Function at 0x14006a080
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
test r9, r9
je 0x14006a934
mov rdi, rdx
mov eax, dword [rcx]
mov dword [rsp + 0x60], eax
mov eax, dword [rcx + 4]
mov dword [rsp + 0x64], eax
mov eax, dword [rcx + 8]
mov dword [rsp + 0x68], eax
mov eax, dword [rcx + 0xc]
mov dword [rsp + 0x6c], eax
mov eax, dword [rcx + 0x10]
mov dword [rsp + 0x70], eax
mov eax, dword [rcx + 0x14]
mov dword [rsp + 0x74], eax
mov eax, dword [rcx + 0x18]
mov dword [rsp + 0x78], eax
mov eax, dword [rcx + 0x1c]
mov dword [rsp + 0x7c], eax
mov r12d, dword [rcx + 0x20]
mov dword [rsp + 0x80], r12d
mov eax, dword [rcx + 0x24]
mov dword [rsp + 0x84], eax
mov eax, dword [rcx + 0x28]
mov dword [rsp + 0x88], eax
mov eax, dword [rcx + 0x2c]
mov dword [rsp + 0x8c], eax
mov qword [rsp + 0xd0], rcx
mov rax, qword [rcx + 0x30]
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xc8], r9
mov r14, r9
mov qword [rsp + 0x40], r8
mov rcx, r9
nop word [rax + rax]
cmp r14, 2
mov eax, 1
cmovae rax, r14
sub rcx, 0x40
mov qword [rsp + 0xe8], rcx
mov qword [rsp + 0xe0], r14
jae 0x14006a190
test rdi, rdi
je 0x14006a19f
cmp rax, 8
jb 0x14006a1bd
lea rdx, [rsp + 0xf0]
sub rdx, rdi
mov ecx, 0
cmp rdx, 0x20
jb 0x14006a230
cmp rax, 0x20
jae 0x14006a1c1
xor ecx, ecx
jmp 0x14006a1fb
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], r8
jmp 0x14006a25a
lea rbp, [rsp + 0xf0]
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], r8
xor eax, eax
mov qword [rsp + 0x50], rax
jmp 0x14006a25a
xor ecx, ecx
jmp 0x14006a230
mov rcx, rax
and rcx, 0xffffffffffffffe0
xor edx, edx
nop word [rax + rax]
movups xmm0, xmmword [rdi + rdx]
movups xmm1, xmmword [rdi + rdx + 0x10]
movaps xmmword [rsp + rdx + 0xf0], xmm0
movaps xmmword [rsp + rdx + 0x100], xmm1
add rdx, 0x20
cmp rcx, rdx
jne 0x14006a1d0
cmp rax, rcx
je 0x14006a243
test al, 0x18
je 0x14006a230
mov rdx, rcx
mov rcx, rax
and rcx, 0xfffffffffffffff8
nop word cs:[rax + rax]
mov r9, qword [rdi + rdx]
mov qword [rsp + rdx + 0xf0], r9
add rdx, 8
cmp rcx, rdx
jne 0x14006a210
cmp rax, rcx
je 0x14006a243
nop word [rax + rax]
movzx eax, byte [rdi + rcx]
mov byte [rsp + rcx + 0xf0], al
inc rcx
cmp rcx, r14
jb 0x14006a230
lea r13, [rsp + 0xf0]
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x50], r13
mov edi, dword [rsp + 0x60]
mov esi, dword [rsp + 0x64]
mov ebx, dword [rsp + 0x68]
mov r11d, dword [rsp + 0x6c]
mov r15d, dword [rsp + 0x70]
mov r8d, dword [rsp + 0x74]
mov edx, dword [rsp + 0x78]
mov ecx, dword [rsp + 0x7c]
mov r9d, dword [rsp + 0x84]
mov r10d, dword [rsp + 0x88]
mov dword [rsp + 0x34], 0x61707865
mov dword [rsp + 0x38], 0x3320646e
mov dword [rsp + 0x2c], 0x79622d32
mov eax, dword [rsp + 0x8c]
mov r14, qword [rsp + 0xd8]
mov dword [rsp + 0x3c], 0x6b206574
mov dword [rsp + 0xb4], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0xbc], r10d
mov dword [rsp + 0xb8], r9d
mov dword [rsp + 0xc0], r12d
mov dword [rsp + 0xb0], ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0xac], edx
mov dword [rsp + 0x24], edx
mov dword [rsp + 0xa8], r8d
mov dword [rsp + 0xa4], r15d
mov dword [rsp + 0xa0], r11d
mov edx, r11d
mov dword [rsp + 0x9c], ebx
mov dword [rsp + 0x98], esi
mov eax, esi
mov dword [rsp + 0x94], edi
mov ecx, edi
nop dword [rax]
mov qword [rsp + 0x58], r14
mov edi, dword [rsp + 0x34]
add edi, ecx
mov esi, r12d
xor esi, edi
rol esi, 0x10
add r15d, esi
xor ecx, r15d
rol ecx, 0xc
add edi, ecx
xor esi, edi
rol esi, 8
add r15d, esi
mov dword [rsp + 0xc4], r15d
xor ecx, r15d
rol ecx, 7
mov r11d, dword [rsp + 0x38]
add r11d, eax
mov r15d, r9d
xor r15d, r11d
rol r15d, 0x10
mov ebp, r8d
add ebp, r15d
xor eax, ebp
rol eax, 0xc
add r11d, eax
xor r15d, r11d
rol r15d, 8
add ebp, r15d
xor eax, ebp
rol eax, 7
mov r14d, dword [rsp + 0x2c]
add r14d, ebx
mov r8d, r10d
xor r8d, r14d
rol r8d, 0x10
mov r12d, dword [rsp + 0x24]
add r12d, r8d
xor ebx, r12d
rol ebx, 0xc
add r14d, ebx
xor r8d, r14d
rol r8d, 8
add r12d, r8d
xor ebx, r12d
rol ebx, 7
mov r13d, dword [rsp + 0x3c]
add r13d, edx
mov r10d, dword [rsp + 0x30]
xor r10d, r13d
rol r10d, 0x10
mov r9d, dword [rsp + 0x28]
add r9d, r10d
xor edx, r9d
rol edx, 0xc
add r13d, edx
xor r10d, r13d
rol r10d, 8
add r9d, r10d
xor edx, r9d
rol edx, 7
add edi, eax
xor r10d, edi
rol r10d, 0x10
add r12d, r10d
xor eax, r12d
rol eax, 0xc
add edi, eax
mov dword [rsp + 0x34], edi
xor r10d, edi
rol r10d, 8
mov dword [rsp + 0x30], r10d
add r12d, r10d
mov dword [rsp + 0x24], r12d
xor eax, r12d
rol eax, 7
add r11d, ebx
xor esi, r11d
rol esi, 0x10
add r9d, esi
xor ebx, r9d
rol ebx, 0xc
add r11d, ebx
mov dword [rsp + 0x38], r11d
xor esi, r11d
rol esi, 8
mov r12d, esi
add r9d, esi
mov dword [rsp + 0x28], r9d
xor ebx, r9d
rol ebx, 7
add r14d, edx
xor r15d, r14d
rol r15d, 0x10
mov r10d, dword [rsp + 0xc4]
add r10d, r15d
xor edx, r10d
rol edx, 0xc
add r14d, edx
mov dword [rsp + 0x2c], r14d
xor r15d, r14d
mov r14, qword [rsp + 0x58]
rol r15d, 8
mov r9d, r15d
add r10d, r15d
mov r15d, r10d
xor edx, r10d
rol edx, 7
add r13d, ecx
xor r8d, r13d
rol r8d, 0x10
add ebp, r8d
xor ecx, ebp
rol ecx, 0xc
add r13d, ecx
mov dword [rsp + 0x3c], r13d
xor r8d, r13d
rol r8d, 8
mov r10d, r8d
add ebp, r8d
mov r8d, ebp
xor ecx, ebp
rol ecx, 7
add r14, 0xfffffffffffffffe
jne 0x14006a330
add ecx, dword [rsp + 0x94]
add eax, dword [rsp + 0x98]
add ebx, dword [rsp + 0x9c]
add edx, dword [rsp + 0xa0]
mov r11d, r15d
add r11d, dword [rsp + 0xa4]
add r8d, dword [rsp + 0xa8]
mov ebp, r8d
mov r13d, dword [rsp + 0x24]
add r13d, dword [rsp + 0xac]
mov r15d, r13d
mov r14d, dword [rsp + 0x28]
add r14d, dword [rsp + 0xb0]
add r12d, dword [rsp + 0xc0]
mov dword [rsp + 0x24], r12d
add r9d, dword [rsp + 0xb8]
mov dword [rsp + 0x28], r9d
add r10d, dword [rsp + 0xbc]
mov dword [rsp + 0x58], r10d
