Function at 0x41e4b0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x4d6bb0]
sub esp, 0x1c
push ebx
push esi
push edi
test eax, eax
je 0x41e4db
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xf0], 0x6e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov edx, dword [esi + 0xf4]
mov eax, dword [esi + 0xb0]
cmp edx, eax
jae 0x41e679
mov ebx, dword [esi + 0x114]
lea ecx, [ebx + ebx]
mov dword [esp + 0x18], ebx
mov dword [esi + 0x114], ecx
cmp ecx, 0x1000
jbe 0x41e517
mov dword [esi + 0x114], 0x1000
lea ecx, [edx + ebx]
cmp ecx, eax
jbe 0x41e526
sub eax, edx
mov ebx, eax
mov dword [esp + 0x18], eax
mov edx, dword [esi + 0x111c]
mov ecx, dword [esi + 0x1118]
xor edi, edi
mov dword [esp + 0x10], edx
mov edx, dword [esi + 0x1120]
mov dword [esp + 0x14], edi
test ebx, ebx
jbe 0x41e5b9
jmp 0x41e550
mov ebx, dword [esi + 0xf4]
add ebx, dword [esi + 0xac]
movzx eax, dx
shr eax, 2
mov al, byte [eax + 0x4d6bb8]
xor al, byte [ebx + edi]
movzx edi, cl
movzx ebx, al
xor edi, ebx
shr ecx, 8
xor ecx, dword [edi*4 + 0x4dae18]
movzx ebx, dl
movzx edi, cl
add edi, dword [esp + 0x10]
shr edx, 8
imul edi, edi, 0x8088405
inc edi
mov dword [esp + 0x10], edi
shr edi, 0x18
xor edi, ebx
xor edx, dword [edi*4 + 0x4dae18]
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov byte [esi + edi + 0x118], al
inc edi
mov dword [esp + 0x14], edi
cmp edi, ebx
jb 0x41e550
add dword [esi + 0xf8], ebx
mov dword [esi + 0x1118], ecx
mov ecx, dword [esp + 0x10]
adc dword [esi + 0xfc], 0
add dword [esi + 0xf4], ebx
mov eax, dword [esi + 0xf4]
mov dword [esi + 0x111c], ecx
mov dword [esi + 0x1120], edx
cmp eax, dword [esi + 0xb0]
jb 0x41e665
mov ecx, dword [esi + 0xc4]
cmp ecx, 0xffffffff
je 0x41e665
mov edx, dword [esi + 0xcc]
mov eax, dword [esi + 0xc8]
push 0
mov dword [esp + 0x28], edx
lea edx, [esp + 0x28]
push edx
push eax
push ecx
mov dword [esp + 0x30], eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov dword [esp + 0x20], eax
cmp eax, 0xffffffff
jne 0x41e63e
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
je 0x41e63a
or eax, 0xffffffff
mov dword [esp + 0x24], eax
jmp 0x41e63e
mov eax, dword [esp + 0x20]
cmp eax, dword [esi + 0xc8]
jne 0x41e652
mov eax, dword [esp + 0x24]
cmp eax, dword [esi + 0xcc]
je 0x41e665
mov dword [esi + 0xf0], 5
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
add esi, 0x118
mov dword [ecx], esi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x108]
mov eax, dword [esi + 0x10c]
mov edx, ecx
or edx, eax
je 0x41e7a6
mov ebx, 0x1000
mov dword [esp + 0x1c], ebx
test eax, eax
jg 0x41e6a8
jl 0x41e6a2
cmp ecx, ebx
jae 0x41e6a8
mov ebx, ecx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esi + 0xc4]
push 0
lea eax, [esp + 0x1c]
push eax
push ebx
lea edi, [esi + 0x118]
push edi
push ecx
mov dword [esp + 0x34], edi
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x41e79c
cmp dword [esp + 0x18], ebx
jne 0x41e79c
mov edx, dword [esi + 0x111c]
mov ecx, dword [esi + 0x1118]
mov dword [esp + 0x10], edx
mov edx, dword [esi + 0x1120]
test ebx, ebx
jbe 0x41e75e
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
lea esp, [esp]
movzx eax, dx
shr eax, 2
mov al, byte [eax + 0x4d6bb8]
xor al, byte [edi]
movzx edi, cl
movzx ebx, al
xor edi, ebx
shr ecx, 8
xor ecx, dword [edi*4 + 0x4dae18]
movzx ebx, dl
movzx edi, cl
add edi, dword [esp + 0x10]
shr edx, 8
imul edi, edi, 0x8088405
inc edi
mov dword [esp + 0x10], edi
shr edi, 0x18
xor edi, ebx
xor edx, dword [edi*4 + 0x4dae18]
mov edi, dword [esp + 0x18]
mov byte [edi], al
inc edi
sub dword [esp + 0x14], 1
mov dword [esp + 0x18], edi
jne 0x41e700
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
xor eax, eax
add dword [esi + 0xf8], ebx
mov dword [esi + 0x1118], ecx
mov ecx, dword [esp + 0x10]
adc dword [esi + 0xfc], eax
sub dword [esi + 0x108], ebx
mov dword [esi + 0x1120], edx
mov edx, dword [ebp + 0xc]
sbb dword [esi + 0x10c], eax
mov dword [esi + 0x111c], ecx
mov dword [edx], edi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0xf0], 3
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret