Function at 0x406e77
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
push ebx
push ebp
sub esp, 0xcc
mov eax, dword [esp + 0xe8]
mov edi, dword [esp + 0xec]
test edi, edi
mov esi, dword [esp + 0xe4]
mov dword [esp + 0x4c], eax
mov dword [esp], eax
jne 0x406eac
add esp, 0xcc
pop ebp
pop ebx
pop edi
pop esi
ret
mov ebx, dword [esp + 0xe0]
mov ebp, dword [ebx + 0x18]
mov dword [esp + 0x78], ebp
mov ebp, dword [ebx + 0x1c]
mov dword [esp + 0x6c], ebp
mov ebp, dword [ebx + 0x20]
mov dword [esp + 0x50], ebp
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov ecx, dword [ebx + 8]
mov ebp, dword [ebx + 0x24]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edx
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x54], ebp
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x14]
mov ebp, dword [ebx + 0x28]
mov ebx, dword [ebx + 0x2c]
mov dword [esp + 0x68], ebp
mov dword [esp + 0x64], ebx
mov dword [esp + 0x60], eax
mov dword [esp + 0x5c], edx
mov dword [esp + 0x58], ecx
jmp 0x406f16
mov eax, dword [esp + 0x4c]
add edi, 0xffffffc0
add eax, 0x40
mov dword [esp + 0x4c], eax
cmp edi, 0x40
jae 0x406f6d
test esi, esi
je 0x406f5e
test edi, edi
jbe 0x406f5a
mov ecx, edi
shr ecx, 1
test ecx, ecx
jbe 0x40738c
xor ebx, ebx
movzx edx, byte [esi + ebx*2]
mov byte [esp + ebx*2 + 4], dl
movzx eax, byte [esi + ebx*2 + 1]
mov byte [esp + ebx*2 + 5], al
inc ebx
cmp ebx, ecx
jb 0x406f31
lea edx, [ebx + ebx + 1]
lea eax, [edx - 1]
cmp eax, edi
jae 0x406f5a
movzx eax, byte [eax + esi]
mov byte [esp + edx + 3], al
lea esi, [esp + 4]
mov eax, dword [esp + 0x4c]
lea edx, [esp + 4]
mov dword [esp], eax
mov dword [esp + 0x4c], edx
mov ebp, dword [esp + 0x60]
mov dword [esp + 0xa8], ebp
mov ebp, dword [esp + 0x50]
mov edx, dword [esp + 0x7c]
mov ebx, dword [esp + 0x58]
mov dword [esp + 0xb4], ebp
mov ebp, dword [esp + 0xe0]
mov dword [esp + 0x94], edx
mov dword [esp + 0x98], ebx
mov edx, dword [esp + 0x78]
mov ebx, dword [esp + 0x6c]
mov dword [esp + 0x88], edx
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0x54]
mov dword [esp + 0x8c], ebx
mov ebx, dword [esp + 0x64]
mov ebp, dword [ebp + 0x30]
test ebp, ebp
mov dword [esp + 0x90], eax
mov dword [esp + 0xb0], edx
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x5c]
mov edx, dword [esp + 0x68]
mov dword [esp + 0x84], ebx
mov ebx, 0x61707865
mov dword [esp + 0xa0], 0x3320646e
mov dword [esp + 0xa4], 0x79622d32
mov dword [esp + 0xac], 0x6b206574
jbe 0x407264
mov dword [esp + 0x9c], ebx
mov dword [esp + 0x80], ebp
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], esi
mov ebp, dword [esp + 0x9c]
add ebp, ecx
mov edi, dword [esp + 0xb4]
xor edi, ebp
rol edi, 0x10
add eax, edi
xor ecx, eax
rol ecx, 0xc
add ebp, ecx
xor edi, ebp
rol edi, 8
add eax, edi
xor ecx, eax
mov dword [esp + 0xb8], eax
mov esi, dword [esp + 0x90]
mov eax, dword [esp + 0xa0]
add eax, esi
rol ecx, 7
mov dword [esp + 0xbc], ecx
mov ecx, dword [esp + 0xb0]
xor ecx, eax
rol ecx, 0x10
mov ebx, dword [esp + 0xa8]
add ebx, ecx
xor esi, ebx
rol esi, 0xc
add eax, esi
mov dword [esp + 0xb4], edi
xor ecx, eax
mov dword [esp + 0xa0], eax
mov edi, dword [esp + 0x94]
mov eax, dword [esp + 0xa4]
add eax, edi
xor edx, eax
rol ecx, 8
rol edx, 0x10
add ebx, ecx
mov dword [esp + 0xb0], ecx
xor esi, ebx
mov ecx, dword [esp + 0x88]
add ecx, edx
xor edi, ecx
rol edi, 0xc
add eax, edi
xor edx, eax
rol edx, 8
add ecx, edx
xor edi, ecx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xc0], edx
mov edx, dword [esp + 0x98]
mov ebx, dword [esp + 0xac]
add ebx, edx
rol edi, 7
mov dword [esp + 0x94], edi
mov edi, dword [esp + 0x84]
xor edi, ebx
rol edi, 0x10
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x8c]
add eax, edi
xor edx, eax
rol edx, 0xc
add ebx, edx
rol esi, 7
xor edi, ebx
rol edi, 8
add ebp, esi
add eax, edi
xor edi, ebp
rol edi, 0x10
xor edx, eax
add ecx, edi
xor esi, ecx
rol esi, 0xc
add ebp, esi
xor edi, ebp
rol edi, 8
add ecx, edi
xor esi, ecx
mov dword [esp + 0x9c], ebp
mov dword [esp + 0x88], ecx
mov ecx, dword [esp + 0x94]
mov ebp, dword [esp + 0xa0]
add ebp, ecx
rol esi, 7
mov dword [esp + 0x90], esi
mov esi, dword [esp + 0xb4]
xor esi, ebp
rol esi, 0x10
add eax, esi
xor ecx, eax
rol ecx, 0xc
add ebp, ecx
rol edx, 7
xor esi, ebp
mov dword [esp + 0xa0], ebp
mov ebp, dword [esp + 0xa4]
add ebp, edx
mov dword [esp + 0x84], edi
rol esi, 8
mov edi, dword [esp + 0xb0]
add eax, esi
xor edi, ebp
xor ecx, eax
rol edi, 0x10
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0xb8]
add eax, edi
xor edx, eax
rol edx, 0xc
add ebp, edx
xor edi, ebp
rol edi, 8
add eax, edi
rol ecx, 7
xor edx, eax
mov dword [esp + 0x94], ecx
mov ecx, dword [esp + 0xbc]
add ebx, ecx
rol edx, 7
mov dword [esp + 0x98], edx
mov edx, dword [esp + 0xc0]
xor edx, ebx
rol edx, 0x10
mov dword [esp + 0xa4], ebp
mov ebp, dword [esp + 0xa8]
add ebp, edx
xor ecx, ebp
rol ecx, 0xc
add ebx, ecx
xor edx, ebx
rol edx, 8
add ebp, edx
xor ecx, ebp
mov dword [esp + 0xac], ebx
rol ecx, 7
mov ebx, dword [esp + 0x80]
mov dword [esp + 0xb4], esi
add ebx, 0xfffffffe
mov dword [esp + 0xb0], edi
mov dword [esp + 0xa8], ebp
mov dword [esp + 0x80], ebx
jne 0x40702a
mov ebx, dword [esp + 0x9c]
mov edi, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
add ebx, 0x61707865
test esi, esi
je 0x4073d1
mov ebp, dword [esi]
xor ebp, ebx
mov ebx, dword [esp + 0x4c]
add ecx, dword [esp + 0x70]
add eax, dword [esp + 0x5c]
mov dword [ebx], ebp
mov ebp, dword [esp + 0xa0]
add ebp, 0x3320646e
xor ebp, dword [esi + 4]
mov dword [ebx + 4], ebp
mov ebp, dword [esp + 0xa4]
add ebp, 0x79622d32
xor ebp, dword [esi + 8]
mov dword [ebx + 8], ebp
mov ebp, dword [esp + 0xac]
add ebp, 0x6b206574
xor ebp, dword [esi + 0xc]
mov dword [ebx + 0xc], ebp
xor ecx, dword [esi + 0x10]
mov dword [ebx + 0x10], ecx
mov ecx, dword [esp + 0x90]
add ecx, dword [esp + 0x74]
mov ebp, dword [esp + 0x94]
xor ecx, dword [esi + 0x14]
mov dword [ebx + 0x14], ecx
add ebp, dword [esp + 0x7c]
mov ecx, dword [esp + 0x98]
xor ebp, dword [esi + 0x18]
mov dword [ebx + 0x18], ebp
add ecx, dword [esp + 0x58]
xor ecx, dword [esi + 0x1c]
mov dword [ebx + 0x1c], ecx
xor eax, dword [esi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [esp + 0xa8]
add eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x88]
xor eax, dword [esi + 0x24]
mov dword [ebx + 0x24], eax
add ecx, dword [esp + 0x78]
mov ebp, dword [esp + 0x8c]
xor ecx, dword [esi + 0x28]
mov dword [ebx + 0x28], ecx
add ebp, dword [esp + 0x6c]
mov eax, dword [esp + 0xb4]
xor ebp, dword [esi + 0x2c]
mov dword [ebx + 0x2c], ebp
add eax, dword [esp + 0x50]
mov ecx, dword [esp + 0xb0]
xor eax, dword [esi + 0x30]
mov dword [ebx + 0x30], eax
add ecx, dword [esp + 0x54]
xor ecx, dword [esi + 0x34]
mov dword [ebx + 0x34], ecx
add edx, dword [esp + 0x68]
xor edx, dword [esi + 0x38]
mov dword [ebx + 0x38], edx
mov edx, dword [esp + 0x84]
add edx, dword [esp + 0x64]
xor edx, dword [esi + 0x3c]
add esi, 0x40
mov dword [ebx + 0x3c], edx
mov edx, dword [esp + 0x54]
inc dword [esp + 0x50]
lea eax, [edx + 1]
jne 0x40737e
mov edx, eax
mov dword [esp + 0x54], edx
cmp edi, 0x40
jbe 0x407396
jmp 0x406f08
mov edx, 1
jmp 0x406f4b
jae 0x4073b1
test edi, edi
jbe 0x4073b1
mov ecx, dword [esp]
xor edx, edx
mov ebx, dword [esp + 0x4c]
movzx eax, byte [edx + ebx]
mov byte [edx + ecx], al
inc edx
cmp edx, edi
jb 0x4073a5
mov ecx, dword [esp + 0xe0]
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], edx
add esp, 0xcc
pop ebp
pop ebx
pop edi
pop esi
ret
mov ebp, dword [esp + 0x4c]
add ecx, dword [esp + 0x70]
add eax, dword [esp + 0x5c]
mov dword [ebp + 0x10], ecx
mov ecx, dword [esp + 0x90]
add ecx, dword [esp + 0x74]
mov dword [ebp + 0x14], ecx
mov ecx, dword [esp + 0x98]
mov dword [ebp], ebx
mov ebx, dword [esp + 0xa0]
add ebx, 0x3320646e
mov dword [ebp + 4], ebx
mov ebx, dword [esp + 0xa4]
add ecx, dword [esp + 0x58]
add ebx, 0x79622d32
mov dword [ebp + 8], ebx
mov ebx, dword [esp + 0xac]
add ebx, 0x6b206574
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x1c], ecx
mov dword [ebp + 0x20], eax
mov ebx, dword [esp + 0x94]
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0x88]
add ebx, dword [esp + 0x7c]
add eax, dword [esp + 0x60]
add ecx, dword [esp + 0x78]
add edx, dword [esp + 0x68]
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x24], eax
mov dword [ebp + 0x28], ecx
mov dword [ebp + 0x38], edx
mov ebx, dword [esp + 0x8c]
mov eax, dword [esp + 0xb4]
mov ecx, dword [esp + 0xb0]
mov edx, dword [esp + 0x84]
add ebx, dword [esp + 0x6c]
add eax, dword [esp + 0x50]
add ecx, dword [esp + 0x54]
add edx, dword [esp + 0x64]
mov dword [ebp + 0x2c], ebx
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x34], ecx
mov dword [ebp + 0x3c], edx
jmp 0x40736f