Function at 0x140026ce0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push r12
push r13
push r15
sub rsp, 0x30
xor r13d, r13d
xor r12d, r12d
mov r15, r9
test r9, r9
je 0x140026cfb
mov byte [r9], r12b
mov qword [rsp + 0x50], rbx
test rcx, rcx
je 0x140027046
mov rbx, qword [rcx + 0x80]
test rbx, rbx
je 0x140027046
cmp qword [rbx], r12
jne 0x140026d33
mov eax, 0xffffff9c
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r15
pop r13
pop r12
ret
test r8d, r8d
jne 0x140026d4a
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r15
pop r13
pop r12
ret
mov eax, dword [rbx + 0x80]
mov qword [rbx + 0x18], rdx
mov dword [rbx + 0x20], r8d
cmp r8d, eax
jbe 0x140026d63
mov dword [rbx + 0x20], eax
mov r8d, eax
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r14
test r8d, r8d
je 0x140027041
lea rcx, [rbx + 8]
mov r14, rcx
lea rbp, [0x14010f250]
nop
cmp dword [rbx + 0x10], 0
jne 0x140026ecc
mov eax, dword [rbx + 0x7c]
mov r14, rcx
test eax, eax
je 0x140026ecc
mov rcx, qword [rbx + 0x88]
mov edi, 0x4000
mov edx, dword [rbx + 0x94]
cmp eax, edi
cmovb edi, eax
add edx, dword [rbx + 0x60]
cmp byte [rcx], 0
je 0x140026de6
cmp byte [rcx + 1], 0
je 0x140026ffe
add edx, dword [rcx + 0x14]
xor r9d, r9d
mov rcx, qword [rcx + 8]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x140026de9
mov dword [rcx + 0x2c], edx
mov r9, qword [rbx + 0x88]
mov r8d, 1
mov rcx, qword [rbx]
mov edx, edi
mov esi, edi
call fcn.140025a30
cmp rax, 1
jne 0x140026ffe
add dword [rbx + 0x60], edi
lea r14, [rbx + 8]
sub dword [rbx + 0x7c], edi
cmp byte [rbx + 0x98], 0
mov r11, qword [rbx]
mov qword [rbx + 8], r11
mov dword [rbx + 0x10], edi
je 0x140026ecc
lea r14, [rbx + 8]
test edi, edi
je 0x140026ecc
nop dword [rax]
mov r9d, dword [rbx + 0xa4]
lea r11, [r11 + 1]
mov edx, dword [rbx + 0x9c]
mov eax, r9d
and eax, 0xfffd
mov ecx, edx
or eax, 2
shr edx, 8
mov r8d, eax
xor r8d, 1
imul r8d, eax
shr r8d, 8
xor r8b, byte [r11 - 1]
movsx rax, r8b
xor rcx, rax
movzx eax, cl
movzx ecx, r9b
shr r9d, 8
xor edx, dword [rbp + rax*4]
movzx eax, dl
add eax, dword [rbx + 0xa0]
imul eax, eax, 0x8088405
mov dword [rbx + 0x9c], edx
inc eax
mov dword [rbx + 0xa0], eax
shr rax, 0x18
xor rcx, rax
xor r9d, dword [rbp + rcx*4]
mov dword [rbx + 0xa4], r9d
mov byte [r11 - 1], r8b
sub rsi, 1
jne 0x140026e40
lea r14, [rbx + 8]
mov r10d, dword [rbx + 0xa8]
mov r8d, dword [rbx + 0x10]
cmp r10d, r8d
mov r9d, r8d
cmovbe r9d, r10d
test r9d, r9d
je 0x140026f22
mov rdx, qword [r14]
lea eax, [r9 - 1]
sub r8d, r9d
movzx r11d, byte [rax + rdx]
sub dword [rbx + 0x80], r9d
mov eax, r9d
add rax, rdx
mov dword [rbx + 0x10], r8d
sub r10d, r9d
mov qword [r14], rax
mov dword [rbx + 0xa8], r10d
jne 0x140026f22
cmp r11b, byte [rbx + 0xac]
jne 0x140027027
cmp dword [rbx + 0x90], 0
jne 0x140026fa0
mov esi, dword [rbx + 0x20]
cmp esi, r8d
cmovae esi, r8d
xor r8d, r8d
test esi, esi
je 0x140026f58
nop dword [rax]
mov rax, qword [r14]
mov rcx, qword [rbx + 0x18]
movzx eax, byte [r8 + rax]
mov byte [r8 + rcx], al
inc r8d
cmp r8d, esi
jb 0x140026f40
mov rdi, qword [rbx + 0x18]
mov r8d, esi
mov ecx, dword [rbx + 0x74]
mov rdx, rdi
call fcn.140024ff0
sub dword [rbx + 0x80], esi
add r12d, esi
sub dword [rbx + 0x10], esi
sub dword [rbx + 0x20], esi
add dword [rbx + 0x24], esi
mov ecx, esi
add qword [r14], rcx
cmp dword [rbx + 0x80], 0
mov dword [rbx + 0x74], eax
lea rax, [rsi + rdi]
mov qword [rbx + 0x18], rax
jne 0x140026fef
test r15, r15
je 0x140026fef
mov byte [r15], 1
jmp 0x140026fef
mov edi, dword [rbx + 0x24]
mov rcx, r14
mov rsi, qword [rbx + 0x18]
call fcn.140025590
mov ebp, dword [rbx + 0x24]
mov rdx, rsi
mov ecx, dword [rbx + 0x74]
sub ebp, edi
mov r8d, ebp
mov r13d, eax
call fcn.140024ff0
mov ecx, dword [rbx + 0x80]
add r12d, ebp
sub ecx, ebp
mov dword [rbx + 0x74], eax
mov dword [rbx + 0x80], ecx
cmp r13d, 1
je 0x140027038
test ecx, ecx
je 0x140027038
test r13d, r13d
jne 0x140027033
lea rbp, [0x14010f250]
cmp dword [rbx + 0x20], 0
jbe 0x14002702e
lea rcx, [rbx + 8]
jmp 0x140026d90
mov eax, 0xffffffff
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov r14, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r15
pop r13
pop r12
ret
mov eax, 0xffffff96
jmp 0x140027003
test r13d, r13d
je 0x140027041
mov eax, r13d
jmp 0x140027003
test r15, r15
je 0x140027041
mov byte [r15], 1
mov eax, r12d
jmp 0x140027003
mov rbx, qword [rsp + 0x50]
mov eax, 0xffffff9a
add rsp, 0x30
pop r15
pop r13
pop r12
ret