Function at 0x1000c6a0
Capabilities:
Contain obfuscated stackstrings
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xffffffe0
sub esp, 0x600
mov ebx, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
test ebx, ebx
je 0x1000c705
js 0x1000c9ff
mov eax, dword [0x106b6680]
movzx eax, byte [eax]
push 1
push ebx
call fcn.1000d070
add esp, 8
test eax, eax
je 0x1000ca08
mov edi, eax
push ebx
push dword [ebp + 0x14]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp ebx, 0xf
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], ebx
ja 0x1000c710
mov dword [esi], 0x80000000
jmp 0x1000c9b8
mov dword [esi], 0x80000000
jmp 0x1000c9eb
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xcc], 0x6b206574
mov dword [esp + 0xc8], 0x79622d32
mov dword [esp + 0xc4], 0x3320646e
mov dword [esp + 0xc0], 0x61707865
lea edx, [ebx - 0x10]
mov dword [esp + 0x24], edx
movsd xmm1, qword [ecx + 8]
movsd xmm0, qword [ecx]
movsd xmm2, qword [ecx + 0x18]
movsd qword [esp + 0xd8], xmm1
movsd xmm1, qword [ecx + 0x10]
movsd qword [esp + 0xd0], xmm0
movsd qword [esp + 0xe8], xmm2
movsd qword [esp + 0xe0], xmm1
movsd xmm1, qword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 0x3a8], eax
lea eax, [edi + ebx - 0x10]
movsd qword [esp + 0x3a0], xmm1
mov dword [esp + 0x34], eax
mov eax, dword [0x101010b8]
movzx eax, byte [eax]
cmp al, 0xff
je 0x1000c9f5
movsd xmm0, qword [esp + 0xe8]
movsd xmm1, qword [esp + 0xc8]
mov eax, dword [esp + 0x3a8]
mov ebx, esp
lea ecx, [esp + 0x38]
mov edx, ebx
movsd qword [esp + 0x60], xmm0
movsd xmm0, qword [esp + 0xe0]
movsd qword [esp + 0x40], xmm1
movsd qword [esp + 0x58], xmm0
movsd xmm0, qword [esp + 0xd8]
movsd qword [esp + 0x50], xmm0
movsd xmm0, qword [esp + 0xd0]
movsd qword [esp + 0x48], xmm0
movsd xmm0, qword [esp + 0xc0]
movsd qword [esp + 0x38], xmm0
movsd xmm0, qword [esp + 0x3a0]
mov dword [esp + 0x68], 0
mov dword [esp + 0x74], eax
movsd qword [esp + 0x6c], xmm0
xorps xmm0, xmm0
mov byte [esp + 0xb8], 0
movsd qword [esp + 0x78], xmm0
movsd qword [esp + 0x80], xmm0
movsd qword [esp + 0x88], xmm0
movsd qword [esp + 0x90], xmm0
movsd qword [esp + 0x98], xmm0
movsd qword [esp + 0xa0], xmm0
movsd qword [esp + 0xa8], xmm0
movsd qword [esp + 0xb0], xmm0
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
push 0x20
call fcn.10008090
add esp, 4
lea eax, [esp + 0x3a0]
push ebx
push eax
call fcn.100535c0
add esp, 8
mov byte [esp], 0
mov byte [esp + 1], 0
mov byte [esp + 2], 0
mov byte [esp + 3], 0
mov byte [esp + 4], 0
mov byte [esp + 5], 0
mov byte [esp + 6], 0
mov byte [esp + 7], 0
mov byte [esp + 8], 0
mov byte [esp + 9], 0
mov byte [esp + 0xa], 0
mov byte [esp + 0xb], 0
mov byte [esp + 0xc], 0
mov byte [esp + 0xd], 0
mov byte [esp + 0xe], 0
mov byte [esp + 0xf], 0
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
mov byte [esp + 0x14], 0
mov byte [esp + 0x15], 0
mov byte [esp + 0x16], 0
mov byte [esp + 0x17], 0
mov byte [esp + 0x18], 0
mov byte [esp + 0x19], 0
mov byte [esp + 0x1a], 0
mov byte [esp + 0x1b], 0
mov byte [esp + 0x1c], 0
mov byte [esp + 0x1d], 0
mov byte [esp + 0x1e], 0
mov byte [esp + 0x1f], 0
mov dword [esp + 0x68], 1
mov byte [esp + 0xb8], 0
lea eax, [esp + 0x300]
push 0x84
lea ecx, [esp + 0x3c]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea ebx, [esp + 0xc0]
push 0x240
lea eax, [esp + 0x3a4]
push eax
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [esp + 0x34]
push dword [esp + 0x28]
push edi
push 0
push 1
push ebx
call fcn.10007750
add esp, 0x18
test al, al
je 0x1000c9c9
mov ebx, dword [esp + 0x28]
mov dword [esi], 0x80000000
test ebx, ebx
je 0x1000c9eb
push 1
push ebx
push dword [esp + 0x34]
call fcn.1000d080
add esp, 0xc
jmp 0x1000c9eb
lea eax, [esp + 0x28]
push dword [esp + 0x24]
push eax
call fcn.10058880
add esp, 8
mov eax, dword [esp + 0x30]
movsd xmm0, qword [esp + 0x28]
mov dword [esi + 8], eax
movsd qword [esi], xmm0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.10052d20
jmp 0x1000c7af
xor eax, eax
push ebx
push eax
call fcn.100d0890
mov eax, 1
push ebx
push eax
call fcn.100d0890
nop word cs:[eax + eax]
nop
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x63eb502c
mov dword [eax + 8], 0xd6cb5d6d
mov dword [eax + 4], 0xb98b1b71
mov dword [eax], 0x57a64178
pop ebp
ret