Function at 0x14005ac50
Capabilities:
Contain obfuscated stackstrings
Encrypt data using salsa20 or chacha
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x140123218]
xor rax, rsp
mov qword [rbp + 0x27], rax
movzx eax, byte [rcx + 2]
mov rbx, rcx
movzx esi, byte [rcx + 3]
movzx r14d, byte [rcx + 7]
movzx r15d, byte [rcx + 0xb]
movzx r12d, byte [rcx + 0xf]
movzx r13d, byte [rcx + 0x13]
shl esi, 8
add esi, eax
shl r14d, 8
movzx eax, byte [rcx + 1]
shl r15d, 8
shl r12d, 8
shl r13d, 8
shl esi, 8
add esi, eax
movzx eax, byte [rcx]
shl esi, 8
add esi, eax
movzx eax, byte [rcx + 6]
add r14d, eax
mov dword [rbp - 0x19], esi
movzx eax, byte [rcx + 5]
shl r14d, 8
add r14d, eax
movzx eax, byte [rcx + 4]
shl r14d, 8
add r14d, eax
movzx eax, byte [rcx + 0xa]
add r15d, eax
mov dword [rbp - 0x15], r14d
movzx eax, byte [rcx + 9]
shl r15d, 8
add r15d, eax
movzx eax, byte [rcx + 8]
shl r15d, 8
add r15d, eax
movzx eax, byte [rcx + 0xe]
add r12d, eax
mov dword [rbp - 0x11], r15d
movzx eax, byte [rcx + 0xd]
shl r12d, 8
add r12d, eax
movzx eax, byte [rcx + 0xc]
shl r12d, 8
add r12d, eax
movzx eax, byte [rcx + 0x12]
add r13d, eax
mov dword [rbp - 0xd], r12d
movzx eax, byte [rcx + 0x11]
shl r13d, 8
add r13d, eax
movzx eax, byte [rcx + 0x10]
movzx ecx, byte [rcx + 0x17]
shl ecx, 8
shl r13d, 8
add r13d, eax
movzx eax, byte [rbx + 0x16]
add ecx, eax
mov dword [rbp - 9], r13d
movzx eax, byte [rbx + 0x15]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 0x14]
shl ecx, 8
add eax, ecx
movzx ecx, byte [rbx + 0x1b]
shl ecx, 8
mov dword [rbp - 0x49], eax
mov dword [rbp - 5], eax
movzx eax, byte [rbx + 0x1a]
add ecx, eax
movzx eax, byte [rbx + 0x19]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 0x18]
shl ecx, 8
add eax, ecx
movzx ecx, byte [rbx + 0x1f]
mov dword [rbp - 0x45], eax
mov dword [rbp - 1], eax
shl ecx, 8
movzx eax, byte [rbx + 0x1e]
add ecx, eax
movzx eax, byte [rbx + 0x1d]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 0x1c]
shl ecx, 8
add eax, ecx
movzx ecx, byte [rbx + 0x23]
shl ecx, 8
mov dword [rbp - 0x41], eax
mov dword [rbp + 3], eax
movzx eax, byte [rbx + 0x22]
add ecx, eax
movzx eax, byte [rbx + 0x21]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 0x20]
shl ecx, 8
add eax, ecx
movzx ecx, byte [rbx + 0x27]
shl ecx, 8
mov dword [rbp - 0x3d], eax
mov dword [rbp + 7], eax
movzx eax, byte [rbx + 0x26]
add ecx, eax
movzx eax, byte [rbx + 0x25]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 0x24]
shl ecx, 8
add eax, ecx
movzx ecx, byte [rbx + 0x2b]
shl ecx, 8
mov dword [rbp - 0x39], eax
mov dword [rbp + 0xb], eax
movzx eax, byte [rbx + 0x2a]
add ecx, eax
movzx eax, byte [rbx + 0x29]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 0x28]
shl ecx, 8
add eax, ecx
movzx ecx, byte [rbx + 0x2f]
shl ecx, 8
mov dword [rbp - 0x35], eax
mov dword [rbp + 0xf], eax
movzx eax, byte [rbx + 0x2e]
add ecx, eax
movzx eax, byte [rbx + 0x2d]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 0x2c]
shl ecx, 8
add eax, ecx
movzx ecx, byte [rbx + 0x33]
shl ecx, 8
mov dword [rbp - 0x31], eax
mov dword [rbp + 0x13], eax
movzx eax, byte [rbx + 0x32]
add ecx, eax
movzx eax, byte [rbx + 0x31]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 0x30]
shl ecx, 8
add eax, ecx
movzx ecx, byte [rbx + 0x37]
shl ecx, 8
mov dword [rbp - 0x2d], eax
mov dword [rbp + 0x17], eax
movzx eax, byte [rbx + 0x36]
add ecx, eax
movzx eax, byte [rbx + 0x35]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 0x34]
shl ecx, 8
add eax, ecx
movzx ecx, byte [rbx + 0x3b]
mov edi, 0xa
shl ecx, 8
mov dword [rbp - 0x29], eax
mov dword [rbp + 0x1b], eax
movzx eax, byte [rbx + 0x3a]
add ecx, eax
movzx eax, byte [rbx + 0x39]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 0x38]
shl ecx, 8
add eax, ecx
movzx ecx, byte [rbx + 0x3f]
shl ecx, 8
mov dword [rbp - 0x25], eax
mov dword [rbp + 0x1f], eax
movzx eax, byte [rbx + 0x3e]
add ecx, eax
movzx eax, byte [rbx + 0x3d]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 0x3c]
shl ecx, 8
add eax, ecx
mov dword [rbp - 0x21], eax
mov dword [rbp + 0x23], eax
nop word [rax + rax]
lea rcx, [rbp - 0x19]
call fcn.14005a5c0
sub rdi, 1
jne 0x14005aa20
mov ecx, dword [rbp - 0x19]
add ecx, esi
mov byte [rbx], cl
mov eax, ecx
shr eax, 8
mov byte [rbx + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [rbx + 2], al
shr ecx, 0x18
mov byte [rbx + 3], cl
mov ecx, dword [rbp - 0x15]
add ecx, r14d
mov byte [rbx + 4], cl
mov eax, ecx
shr eax, 8
mov byte [rbx + 5], al
mov eax, ecx
shr eax, 0x10
mov byte [rbx + 6], al
shr ecx, 0x18
mov byte [rbx + 7], cl
mov ecx, dword [rbp - 0x11]
add ecx, r15d
mov byte [rbx + 8], cl
mov eax, ecx
shr eax, 8
mov byte [rbx + 9], al
mov eax, ecx
shr eax, 0x10
mov byte [rbx + 0xa], al
shr ecx, 0x18
mov byte [rbx + 0xb], cl
mov ecx, dword [rbp - 0xd]
add ecx, r12d
mov byte [rbx + 0xc], cl
mov eax, ecx
shr eax, 8
mov byte [rbx + 0xd], al
mov eax, ecx
shr eax, 0x10
mov byte [rbx + 0xe], al
shr ecx, 0x18
mov byte [rbx + 0xf], cl
mov ecx, dword [rbp - 9]
add ecx, r13d
mov byte [rbx + 0x10], cl
mov eax, ecx
shr eax, 8
mov byte [rbx + 0x11], al
mov eax, ecx
shr eax, 0x10
mov byte [rbx + 0x12], al
shr ecx, 0x18
mov byte [rbx + 0x13], cl
mov ecx, dword [rbp - 0x49]
add ecx, dword [rbp - 5]
mov byte [rbx + 0x14], cl
mov eax, ecx
shr eax, 8
mov byte [rbx + 0x15], al
mov eax, ecx
shr eax, 0x10
mov byte [rbx + 0x16], al
shr ecx, 0x18
mov byte [rbx + 0x17], cl
mov ecx, dword [rbp - 0x45]
add ecx, dword [rbp - 1]
mov byte [rbx + 0x18], cl
mov eax, ecx
shr eax, 8
mov byte [rbx + 0x19], al
mov eax, ecx
shr eax, 0x10
shr ecx, 0x18
mov byte [rbx + 0x1a], al
mov byte [rbx + 0x1b], cl
mov ecx, dword [rbp - 0x41]
add ecx, dword [rbp + 3]
mov byte [rbx + 0x1c], cl
mov eax, ecx
shr eax, 8
mov byte [rbx + 0x1d], al
mov eax, ecx
shr eax, 0x10
mov byte [rbx + 0x1e], al
shr ecx, 0x18
mov byte [rbx + 0x1f], cl
mov ecx, dword [rbp - 0x3d]
add ecx, dword [rbp + 7]
mov byte [rbx + 0x20], cl
mov eax, ecx
shr eax, 8
mov byte [rbx + 0x21], al
mov eax, ecx
shr eax, 0x10
mov byte [rbx + 0x22], al
shr ecx, 0x18
mov byte [rbx + 0x23], cl
mov ecx, dword [rbp - 0x39]
add ecx, dword [rbp + 0xb]
mov byte [rbx + 0x24], cl
mov eax, ecx
shr eax, 8
mov byte [rbx + 0x25], al
mov eax, ecx
shr eax, 0x10
mov byte [rbx + 0x26], al
shr ecx, 0x18
mov byte [rbx + 0x27], cl
mov ecx, dword [rbp - 0x35]
add ecx, dword [rbp + 0xf]
mov byte [rbx + 0x28], cl
mov eax, ecx
shr eax, 8
mov byte [rbx + 0x29], al
mov eax, ecx
shr eax, 0x10
mov byte [rbx + 0x2a], al
shr ecx, 0x18
mov byte [rbx + 0x2b], cl
mov ecx, dword [rbp - 0x31]
add ecx, dword [rbp + 0x13]
mov byte [rbx + 0x2c], cl
mov eax, ecx
shr eax, 8
mov byte [rbx + 0x2d], al
mov eax, ecx
shr eax, 0x10
mov byte [rbx + 0x2e], al
shr ecx, 0x18
mov byte [rbx + 0x2f], cl
mov ecx, dword [rbp - 0x2d]
add ecx, dword [rbp + 0x17]
mov byte [rbx + 0x30], cl
mov eax, ecx
shr eax, 8
mov byte [rbx + 0x31], al
mov eax, ecx
shr eax, 0x10
mov byte [rbx + 0x32], al
shr ecx, 0x18
mov byte [rbx + 0x33], cl
mov ecx, dword [rbp - 0x29]
add ecx, dword [rbp + 0x1b]
mov byte [rbx + 0x34], cl
mov eax, ecx
shr eax, 8
mov byte [rbx + 0x35], al
mov eax, ecx
shr eax, 0x10
mov byte [rbx + 0x36], al
shr ecx, 0x18
mov byte [rbx + 0x37], cl
mov ecx, dword [rbp - 0x25]
add ecx, dword [rbp + 0x1f]
mov eax, ecx
mov byte [rbx + 0x38], cl
shr eax, 8
mov byte [rbx + 0x39], al
mov eax, ecx
shr eax, 0x10
mov byte [rbx + 0x3a], al
shr ecx, 0x18
mov byte [rbx + 0x3b], cl
mov ecx, dword [rbp - 0x21]
add ecx, dword [rbp + 0x23]
mov byte [rbx + 0x3c], cl
mov eax, ecx
shr eax, 8
mov byte [rbx + 0x3d], al
mov eax, ecx
shr eax, 0x10
shr ecx, 0x18
mov byte [rbx + 0x3e], al
mov byte [rbx + 0x3f], cl
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400cad70
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x30
xor r11d, r11d
mov dword [rsp + 0x20], 0x61707865
mov r10, r8
mov dword [rsp + 0x24], 0x3320646e
mov r9d, r11d
mov dword [rsp + 0x28], 0x79622d32
add r8, 2
mov dword [rsp + 0x2c], 0x6b206574
mov rsi, rdx
mov rbx, rcx
nop dword [rax]
mov eax, 0xcccccccd
lea r8, [r8 + 0x14]
mul r9d
add r9d, 0x14
shr edx, 4
lea rcx, [rdx*4]
movzx eax, byte [rsp + rcx + 0x20]
mov byte [r8 - 0x16], al
movzx eax, byte [rsp + rcx + 0x21]
mov byte [r8 - 0x15], al
movzx eax, byte [rsp + rcx + 0x22]
mov byte [r8 - 0x14], al
movzx eax, byte [rsp + rcx + 0x23]
mov byte [r8 - 0x13], al
cmp r9d, 0x40
jl 0x14005ac90
lea rcx, [r10 + 4]
lea rax, [rsi + 0xf]
lea rdx, [r10 + 0x3b]
cmp rcx, rax
ja 0x14005aceb
cmp rdx, rsi
jae 0x14005acf9
lea rax, [rbx + 0x1f]
cmp rcx, rax
ja 0x14005ad68
cmp rdx, rbx
jb 0x14005ad68
mov rcx, r10
mov qword [rsp + 0x40], rdi
sub rcx, rbx
lea rax, [r11 + 0x10]
add rax, rbx
sub rsi, rbx
mov edx, reloc.WS2_32.dll_recv
sub rdx, r11
lea r8, [rcx - 0xc]
lea r9, [rcx + 0x1c]
lea rdi, [rcx + 8]
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rax - 0x10]
mov byte [r8 + rax], cl
movzx ecx, byte [rax]
mov byte [rax + r9], cl
movzx ecx, byte [rax + rsi - 0x10]
mov byte [rax + rdi], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x14005ad30
mov rdi, qword [rsp + 0x40]
mov rcx, r10
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
jmp 0x14005a780
movups xmm0, xmmword [rbx]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rbx + 0x10]
movups xmmword [r10 + 0x2c], xmm0
movups xmm0, xmmword [rsi]
movups xmmword [r10 + 0x18], xmm0
mov rcx, r10
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
jmp 0x14005a780