Function at 0x5a4940
Capabilities:
Encrypt data using salsa20 or chacha
Reference http user-agent string
Resolve function by parsing pe exports

Disassembly:
lea r12, [rsp - 0x90]
cmp r12, qword [r14 + 0x10]
jbe 0x5a5186
push rbp
mov rbp, rsp
sub rsp, 0x108
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0x138], rsi
cmp rcx, r8
jne 0x5a5171
nop word [rax + rax]
nop
test rcx, 0x3f
jne 0x5a5171
mov qword [rsp + 0x128], rcx
mov edx, dword [rax]
mov dword [rsp + 0x50], edx
mov r10d, dword [rax + 4]
mov dword [rsp + 0x4c], r10d
mov r11d, dword [rax + 8]
mov dword [rsp + 0x48], r11d
mov r12d, dword [rax + 0xc]
mov dword [rsp + 0x44], r12d
mov r13d, dword [rax + 0x10]
mov dword [rsp + 0x40], r13d
mov r15d, dword [rax + 0x14]
mov dword [rsp + 0x3c], r15d
mov r13d, dword [rax + 0x18]
mov dword [rsp + 0x64], r13d
mov edx, dword [rax + 0x1c]
mov dword [rsp + 0x60], edx
mov edx, dword [rax + 0x24]
mov dword [rsp + 0x5c], edx
mov r12d, dword [rax + 0x28]
mov dword [rsp + 0x58], r12d
mov ecx, dword [rax + 0x2c]
mov dword [rsp + 0x54], ecx
cmp byte [rax + 0x79], 0
jne 0x5a4b77
mov qword [rsp + 0x148], r9
mov qword [rsp + 0x140], r8
mov qword [rsp + 0x138], rsi
mov qword [rsp + 0x130], rdi
mov qword [rsp + 0x120], rbx
lea ebx, [r10 + 0x3320646e]
xor ebx, edx
rol ebx, 0x10
lea edx, [r15 + rbx]
mov dword [rsp + 0x80], edx
xor edx, r10d
rol edx, 0xc
lea r15d, [r10 + rdx]
lea r15d, [r15 + 0x3320646e]
xor ebx, r15d
rol ebx, 8
mov r10d, dword [rsp + 0x80]
add r10d, ebx
xor edx, r10d
rol edx, 7
lea esi, [r11 + 0x79622d32]
xor esi, r12d
rol esi, 0x10
lea r12d, [r13 + rsi]
mov dword [rsp + 0x7c], r12d
xor r12d, r11d
rol r12d, 0xc
lea r13d, [r11 + r12]
lea r13d, [r13 + 0x79622d32]
xor esi, r13d
rol esi, 8
mov r11d, dword [rsp + 0x7c]
add r11d, esi
xor r12d, r11d
rol r12d, 7
mov edi, dword [rsp + 0x44]
lea r8d, [rdi + 0x6b206574]
xor r8d, ecx
rol r8d, 0x10
mov ecx, dword [rsp + 0x60]
add ecx, r8d
mov dword [rsp + 0x78], ecx
xor ecx, edi
rol ecx, 0xc
lea edi, [rdi + rcx]
lea edi, [rdi + 0x6b206574]
xor r8d, edi
rol r8d, 8
mov r9d, dword [rsp + 0x78]
add r9d, r8d
xor ecx, r9d
rol ecx, 7
mov dword [rax + 0x7c], r15d
mov dword [rax + 0x80], edx
mov dword [rax + 0x84], r10d
mov dword [rax + 0x88], ebx
mov dword [rax + 0x8c], r13d
mov dword [rax + 0x90], r12d
mov dword [rax + 0x94], r11d
mov dword [rax + 0x98], esi
mov dword [rax + 0x9c], edi
mov dword [rax + 0xa0], ecx
mov dword [rax + 0xa4], r9d
mov dword [rax + 0xa8], r8d
mov byte [rax + 0x79], 1
mov ecx, dword [rsp + 0x54]
mov edx, dword [rsp + 0x5c]
mov rbx, qword [rsp + 0x120]
mov rsi, qword [rsp + 0x138]
