Function at 0x420e80
Capabilities:
Encrypt data using salsa20 or chacha
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x462040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x463b1c]
mov byte [0x465842], 1
push ebx
push esi
push edi
cmp eax, 0xffffffff
je 0x42106b
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x28]
push 0
push ecx
push 8
lea ecx, [ebp + 8]
push ecx
push eax
call esi
push 0
lea eax, [ebp - 0x28]
push eax
push 8
lea eax, [ebp + 0x10]
push eax
push dword [0x463b1c]
call esi
push 0x40
call fcn.00439af3
mov edx, dword [ebp + 8]
add esp, 4
mov ecx, dword [ebp + 0x10]
mov ebx, edx
mov esi, dword [ebp + 0x14]
xor ebx, ecx
mov edi, dword [ebp + 0xc]
mov dword [0x465844], eax
mov eax, dword [ebp + 0xc]
xor eax, esi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], eax
lea eax, [ecx + edx]
add al, bl
mov byte [ebp - 0x22], bl
mov byte [ebp - 0x21], al
mov ebx, edx
mov byte [ebp - 0x23], cl
mov eax, edi
shrd ebx, eax, 8
mov byte [ebp - 0x24], dl
mov eax, esi
mov edx, ecx
mov byte [ebp - 0x20], bl
mov ecx, dword [ebp - 0x30]
shrd edx, eax, 8
mov eax, dword [ebp - 0x2c]
shrd ecx, eax, 8
mov byte [ebp - 0x1f], dl
mov eax, edi
mov byte [ebp - 0x1e], cl
add cl, dl
mov edx, dword [ebp + 0x10]
add cl, bl
mov ebx, dword [ebp + 8]
shrd ebx, eax, 0x10
mov byte [ebp - 0x1d], cl
mov eax, esi
mov ecx, dword [ebp - 0x30]
shrd edx, eax, 0x10
mov eax, dword [ebp - 0x2c]
shrd ecx, eax, 0x10
mov byte [ebp - 0x1c], bl
mov eax, edi
mov byte [ebp - 0x1a], cl
add cl, dl
add cl, bl
mov byte [ebp - 0x1b], dl
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
shrd ebx, eax, 0x18
mov byte [ebp - 0x19], cl
mov eax, esi
mov ecx, dword [ebp - 0x30]
shrd edx, eax, 0x18
mov eax, dword [ebp - 0x2c]
shrd ecx, eax, 0x18
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x16], cl
add cl, dl
mov byte [ebp - 0x17], dl
add cl, bl
mov eax, dword [ebp - 0x2c]
mov ebx, esi
mov esi, dword [ebp - 0x2c]
mov byte [ebp - 0x12], al
add al, bl
mov byte [ebp - 0x15], cl
mov ecx, edi
add al, cl
mov byte [ebp - 0x14], cl
mov byte [ebp - 0x11], al
mov edx, ecx
mov ecx, ebx
shr edx, 8
shr ecx, 8
mov eax, esi
shr eax, 8
mov byte [ebp - 0xe], al
add al, cl
add al, dl
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xd], al
mov ecx, ebx
shr ecx, 0x10
mov eax, esi
shr eax, 0x10
mov byte [ebp - 0xa], al
add al, cl
mov byte [ebp - 0x10], dl
mov edx, edi
shr edx, 0x10
add al, dl
mov byte [ebp - 0xb], cl
mov byte [ebp - 9], al
mov ecx, edi
mov eax, esi
mov byte [ebp - 0x13], bl
shr eax, 0x18
mov byte [ebp - 6], al
shr ebx, 0x18
add al, bl
shr ecx, 0x18
add al, cl
mov byte [ebp - 8], cl
mov ecx, dword [0x465844]
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x24]
mov byte [ebp - 0xc], dl
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x20]
mov dword [ecx + 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ecx + 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ecx + 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ecx + 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ecx + 0x28], eax
mov byte [ebp - 7], bl
mov eax, dword [ebp - 8]
mov dword [ecx + 0x2c], eax
mov eax, dword [ebp - 0x30]
mov dword [ecx], 0x61707865
mov dword [ecx + 4], 0x3320646e
mov dword [ecx + 8], 0x79622d32
mov dword [ecx + 0xc], 0x6b206574
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], eax
mov dword [ecx + 0x3c], esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00434f21
mov esp, ebp
pop ebp
ret