Function at 0x428767
Capabilities:
Allocate or change rwx memory
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
pushfd
push ebp
mov ebp, esp
sub esp, 0x150
mov dword [ebp - 0x14c], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x13c], esi
mov ebx, 0xfffffff
mov dword [ebp - 0x140], edi
mov edi, dword [0x4c7398]
mov esi, dword [eax + 4]
sub eax, 4
mov dword [ebp - 0xd4], eax
mov eax, dword [esi]
and eax, ebx
lea ecx, [edi + eax - 1]
xor edx, edx
mov eax, ecx
div edi
mov eax, dword [0x4c7398]
sub ecx, edx
mov dword [ebp - 0x78], ecx
mov eax, dword [0x403ef8]
mov dword [ebp - 0x68], eax
mov eax, dword [0x4c7398]
mov eax, dword [0x403ef8]
test eax, eax
je 0x428862
and dword [ebp - 0x6c], 0
mov eax, dword [0x403ef8]
dec eax
lea ecx, [eax + 1]
xor eax, eax
mov edx, ecx
test ecx, ecx
je 0x42881a
mov edi, dword [0x51b214]
imul edi, edi, 0x343fd
add edi, 0x269ec3
mov dword [0x51b214], edi
shr edi, 0x10
shl eax, 0x10
or eax, edi
shr edx, 0x10
jne 0x4287f5
xor edx, edx
div ecx
cmp dword [ebp - 0x68], 0
jbe 0x42885c
mov ecx, 0xffffc390
inc dword [ebp - 0x6c]
lea edi, [edx*4 + 0x529524]
mov eax, 0x3c6f
lock cmpxchg dword [edi], ecx
cmp eax, 0x3c6f
je 0x428a06
lea eax, [edx + 1]
mov ecx, dword [0x403ef8]
xor edx, edx
div ecx
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x68]
jb 0x428824
xor edi, edi
test edi, edi
jne 0x4288db
call dword [sym.imp.kernel32.dll_GetLastError]
xor edi, edi
mov dword [ebp - 0x70], eax
push 0x40
inc edi
push 0x1000
push dword [ebp - 0x78]
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x428a1a
push eax
call dword [sym.imp.kernel32.dll_Sleep]
cmp edi, 0x11
jb 0x42886d
xor edi, edi
cmp dword [0x51b2c4], edi
ja 0x4288a6
test edi, 3
je 0x4288ba
test edi, edi
je 0x4288b8
push 0x8000
push 0
push edi
call dword [sym.imp.kernel32.dll_VirtualFree]
xor edi, edi
push dword [ebp - 0x70]
call dword [sym.imp.kernel32.dll_SetLastError]
test edi, edi
je 0x4287c6
mov eax, edi
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x4288db
mov byte [eax], 0
inc eax
dec ecx
jne 0x4288d4
mov eax, 0xd8d22815
mov eax, dword [esi]
mov ecx, eax
shr ecx, 0x1c
and eax, ebx
mov ebx, eax
and ecx, 7
lea ecx, [ecx + esi + 8]
lea eax, [ebx + ecx]
mov esi, 0x400000
mov dword [ebp - 0x70], eax
mov eax, dword [0x4c7398]
mov dword [ebp - 0x7c], ecx
sub eax, ebx
mov dword [ebp - 0x6c], ecx
lea ecx, [eax + 1]
sub dword [ebp - 0x7c], esi
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0x68], ecx
xor eax, eax
test ecx, ecx
je 0x428945
mov edx, dword [0x51b214]
imul edx, edx, 0x343fd
add edx, 0x269ec3
mov dword [0x51b214], edx
shr edx, 0x10
shl eax, 0x10
or eax, edx
shr dword [ebp - 0x68], 0x10
jne 0x42891f
xor edx, edx
div ecx
add edi, edx
push edi
push ebx
push dword [ebp - 0x7c]
mov dword [ebp - 0xc0], edi
mov eax, 0x565a6ceb
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x6c]
add esp, 0xc
mov dword [ebp - 0x68], edi
mov dword [ebp - 0xf0], ecx
mov byte [ebp - 0x55], 0
test ebx, ebx
mov edi, 0xfffff000
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0x78], eax
je 0x428fd7
lea eax, [ebp - 0xf0]
push eax
mov eax, 0x721a49c9
mov ebx, dword [ebp - 0xf0]
and dword [ebp - 0x60], 0
and dword [ebp - 0x5c], 0
mov eax, 0xfffffff
pop ecx
mov ecx, dword [ebp - 0xec]
and ecx, eax
mov dword [ebp - 0x64], ecx
and ebx, eax
mov eax, esi
add ebx, esi
mov ecx, dword [0x402600]
sub eax, ecx
mov dword [ebp - 0xf4], eax
jne 0x428a21
xor esi, esi
cmp dword [ebp - 0x64], esi
jbe 0x428be8
mov ecx, 0x82a003e
movzx eax, byte [ebx + esi]
mov edx, ecx
add eax, ecx
add dword [ebp - 0x60], eax
add eax, dword [ebp - 0x5c]
mul edx
add eax, edx
add dword [ebp - 0x60], eax
inc esi
cmp esi, dword [ebp - 0x64]
mov dword [ebp - 0x5c], eax
jb 0x4289e3
jmp 0x428be8
mov edi, dword [0x4c7398]
imul edi, edx
lea edi, [edi + section..data]
jmp 0x42885e
mov edi, eax
jmp 0x428896
mov eax, dword [ebp - 0x64]
add eax, ebx
mov edx, dword [0x40003c]
lea edx, [edx + 0x4000a0]
mov ecx, ebx
mov dword [ebp - 0x74], eax
mov eax, dword [edx]
add eax, esi
mov edx, dword [edx + 4]
mov dword [ebp - 0xcc], edx
sub ecx, esi
mov esi, ecx
mov edx, ecx
and edx, edi
sub esi, edx
mov dword [ebp - 0xd0], esi
mov esi, dword [ebp - 0x64]
add ecx, esi
mov esi, ecx
and esi, edi
sub ecx, esi
mov dword [ebp - 0xe4], ecx
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0xe8], esi
mov esi, eax
add ecx, eax
cmp eax, ecx
mov dword [ebp - 0xe0], ecx
je 0x428a8e
cmp dword [esi], edx
jae 0x428a8e
add esi, dword [esi + 4]
cmp esi, dword [ebp - 0xe0]
jne 0x428a7f
xor edi, edi
cmp esi, dword [ebp - 0xe0]
je 0x428abe
cmp dword [esi], edx
jne 0x428abe
mov eax, dword [esi + 4]
sub eax, 8
shr eax, 1
je 0x428abe
movzx ecx, word [esi + edi*2 + 8]
and ecx, 0xfff
cmp ecx, dword [ebp - 0xd0]
jae 0x428abe
inc edi
cmp edi, eax
jne 0x428aa6
mov ecx, 0x82a003e
cmp esi, dword [ebp - 0xe0]
je 0x428bc2
mov eax, dword [ebp - 0xe8]
cmp dword [esi], eax
ja 0x428bc2
mov eax, dword [esi + 4]
lea edx, [eax - 8]
shr edx, 1
cmp edi, edx
jne 0x428b09
add esi, eax
cmp esi, dword [ebp - 0xe0]
je 0x428bc2
mov eax, dword [ebp - 0xe8]
cmp dword [esi], eax
ja 0x428bc2
xor edi, edi
jmp 0x428add
mov eax, dword [esi]
cmp eax, dword [ebp - 0xe8]
jne 0x428b29
movzx eax, word [esi + edi*2 + 8]
and eax, 0xfff
cmp eax, dword [ebp - 0xe4]
jae 0x428bc2
mov eax, edi
inc edi
test word [esi + eax*2 + 8], 0xf000
mov dword [ebp - 0xd8], edi
je 0x428ac3
mov edx, dword [esi]
movzx eax, word [esi + eax*2 + 8]
and eax, 0xfff
xor edi, edi
lea eax, [eax + edx + 0x400000]
mov dword [ebp - 0x64], eax
sub dword [ebp - 0x64], ebx
mov dword [ebp - 0xd0], eax
je 0x428b7c
mov edx, ecx
movzx eax, byte [edi + ebx]
add eax, ecx
add dword [ebp - 0x60], eax
add eax, dword [ebp - 0x5c]
mul edx
add eax, edx
add dword [ebp - 0x60], eax
inc edi
cmp edi, dword [ebp - 0x64]
mov dword [ebp - 0x5c], eax
jb 0x428b5e
mov ebx, dword [ebp - 0xd0]
mov eax, dword [ebx]
sub eax, dword [ebp - 0xf4]
xor edi, edi
mov dword [ebp - 0xf8], eax
mov edx, ecx
movzx eax, byte [ebp + edi - 0xf8]
add eax, ecx
add dword [ebp - 0x60], eax
add eax, dword [ebp - 0x5c]
mul edx
add eax, edx
add dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
inc edi
cmp edi, 4
jb 0x428b92
mov edi, dword [ebp - 0xd8]
add ebx, 4
jmp 0x428ac3
mov edi, dword [ebp - 0x74]
xor esi, esi
sub edi, ebx
je 0x428be8
movzx eax, byte [ebx + esi]
add eax, ecx
mov edx, ecx
add dword [ebp - 0x60], eax
add eax, dword [ebp - 0x5c]
mul edx
add eax, edx
add dword [ebp - 0x60], eax
inc esi
cmp esi, edi
mov dword [ebp - 0x5c], eax
jb 0x428bcb
xor edi, edi
xor eax, eax
mov ecx, eax
and ecx, 7
mov cl, byte [ebp + ecx - 0x60]
mov byte [ebp + eax - 0x54], cl
inc eax
cmp eax, 0x10
jb 0x428bec
mov eax, 0xa21b703d
mov edx, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x10c], eax
mov eax, dword [0x5294e0]
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x108], ecx
mov ecx, dword [eax]
mov dword [ebp - 0x138], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x124], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x110], ecx
lea ecx, [ebp - 0x44]
sub eax, ecx
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x6c]
sub eax, dword [ebp - 0xc0]
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x128], esi
mov dword [ebp - 0x104], edx
mov dword [ebp - 0x100], esi
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x11c], edi
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x74], eax
lea edi, [ebp - 0xbc]
lea esi, [ebp - 0x138]
push 0x10
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x8c]
mov esi, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x64], 3
lea edi, [edx + esi]
rol edi, 7
mov ebx, dword [ebp - 0xb8]
xor eax, edi
lea edi, [esi + eax]
rol edi, 9
xor ecx, edi
lea edi, [ecx + eax]
rol edi, 0xd
xor edx, edi
lea edi, [ecx + edx]
ror edi, 0xe
xor esi, edi
mov edi, dword [ebp - 0xa8]
add ebx, edi
rol ebx, 7
xor dword [ebp - 0x98], ebx
mov ebx, dword [ebp - 0x98]
add edi, ebx
rol edi, 9
xor dword [ebp - 0x88], edi
mov edi, ebx
mov ebx, dword [ebp - 0x88]
add ebx, edi
rol ebx, 0xd
mov edi, dword [ebp - 0x88]
xor dword [ebp - 0xb8], ebx
mov ebx, dword [ebp - 0xb8]
add edi, ebx
mov ebx, dword [ebp - 0x94]
ror edi, 0xe
xor dword [ebp - 0xa8], edi
mov edi, dword [ebp - 0xa4]
add edi, ebx
rol edi, 7
xor dword [ebp - 0x84], edi
mov edi, ebx
mov ebx, dword [ebp - 0x84]
add edi, ebx
rol edi, 9
xor dword [ebp - 0xb4], edi
