [eax]
mov eax, dword [eax + 4]
and dl, 0x3f
or dl, 0x80
mov byte [ecx + eax], dl
mov ecx, dword [esp + 0x20]
mov eax, dword [ebp + 0x14]
inc dword [eax + 4]
sub ecx, 6
dec edi
mov dword [esp + 0x20], ecx
jns 0x10007322
jmp case.0x10006e1e.19395
mov edx, dword [esi]
mov eax, dword [edi]
lea ecx, [ecx + ecx*2]
add ecx, ecx
sar edx, cl
mov ecx, dword [edi + 4]
or dl, byte [esp + 0x1c]
mov byte [eax + ecx], dl
inc dword [edi + 4]
jmp case.0x10006e1e.19395
mov edx, dword [esp + 0x18]
xor edi, edi
cmp dword [edx + 0x24], edi
jbe case.0x10006e1e.19395
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x20]
mov edx, dword [ecx + edi*4]
push edx
push ebx
call fcn.100317c0
mov eax, dword [esp + 0x20]
inc edi
add esp, 8
cmp edi, dword [eax + 0x24]
jb 0x10007372
jmp case.0x10006e1e.19395
sub eax, 0x800f
je 0x100073c3
sub eax, 0x22
je 0x100073b8
sub eax, 0x22
jne case.0x10006e1e.19395
mov ecx, dword [esp + 0x18]
push ecx
push ebx
call fcn.1000b2e0
add esp, 8
call fcn.1003db30
jmp case.0x10006e1e.19395
mov eax, dword [esp + 0x18]
call fcn.1002ae50
jmp case.0x10006e1e.19395
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 0x20]
push eax
push ebx
call fcn.1003ade0
add esp, 8
mov eax, dword [esp + 0x24]
add eax, 0x22
mov dword [esp + 0x24], eax
cmp eax, dword [esp + 0x2c]
jbe 0x10006de0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi]
mov edx, dword [ebx]
push ecx
push edx
mov edx, esi
call fcn.100146d0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
mov ecx, dword [ebx]
push eax
push ecx
mov ecx, esi
call fcn.1000cee0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
or dword [edi - 0x742e59fd], ebp
inc esp
and al, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx]
pop edi
pop esi
not eax
pop ebx
mov esp, ebp
pop ebp
ret