Function at 0x140017e50
Capabilities:
Encrypt data using salsa20 or chacha
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xc8
movsx eax, byte [str.expand_32_byte_k]
movsx ecx, byte [0x140037a41]
shl ecx, 8
or eax, ecx
movsx ecx, byte [0x140037a42]
shl ecx, 0x10
or eax, ecx
movsx ecx, byte [0x140037a43]
shl ecx, 0x18
or eax, ecx
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0xd8]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 1]
shl ecx, 8
or eax, ecx
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 2]
shl ecx, 0x10
or eax, ecx
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 3]
shl ecx, 0x18
or eax, ecx
mov dword [rsp + 0x74], eax
mov rax, qword [rsp + 0xd8]
movzx eax, byte [rax + 4]
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 5]
shl ecx, 8
or eax, ecx
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 6]
shl ecx, 0x10
or eax, ecx
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 7]
shl ecx, 0x18
or eax, ecx
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0xd8]
movzx eax, byte [rax + 8]
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 9]
shl ecx, 8
or eax, ecx
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 0xa]
shl ecx, 0x10
or eax, ecx
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 0xb]
shl ecx, 0x18
or eax, ecx
mov dword [rsp + 0x7c], eax
mov rax, qword [rsp + 0xd8]
movzx eax, byte [rax + 0xc]
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 0xd]
shl ecx, 8
or eax, ecx
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 0xe]
shl ecx, 0x10
or eax, ecx
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 0xf]
shl ecx, 0x18
or eax, ecx
mov dword [rsp + 0x80], eax
movsx eax, byte [0x140037a44]
movsx ecx, byte [0x140037a45]
shl ecx, 8
or eax, ecx
movsx ecx, byte [0x140037a46]
shl ecx, 0x10
or eax, ecx
movsx ecx, byte [0x140037a47]
shl ecx, 0x18
or eax, ecx
mov dword [rsp + 0x84], eax
mov eax, 0xffffffff
mov rcx, qword [rsp + 0xe0]
and rcx, rax
mov rax, rcx
mov dword [rsp + 0x88], eax
mov rax, qword [rsp + 0xe0]
shr rax, 0x20
mov dword [rsp + 0x8c], eax
mov eax, 0xffffffff
mov rcx, qword [rsp + 0xe8]
and rcx, rax
mov rax, rcx
mov dword [rsp + 0x90], eax
mov rax, qword [rsp + 0xe8]
shr rax, 0x20
mov dword [rsp + 0x94], eax
movsx eax, byte [0x140037a48]
movsx ecx, byte [0x140037a49]
shl ecx, 8
or eax, ecx
movsx ecx, byte [0x140037a4a]
shl ecx, 0x10
or eax, ecx
movsx ecx, byte [0x140037a4b]
shl ecx, 0x18
or eax, ecx
mov dword [rsp + 0x98], eax
mov rax, qword [rsp + 0xd8]
movzx eax, byte [rax + 0x10]
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 0x11]
shl ecx, 8
or eax, ecx
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 0x12]
shl ecx, 0x10
or eax, ecx
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 0x13]
shl ecx, 0x18
or eax, ecx
mov dword [rsp + 0x9c], eax
mov rax, qword [rsp + 0xd8]
movzx eax, byte [rax + 0x14]
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 0x15]
shl ecx, 8
or eax, ecx
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 0x16]
shl ecx, 0x10
or eax, ecx
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 0x17]
shl ecx, 0x18
or eax, ecx
mov dword [rsp + 0xa0], eax
mov rax, qword [rsp + 0xd8]
movzx eax, byte [rax + 0x18]
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 0x19]
shl ecx, 8
or eax, ecx
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 0x1a]
shl ecx, 0x10
or eax, ecx
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 0x1b]
shl ecx, 0x18
or eax, ecx
mov dword [rsp + 0xa4], eax
mov rax, qword [rsp + 0xd8]
movzx eax, byte [rax + 0x1c]
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 0x1d]
shl ecx, 8
or eax, ecx
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 0x1e]
shl ecx, 0x10
or eax, ecx
mov rcx, qword [rsp + 0xd8]
movzx ecx, byte [rcx + 0x1f]
shl ecx, 0x18
or eax, ecx
mov dword [rsp + 0xa8], eax
movsx eax, byte [0x140037a4c]
movsx ecx, byte [0x140037a4d]
shl ecx, 8
or eax, ecx
movsx ecx, byte [0x140037a4e]
shl ecx, 0x10
or eax, ecx
movsx ecx, byte [0x140037a4f]
shl ecx, 0x18
or eax, ecx
mov dword [rsp + 0xac], eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.140017770
mov dword [rsp + 0x60], 0
jmp 0x1400181d3
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0x40
jge 0x14001822b
mov eax, dword [rsp + 0x60]
cdq
and edx, 3
add eax, edx
sar eax, 2
cdqe
mov qword [rsp + 0xb0], rax
mov eax, dword [rsp + 0x60]
cdq
and edx, 3
add eax, edx
and eax, 3
sub eax, edx
shl eax, 3
movzx ecx, al
mov rax, qword [rsp + 0xb0]
mov eax, dword [rsp + rax*4 + 0x20]
shr eax, cl
and eax, 0xff
movsxd rcx, dword [rsp + 0x60]
mov rdx, qword [rsp + 0xd0]
mov byte [rdx + rcx], al
jmp 0x1400181c9
add rsp, 0xc8
ret