mov edi, ebx
mov ebx, dword [ebp - 0xb4]
add ebx, edi
mov edi, dword [ebp - 0xb4]
rol ebx, 0xd
xor dword [ebp - 0xa4], ebx
mov ebx, dword [ebp - 0xa4]
add edi, ebx
ror edi, 0xe
mov ebx, dword [ebp - 0x80]
xor dword [ebp - 0x94], edi
mov edi, dword [ebp - 0x90]
add edi, ebx
rol edi, 7
xor dword [ebp - 0xb0], edi
mov edi, ebx
mov ebx, dword [ebp - 0xb0]
add edi, ebx
rol edi, 9
xor dword [ebp - 0xa0], edi
mov edi, ebx
mov ebx, dword [ebp - 0xa0]
add ebx, edi
rol ebx, 0xd
mov edi, dword [ebp - 0xa0]
xor dword [ebp - 0x90], ebx
mov ebx, dword [ebp - 0x90]
add edi, ebx
ror edi, 0xe
xor dword [ebp - 0x80], edi
mov edi, dword [ebp - 0xb0]
add edi, esi
rol edi, 7
xor dword [ebp - 0xb8], edi
mov edi, dword [ebp - 0xb8]
add edi, esi
rol edi, 9
xor dword [ebp - 0xb4], edi
mov ebx, dword [ebp - 0xb4]
mov edi, dword [ebp - 0xb8]
add ebx, edi
rol ebx, 0xd
mov edi, dword [ebp - 0xb4]
xor dword [ebp - 0xb0], ebx
mov ebx, dword [ebp - 0xb0]
add ebx, edi
mov edi, dword [ebp - 0xa8]
add edi, eax
ror ebx, 0xe
xor esi, ebx
rol edi, 7
xor dword [ebp - 0xa4], edi
mov ebx, dword [ebp - 0xa4]
mov edi, dword [ebp - 0xa8]
add ebx, edi
mov edi, dword [ebp - 0xa4]
rol ebx, 9
xor dword [ebp - 0xa0], ebx
mov ebx, dword [ebp - 0xa0]
add ebx, edi
mov edi, dword [ebp - 0xa0]
rol ebx, 0xd
xor eax, ebx
mov ebx, dword [ebp - 0x98]
add edi, eax
ror edi, 0xe
xor dword [ebp - 0xa8], edi
mov edi, dword [ebp - 0x94]
add edi, ebx
rol edi, 7
xor dword [ebp - 0x90], edi
mov edi, dword [ebp - 0x94]
mov ebx, dword [ebp - 0x90]
add ebx, edi
rol ebx, 9
mov edi, dword [ebp - 0x90]
xor ecx, ebx
add edi, ecx
rol edi, 0xd
mov ebx, dword [ebp - 0x84]
xor dword [ebp - 0x98], edi
mov edi, dword [ebp - 0x98]
add edi, ecx
ror edi, 0xe
xor dword [ebp - 0x94], edi
mov edi, dword [ebp - 0x80]
add edi, ebx
rol edi, 7
xor edx, edi
mov edi, dword [ebp - 0x80]
add edi, edx
rol edi, 9
xor dword [ebp - 0x88], edi
mov edi, dword [ebp - 0x88]
add edi, edx
rol edi, 0xd
xor dword [ebp - 0x84], edi
mov edi, dword [ebp - 0x88]
mov ebx, dword [ebp - 0x84]
add ebx, edi
ror ebx, 0xe
xor dword [ebp - 0x80], ebx
dec dword [ebp - 0x64]
jne 0x428ccd
mov dword [ebp - 0x8c], edx
xor edx, edx
push 0x40
mov dword [ebp - 0xac], eax
xor eax, eax
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0xbc], esi
pop ebx
mov ecx, dword [ebp + eax - 0x138]
add dword [ebp + eax - 0xbc], ecx
add eax, 4
cmp eax, ebx
jl 0x428f30
inc dword [ebp - 0x118]
cmp dword [ebp - 0xc4], ebx
lea esi, [ebp - 0xbc]
lea edi, [ebp - 0x44]
push 0x10
pop ecx
rep movsd dword es:[edi], dword [esi]
jbe 0x428f9a
mov esi, dword [ebp - 0xcc]
mov eax, dword [ebp - 0x74]
lea edi, [esi + eax]
lea ecx, [ebp + edx - 0x44]
mov al, byte [ecx + edi]
xor al, byte [ecx]
xor byte [ebp - 0x55], al
mov byte [ecx + esi], al
inc edx
cmp edx, ebx
jb 0x428f6d
sub dword [ebp - 0xc4], ebx
add dword [ebp - 0x68], ebx
add esi, ebx
add dword [ebp - 0x78], ebx
mov dword [ebp - 0xcc], esi
jmp 0x428c9d
cmp dword [ebp - 0xc4], edx
jbe 0x428fc7
mov esi, dword [ebp - 0x78]
mov edi, dword [ebp - 0x68]
lea eax, [ebp - 0x44]
sub esi, eax
sub edi, eax
lea ecx, [ebp + edx - 0x44]
mov al, byte [ecx + esi]
xor al, byte [ecx]
xor byte [ebp - 0x55], al
inc edx
cmp edx, dword [ebp - 0xc4]
mov byte [ecx + edi], al
jb 0x428faf
mov edi, 0xfffff000
mov esi, 0x400000
mov ebx, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x70]
mov al, byte [eax + 8]
xor al, byte [ebp - 0x55]
je 0x42906f
call fcn.004a46e1
mov edx, 0xffff
mov ebx, eax
mov eax, dword [ebp - 0xd4]
lea ecx, [eax + 0xc]
and ecx, 0xfffffffc
mov dword [eax + 8], 0x4b3c5b
and ebx, edi
lea esi, [ecx + 0xfff]
and esi, edi
xor eax, eax
mov edi, dword [0x51b214]
imul edi, edi, 0x343fd
add edi, 0x269ec3
mov dword [0x51b214], edi
shr edi, 0x10
shl eax, 0x10
or eax, edi
shr edx, 0x10
jne 0x429011
xor edx, edx
mov edi, 0xffff
div edi
inc edx
mov eax, ecx
cmp ecx, esi
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x74], 0
jae 0x429065
mov ecx, dword [ebp - 0x74]
mov dword [eax], ecx
add eax, 4
cmp eax, esi
jb 0x429059
mov eax, 0x4b3c5b
jmp 0x42914b
mov ecx, dword [0x402600]
mov eax, dword [ebp - 0x6c]
sub eax, dword [ebp - 0xc0]
mov dword [ebp - 0xc8], eax
sub esi, ecx
mov dword [ebp - 0x70], esi
jne 0x429093
test eax, eax
je 0x42913b
mov ecx, dword [0x4bebb0]
mov eax, dword [ebp - 0x7c]
mov esi, dword [ebp - 0xc0]
sub esi, dword [ebp - 0x6c]
add eax, ebx
mov dword [ebp - 0x74], eax
xor ebx, ebx
dec ecx
js 0x4290d7
lea eax, [ebx + ecx]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x4bebb4]
and edx, 0xfffffff
cmp dword [ebp - 0x7c], edx
jae 0x4290ce
lea ecx, [eax - 1]
jmp 0x4290d3
jbe 0x4290db
lea ebx, [eax + 1]
cmp ecx, ebx
jge 0x4290af
mov edi, ebx
jmp 0x429133
mov edi, eax
jmp 0x429133
mov eax, dword [edi*4 + 0x4bebb4]
mov ecx, eax
and ecx, 0xfffffff
cmp ecx, dword [ebp - 0x74]
jae 0x42913b
lea ebx, [ecx + esi + 0x400000]
mov ecx, eax
shl ecx, 2
sar ecx, 0x1e
sar eax, 0x1e
and ecx, 3
and eax, 3
xor edx, edx
dec ecx
je 0x429123
dec ecx
je 0x42911b
dec ecx
jne 0x42912c
mov edx, dword [ebp - 0x70]
jmp 0x42912c
mov edx, dword [ebp - 0xc8]
jmp 0x42912c
mov edx, dword [ebp - 0x70]
sub edx, dword [ebp - 0xc8]
dec eax
dec eax
jne 0x429132
add dword [ebx], edx
inc edi
cmp edi, dword [0x4bebb0]
jb 0x4290df
mov eax, dword [0x4c7398]
mov eax, 0x6fa7ec9d
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xd4]
mov dword [ecx + 8], eax
mov ebx, dword [ebp - 0x148]
mov edi, dword [ebp - 0x140]
mov esi, dword [ebp - 0x13c]
mov edx, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x14c]
mov esp, ebp
pop ebp
popfd
ret