Function at 0x40a7b7
Capabilities:
Allocate or change rwx memory
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
pushfd
push ebp
mov ebp, esp
sub esp, 0x150
mov dword [ebp - 0x14c], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x13c], esi
mov dword [ebp - 0x140], edi
mov esi, dword [eax + 4]
mov edi, 0xfffffff
sub eax, 4
mov ebx, dword [0x4c7398]
mov dword [ebp - 0xe8], eax
mov eax, dword [esi]
shr eax, 1
and eax, edi
lea ecx, [ebx + eax - 1]
xor edx, edx
mov eax, ecx
div ebx
sub ecx, edx
mov eax, dword [0x4c7398]
mov dword [ebp - 0x84], ecx
mov eax, dword [0x403ef8]
mov dword [ebp - 0x64], eax
mov eax, dword [0x4c7398]
mov eax, dword [0x403ef8]
test eax, eax
je 0x40a8b7
and dword [ebp - 0x70], 0
mov eax, dword [0x403ef8]
dec eax
lea ecx, [eax + 1]
mov edx, ecx
xor eax, eax
test ecx, ecx
je 0x40a86f
mov ebx, dword [0x51b214]
imul ebx, ebx, 0x343fd
add ebx, 0x269ec3
mov dword [0x51b214], ebx
shr ebx, 0x10
shl eax, 0x10
or eax, ebx
shr edx, 0x10
jne 0x40a84a
xor edx, edx
div ecx
cmp dword [ebp - 0x64], 0
jbe 0x40a8b1
mov ecx, 0xffffc390
inc dword [ebp - 0x70]
mov eax, 0x3c6f
lea ebx, [edx*4 + 0x529524]
lock cmpxchg dword [ebx], ecx
cmp eax, 0x3c6f
je 0x40aa8f
lea eax, [edx + 1]
xor edx, edx
mov ecx, dword [0x403ef8]
div ecx
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x64]
jb 0x40a879
xor ebx, ebx
test ebx, ebx
jne 0x40a936
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x74], eax
xor ebx, ebx
inc ebx
push 0x40
push 0x1000
push dword [ebp - 0x84]
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x40aaa3
push eax
call dword [sym.imp.kernel32.dll_Sleep]
cmp ebx, 0x11
jb 0x40a8c2
xor ebx, ebx
cmp dword [0x51b2c4], ebx
ja 0x40a8fe
test ebx, 3
je 0x40a912
test ebx, ebx
je 0x40a910
push 0x8000
push 0
push ebx
call dword [sym.imp.kernel32.dll_VirtualFree]
xor ebx, ebx
push dword [ebp - 0x74]
call dword [sym.imp.kernel32.dll_SetLastError]
test ebx, ebx
je 0x40a81b
mov ecx, dword [ebp - 0x84]
test ecx, ecx
mov eax, ebx
je 0x40a936
mov byte [eax], 0
inc eax
dec ecx
jne 0x40a92f
mov eax, 0xfba2faac
mov eax, dword [esi + 4]
and eax, 7
lea eax, [eax + esi + 8]
mov esi, dword [esi]
shr esi, 1
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x70], eax
and esi, edi
mov edi, 0x400000
lea ecx, [esi + eax]
mov eax, dword [0x4c7398]
sub eax, esi
mov dword [ebp - 0x74], ecx
lea ecx, [eax + 1]
sub dword [ebp - 0x80], edi
mov dword [ebp - 0xd0], esi
mov dword [ebp - 0x64], ecx
xor eax, eax
test ecx, ecx
je 0x40a99e
mov edx, dword [0x51b214]
imul edx, edx, 0x343fd
add edx, 0x269ec3
mov dword [0x51b214], edx
shr edx, 0x10
shl eax, 0x10
or eax, edx
shr dword [ebp - 0x64], 0x10
jne 0x40a978
xor edx, edx
div ecx
add ebx, edx
push ebx
push esi
push dword [ebp - 0x80]
mov dword [ebp - 0xcc], ebx
mov eax, 0xff6e82ee
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x70]
add esp, 0xc
test esi, esi
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0xf0], ecx
mov byte [ebp - 0x55], 0
mov ebx, 0xfffff000
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0x84], eax
je 0x40b0ed
lea eax, [ebp - 0xf0]
push eax
mov eax, 0x3a995906
mov esi, dword [0x402600]
and dword [ebp - 0x60], 0
and dword [ebp - 0x5c], 0
pop ecx
mov eax, 0xfffffff
mov ecx, dword [ebp - 0xec]
and ecx, eax
mov edx, ecx
mov ecx, dword [ebp - 0xf0]
mov dword [ebp - 0x68], edx
and ecx, eax
mov eax, edi
add ecx, edi
sub eax, esi
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0xf4], eax
jne 0x40aaaa
xor edi, edi
test edx, edx
jbe 0x40acf2
mov esi, 0x7fffffff
mov ecx, 0x69bf6243
mov eax, dword [ebp - 0x7c]
mov edx, ecx
movzx eax, byte [eax + edi]
add eax, ecx
add dword [ebp - 0x60], eax
add eax, dword [ebp - 0x5c]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, esi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, esi
add eax, edx
mov edx, ecx
mul edx
add eax, edx
mov edx, ecx
mul edx
add eax, edx
add dword [ebp - 0x60], eax
inc edi
cmp edi, dword [ebp - 0x68]
mov dword [ebp - 0x5c], eax
jb 0x40aa48
jmp 0x40acf2
mov ebx, dword [0x4c7398]
imul ebx, edx
lea ebx, [ebx + section..data]
jmp 0x40a8b3
mov ebx, eax
jmp 0x40a8ee
lea eax, [ecx + edx]
sub ecx, edi
mov esi, ecx
mov edx, dword [0x40003c]
lea edx, [edx + 0x4000a0]
mov dword [ebp - 0x6c], eax
mov eax, dword [edx]
add eax, edi
mov edi, dword [ebp - 0x68]
mov edx, dword [edx + 4]
mov dword [ebp - 0x78], edx
mov edx, ecx
add ecx, edi
mov edi, ecx
and edi, ebx
sub ecx, edi
and edx, ebx
mov dword [ebp - 0xe0], ecx
mov ebx, eax
mov ecx, dword [ebp - 0x78]
mov dword [ebp - 0xe4], edi
add ecx, eax
mov dword [ebp - 0xdc], ecx
sub esi, edx
cmp eax, ecx
je 0x40ab07
cmp dword [ebx], edx
jae 0x40ab07
add ebx, dword [ebx + 4]
cmp ebx, dword [ebp - 0xdc]
jne 0x40aaf8
and dword [ebp - 0xd4], 0
cmp ebx, dword [ebp - 0xdc]
je 0x40ab47
cmp dword [ebx], edx
jne 0x40ab47
mov eax, dword [ebx + 4]
sub eax, 8
shr eax, 1
je 0x40ab47
mov ecx, dword [ebp - 0xd4]
movzx ecx, word [ebx + ecx*2 + 8]
and ecx, 0xfff
cmp ecx, esi
jae 0x40ab47
inc dword [ebp - 0xd4]
cmp dword [ebp - 0xd4], eax
jne 0x40ab24
mov edi, dword [ebp - 0x7c]
mov esi, 0x7fffffff
mov ecx, 0x69bf6243
cmp ebx, dword [ebp - 0xdc]
je 0x40aca7
mov eax, dword [ebx]
cmp eax, dword [ebp - 0xe4]
ja 0x40aca7
mov eax, dword [ebx + 4]
lea edx, [eax - 8]
shr edx, 1
mov eax, dword [ebp - 0xd4]
cmp eax, edx
jne 0x40aba6
add ebx, dword [ebx + 4]
cmp ebx, dword [ebp - 0xdc]
je 0x40aca7
mov eax, dword [ebp - 0xe4]
cmp dword [ebx], eax
ja 0x40aca7
and dword [ebp - 0xd4], 0
jmp 0x40ab6e
mov edx, dword [ebx]
cmp edx, dword [ebp - 0xe4]
jne 0x40abc6
movzx eax, word [ebx + eax*2 + 8]
and eax, 0xfff
cmp eax, dword [ebp - 0xe0]
jae 0x40aca7
mov eax, dword [ebp - 0xd4]
inc dword [ebp - 0xd4]
test word [ebx + eax*2 + 8], 0xf000
je 0x40ab54
movzx eax, word [ebx + eax*2 + 8]
and dword [ebp - 0x7c], 0
and eax, 0xfff
lea eax, [eax + edx + 0x400000]
mov dword [ebp - 0x68], eax
sub dword [ebp - 0x68], edi
mov dword [ebp - 0x78], eax
je 0x40ac46
mov eax, dword [ebp - 0x7c]
movzx eax, byte [eax + edi]
add eax, ecx
mov edx, ecx
add dword [ebp - 0x60], eax
add eax, dword [ebp - 0x5c]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, esi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, esi
add eax, edx
mov edx, ecx
mul edx
add eax, edx
mov edx, ecx
mul edx
add eax, edx
add dword [ebp - 0x60], eax
inc dword [ebp - 0x7c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x68]
jb 0x40abff
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
sub eax, dword [ebp - 0xf4]
mov dword [ebp - 0xf8], eax
xor edi, edi
movzx eax, byte [ebp + edi - 0xf8]
mov edx, ecx
add eax, ecx
add dword [ebp - 0x60], eax
add eax, dword [ebp - 0x5c]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, esi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, esi
add eax, edx
mov edx, ecx
mul edx
add eax, edx
mov edx, ecx
mul edx
add eax, edx
add dword [ebp - 0x60], eax
inc edi
cmp edi, 4
mov dword [ebp - 0x5c], eax
jb 0x40ac59
mov edi, dword [ebp - 0x78]
add edi, 4
jmp 0x40ab54
xor ebx, ebx
mov eax, dword [ebp - 0x6c]
sub eax, edi
mov dword [ebp - 0x6c], eax
je 0x40acf2
movzx eax, byte [edi + ebx]
add eax, ecx
add dword [ebp - 0x60], eax
mov edx, ecx
add eax, dword [ebp - 0x5c]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, esi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, esi
add eax, edx
mov edx, ecx
mul edx
add eax, edx
mov edx, ecx
mul edx
add eax, edx
add dword [ebp - 0x60], eax
inc ebx
cmp ebx, dword [ebp - 0x6c]
mov dword [ebp - 0x5c], eax
jb 0x40acb3
xor edi, edi
xor eax, eax
mov ecx, eax
and ecx, 7
mov cl, byte [ebp + ecx - 0x60]
mov byte [ebp + eax - 0x54], cl
inc eax
cmp eax, 0x10
jb 0x40acf6
mov eax, 0x3da4fdf7
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov edx, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x48]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x10c], eax
mov eax, dword [0x5294e0]
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x108], ecx
mov ecx, dword [eax]
mov dword [ebp - 0x138], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x124], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x110], ecx
lea ecx, [ebp - 0x44]
sub eax, ecx
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0xcc]
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x128], esi
mov dword [ebp - 0x104], edx
mov dword [ebp - 0x100], esi
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x11c], edi
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x6c], eax
lea edi, [ebp - 0xc4]
push 0x10
pop ecx
lea esi, [ebp - 0x138]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xa4]
mov edx, dword [ebp - 0x94]
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x78], 2
lea edi, [edx + esi]
rol edi, 7
mov ebx, dword [ebp - 0xc0]
xor eax, edi
lea edi, [esi + eax]
rol edi, 9
xor ecx, edi
lea edi, [ecx + eax]
rol edi, 0xd
xor edx, edi
lea edi, [ecx + edx]
ror edi, 0xe
xor esi, edi
mov edi, dword [ebp - 0xb0]
add ebx, edi
rol ebx, 7
xor dword [ebp - 0xa0], ebx
mov ebx, dword [ebp - 0xa0]
add edi, ebx
rol edi, 9
xor dword [ebp - 0x90], edi
mov edi, ebx
mov ebx, dword [ebp - 0x90]
add ebx, edi
mov edi, dword [ebp - 0x90]
rol ebx, 0xd
xor dword [ebp - 0xc0], ebx
mov ebx, dword [ebp - 0xc0]
add edi, ebx
mov ebx, dword [ebp - 0x9c]
ror edi, 0xe
xor dword [ebp - 0xb0], edi
mov edi, dword [ebp - 0xac]
add edi, ebx
rol edi, 7
xor dword [ebp - 0x8c], edi
mov edi, ebx
mov ebx, dword [ebp - 0x8c]
add edi, ebx
rol edi, 9
xor dword [ebp - 0xbc], edi
mov edi, ebx
mov ebx, dword [ebp - 0xbc]
add ebx, edi
mov edi, dword [ebp - 0xbc]
rol ebx, 0xd
xor dword [ebp - 0xac], ebx
mov ebx, dword [ebp - 0xac]
add edi, ebx
mov ebx, dword [ebp - 0x88]
ror edi, 0xe
xor dword [ebp - 0x9c], edi
mov edi, dword [ebp - 0x98]
add edi, ebx
rol edi, 7
xor dword [ebp - 0xb8], edi
mov edi, ebx
mov ebx, dword [ebp - 0xb8]
add edi, ebx
rol edi, 9
xor dword [ebp - 0xa8], edi
mov edi, ebx
mov ebx, dword [ebp - 0xa8]
add ebx, edi
rol ebx, 0xd
mov edi, dword [ebp - 0xa8]
xor dword [ebp - 0x98], ebx
mov ebx, dword [ebp - 0x98]
add edi, ebx
ror edi, 0xe
xor dword [ebp - 0x88], edi
mov edi, dword [ebp - 0xb8]
add edi, esi
rol edi, 7
xor dword [ebp - 0xc0], edi
mov edi, dword [ebp - 0xc0]
add edi, esi
rol edi, 9
xor dword [ebp - 0xbc], edi
mov edi, dword [ebp - 0xc0]
mov ebx, dword [ebp - 0xbc]
add ebx, edi
mov edi, dword [ebp - 0xbc]
rol ebx, 0xd
xor dword [ebp - 0xb8], ebx
mov ebx, dword [ebp - 0xb8]
add ebx, edi
mov edi, dword [ebp - 0xb0]
add edi, eax
ror ebx, 0xe
xor esi, ebx
rol edi, 7
xor dword [ebp - 0xac], edi
mov ebx, dword [ebp - 0xac]
mov edi, dword [ebp - 0xb0]
add ebx, edi
mov edi, dword [ebp - 0xac]
rol ebx, 9
xor dword [ebp - 0xa8], ebx
mov ebx, dword [ebp - 0xa8]
add ebx, edi
rol ebx, 0xd
xor eax, ebx
mov edi, dword [ebp - 0xa8]
add edi, eax
mov ebx, dword [ebp - 0xa0]
ror edi, 0xe
xor dword [ebp - 0xb0], edi
mov edi, dword [ebp - 0x9c]
add edi, ebx
rol edi, 7
xor dword [ebp - 0x98], edi
mov edi, dword [ebp - 0x9c]
mov ebx, dword [ebp - 0x98]
add ebx, edi
mov edi, dword [ebp - 0x98]
rol ebx, 9
xor ecx, ebx
add edi, ecx
rol edi, 0xd
mov ebx, dword [ebp - 0x8c]
xor dword [ebp - 0xa0], edi
mov edi, dword [ebp - 0xa0]
add edi, ecx
ror edi, 0xe
xor dword [ebp - 0x9c], edi
mov edi, dword [ebp - 0x88]
add edi, ebx
rol edi, 7
xor edx, edi
mov edi, dword [ebp - 0x88]
add edi, edx
rol edi, 9
xor dword [ebp - 0x90], edi
mov edi, dword [ebp - 0x90]
add edi, edx
rol edi, 0xd
xor dword [ebp - 0x8c], edi
mov edi, dword [ebp - 0x90]
mov ebx, dword [ebp - 0x8c]
add ebx, edi
ror ebx, 0xe
xor dword [ebp - 0x88], ebx
dec dword [ebp - 0x78]
jne 0x40add4
mov dword [ebp - 0x94], edx
push 0x40
xor edx, edx
mov dword [ebp - 0xb4], eax
xor eax, eax
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xc4], esi
pop ebx
mov ecx, dword [ebp + eax - 0x138]
add dword [ebp + eax - 0xc4], ecx
add eax, 4
cmp eax, ebx
jl 0x40b046
lea edi, [ebp - 0x44]
lea esi, [ebp - 0xc4]
inc dword [ebp - 0x118]
cmp dword [ebp - 0xc8], ebx
push 0x10
pop ecx
rep movsd dword es:[edi], dword [esi]
jbe 0x40b0ad
mov eax, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x68]
lea edi, [esi + eax]
lea ecx, [ebp + edx - 0x44]
mov al, byte [ecx + edi]
xor al, byte [ecx]
xor byte [ebp - 0x55], al
inc edx
cmp edx, ebx
mov byte [ecx + esi], al
jb 0x40b080
sub dword [ebp - 0xc8], ebx
add dword [ebp - 0x64], ebx
add esi, ebx
add dword [ebp - 0x84], ebx
mov dword [ebp - 0x68], esi
jmp 0x40ada4
cmp dword [ebp - 0xc8], edx
jbe 0x40b0dd
lea eax, [ebp - 0x44]
mov edi, dword [ebp - 0x64]
mov esi, dword [ebp - 0x84]
sub esi, eax
sub edi, eax
lea ecx, [ebp + edx - 0x44]
mov al, byte [ecx + esi]
xor al, byte [ecx]
xor byte [ebp - 0x55], al
inc edx
cmp edx, dword [ebp - 0xc8]
mov byte [ecx + edi], al
jb 0x40b0c5
mov ebx, 0xfffff000
mov edi, 0x400000
mov esi, dword [ebp - 0xd0]
mov eax, dword [ebp - 0x74]
mov al, byte [eax + 8]
xor al, byte [ebp - 0x55]
je 0x40b185
call fcn.004a5a28
mov edi, eax
mov eax, dword [ebp - 0xe8]
mov edx, 0xffff
lea ecx, [eax + 0xc]
mov dword [eax + 8], 0x4b3c5b
and ecx, 0xfffffffc
and edi, ebx
lea esi, [ecx + 0xfff]
and esi, ebx
xor eax, eax
mov ebx, dword [0x51b214]
imul ebx, ebx, 0x343fd
add ebx, 0x269ec3
mov dword [0x51b214], ebx
shr ebx, 0x10
shl eax, 0x10
or eax, ebx
shr edx, 0x10
jne 0x40b127
mov ebx, 0xffff
xor edx, edx
div ebx
inc edx
cmp ecx, esi
mov eax, ecx
mov dword [ebp - 0x150], edi
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x6c], 0
jae 0x40b17b
mov ecx, dword [ebp - 0x6c]
mov dword [eax], ecx
add eax, 4
cmp eax, esi
jb 0x40b16f
mov eax, 0x4b3c5b
jmp 0x40b261
mov eax, dword [ebp - 0x70]
mov ecx, dword [0x402600]
sub eax, dword [ebp - 0xcc]
mov dword [ebp - 0xd0], eax
sub edi, ecx
mov dword [ebp - 0x74], edi
jne 0x40b1a9
test eax, eax
je 0x40b251
mov edi, dword [ebp - 0xcc]
sub edi, dword [ebp - 0x70]
mov eax, dword [ebp - 0x80]
mov ecx, dword [0x4bebb0]
add eax, esi
xor esi, esi
dec ecx
mov dword [ebp - 0x6c], eax
js 0x40b1ed
lea eax, [esi + ecx]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x4bebb4]
and edx, 0xfffffff
cmp dword [ebp - 0x80], edx
jae 0x40b1e4
lea ecx, [eax - 1]
jmp 0x40b1e9
jbe 0x40b1f1
lea esi, [eax + 1]
cmp ecx, esi
jge 0x40b1c5
mov ebx, esi
jmp 0x40b249
mov ebx, eax
jmp 0x40b249
mov eax, dword [ebx*4 + 0x4bebb4]
mov ecx, eax
and ecx, 0xfffffff
cmp ecx, dword [ebp - 0x6c]
jae 0x40b251
lea esi, [ecx + edi + 0x400000]
mov ecx, eax
shl ecx, 2
sar ecx, 0x1e
sar eax, 0x1e
and ecx, 3
and eax, 3
xor edx, edx
dec ecx
je 0x40b239
dec ecx
je 0x40b231
dec ecx
jne 0x40b242
mov edx, dword [ebp - 0x74]
jmp 0x40b242
mov edx, dword [ebp - 0xd0]
jmp 0x40b242
mov edx, dword [ebp - 0x74]
sub edx, dword [ebp - 0xd0]
dec eax
dec eax
jne 0x40b248
add dword [esi], edx
inc ebx
cmp ebx, dword [0x4bebb0]
jb 0x40b1f5
mov eax, dword [0x4c7398]
mov eax, 0x68006b9d
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0xe8]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x14c]
mov esi, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x144]
mov edi, dword [ebp - 0x140]
mov ebx, dword [ebp - 0x148]
mov edx, dword [ebp - 0x150]
mov esp, ebp
pop ebp
popfd
ret