Function at 0x41f110
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 0x14]
xor eax, eax
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edi
test edx, edx
je 0x41f12b
mov byte [edx], al
mov esi, dword [ebp + 8]
test esi, esi
je 0x41f3ee
mov esi, dword [esi + 0x7c]
test esi, esi
je 0x41f3ee
cmp dword [esi], eax
jne 0x41f150
pop edi
mov eax, 0xffffff9c
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x41f15f
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, ecx
mov dword [esi + 0x14], ecx
cmp dword [esi + 0x5c], edi
jne 0x41f179
test edx, edx
je 0x41f179
mov byte [edx], 1
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0x5c]
cmp ecx, edx
jbe 0x41f185
mov dword [esi + 0x14], edx
mov eax, edx
push ebx
test eax, eax
je 0x41f3e5
lea edx, [esi + 4]
mov ecx, edx
cmp dword [esi + 8], 0
mov dword [ebp - 4], ecx
jne 0x41f2b2
mov eax, dword [esi + 0x58]
mov ecx, edx
mov dword [ebp - 4], ecx
test eax, eax
je 0x41f2b2
mov ecx, dword [esi + 0x60]
mov ebx, 0x4000
mov edx, dword [esi + 0x68]
cmp eax, ebx
cmovb ebx, eax
add edx, dword [esi + 0x3c]
cmp byte [ecx], 0
je 0x41f1e7
cmp byte [ecx + 1], 0
je 0x41f3b8
mov eax, dword [ecx + 0xc]
push 0
push 0
add eax, edx
push eax
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x41f1ea
mov dword [ecx + 0x1c], edx
push dword [esi + 0x60]
push 1
push ebx
push dword [esi]
call fcn.0041e910
add esp, 0x10
cmp eax, 1
jne 0x41f3b8
mov ecx, dword [esi]
add dword [esi + 0x3c], ebx
sub dword [esi + 0x58], ebx
cmp byte [esi + 0x6c], 0
mov dword [ebp - 0x10], ecx
mov dword [esi + 4], ecx
lea ecx, [esi + 4]
mov dword [esi + 8], ebx
mov dword [ebp - 4], ecx
je 0x41f2b2
mov dword [ebp + 8], 0
lea ecx, [esi + 4]
mov dword [ebp - 4], ecx
test ebx, ebx
je 0x41f2b2
mov ecx, dword [ebp - 0x10]
nop dword [eax + eax]
mov edi, dword [esi + 0x78]
mov eax, edi
and eax, 0xfffd
or eax, 2
mov edx, eax
xor edx, 1
imul edx, eax
mov eax, dword [ebp + 8]
shr edx, 8
xor dl, byte [eax + ecx]
mov ecx, dword [esi + 0x70]
movsx eax, dl
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x582af8]
movzx eax, cl
add eax, dword [esi + 0x74]
imul eax, eax, 0x8088405
mov dword [esi + 0x70], ecx
mov ecx, dword [ebp - 0x10]
inc eax
mov dword [esi + 0x74], eax
shr eax, 0x18
xor eax, edi
shr edi, 8
movzx eax, al
xor edi, dword [eax*4 + 0x582af8]
mov eax, dword [ebp + 8]
mov dword [esi + 0x78], edi
mov byte [eax + ecx], dl
inc eax
mov dword [ebp + 8], eax
cmp eax, ebx
jb 0x41f240
lea ecx, [esi + 4]
mov dword [ebp - 4], ecx
mov ebx, dword [esi + 0x7c]
mov edx, dword [esi + 8]
cmp ebx, edx
mov edi, edx
cmovbe edi, ebx
test edi, edi
je 0x41f2ee
mov eax, dword [ecx]
sub edx, edi
mov cl, byte [eax + edi - 1]
add eax, edi
mov byte [ebp + 0xb], cl
sub ebx, edi
mov ecx, dword [ebp - 4]
mov dword [esi + 8], edx
mov dword [esi + 0x7c], ebx
mov dword [ecx], eax
jne 0x41f2ee
mov al, byte [ebp + 0xb]
cmp al, byte [esi + 0x80]
jne 0x41f3c2
cmp dword [esi + 0x64], 0
jne 0x41f35c
mov ebx, dword [esi + 0x14]
cmp ebx, edx
cmovae ebx, edx
xor edx, edx
test ebx, ebx
je 0x41f315
mov eax, dword [ecx]
mov ecx, dword [esi + 0x10]
mov al, byte [edx + eax]
mov byte [edx + ecx], al
inc edx
mov ecx, dword [ebp - 4]
cmp edx, ebx
jb 0x41f302
mov edi, dword [esi + 0x10]
push ebx
push edi
push dword [esi + 0x50]
call fcn.0041e980
mov ecx, dword [ebp - 4]
add esp, 0xc
sub dword [esi + 0x5c], ebx
sub dword [esi + 8], ebx
sub dword [esi + 0x14], ebx
add dword [ecx], ebx
add dword [esi + 0x18], ebx
mov dword [esi + 0x50], eax
lea eax, [edi + ebx]
mov edi, dword [ebp - 8]
add edi, ebx
mov dword [esi + 0x10], eax
cmp dword [esi + 0x5c], 0
mov dword [ebp - 8], edi
jne 0x41f357
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x41f357
mov byte [eax], 1
mov ebx, dword [ebp - 0xc]
jmp 0x41f3aa
mov edi, dword [esi + 0x18]
mov ebx, dword [esi + 0x10]
push 2
push ecx
call fcn.0041c9d0
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x18]
sub eax, edi
push eax
push ebx
push dword [esi + 0x50]
mov dword [ebp + 8], eax
call fcn.0041e980
mov ecx, dword [esi + 0x5c]
add esp, 0x14
mov edi, dword [ebp - 8]
sub ecx, dword [ebp + 8]
add edi, dword [ebp + 8]
mov ebx, dword [ebp - 0xc]
mov dword [esi + 0x50], eax
mov dword [esi + 0x5c], ecx
mov dword [ebp - 8], edi
cmp ebx, 1
je 0x41f3db
test ecx, ecx
je 0x41f3db
mov ecx, dword [ebp - 4]
test ebx, ebx
jne 0x41f3d2
cmp dword [esi + 0x14], 0
jbe 0x41f3ce
lea edx, [esi + 4]
jmp 0x41f193
pop ebx
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
mov eax, 0xffffff96
pop esi
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x41f3e5
mov eax, ebx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x41f3e5
mov byte [edx], 1
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0xffffff9a
pop esi
mov esp, ebp
pop ebp
ret