mov rdi, qword [rsp + 0x130]
mov r8, qword [rsp + 0x140]
mov r9, qword [rsp + 0x148]
mov r10d, dword [rsp + 0x4c]
mov r11d, dword [rsp + 0x48]
mov r12d, dword [rsp + 0x58]
mov r13d, dword [rsp + 0x64]
mov r15d, dword [rsp + 0x3c]
mov qword [rsp + 0x118], rax
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xc0]
nop
jmp 0x5a4dc1
mov dword [rsp + 0x28], r9d
mov r10, qword [rsp + 0xd8]
add r10, 0xffffffffffffffc0
mov qword [rsp + 0xd8], r10
neg r10
sar r10, 0x3f
and r10d, 0x40
mov qword [rsp + 0xd0], r10
mov r10, qword [rsp + 0xe0]
add r10, 0xffffffffffffffc0
mov qword [rsp + 0xe0], r10
neg r10
sar r10, 0x3f
and r10d, 0x40
mov qword [rsp + 0xc8], r10
add edi, 0x61707865
mov r10, qword [rsp + 0xf8]
xor edi, dword [r10]
mov r9d, dword [rsp + 0x34]
add r9d, 0x3320646e
add r13d, 0x79622d32
add ecx, 0x6b206574
mov dword [rsp + 0x9c], ecx
mov ecx, dword [rsp + 0x50]
add eax, ecx
mov ecx, dword [rsp + 0x4c]
add r8d, ecx
mov ecx, dword [rsp + 0x48]
add r12d, ecx
mov ecx, dword [rsp + 0x44]
add r15d, ecx
mov ecx, dword [rsp + 0x40]
add esi, ecx
mov ecx, dword [rsp + 0x3c]
add ebx, ecx
mov dword [rsp + 0x98], ebx
mov ecx, dword [rsp + 0x30]
mov ebx, dword [rsp + 0x64]
add ecx, ebx
mov dword [rsp + 0x94], ecx
mov ebx, dword [rsp + 0x2c]
mov ecx, dword [rsp + 0x60]
add ebx, ecx
mov ecx, dword [rsp + 0x5c]
add r11d, ecx
mov ecx, dword [rsp + 0x58]
add edx, ecx
mov dword [rsp + 0x90], edx
mov ecx, dword [rsp + 0x20]
mov edx, dword [rsp + 0x54]
add ecx, edx
nop
mov rdx, qword [rsp + 0x100]
mov dword [rdx], edi
xor r9d, dword [r10 + 4]
nop
mov dword [rdx + 4], r9d
xor r13d, dword [r10 + 8]
nop
mov dword [rdx + 8], r13d
mov edi, dword [rsp + 0x9c]
xor edi, dword [r10 + 0xc]
nop
mov dword [rdx + 0xc], edi
xor eax, dword [r10 + 0x10]
nop
mov dword [rdx + 0x10], eax
xor r8d, dword [r10 + 0x14]
nop
mov dword [rdx + 0x14], r8d
xor r12d, dword [r10 + 0x18]
nop
mov dword [rdx + 0x18], r12d
xor r15d, dword [r10 + 0x1c]
nop
mov dword [rdx + 0x1c], r15d
xor esi, dword [r10 + 0x20]
nop
mov dword [rdx + 0x20], esi
mov eax, dword [rsp + 0x98]
xor eax, dword [r10 + 0x24]
nop
mov dword [rdx + 0x24], eax
mov eax, dword [rsp + 0x94]
xor eax, dword [r10 + 0x28]
nop
mov dword [rdx + 0x28], eax
xor ebx, dword [r10 + 0x2c]
nop
mov dword [rdx + 0x2c], ebx
mov rax, qword [rsp + 0x118]
mov ebx, dword [rax + 0x20]
mov esi, dword [rsp + 0x28]
add ebx, esi
xor ebx, dword [r10 + 0x30]
mov dword [rdx + 0x30], ebx
xor r11d, dword [r10 + 0x34]
nop
mov dword [rdx + 0x34], r11d
mov ebx, dword [rsp + 0x90]
xor ebx, dword [r10 + 0x38]
nop
mov dword [rdx + 0x38], ebx
xor ecx, dword [r10 + 0x3c]
nop
mov dword [rdx + 0x3c], ecx
inc dword [rax + 0x20]
mov rcx, qword [rsp + 0xd0]
lea rsi, [r10 + rcx]
mov r8, qword [rsp + 0xe8]
add r8, 0xffffffffffffffc0
mov rcx, qword [rsp + 0xc8]
lea rbx, [rdx + rcx]
mov rcx, qword [rsp + 0xf0]
add rcx, 0xffffffffffffffc0
mov edx, dword [rsp + 0x40]
mov edi, dword [rsp + 0x50]
mov r9, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xe0]
mov edx, dword [rsp + 0x5c]
mov r10d, dword [rsp + 0x4c]
mov r11d, dword [rsp + 0x48]
mov r12d, dword [rsp + 0x58]
mov r13d, dword [rsp + 0x64]
mov r15d, dword [rsp + 0x3c]
mov qword [rsp + 0xf0], rcx
mov rdi, qword [rsp + 0xe0]
mov ecx, dword [rsp + 0x54]
cmp r8, 0x40
jl 0x5a4fcf
mov qword [rsp + 0xe8], r8
mov r8, qword [rsp + 0xf0]
nop dword [rax + rax]
cmp r8, 0x40
jl 0x5a4fcf
mov qword [rsp + 0xe0], rdi
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0xd8], r9
mov qword [rsp + 0xf8], rsi
mov r8d, dword [rax + 0x80]
mov ebx, dword [rax + 0x94]
mov ecx, dword [rax + 0x7c]
mov r12d, dword [rax + 0x90]
mov edx, dword [rax + 0xa4]
mov r13d, dword [rax + 0x8c]
mov r15d, dword [rax + 0xa0]
mov r11d, dword [rax + 0x88]
mov r10d, dword [rax + 0x9c]
mov dword [rsp + 0x88], r10d
mov esi, dword [rax + 0x84]
mov dword [rsp + 0x68], esi
mov edi, dword [rax + 0x98]
mov dword [rsp + 0x38], edi
mov r9d, dword [rsp + 0x50]
lea esi, [r9 + 0x61707865]
xor esi, dword [rax + 0x20]
rol esi, 0x10
mov edi, dword [rsp + 0x40]
add edi, esi
mov dword [rsp + 0x74], edi
xor edi, r9d
rol edi, 0xc
lea r10d, [r9 + rdi]
lea r9d, [rdi + r9]
lea r9d, [r9 + 0x61707865]
xor r9d, esi
rol r9d, 8
mov esi, dword [rsp + 0x74]
add esi, r9d
xor edi, esi
rol edi, 7
mov dword [rsp + 0x84], edi
lea edi, [r8 + r10]
lea r10d, [r10 + r8]
lea r10d, [r10 + 0x61707865]
xor r10d, dword [rax + 0xa8]
rol r10d, 0x10
add ebx, r10d
xor r8d, ebx
rol r8d, 0xc
lea edi, [rdi + r8]
lea edi, [rdi + 0x61707865]
xor r10d, edi
rol r10d, 8
add ebx, r10d
mov dword [rsp + 0x70], ebx
xor r8d, ebx
add ecx, r12d
xor r9d, ecx
rol r9d, 0x10
add edx, r9d
xor r12d, edx
rol r12d, 0xc
add ecx, r12d
mov dword [rsp + 0x8c], ecx
xor r9d, ecx
rol r9d, 8
add edx, r9d
mov dword [rsp + 0x6c], edx
xor r12d, edx
add r13d, r15d
xor r11d, r13d
rol r11d, 0x10
add esi, r11d
xor r15d, esi
rol r15d, 0xc
add r13d, r15d
xor r11d, r13d
rol r11d, 8
add esi, r11d
xor r15d, esi
mov eax, dword [rsp + 0x84]
mov ecx, dword [rsp + 0x88]
add ecx, eax
mov edx, dword [rsp + 0x38]
xor edx, ecx
rol edx, 0x10
mov ebx, dword [rsp + 0x68]
add ebx, edx
xor eax, ebx
rol eax, 0xc
add ecx, eax
xor edx, ecx
rol edx, 8
add ebx, edx
xor eax, ebx
