Function at 0x140005668
Capabilities:
Check for time delay via gettickcount
Encode data using xor
Generate random numbers using the delphi lcg
Get file size
Read file via mapping

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4d8
xor edi, edi
mov qword [rsp + 0x40], rdi
mov r12, rdi
mov rbp, rdi
mov r14, rdi
mov rsi, rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x528], rdi
call fcn.140004628
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0x11
cmp eax, 0x111
je 0x14000571a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [rsp + 0x520]
mov r15d, dword [rsp + 0x520]
mov r13d, dword [rsp + 0x520]
mov dword [rsp + 0x520], edi
mov dword [0x140007054], eax
xor edi, edi
call main
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x140007054]
mov ecx, r11d
mul r11d
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
test r11d, 0xffff8000
je 0x14000585a
cmp ecx, edi
je 0x140005e03
cmp ecx, 1
jne 0x140005738
jmp 0x1400056dd
mov eax, dword [rsp + 0x520]
mov r15d, dword [rsp + 0x520]
mov r13d, dword [rsp + 0x520]
mov dword [rsp + 0x520], eax
mov ebx, r15d
mov r9d, 4
mov r8d, 0x1000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
call main
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x140007054]
mov ecx, r11d
mul r11d
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
test r11d, 0xffff8000
je 0x140005794
xor edi, edi
cmp ecx, edi
je 0x140005e01
cmp ecx, 1
je 0x1400056dd
jmp 0x14000573b
mov rax, qword [rsp + 0x48]
lea rcx, [rsp + 0x50]
mov edx, 4
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x68], r15d
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], rax
call fcn.140003370
cmp eax, 1
jne 0x140005e7f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call main
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x140007054]
mov ecx, r11d
mul r11d
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
test r11d, 0xffff8000
jne 0x14000577f
mov rcx, rdi
call fcn.140004fe8
mov edx, r15d
mov r8d, 0x8000
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test rbx, rbx
je 0x140005e96
mov rcx, rbx
call fcn.140004e78
lea rdx, [0x140001590]
mov rcx, rbx
call fcn.140004f18
mov rdi, rax
test rax, rax
jne 0x140005df4
lea rdx, [0x140001598]
jmp 0x140005e86
lea rdx, [0x140001370]
lea rcx, [0x140007060]
call fcn.1400060c0
mov dword [rsp + 0x4c4], edi
mov word [rsp + 0xb0], di
call main
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x140007054]
mov ecx, r11d
mul r11d
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
test r11d, 0xffff8000
jne 0x14000570b
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 0x60]
movabs rax, 0x74636a6e696d7678
add rbx, 0xfe0
cmp qword [rbx], rax
je 0x140005906
call fcn.140004a18
cmp eax, edi
je 0x140005e96
mov rcx, rbx
cmp eax, 1
jne 0x1400058f2
call fcn.1400052b8
cmp al, dil
je 0x140005e96
jmp 0x140005906
call fcn.1400048c8
cmp eax, edi
je 0x140005e96
cmp eax, 2
cmove rbx, rdi
cmp rbx, rdi
je 0x140005971
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
xor r8d, r8d
lea r12d, [r9 + 6]
mov qword [rsp + 0x20], rdi
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x40], rax
cmp rax, rdi
je 0x140005cec
mov ecx, dword [rax + 0x1c]
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
cmp rax, rdi
je 0x140005ce3
mov edx, dword [rax + 0x4c]
mov r8d, dword [rax + 0x48]
lea rcx, [rsp + 0xb0]
add rdx, rax
call fcn.140006040
jmp 0x1400059ae
lea rdx, [rsp + 0xb0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r11, [rsp + 0xb0]
mov eax, edi
cmp word [rsp + 0xb0], di
je 0x1400059a7
add r11, 2
inc eax
cmp word [r11], di
jne 0x14000599b
mov dword [rsp + 0x4c4], eax
call main
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x140007054]
mul r11d
mov eax, r11d
shr edx, 1
lea ecx, [rdx + rdx*2]
sub eax, ecx
test r11d, 0xffff8000
je 0x1400059e8
cmp eax, edi
je 0x140005e03
cmp eax, 1
jmp 0x140005716
or ebx, 0xffffffff
lea rdx, [rsp + 0xb0]
lea rcx, [0x140007060]
mov r8d, ebx
call fcn.140006040
lea rdx, [0x14000125c]
lea rcx, [0x140007060]
mov r8d, ebx
call fcn.140006040
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0xb0]
lea r8d, [r9 + 7]
mov edx, 0x80000000
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140005de5
lea rcx, [0x140001448]
call fcn.1400047d8
cmp eax, edi
jne 0x1400056dd
xor r9d, r9d
xor edx, edx
mov rcx, rbp
lea r8d, [r9 + 2]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
cmp rax, rdi
je 0x140005dd6
xor r9d, r9d
mov esi, 0x1000
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x140005dc7
mov rcx, rax
call fcn.140004868
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea rdx, [rsp + 0x538]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor edi, edi
cmp eax, edi
je 0x140005dbb
lea rcx, [rsi + rbx]
cmp qword [rsp + 0x538], rcx
jle 0x140005d6d
lea ecx, [rbx + 0x1000]
lea edx, [rdi + 4]
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rcx, r14
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
cmp rax, rdi
je 0x140005d64
call main
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x140007054]
mul r11d
shr edx, 1
lea ecx, [rdx + rdx*2]
mov edx, r11d
sub edx, ecx
test r11d, 0xffff8000
je 0x140005b57
cmp edx, edi
je 0x140005e01
cmp edx, 1
jmp 0x140005716
mov rcx, rsi
call fcn.140004868
mov r11d, eax
add r11, rsi
cmp dword [r11], 0x6d7678
jne 0x140005d58
cmp dword [r11 + 4], 3
jne 0x140005d4c
mov edx, dword [r11 + 8]
mov ebx, edx
imul ebx, ebx, 0x8088405
inc ebx
mov eax, ebx
xor eax, edx
cmp eax, dword [r11 + 0xc]
jne 0x140005d40
mov ecx, ebx
imul ecx, ecx, 0x8088405
inc ecx
mov eax, ecx
xor eax, ebx
cmp eax, dword [r11 + 0x10]
jne 0x140005d34
mov eax, dword [r11 + 0x18]
mov r15d, dword [r11 + 0x1c]
imul ecx, ecx, 0x2b9ad7e7
add r11, 0x20
mov r13d, 0x8088406
sub r13d, ecx
mov rcx, rsi
xor eax, r13d
imul r13d, r13d, 0x8088405
inc r13d
xor r15d, r13d
imul r13d, r13d, 0x8088405
inc r13d
xor r13d, dword [r11]
sub r11d, esi
lea edi, [r11 + rax + 4]
lea eax, [rdi + r13]
mov dword [rsp + 0x520], eax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
mov rcx, rbp
lea r8d, [r9 + 8]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
test rax, rax
je 0x140005d2b
mov eax, dword [rsp + 0x520]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
je 0x140005cf5
add rdi, rax
mov qword [rsp + 0x48], rdi
mov rcx, rdi
xor edi, edi
cmp r13d, edi
jbe 0x140005c93
mov edx, r13d
imul ebx, ebx, 0x343fd
add ebx, 0x269ec3
mov eax, ebx
shr eax, 0x10
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140005c77
mov r9d, 0x58
lea r8, [0x140001564]
lea rcx, [rsp + 0x50]
lea edx, [r9 - 0x49]
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rdi
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x50], rdi
call fcn.140004570
cmp eax, edi
je 0x140005738
lea rdx, [0x140001570]
jmp 0x140005e86
lea rdx, [0x140001418]
jmp 0x140005cfc
lea rdx, [0x140001400]
jmp 0x140005cfc
lea rdx, [0x140001550]
or r8d, 0xffffffff
lea rcx, [0x140007060]
call fcn.140006040
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140007060]
mov r8d, 0xa
call fcn.140005f90
jmp 0x140005e96
lea rdx, [0x140001538]
jmp 0x140005cfc
lea rdx, [0x140001528]
jmp 0x140005e86
lea rdx, [0x140001518]
jmp 0x140005e86
lea rdx, [0x140001508]
jmp 0x140005e86
lea rdx, [0x1400014f8]
jmp 0x140005e86
lea rdx, [0x1400014e0]
jmp 0x140005cfc
lea rdx, [0x1400014c8]
lea rcx, [0x140007060]
or r8d, 0xffffffff
call fcn.140006040
mov edx, dword [rsp + 0x538]
lea rcx, [0x140007060]
mov r8d, 0xa
call fcn.140005f90
lea rdx, [0x14000125c]
lea rcx, [0x140007060]
or r8d, 0xffffffff
call fcn.140006040
mov edx, ebx
jmp 0x140005d14
lea rdx, [0x1400014b0]
jmp 0x140005cfc
mov r8d, ebx
lea rdx, [0x140001498]
jmp 0x140005d00
mov r8d, ebx
lea rdx, [0x140001480]
jmp 0x140005d00
mov r8d, ebx
lea rdx, [0x140001430]
jmp 0x140005d00
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rsi, rax
jmp 0x140005e0e
jmp 0x140005e0b
mov rdi, qword [rsp + 0x528]
mov rsi, rdi
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
lea r8d, [r9 + 2]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
test rax, rax
jne 0x140005e3f
lea rdx, [0x1400015a8]
jmp 0x140005cfc
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, dword [rsp + 0x520]
mov rax, qword [rsp + 0x40]
mov r8, qword [rsp + 0x538]
add r9d, 0xffff
mov rdx, rbx
mov rcx, rsi
and r9d, 0xffff0000
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call rdi
jmp 0x140005ecb
lea rdx, [0x140001580]
lea rcx, [0x140007060]
or r8d, 0xffffffff
call fcn.140006040
lea rcx, [0x1400015d0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, [0x1400015c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [0x1400015e8]
lea rdx, [0x140007060]
mov r9d, 0x10
xor ecx, ecx
call rax
add rsp, 0x4d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret