Function at 0x433300
Capabilities:
Contain obfuscated stackstrings
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
mov edx, dword [esp + 0x74]
mov eax, 0x6b206574
mov dword [esp + 0x2c], 0x61707865
mov dword [esp + 0x20], 0x3320646e
mov dword [esp + 0x24], 0x79622d32
test edx, edx
je 0x4333b3
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 6]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [edx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xa]
mov dword [esp + 0x20], ecx
movzx ecx, byte [edx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xf]
shl eax, 8
mov dword [esp + 0x24], ecx
movzx ecx, byte [edx + 0xe]
or eax, ecx
movzx ecx, byte [edx + 0xd]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 0xc]
shl eax, 8
or eax, ecx
mov edx, dword [esp + 0x70]
push ebx
push ebp
push esi
movzx esi, byte [edx + 3]
movzx ecx, byte [edx + 2]
movzx ebx, byte [edx + 0xb]
shl esi, 8
or esi, ecx
movzx ebp, byte [edx + 0xf]
movzx ecx, byte [edx + 1]
shl esi, 8
or esi, ecx
shl ebx, 8
movzx ecx, byte [edx]
push edi
movzx edi, byte [edx + 7]
shl edi, 8
shl esi, 8
or esi, ecx
shl ebp, 8
movzx ecx, byte [edx + 6]
or edi, ecx
mov dword [esp + 0x70], eax
movzx ecx, byte [edx + 5]
shl edi, 8
or edi, ecx
mov dword [esp + 0x40], esi
movzx ecx, byte [edx + 4]
shl edi, 8
or edi, ecx
movzx ecx, byte [edx + 0xa]
or ebx, ecx
mov dword [esp + 0x38], edi
movzx ecx, byte [edx + 9]
shl ebx, 8
or ebx, ecx
mov dword [esp + 0x44], edi
movzx ecx, byte [edx + 8]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [edx + 0xe]
or ebp, ecx
mov dword [esp + 0x48], ebx
movzx ecx, byte [edx + 0xd]
shl ebp, 8
or ebp, ecx
movzx ecx, byte [edx + 0xc]
shl ebp, 8
or ebp, ecx
movzx ecx, byte [edx + 0x13]
shl ecx, 8
mov dword [esp + 0x10], ecx
movzx ecx, byte [edx + 0x12]
or dword [esp + 0x10], ecx
shl dword [esp + 0x10], 8
movzx ecx, byte [edx + 0x11]
or dword [esp + 0x10], ecx
shl dword [esp + 0x10], 8
movzx ecx, byte [edx + 0x10]
or dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x60], ecx
movzx ecx, byte [edx + 0x17]
shl ecx, 8
mov dword [esp + 0x84], ecx
movzx ecx, byte [edx + 0x16]
or dword [esp + 0x84], ecx
shl dword [esp + 0x84], 8
movzx ecx, byte [edx + 0x15]
or dword [esp + 0x84], ecx
shl dword [esp + 0x84], 8
movzx ecx, byte [edx + 0x14]
or dword [esp + 0x84], ecx
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x64], ecx
movzx ecx, byte [edx + 0x1b]
shl ecx, 8
mov dword [esp + 0x80], ecx
movzx ecx, byte [edx + 0x1a]
mov dword [esp + 0x4c], ebp
or dword [esp + 0x80], ecx
shl dword [esp + 0x80], 8
movzx ecx, byte [edx + 0x19]
or dword [esp + 0x80], ecx
movzx ecx, byte [edx + 0x18]
shl dword [esp + 0x80], 8
or dword [esp + 0x80], ecx
movzx edi, byte [edx + 0x1f]
shl edi, 8
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x68], ecx
movzx ecx, byte [edx + 0x1e]
or edi, ecx
movzx ecx, byte [edx + 0x1d]
shl edi, 8
or edi, ecx
movzx ecx, byte [edx + 0x1c]
mov edx, dword [esp + 0x7c]
shl edi, 8
or edi, ecx
mov dword [esp + 0x28], edi
movzx ecx, byte [edx + 2]
mov dword [esp + 0x6c], edi
movzx edi, byte [edx + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [edx + 1]
shl edi, 8
or edi, ecx
movzx ecx, byte [edx]
shl edi, 8
or edi, ecx
movzx ecx, byte [edx + 6]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x50], edi
movzx edi, byte [edx + 7]
shl edi, 8
or edi, ecx
movzx ecx, byte [edx + 5]
shl edi, 8
or edi, ecx
movzx ecx, byte [edx + 4]
shl edi, 8
or edi, ecx
movzx ecx, byte [edx + 0xa]
mov dword [esp + 0x20], edi
mov dword [esp + 0x54], edi
movzx edi, byte [edx + 0xb]
shl edi, 8
or edi, ecx
movzx ecx, byte [edx + 9]
shl edi, 8
or edi, ecx
movzx ecx, byte [edx + 8]
shl edi, 8
or edi, ecx
movzx ecx, byte [edx + 0xe]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x58], edi
movzx edi, byte [edx + 0xf]
shl edi, 8
or edi, ecx
movzx ecx, byte [edx + 0xd]
shl edi, 8
or edi, ecx
movzx ecx, byte [edx + 0xc]
mov edx, dword [esp + 0x3c]
shl edi, 8
or edi, ecx
cmp dword [esp + 0x88], 0
mov dword [esp + 0x24], edi
mov ecx, edx
mov dword [esp + 0x5c], edi
mov edi, dword [esp + 0x30]
mov dword [esp + 0x7c], edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x38]
jle 0x433824
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x7c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x88]
dec ecx
mov dword [esp + 0x18], edx
shr ecx, 1
inc ecx
mov dword [esp + 0x88], ecx
jmp 0x433634
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x84]
add ecx, edx
ror ecx, 0x19
xor ebp, ecx
lea ecx, [edx + ebp]
mov edx, dword [esp + 0x2c]
ror ecx, 0x17
xor edx, ecx
mov dword [esp + 0x2c], edx
lea ecx, [edx + ebp]
ror ecx, 0x13
xor dword [esp + 0x84], ecx
mov ecx, dword [esp + 0x84]
add ecx, edx
mov edx, dword [esp + 0x24]
ror ecx, 0xe
xor dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x7c]
add ecx, esi
ror ecx, 0x19
xor edx, ecx
mov ecx, dword [esp + 0x7c]
add ecx, edx
mov dword [esp + 0x24], edx
ror ecx, 0x17
xor dword [esp + 0x80], ecx
mov ecx, dword [esp + 0x80]
add ecx, edx
mov edx, dword [esp + 0x28]
ror ecx, 0x13
xor esi, ecx
mov ecx, dword [esp + 0x80]
add ecx, esi
ror ecx, 0xe
xor dword [esp + 0x7c], ecx
mov ecx, dword [esp + 0x1c]
add ecx, dword [esp + 0x14]
ror ecx, 0x19
xor edx, ecx
mov ecx, dword [esp + 0x14]
add ecx, edx
mov dword [esp + 0x28], edx
ror ecx, 0x17
xor edi, ecx
lea ecx, [edx + edi]
mov edx, dword [esp + 0x1c]
ror ecx, 0x13
xor edx, ecx
mov dword [esp + 0x1c], edx
lea ecx, [edx + edi]
mov edx, dword [esp + 0x10]
ror ecx, 0xe
xor dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + eax]
ror ecx, 0x19
xor ebx, ecx
lea ecx, [ebx + eax]
ror ecx, 0x17
xor dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
add ecx, ebx
ror ecx, 0x13
xor edx, ecx
mov ecx, dword [esp + 0x20]
add ecx, edx
ror ecx, 0xe
xor eax, ecx
mov ecx, dword [esp + 0x18]
add ecx, ebx
ror ecx, 0x19
xor esi, ecx
mov ecx, dword [esp + 0x18]
add ecx, esi
ror ecx, 0x17
xor edi, ecx
mov dword [esp + 0x38], edi
lea ecx, [edi + esi]
ror ecx, 0x13
xor ebx, ecx
lea ecx, [ebx + edi]
mov edi, dword [esp + 0x7c]
ror ecx, 0xe
xor dword [esp + 0x18], ecx
lea ecx, [edi + ebp]
ror ecx, 0x19
xor dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
add ecx, edi
mov edi, dword [esp + 0x20]
ror ecx, 0x17
xor edi, ecx
mov ecx, dword [esp + 0x1c]
add ecx, edi
mov dword [esp + 0x20], edi
ror ecx, 0x13
xor ebp, ecx
mov ecx, edi
mov edi, dword [esp + 0x14]
add ecx, ebp
ror ecx, 0xe
xor dword [esp + 0x7c], ecx
mov ecx, dword [esp + 0x24]
add ecx, edi
ror ecx, 0x19
xor edx, ecx
mov dword [esp + 0x10], edx
lea ecx, [edx + edi]
mov edi, dword [esp + 0x2c]
ror ecx, 0x17
xor edi, ecx
mov dword [esp + 0x2c], edi
lea ecx, [edi + edx]
mov edx, dword [esp + 0x24]
ror ecx, 0x13
xor edx, ecx
mov dword [esp + 0x24], edx
lea ecx, [edx + edi]
mov edx, dword [esp + 0x80]
ror ecx, 0xe
xor dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x28]
add ecx, eax
mov edi, dword [esp + 0x38]
ror ecx, 0x19
xor dword [esp + 0x84], ecx
mov ecx, dword [esp + 0x84]
add ecx, eax
ror ecx, 0x17
xor edx, ecx
mov ecx, dword [esp + 0x84]
add ecx, edx
mov dword [esp + 0x80], edx
mov edx, dword [esp + 0x28]
ror ecx, 0x13
xor edx, ecx
mov ecx, dword [esp + 0x80]
add ecx, edx
mov dword [esp + 0x28], edx
ror ecx, 0xe
xor eax, ecx
sub dword [esp + 0x88], 1
jne 0x433630
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x3c]
add ecx, edx
mov edx, dword [esp + 0x78]
mov byte [edx], cl
shr ecx, 8
mov byte [edx + 1], cl
shr ecx, 8
mov byte [edx + 2], cl
shr ecx, 8
mov byte [edx + 3], cl
mov ecx, dword [esp + 0x40]
add ecx, esi
mov byte [edx + 4], cl
shr ecx, 8
mov byte [edx + 5], cl
shr ecx, 8
mov byte [edx + 6], cl
shr ecx, 8
mov byte [edx + 7], cl
mov ecx, dword [esp + 0x44]
add ecx, edi
mov byte [edx + 8], cl
shr ecx, 8
mov byte [edx + 9], cl
shr ecx, 8
mov byte [edx + 0xa], cl
shr ecx, 8
mov byte [edx + 0xb], cl
mov ecx, dword [esp + 0x48]
add ecx, ebx
mov byte [edx + 0xc], cl
shr ecx, 8
mov byte [edx + 0xd], cl
shr ecx, 8
mov byte [edx + 0xe], cl
shr ecx, 8
mov byte [edx + 0xf], cl
mov ecx, dword [esp + 0x4c]
add ecx, ebp
mov byte [edx + 0x10], cl
shr ecx, 8
mov byte [edx + 0x11], cl
shr ecx, 8
mov byte [edx + 0x12], cl
shr ecx, 8
mov byte [edx + 0x13], cl
mov ecx, dword [esp + 0x7c]
add ecx, dword [esp + 0x30]
mov byte [edx + 0x14], cl
shr ecx, 8
mov byte [edx + 0x15], cl
shr ecx, 8
mov byte [edx + 0x16], cl
shr ecx, 8
mov byte [edx + 0x17], cl
mov ecx, dword [esp + 0x1c]
add ecx, dword [esp + 0x50]
mov byte [edx + 0x18], cl
shr ecx, 8
mov byte [edx + 0x19], cl
shr ecx, 8
mov byte [edx + 0x1a], cl
shr ecx, 8
mov byte [edx + 0x1b], cl
mov ecx, dword [esp + 0x20]
add ecx, dword [esp + 0x54]
mov byte [edx + 0x1c], cl
shr ecx, 8
mov byte [edx + 0x1d], cl
shr ecx, 8
mov byte [edx + 0x1e], cl
shr ecx, 8
mov byte [edx + 0x1f], cl
mov ecx, dword [esp + 0x2c]
add ecx, dword [esp + 0x58]
mov byte [edx + 0x20], cl
shr ecx, 8
mov byte [edx + 0x21], cl
shr ecx, 8
mov byte [edx + 0x22], cl
shr ecx, 8
mov byte [edx + 0x23], cl
mov ecx, dword [esp + 0x24]
add ecx, dword [esp + 0x5c]
mov byte [edx + 0x24], cl
shr ecx, 8
mov byte [edx + 0x25], cl
shr ecx, 8
mov byte [edx + 0x26], cl
shr ecx, 8
mov byte [edx + 0x27], cl
mov ecx, dword [esp + 0x14]
add ecx, dword [esp + 0x34]
mov byte [edx + 0x28], cl
shr ecx, 8
mov byte [edx + 0x29], cl
shr ecx, 8
mov byte [edx + 0x2a], cl
shr ecx, 8
mov byte [edx + 0x2b], cl
mov ecx, dword [esp + 0x10]
add ecx, dword [esp + 0x60]
mov byte [edx + 0x2c], cl
shr ecx, 8
mov byte [edx + 0x2d], cl
shr ecx, 8
mov byte [edx + 0x2e], cl
shr ecx, 8
mov byte [edx + 0x2f], cl
mov ecx, dword [esp + 0x84]
add ecx, dword [esp + 0x64]
mov byte [edx + 0x30], cl
shr ecx, 8
mov byte [edx + 0x31], cl
shr ecx, 8
add eax, dword [esp + 0x70]
mov byte [edx + 0x32], cl
shr ecx, 8
mov byte [edx + 0x33], cl
mov ecx, dword [esp + 0x80]
add ecx, dword [esp + 0x68]
mov byte [edx + 0x34], cl
shr ecx, 8
mov byte [edx + 0x35], cl
shr ecx, 8
mov byte [edx + 0x36], cl
shr ecx, 8
mov byte [edx + 0x37], cl
mov ecx, dword [esp + 0x28]
add ecx, dword [esp + 0x6c]
mov byte [edx + 0x38], cl
shr ecx, 8
mov byte [edx + 0x3c], al
shr eax, 8
mov byte [edx + 0x39], cl
shr ecx, 8
pop edi
mov byte [edx + 0x3d], al
shr eax, 8
pop esi
mov byte [edx + 0x3a], cl
shr ecx, 8
mov byte [edx + 0x3e], al
shr eax, 8
pop ebp
mov byte [edx + 0x3b], cl
mov byte [edx + 0x3f], al
pop ebx
add esp, 0x64
ret