mov r8d, dword [rsp + 0xb4]
add dword [rsp + 0x30], r8d
mov r8d, dword [rsp + 0x34]
add r8d, 0x61707865
mov r12d, dword [rsp + 0x38]
add r12d, 0x3320646e
mov r13d, dword [rsp + 0x2c]
add r13d, 0x79622d32
mov r9d, dword [rsp + 0x3c]
add r9d, 0x6b206574
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x14006a640
mov esi, r8d
xor esi, dword [rdi]
mov r8, qword [rsp + 0x48]
mov dword [r8], esi
xor r12d, dword [rdi + 4]
mov dword [r8 + 4], r12d
xor r13d, dword [rdi + 8]
mov dword [r8 + 8], r13d
xor r9d, dword [rdi + 0xc]
mov dword [r8 + 0xc], r9d
xor ecx, dword [rdi + 0x10]
mov dword [r8 + 0x10], ecx
xor eax, dword [rdi + 0x14]
mov dword [r8 + 0x14], eax
xor ebx, dword [rdi + 0x18]
mov dword [r8 + 0x18], ebx
xor edx, dword [rdi + 0x1c]
mov dword [r8 + 0x1c], edx
xor r11d, dword [rdi + 0x20]
mov dword [r8 + 0x20], r11d
xor ebp, dword [rdi + 0x24]
mov dword [r8 + 0x24], ebp
xor r15d, dword [rdi + 0x28]
mov dword [r8 + 0x28], r15d
xor r14d, dword [rdi + 0x2c]
mov dword [r8 + 0x2c], r14d
mov esi, dword [rsp + 0x24]
xor esi, dword [rdi + 0x30]
mov dword [r8 + 0x30], esi
mov rsi, r8
mov r11d, dword [rsp + 0x28]
xor r11d, dword [rdi + 0x34]
mov dword [r8 + 0x34], r11d
mov r10d, dword [rsp + 0x58]
xor r10d, dword [rdi + 0x38]
mov dword [r8 + 0x38], r10d
mov r9d, dword [rsp + 0x30]
xor r9d, dword [rdi + 0x3c]
mov dword [r8 + 0x3c], r9d
add rdi, 0x40
jmp 0x14006a7de
mov rdi, qword [rsp + 0x48]
mov r10d, r8d
mov byte [rdi], r10b
mov dword [rsp + 0x2c], eax
mov eax, r8d
mov byte [rdi + 1], ah
shr r8d, 0x10
mov byte [rdi + 2], r8b
shr r10d, 0x18
mov byte [rdi + 3], r10b
mov byte [rdi + 4], r12b
mov r10d, ebx
mov ebx, r12d
mov byte [rdi + 5], bh
mov r8d, r12d
shr r8d, 0x10
mov byte [rdi + 6], r8b
shr r12d, 0x18
mov byte [rdi + 7], r12b
mov byte [rdi + 8], r13b
mov esi, edx
mov edx, r13d
mov byte [rdi + 9], dh
mov r8d, r13d
shr r8d, 0x10
mov byte [rdi + 0xa], r8b
shr r13d, 0x18
mov byte [rdi + 0xb], r13b
mov edx, r9d
mov byte [rdi + 0xc], dl
mov byte [rdi + 0xd], dh
mov r8d, r9d
shr r8d, 0x10
mov byte [rdi + 0xe], r8b
shr edx, 0x18
mov byte [rdi + 0xf], dl
mov byte [rdi + 0x10], cl
mov byte [rdi + 0x11], ch
mov r8d, ecx
shr r8d, 0x10
mov byte [rdi + 0x12], r8b
shr ecx, 0x18
mov byte [rdi + 0x13], cl
mov eax, dword [rsp + 0x2c]
mov byte [rdi + 0x14], al
mov byte [rdi + 0x15], ah
mov ecx, eax
shr ecx, 0x10
mov byte [rdi + 0x16], cl
shr eax, 0x18
mov byte [rdi + 0x17], al
mov ecx, r10d
mov byte [rdi + 0x18], cl
mov byte [rdi + 0x19], ch
mov eax, r10d
shr eax, 0x10
mov byte [rdi + 0x1a], al
shr ecx, 0x18
mov byte [rdi + 0x1b], cl
mov ecx, esi
mov byte [rdi + 0x1c], cl
mov byte [rdi + 0x1d], ch
mov eax, esi
shr eax, 0x10
mov byte [rdi + 0x1e], al
shr ecx, 0x18
mov byte [rdi + 0x1f], cl
mov ecx, r11d
mov byte [rdi + 0x20], cl
mov byte [rdi + 0x21], ch
mov eax, r11d
shr eax, 0x10
mov byte [rdi + 0x22], al
shr ecx, 0x18
mov byte [rdi + 0x23], cl
mov ecx, ebp
mov byte [rdi + 0x24], cl
mov byte [rdi + 0x25], ch
mov eax, ebp
shr eax, 0x10
mov byte [rdi + 0x26], al
shr ecx, 0x18
mov byte [rdi + 0x27], cl
mov ecx, r15d
mov byte [rdi + 0x28], cl
mov byte [rdi + 0x29], ch
mov eax, r15d
shr eax, 0x10
mov byte [rdi + 0x2a], al
shr ecx, 0x18
mov byte [rdi + 0x2b], cl
mov ecx, r14d
mov byte [rdi + 0x2c], cl
mov byte [rdi + 0x2d], ch
mov eax, r14d
shr eax, 0x10
mov byte [rdi + 0x2e], al
shr ecx, 0x18
mov byte [rdi + 0x2f], cl
mov ecx, dword [rsp + 0x24]
mov rsi, rdi
mov byte [rdi + 0x30], cl
mov byte [rdi + 0x31], ch
mov eax, ecx
shr eax, 0x10
mov byte [rdi + 0x32], al
shr ecx, 0x18
mov byte [rdi + 0x33], cl
mov ecx, dword [rsp + 0x28]
mov byte [rdi + 0x34], cl
mov byte [rdi + 0x35], ch
mov eax, ecx
shr eax, 0x10
mov byte [rdi + 0x36], al
shr ecx, 0x18
mov byte [rdi + 0x37], cl
mov ecx, dword [rsp + 0x58]
mov byte [rdi + 0x38], cl
mov byte [rdi + 0x39], ch
mov eax, ecx
shr eax, 0x10
mov byte [rdi + 0x3a], al
shr ecx, 0x18
mov byte [rdi + 0x3b], cl
mov ecx, dword [rsp + 0x30]
mov byte [rdi + 0x3c], cl
mov byte [rdi + 0x3d], ch
mov eax, ecx
shr eax, 0x10
mov byte [rdi + 0x3e], al
shr ecx, 0x18
mov byte [rdi + 0x3f], cl
xor edi, edi
mov r12d, dword [rsp + 0x80]
inc r12d
mov dword [rsp + 0x80], r12d
mov rcx, qword [rsp + 0xe8]
mov r10, qword [rsp + 0xe0]
jne 0x14006a80a
inc dword [rsp + 0x84]
cmp r10, 0x40
jbe 0x14006a81f
add rsi, 0x40
mov r14, rcx
mov r8, rsi
jmp 0x14006a130
lea rax, [r10 - 1]
cmp rax, 0x3e
ja 0x14006a908
xor eax, eax
mov rdx, qword [rsp + 0xc8]
mov rcx, rdx
sub rcx, 0x40
cmovb rcx, rax
add rcx, 0x3f
and rcx, 0xffffffffffffffc0
sub rdx, rcx
cmp rdx, 2
mov ecx, 1
cmovae rcx, rdx
cmp rcx, 8
jb 0x14006a87f
mov r9, qword [rsp + 0x40]
mov rdx, r9
sub rdx, rsi
cmp rdx, 0x20
jb 0x14006a8f0
cmp rcx, 0x20
jae 0x14006a886
xor eax, eax
jmp 0x14006a8b7
mov r9, qword [rsp + 0x40]
jmp 0x14006a8f0
mov rax, rcx
and rax, 0xffffffffffffffe0
xor edx, edx
nop
movups xmm0, xmmword [rsi + rdx]
movups xmm1, xmmword [rsi + rdx + 0x10]
movups xmmword [r9 + rdx], xmm0
movups xmmword [r9 + rdx + 0x10], xmm1
add rdx, 0x20
cmp rax, rdx
jne 0x14006a890
cmp rcx, rax
je 0x14006a900
test cl, 0x18
je 0x14006a8f0
mov rdx, rax
mov rax, rcx
and rax, 0xfffffffffffffff8
nop word cs:[rax + rax]
mov r8, qword [rsi + rdx]
mov qword [r9 + rdx], r8
add rdx, 8
cmp rax, rdx
jne 0x14006a8d0
cmp rcx, rax
je 0x14006a900
nop word cs:[rax + rax]
movzx ecx, byte [rsi + rax]
mov byte [r9 + rax], cl
inc rax
cmp rax, r10
jb 0x14006a8f0
mov r12d, dword [rsp + 0x80]
mov rcx, qword [rsp + 0xd0]
mov dword [rcx + 0x20], r12d
mov eax, dword [rsp + 0x84]
mov dword [rcx + 0x24], eax
mov rax, qword [sub.msvcrt.dll_memset]
lea rcx, [rsp + 0x60]
mov r8d, 0x30
xor edx, edx
call rax
nop
add rsp, 0x138
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret