Function at 0x100013778
Capabilities:
Allocate or change rwx memory
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1b0
mov rax, qword [0x100083348]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0xe0], rdx
mov r15d, 0x8000
lea rax, [0x100000000]
lea r12, [rcx + 0x18]
lea r11, [0x100000000]
mov qword [rsp + 0xf0], rcx
mov ecx, 0xfffffff
mov r13, qword [r12]
mov esi, dword [r13 + 1]
mov edx, dword [r13 + 5]
mov qword [rsp + 0xd8], r12
and rdx, rcx
shr rsi, 2
and rsi, rcx
add rsi, rax
mov eax, dword [0x10000dfa4]
mov rcx, rax
lea rbp, [rax + rdx - 1]
xor edx, edx
mov rax, rbp
mov qword [rsp + 0xe8], rsi
div rcx
sub rbp, rdx
mov eax, dword [0x10000dfa4]
mov eax, dword [0x10000dfa4]
mov eax, dword [0x10001c66c]
test eax, eax
mov r10d, dword [0x10001c66c]
je 0x1000138c2
xor r8d, r8d
xor eax, eax
mov edi, dword [0x10001c66c]
dec edi
inc rdi
mov r9, rdi
je 0x10001387c
mov rcx, qword [0x100082270]
imul rcx, rcx, 0x343fd
shl rax, 0x10
shr r9, 0x10
add rcx, 0x269ec3
mov rdx, rcx
shr rdx, 0x10
movzx edx, dx
or rax, rdx
test r9, r9
jne 0x10001384d
mov qword [0x100082270], rcx
xor edx, edx
div rdi
test r10, r10
je 0x1000138b7
inc r8
mov eax, 0xe941
mov ecx, 0xffff16be
lock cmpxchg dword [r11 + rdx*4 + 0x82500], ecx
je 0x100013b79
lea rax, [rdx + 1]
xor edx, edx
mov ecx, dword [0x10001c66c]
div rcx
cmp r8, r10
jb 0x100013886
xor ebx, ebx
test rbx, rbx
jne 0x1000139e8
call sub.KERNEL32.dll_GetLastError
xor edi, edi
mov r14d, eax
inc rdi
mov rcx, qword [0x100083848]
mov r8, rcx
xor eax, eax
mov r9, rcx
test rcx, rcx
je 0x100013919
mov rcx, qword [0x100082270]
imul rcx, rcx, 0x343fd
shl rax, 0x10
shr r9, 0x10
add rcx, 0x269ec3
mov rdx, rcx
shr rdx, 0x10
movzx edx, dx
or rax, rdx
test r9, r9
jne 0x1000138ea
mov qword [0x100082270], rcx
mov r9d, 0x40
xor edx, edx
div r8
mov r8d, 0x3000
mov rcx, rdx
mov rdx, rbp
shl rcx, 0x10
add rcx, qword [0x100083340]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x100013981
lea r9, [0x100015b70]
mov rdx, rax
mov r8d, ebp
mov rcx, rax
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
or rcx, 3
call qword [sym.imp.KERNEL32.dll_RtlInstallFunctionTableCallback]
test al, al
jne 0x100013995
mov r8d, r15d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp rdi, 0x11
jb 0x1000138cc
xor ebx, ebx
cmp rbx, 0x10000
jb 0x1000139a3
test bl, 3
je 0x1000139c5
test rbx, rbx
je 0x1000139c3
mov rcx, rbx
or rcx, 3
call qword [sym.imp.KERNEL32.dll_RtlDeleteFunctionTable]
mov r8d, r15d
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ebx, ebx
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
lea r11, [0x100000000]
je 0x100013816
xor eax, eax
mov rdi, rbx
mov rcx, rbp
rep stosb byte [rdi], al
mov eax, 0xb1a3ad61
mov r9d, esi
add qword [r12], 9
mov r15d, dword [r13 + 5]
mov r10d, dword [0x10000dfa4]
lea r13, [0x100000000]
mov ebp, 0xfffffff
and r15, rbp
mov qword [rsp + 0x140], r15
xor edi, edi
sub r10, r15
sub r9d, r13d
inc r10
mov r8, r10
je 0x100013a5d
mov rdx, qword [0x100082270]
imul rdx, rdx, 0x343fd
shl rdi, 0x10
shr r8, 0x10
add rdx, 0x269ec3
mov rcx, rdx
shr rcx, 0x10
movzx eax, cx
or rdi, rax
test r8, r8
jne 0x100013a2e
mov qword [0x100082270], rdx
mov ecx, r9d
xor edx, edx
mov rax, rdi
div r10
lea r14, [rdx + rbx]
mov rdx, r15
mov r8, r14
mov qword [rsp + 0xc0], r14
mov eax, 0x63e07b70
xor dil, dil
mov rbx, 0xfffffffffffff000
test r15, r15
mov rdx, qword [r15 + rsi]
mov byte [rsp + 0x30], dil
mov qword [rsp + 0xf8], r15
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xb0], rdx
mov qword [rsp + 0xb8], r14
je 0x10001432d
lea rcx, [rsp + 0xb0]
mov eax, 0x18acb234
mov r9, qword [rsp + 0xb0]
mov rcx, r13
mov r10d, dword [rsp + 0xb4]
mov rax, qword [0x100033ac0]
and qword [rsp + 0x40], 0
and r9, rbp
add r9, r13
and r10, rbp
sub rcx, rax
mov qword [rsp + 0x68], rcx
jne 0x100013b90
xor r11d, r11d
test r10, r10
je 0x100013ea1
mov r8d, dword [rsp + 0x40]
mov edx, dword [rsp + 0x44]
movzx ecx, byte [r11 + r9]
inc r11
add ecx, 0x637ce67c
add r8d, ecx
add ecx, edx
mov eax, ecx
imul eax, eax, 0x3041
rol eax, 0xc
ror ecx, 0xc
xor eax, ecx
imul rax, rax, 0x637ce67c
mov qword [rsp + 0x38], rax
mov ecx, dword [rsp + 0x38]
shr rax, 0x20
add eax, ecx
imul rax, rax, 0x637ce67c
mov qword [rsp + 0x38], rax
shr rax, 0x20
mov edx, dword [rsp + 0x38]
add edx, eax
add r8d, edx
cmp r11, r10
jb 0x100013b14
mov dword [rsp + 0x44], edx
mov dword [rsp + 0x40], r8d
jmp 0x100013ea1
mov ecx, dword [0x10000dfa4]
imul rcx, rdx
lea rbx, [rcx + r11 + 0x79010]
jmp 0x1000138b9
lea rax, [r9 + r10]
movsxd rcx, dword [0x10000003c]
mov r8d, dword [rcx + r13 + 0xb0]
add r8, r13
mov edx, dword [rcx + r13 + 0xb4]
mov qword [rsp + 0xd0], rax
mov eax, r9d
sub eax, r13d
lea r14, [rax + r10]
mov r13, r14
mov ebp, eax
mov r11d, eax
and r11, rbx
sub rbp, r11
and r13, rbx
mov qword [rsp + 0x60], r13
sub r14, r13
add rdx, r8
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r14
jmp 0x100013bf7
mov eax, dword [r8]
cmp rax, r11
jae 0x100013bfc
mov eax, dword [r8 + 4]
add r8, rax
cmp r8, rdx
jne 0x100013be8
xor ebx, ebx
cmp r8, rdx
je 0x100013c3a
mov eax, dword [r8]
cmp rax, r11
jne 0x100013c3a
mov ecx, dword [r8 + 4]
sub rcx, 8
shr rcx, 1
je 0x100013c3a
lea rdx, [r8 + 8]
movzx eax, word [rdx]
and eax, 0xfff
cmp rax, rbp
jae 0x100013c35
inc rbx
add rdx, 2
cmp rbx, rcx
jne 0x100013c1c
mov rdx, qword [rsp + 0x48]
lea rsi, [0x100000000]
mov r10d, dword [rsp + 0x44]
mov r11d, dword [rsp + 0x40]
mov r12, qword [rsp + 0x68]
cmp r8, rdx
je 0x100013e1e
mov eax, dword [r8]
cmp rax, r13
ja 0x100013e1e
mov ecx, dword [r8 + 4]
lea rax, [rcx - 8]
shr rax, 1
cmp rbx, rax
jne 0x100013c91
add r8, rcx
cmp r8, rdx
je 0x100013e1e
mov eax, dword [r8]
cmp rax, r13
ja 0x100013e1e
xor ebx, ebx
jmp 0x100013c65
mov eax, dword [r8]
cmp rax, r13
jne 0x100013cad
movzx eax, word [r8 + rbx*2 + 8]
and eax, 0xfff
cmp rax, r14
jae 0x100013e1e
mov rax, rbx
inc rbx
mov ecx, 0xf000
test word [r8 + rax*2 + 8], cx
je 0x100013c50
movzx edx, word [r8 + rax*2 + 8]
mov ebp, edx
xor r13d, r13d
and ebp, 0xfff
add ebp, dword [r8]
add rbp, rsi
mov r14, rbp
sub r14, r9
je 0x100013d44
movzx ecx, byte [r13 + r9]
inc r13
add ecx, 0x637ce67c
add r11d, ecx
add ecx, r10d
mov eax, ecx
imul eax, eax, 0x3041
rol eax, 0xc
ror ecx, 0xc
xor eax, ecx
imul rax, rax, 0x637ce67c
mov qword [rsp + 0x58], rax
shr rax, 0x20
mov ecx, dword [rsp + 0x58]
add eax, ecx
imul rax, rax, 0x637ce67c
mov qword [rsp + 0x58], rax
mov r10d, dword [rsp + 0x58]
shr rax, 0x20
add r10d, eax
add r11d, r10d
cmp r13, r14
jb 0x100013cdf
mov dword [rsp + 0x44], r10d
mov dword [rsp + 0x40], r11d
mov rax, qword [rbp]
mov qword [rsp + 0x58], rax
shr edx, 0xc
cmp edx, 3
je 0x100013d63
sub edx, 0xa
neg edx
sbb r9d, r9d
add r9d, 3
jmp 0x100013d69
mov r9d, 2
mov rdx, r12
neg rdx
sub r9d, 2
je 0x100013d90
cmp r9d, 1
je 0x100013d81
or rdx, 0xffffffffffffffff
jmp 0x100013d99
add rax, rdx
mov edx, 8
mov qword [rsp + 0x58], rax
jmp 0x100013d99
add dword [rsp + 0x58], edx
mov edx, 4
xor r9d, r9d
test rdx, rdx
je 0x100013e06
movzx ecx, byte [rsp + r9 + 0x58]
inc r9
add ecx, 0x637ce67c
add r11d, ecx
add ecx, r10d
mov eax, ecx
imul eax, eax, 0x3041
rol eax, 0xc
ror ecx, 0xc
xor eax, ecx
imul rax, rax, 0x637ce67c
mov qword [rsp + 0x38], rax
mov ecx, dword [rsp + 0x38]
shr rax, 0x20
add eax, ecx
imul rax, rax, 0x637ce67c
mov qword [rsp + 0x38], rax
shr rax, 0x20
mov r10d, dword [rsp + 0x38]
add r10d, eax
add r11d, r10d
cmp r9, rdx
jb 0x100013da1
mov dword [rsp + 0x44], r10d
mov dword [rsp + 0x40], r11d
lea r9, [rdx + rbp]
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x48]
jmp 0x100013c50
mov rsi, qword [rsp + 0xe8]
mov r8, qword [rsp + 0xd0]
xor edx, edx
sub r8, r9
je 0x100013e99
movzx ecx, byte [rdx + r9]
inc rdx
add ecx, 0x637ce67c
add r11d, ecx
add ecx, r10d
mov eax, ecx
imul eax, eax, 0x3041
rol eax, 0xc
ror ecx, 0xc
xor eax, ecx
imul rax, rax, 0x637ce67c
mov qword [rsp + 0x38], rax
mov ecx, dword [rsp + 0x38]
shr rax, 0x20
add eax, ecx
imul rax, rax, 0x637ce67c
mov qword [rsp + 0x38], rax
shr rax, 0x20
mov r10d, dword [rsp + 0x38]
add r10d, eax
add r11d, r10d
cmp rdx, r8
jb 0x100013e35
mov dword [rsp + 0x44], r10d
mov dword [rsp + 0x40], r11d
mov r14, qword [rsp + 0xc0]
xor ecx, ecx
mov rax, rcx
inc rcx
and eax, 7
mov al, byte [rsp + rax + 0x40]
mov byte [rsp + rcx + 0x147], al
cmp rcx, 0x10
jb 0x100013ea3
mov eax, 0xc33bb3e9
mov rbx, r14
mov r11d, dword [rsp + 0x148]
mov r13, rsi
mov eax, dword [rsp + 0x154]
mov edx, dword [rsp + 0x14c]
mov ecx, dword [rsp + 0x150]
and dword [rsp + 0x118], 0
and dword [rsp + 0x11c], 0
xor ebp, ebp
lea esi, [rbp + 0x40]
mov dword [rsp + 0x110], eax
mov dword [rsp + 0x138], eax
mov eax, dword [0x10006a908]
and dword [rsp + 0x124], ebp
mov dword [rsp + 0x100], eax
mov eax, dword [0x10006a90c]
mov dword [rsp + 0x114], eax
mov eax, dword [0x10006a910]
mov dword [rsp + 0x128], eax
mov eax, dword [0x10006a914]
mov dword [rsp + 0x104], r11d
mov dword [rsp + 0x13c], eax
lea rax, [rsp + 0x160]
mov dword [rsp + 0x108], edx
mov dword [rsp + 0x10c], ecx
mov dword [rsp + 0x12c], r11d
mov dword [rsp + 0x130], edx
mov dword [rsp + 0x134], ecx
sub rbx, rax
sub r13, r14
mov qword [rsp + 0xd0], r13
mov dword [rsp + 0x120], ebp