nop
rol r8d, 7
rol r12d, 7
rol r15d, 7
rol eax, 7
mov dword [rsp + 0xb8], eax
xor eax, eax
mov qword [rsp + 0xa0], rax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0xb0], ecx
mov ecx, dword [rsp + 0x8c]
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0xa8], edx
mov edx, dword [rsp + 0x6c]
mov dword [rsp + 0x2c], edx
mov eax, dword [rsp + 0xb8]
mov edx, dword [rsp + 0xa8]
mov ecx, dword [rsp + 0xb0]
jmp 0x5a5155
add rsp, 0x108
pop rbp
ret
add edi, eax
xor r9d, edi
rol r9d, 0x10
add esi, r9d
xor eax, esi
rol eax, 0xc
add edi, eax
xor r9d, edi
rol r9d, 8
add esi, r9d
xor eax, esi
rol eax, 7
mov dword [rsp + 0x18], eax
mov r10d, dword [rsp + 0x34]
add r10d, r8d
xor r11d, r10d
rol r11d, 0x10
add ebx, r11d
xor r8d, ebx
rol r8d, 0xc
add r10d, r8d
xor r11d, r10d
rol r11d, 8
add ebx, r11d
mov dword [rsp + 0x14], ebx
xor r8d, ebx
rol r8d, 7
add r13d, r12d
xor edx, r13d
rol edx, 0x10
mov ebx, dword [rsp + 0x30]
add ebx, edx
xor r12d, ebx
rol r12d, 0xc
add r13d, r12d
xor edx, r13d
rol edx, 8
mov dword [rsp + 0x24], edx
add ebx, edx
xor r12d, ebx
rol r12d, 7
add ecx, r15d
mov edx, dword [rsp + 0x20]
xor edx, ecx
rol edx, 0x10
mov eax, dword [rsp + 0x2c]
add eax, edx
xor r15d, eax
rol r15d, 0xc
add ecx, r15d
xor edx, ecx
rol edx, 8
add eax, edx
xor r15d, eax
rol r15d, 7
add edi, r8d
xor edx, edi
rol edx, 0x10
add ebx, edx
xor r8d, ebx
rol r8d, 0xc
add edi, r8d
xor edx, edi
rol edx, 8
mov dword [rsp + 0x20], edx
add ebx, edx
mov dword [rsp + 0x30], ebx
xor r8d, ebx
add r10d, r12d
xor r9d, r10d
rol r9d, 0x10
add eax, r9d
xor r12d, eax
rol r12d, 0xc
add r10d, r12d
xor r9d, r10d
rol r9d, 8
add eax, r9d
mov dword [rsp + 0x2c], eax
xor r12d, eax
add r13d, r15d
xor r11d, r13d
rol r11d, 0x10
add esi, r11d
xor r15d, esi
rol r15d, 0xc
add r13d, r15d
xor r11d, r13d
rol r11d, 8
add esi, r11d
xor r15d, esi
mov eax, dword [rsp + 0x18]
add ecx, eax
mov edx, dword [rsp + 0x24]
xor edx, ecx
rol edx, 0x10
mov ebx, dword [rsp + 0x14]
add ebx, edx
xor eax, ebx
rol eax, 0xc
add ecx, eax
mov dword [rsp + 0x1c], ecx
xor edx, ecx
rol edx, 8
add ebx, edx
xor eax, ebx
mov rcx, qword [rsp + 0xa0]
inc rcx
nop
nop
nop
nop
nop
rol r8d, 7
rol r12d, 7
rol r15d, 7
rol eax, 7
mov qword [rsp + 0xa0], rcx
mov dword [rsp + 0x34], r10d
mov ecx, dword [rsp + 0x1c]
mov r10d, dword [rsp + 0x20]
mov dword [rsp + 0x20], r10d
mov r10, qword [rsp + 0xa0]
cmp r10, 9
jl 0x5a4fd8
jmp 0x5a4ba5
lea rax, [0x0065b7a0]
lea rbx, [0x00728380]
nop
call fcn.00436ac0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.004646a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.005a4940