Function at 0x1401f5130
Capabilities:
Encode data using xor
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xe8
mov rsi, qword [rsp + 0x158]
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x40], rsi
mov rsi, qword [0x140485900]
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsi]
mov qword [rsp + 0xd8], rdx
xor edx, edx
mov esi, dword [r9]
mov dword [rsp + 0x130], ecx
mov qword [rsp + 0x38], r8
mov dword [rsp + 0x58], esi
mov esi, dword [r9 + 4]
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x5c], esi
mov esi, dword [r9 + 8]
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x60], esi
mov esi, dword [r9 + 0xc]
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x64], esi
mov esi, dword [r9 + 0x10]
mov dword [rsp + 0x68], esi
mov esi, dword [r9 + 0x14]
mov dword [rsp + 0x6c], esi
mov esi, dword [r9 + 0x18]
mov dword [rsp + 0x70], esi
mov esi, dword [r9 + 0x1c]
mov dword [rsp + 0x74], esi
mov esi, dword [rax]
mov eax, dword [rax + 4]
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x7c], eax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x38], 0x3f
mov qword [rsp + 0x140], r8
jbe 0x1401f5550
nop dword [rax]
mov r14d, dword [rsp + 0x7c]
mov r15d, dword [rsp + 0x64]
mov r10d, 0x6b206574
mov ebx, 0x79622d32
mov eax, dword [rsp + 0x130]
mov r12d, dword [rsp + 0x70]
mov esi, 0x3320646e
mov r13d, 0x61707865
mov r8d, dword [rsp + 0x60]
mov r9d, dword [rsp + 0x6c]
mov edx, dword [rsp + 0x50]
mov edi, dword [rsp + 0x5c]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x74]
mov r11d, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x34]
mov ebp, dword [rsp + 0x58]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x78]
nop dword [rax + rax]
add r13d, ebp
add esi, edi
add ebx, r8d
xor ecx, r13d
xor edx, esi
xor eax, ebx
rol ecx, 0x10
rol edx, 0x10
add r11d, ecx
add r9d, edx
rol eax, 0x10
xor ebp, r11d
xor edi, r9d
add r12d, eax
rol ebp, 0xc
rol edi, 0xc
xor r8d, r12d
add r13d, ebp
add esi, edi
rol r8d, 0xc
xor ecx, r13d
xor edx, esi
add ebx, r8d
rol ecx, 8
rol edx, 8
xor eax, ebx
add r11d, ecx
add r9d, edx
xor ebp, r11d
xor edi, r9d
mov dword [rsp + 0x30], r9d
rol ebp, 7
rol edi, 7
mov dword [rsp + 0x2c], r11d
rol eax, 8
add r10d, r15d
add r13d, edi
xor r14d, r10d
add r12d, eax
mov r9d, r14d
mov r14d, dword [rsp + 0x24]
xor r8d, r12d
rol r9d, 0x10
rol r8d, 7
add r14d, r9d
add esi, r8d
xor r15d, r14d
mov r11d, r14d
xor ecx, esi
rol r15d, 0xc
rol ecx, 0x10
add r10d, r15d
xor r9d, r10d
rol r9d, 8
add r11d, r9d
xor r9d, r13d
rol r9d, 0x10
xor r15d, r11d
add r11d, ecx
add r12d, r9d
rol r15d, 7
xor edi, r12d
rol edi, 0xc
add r13d, edi
xor r9d, r13d
mov r14d, r9d
mov r9d, dword [rsp + 0x30]
rol r14d, 8
add r12d, r14d
xor edi, r12d
rol edi, 7
xor r8d, r11d
add ebx, r15d
add r10d, ebp
rol r8d, 0xc
xor edx, ebx
xor eax, r10d
rol edx, 0x10
add esi, r8d
rol eax, 0x10
xor ecx, esi
add r9d, eax
rol ecx, 8
xor ebp, r9d
add r11d, ecx
rol ebp, 0xc
xor r8d, r11d
mov dword [rsp + 0x24], r11d
mov r11d, dword [rsp + 0x2c]
add r10d, ebp
xor eax, r10d
rol r8d, 7
add r11d, edx
rol eax, 8
xor r15d, r11d
add r9d, eax
rol r15d, 0xc
xor ebp, r9d
add ebx, r15d
rol ebp, 7
xor edx, ebx
rol edx, 8
add r11d, edx
xor r15d, r11d
rol r15d, 7
sub dword [rsp + 0x28], 2
cmp dword [rsp + 0x28], 0
jg 0x1401f5270
add r10d, 0x6b206574
add r13d, 0x61707865
add esi, 0x3320646e
add ebx, 0x79622d32
mov dword [rsp + 0x28], r10d
mov r10d, dword [rsp + 0x58]
add ebp, r10d
mov r10d, dword [rsp + 0x5c]
add edi, r10d
mov r10d, dword [rsp + 0x60]
add r8d, r10d
mov r10d, dword [rsp + 0x64]
mov dword [rsp + 0x2c], r8d
mov r8d, dword [rsp + 0x74]
add r15d, r10d
mov r10d, dword [rsp + 0x68]
add r11d, r10d
mov r10d, dword [rsp + 0x6c]
add r9d, r10d
mov r10d, dword [rsp + 0x70]
add r12d, r10d
mov r10d, dword [rsp + 0x24]
add r10d, r8d
mov r8d, dword [rsp + 0x78]
mov dword [rsp + 0x24], r10d
mov r10d, dword [rsp + 0x34]
add eax, r8d
mov r8d, dword [rsp + 0x7c]
add ecx, r10d
mov dword [rsp + 0x30], eax
mov r10d, dword [rsp + 0x50]
add r14d, r8d
mov r8, qword [rsp + 0x48]
add edx, r10d
mov r10d, dword [rsp + 0x28]
mov eax, dword [r8]
xor r10d, dword [r8 + 0xc]
xor ebx, dword [r8 + 8]
xor esi, dword [r8 + 4]
mov dword [rsp + 0x28], r10d
xor eax, r13d
mov r13, r8
xor ebp, dword [r8 + 0x10]
xor edi, dword [r8 + 0x14]
xor r15d, dword [r13 + 0x1c]
xor r11d, dword [r13 + 0x20]
mov dword [rsp + 0x54], eax
xor r9d, dword [r13 + 0x24]
mov r8d, dword [rsp + 0x2c]
xor r8d, dword [r13 + 0x18]
xor r12d, dword [r13 + 0x28]
mov eax, dword [rsp + 0x24]
xor eax, dword [r13 + 0x2c]
xor ecx, dword [r13 + 0x30]
xor edx, dword [r13 + 0x34]
mov dword [rsp + 0x24], eax
xor r14d, dword [r13 + 0x3c]
mov eax, dword [rsp + 0x30]
xor eax, dword [r13 + 0x38]
add dword [rsp + 0x34], 1
mov r13d, dword [rsp + 0x34]
mov r10d, dword [rsp + 0x54]
cmp r13d, 1
mov r13, qword [rsp + 0x40]
adc dword [rsp + 0x50], 0
mov dword [r13], r10d
mov r10d, dword [rsp + 0x24]
mov dword [r13 + 8], ebx
mov ebx, dword [rsp + 0x28]
mov dword [r13 + 4], esi
mov dword [r13 + 0xc], ebx
mov dword [r13 + 0x10], ebp
mov dword [r13 + 0x14], edi
mov dword [r13 + 0x18], r8d
mov dword [r13 + 0x1c], r15d
mov dword [r13 + 0x20], r11d
mov dword [r13 + 0x24], r9d
mov dword [r13 + 0x28], r12d
mov dword [r13 + 0x2c], r10d
mov dword [r13 + 0x30], ecx
mov dword [r13 + 0x34], edx
mov dword [r13 + 0x38], eax
cmp qword [rsp + 0x38], 0x40
mov dword [r13 + 0x3c], r14d
jbe 0x1401f5590
sub qword [rsp + 0x38], 0x40
add qword [rsp + 0x40], 0x40
add qword [rsp + 0x48], 0x40
cmp qword [rsp + 0x38], 0x3f
ja 0x1401f5210
mov rbx, qword [rsp + 0x88]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
call sym.memcpy
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x80], rax
jmp 0x1401f5210
mov rbx, qword [rsp + 0x140]
lea rax, [rbx - 1]
and rax, 0xffffffffffffffc0
sub rbx, rax
cmp rbx, 0x40
je 0x1401f55bc
mov rcx, qword [rsp + 0x80]
mov r8, rbx
mov rdx, r13
call sym.memcpy
mov rbx, qword [0x140485900]
mov rax, qword [rsp + 0xd8]
sub rax, qword [rbx]
jne 0x1401f55e4
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call dbg.__stack_chk_fail
nop
nop word [rax + rax]