Function at 0x411530
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov eax, edx
xor edx, edx
push esi
push edi
mov dword [ebp - 4], edx
xor edi, edi
mov edx, dword [ebp + 0xc]
mov dword [ebp - 8], edi
test edx, edx
je 0x41154f
mov byte [edx], 0
test ecx, ecx
jne 0x41155f
mov eax, 0xffffff9a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ecx + 0x7c]
test esi, esi
je 0x411553
cmp dword [esi], edi
jne 0x411576
mov eax, 0xffffff9c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x411586
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, dword [esi + 0x5c]
mov dword [esi + 0x10], eax
cmova ecx, dword [esi + 0x5c]
mov dword [esi + 0x14], ecx
cmp ecx, edi
jbe 0x4117c8
nop dword [eax + eax]
cmp dword [esi + 8], 0
jne 0x41169f
mov eax, dword [esi + 0x58]
test eax, eax
je 0x41169f
mov ecx, dword [esi + 0x60]
mov ebx, 0x4000
mov edx, dword [esi + 0x68]
cmp eax, ebx
cmovb ebx, eax
add edx, dword [esi + 0x3c]
cmp byte [ecx], 0
je 0x4115ec
cmp byte [ecx + 1], 0
je 0x4117a8
mov eax, dword [ecx + 0xc]
push 0
push 0
add eax, edx
push eax
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4115ef
mov dword [ecx + 0x1c], edx
push dword [esi + 0x60]
mov ecx, dword [esi]
mov edx, ebx
push 1
call fcn.00410420
add esp, 8
cmp eax, 1
jne 0x4117a8
add dword [esi + 0x3c], ebx
sub dword [esi + 0x58], ebx
cmp byte [esi + 0x6c], 0
mov eax, dword [esi]
mov dword [ebp - 0xc], eax
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
je 0x41169f
xor ecx, ecx
mov dword [ebp - 0x10], ecx
test ebx, ebx
je 0x41169f
nop dword [eax]
mov edi, dword [esi + 0x78]
mov eax, edi
and eax, 0xfffd
or eax, 2
mov edx, eax
xor edx, 1
imul edx, eax
mov eax, dword [ebp - 0xc]
shr edx, 8
xor dl, byte [ecx + eax]
mov ecx, dword [esi + 0x70]
movsx eax, dl
xor eax, dword [esi + 0x70]
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x4f2210]
xor eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword [esi + 0x70], eax
movzx eax, al
add eax, dword [esi + 0x74]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x74], eax
shr eax, 0x18
xor eax, edi
shr edi, 8
movzx eax, al
xor edi, dword [eax*4 + 0x4f2210]
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x78], edi
mov byte [ecx + eax], dl
inc ecx
mov dword [ebp - 0x10], ecx
cmp ecx, ebx
jb 0x411630
mov ecx, dword [esi + 0x7c]
mov edx, dword [esi + 8]
cmp ecx, edx
cmova ecx, edx
test ecx, ecx
je 0x4116d2
mov eax, dword [esi + 4]
sub edx, ecx
add eax, ecx
mov bl, byte [eax - 1]
sub dword [esi + 0x5c], ecx
sub dword [esi + 0x7c], ecx
mov dword [esi + 8], edx
mov dword [esi + 4], eax
jne 0x4116d2
cmp bl, byte [esi + 0x80]
jne 0x4117b2
cmp dword [esi + 0x64], 0
jne 0x411747
mov ebx, dword [esi + 8]
cmp dword [esi + 0x14], ebx
cmovb ebx, dword [esi + 0x14]
xor edx, edx
test ebx, ebx
je 0x411701
nop dword [eax + eax]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x10]
mov al, byte [edx + eax]
mov byte [edx + ecx], al
inc edx
cmp edx, ebx
jb 0x4116f0
mov edi, dword [esi + 0x10]
mov edx, edi
mov ecx, dword [esi + 0x50]
push ebx
call fcn.0040fb90
sub dword [esi + 0x5c], ebx
add esp, 4
sub dword [esi + 8], ebx
sub dword [esi + 0x14], ebx
add dword [esi + 4], ebx
add dword [esi + 0x18], ebx
mov dword [esi + 0x50], eax
lea eax, [edi + ebx]
mov edi, dword [ebp - 8]
add edi, ebx
mov dword [esi + 0x10], eax
cmp dword [esi + 0x5c], 0
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], edi
jne 0x411791
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x411791
mov byte [edx], 1
jmp 0x411791
mov edi, dword [esi + 0x18]
lea ecx, [esi + 4]
mov ebx, dword [esi + 0x10]
call fcn.0040ff40
mov ecx, dword [esi + 0x50]
mov edx, ebx
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x18]
sub eax, edi
push eax
mov dword [ebp - 0x10], eax
call fcn.0040fb90
mov edi, dword [ebp - 8]
add esp, 4
mov ebx, dword [ebp - 4]
mov dword [esi + 0x50], eax
mov eax, dword [ebp - 0x10]
add edi, eax
sub dword [esi + 0x5c], eax
mov dword [ebp - 8], edi
cmp ebx, 1
je 0x4117be
cmp dword [esi + 0x5c], 0
je 0x4117be
test ebx, ebx
jne 0x41179f
cmp dword [esi + 0x14], 0
ja 0x4115a0
test ebx, ebx
je 0x4117c8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xffffff96
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4117c8
mov byte [ecx], 1
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret