Function at 0x1006df00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov eax, edx
mov dword [ebp - 0x10], ecx
xor esi, esi
mov dword [ebp - 0xc], eax
push edi
test eax, eax
je 0x1006df85
mov edx, 0x108
lea edi, [eax + 3]
nop
movzx eax, byte [edi - 3]
lea edi, [edi + 4]
movzx ecx, byte [edi - 6]
add esi, eax
movzx eax, byte [edi - 5]
dec edx
shl ecx, 8
add esi, ecx
movzx ecx, byte [edi - 4]
shl ecx, 8
add ecx, eax
mov eax, esi
shl eax, 0x10
shl ecx, 0xb
xor ecx, eax
xor esi, ecx
mov eax, esi
shr eax, 0xb
add esi, eax
test edx, edx
jg 0x1006df20
lea eax, [esi*8]
xor esi, eax
mov eax, esi
shr eax, 5
add esi, eax
mov eax, esi
shl eax, 4
xor esi, eax
mov eax, esi
shr eax, 0x11
add esi, eax
mov eax, esi
shl eax, 0x19
xor esi, eax
mov ebx, esi
shr ebx, 6
add ebx, esi
jmp 0x1006df87
xor ebx, ebx
mov dword [ebp - 0x14], ebx
call fcn.1006d990
mov ecx, dword [eax]
mov edi, ecx
mov eax, dword [edi + 4]
cmp byte [eax + 0xd], 0
jne 0x1006dfbd
nop dword [eax]
cmp dword [eax + 0x10], ebx
jae 0x1006dfaa
mov eax, dword [eax + 8]
jmp 0x1006dfae
mov edi, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x1006dfa0
cmp edi, ecx
je 0x1006dfbd
cmp ebx, dword [edi + 0x10]
jae 0x1006dfbf
mov edi, ecx
cmp edi, ecx
je 0x1006e00c
mov eax, dword [edi + 0x14]
mov esi, dword [eax]
mov eax, dword [eax + 4]
cmp esi, eax
je 0x1006e00c
nop
mov edx, dword [esi]
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 8], 0x41c
nop dword [eax]
mov ecx, dword [edx]
cmp ecx, dword [ebx]
jne 0x1006e005
add edx, 4
add ebx, 4
sub dword [ebp - 8], 4
jae 0x1006dfe0
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, dword [edi + 0x14]
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], edx
mov esi, dword [esi]
jmp 0x1006e00e
add esi, 4
cmp esi, eax
jne 0x1006dfd0
xor esi, esi
mov ebx, dword [ebp - 0x10]
mov edi, ebx
test esi, esi
je 0x1006e058
movzx edx, word [ebx + 0x43e]
add esi, 0x420
mov ecx, 0x110
rep movsd dword es:[edi], dword [esi]
mov ax, word [ebx + 0x43e]
xor ax, dx
and ax, 3
xor ax, word [ebx + 0x43e]
movzx eax, ax
xor edx, eax
and edx, 0xc
xor edx, eax
mov word [ebx + 0x43e], dx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0xc]
xor eax, eax
mov word [ebx + 0x43c], ax
mov ecx, 0x108
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call fcn.100707b0
mov ax, word [ebx + 0x43e]
lea edi, [ebx + 0x24]
and ax, 0xffdf
or ax, 0x10
movzx eax, ax
and eax, 0xffffff7f
or eax, 0x40
xor esi, esi
mov word [ebx + 0x43e], ax
lea eax, [ebx + 0x420]
mov dword [ebp - 8], eax
mov al, byte [edi - 0x10]
mov ecx, edi
mov byte [ebp - 1], al
cmp al, 2
jne 0x1006e0b6
mov edx, esi
call fcn.1001edf0
jmp 0x1006e0bb
call fcn.10078570
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x1006e0c6
or ecx, eax
jmp 0x1006e0d4
mov eax, ecx
or eax, 0x80000000
cmp byte [ebp - 1], 2
cmove ecx, eax
mov eax, dword [ebp - 8]
mov dword [eax], ecx
test esi, esi
jle 0x1006e11c
push esi
lea edx, [esi - 1]
mov ecx, ebx
call fcn.10070860
add esp, 4
test eax, eax
je 0x1006e11c
mov ax, word [ebx + 0x43e]
and ax, 0xffcf
mov word [ebx + 0x43e], ax
movzx ecx, ax
mov eax, dword [edi - 0xa8]
cmp eax, dword [edi - 0x14]
je 0x1006e11c
and ecx, 0xffffff3f
mov word [ebx + 0x43e], cx
add dword [ebp - 8], 4
inc esi
add edi, 0x94
cmp esi, 7
jl 0x1006e0a1
push ebx
push dword [ebp - 0xc]
push dword [ebp - 0x14]
call fcn.1006d990
mov ecx, eax
call fcn.1006da40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret