Function at 0x440870
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5b4
mov eax, dword [0x72400c]
xor eax, esp
mov dword [esp + 0x5b0], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [esp + 0xc], eax
push esi
push edi
cmp dword [ebx + 0x14], 0
je 0x4408b8
mov eax, 0x40000
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.004ce564
mov esp, ebp
pop ebp
ret 0x10
cmp byte [ebx + 0x2c], 0
je 0x4408da
mov eax, 0x50000
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.004ce564
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 8]
lea edx, [esp + 0x3b0]
xor edi, edi
mov eax, 0xc
cmp dword [ebx], edi
cmovne edi, eax
sub edx, ecx
mov dword [esp + 0x1c], edi
nop word [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x440900
cmp word [esp + 0x3b0], ax
jne 0x440936
mov eax, 0x10000
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.004ce564
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x3b0]
mov ecx, 0x2f
cmp word [eax], 0x5c
jne 0x44094b
mov word [eax], cx
add eax, 2
cmp word [eax], 0
jne 0x440942
lea ecx, [esp + 0x3b0]
mov esi, 8
call fcn.00440070
push dword [ebp + 0x10]
xor ecx, ecx
test al, al
push dword [esp + 0x18]
cmovne esi, ecx
mov ecx, ebx
mov dword [esp + 0x20], esi
call fcn.00440480
test eax, eax
jne 0x440f49
push eax
push eax
push 0x104
mov dword [esp + 0x388], eax
mov byte [esp + 0x64], al
lea eax, [esp + 0x174]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x3c4]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [esp + 0x168]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4409c1
mov byte [esp + 0x26c], al
sub ecx, edx
xor eax, eax
mov dword [esp + 0x38], ecx
cmp dword [ebx], 0
mov word [esp + 0x4a], ax
mov eax, dword [ebx + 0x68]
mov dword [esp + 0x28], eax
mov eax, 8
mov dword [esp + 0x164], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x370], 1
mov dword [esp + 0x378], 0
mov dword [esp + 0x20], 0x140b17
mov dword [esp + 0x2c], 0
mov word [esp + 0x24], ax
je 0x440a35
mov eax, 9
mov word [esp + 0x24], ax
mov word [esp + 0x4c], ax
mov word [esp + 0x26], si
test esi, esi
jne 0x440a52
mov eax, dword [ebx + 0x70]
test eax, eax
js 0x440a52
add eax, edi
mov dword [esp + 0x30], eax
jmp 0x440a5a
mov dword [esp + 0x30], 0
mov eax, dword [ebx + 0x70]
mov dword [esp + 0x34], eax
xor eax, eax
mov word [esp + 0x48], ax
mov eax, dword [ebx + 0x4c]
mov dword [esp + 0x50], eax
mov eax, dword [ebx + 0x10]
add eax, dword [ebx + 0x18]
mov dword [esp + 0x54], eax
lea eax, [esp + 0x384]
mov dword [esp + 0x15c], eax
lea eax, [esp + 0x398]
mov edx, dword [ebx + 0x5c]
mov ecx, dword [ebx + 0x58]
mov dword [esp + 0x160], eax
mov al, byte [ebx + 0x58]
mov byte [esp + 0x389], al
mov eax, edx
shrd ecx, eax, 8
mov dword [esp + 0x384], 0xd5455
sar eax, 8
mov byte [esp + 0x38a], cl
mov eax, edx
mov ecx, dword [ebx + 0x58]
shrd ecx, eax, 0x10
mov byte [esp + 0x388], 7
sar eax, 0x10
mov eax, dword [ebx + 0x58]
shrd eax, edx, 0x18
mov byte [esp + 0x38b], cl
mov ecx, dword [ebx + 0x50]
mov dword [esp + 0x14], eax
mov byte [esp + 0x38c], al
mov al, byte [ebx + 0x50]
mov byte [esp + 0x38d], al
sar edx, 0x18
mov edx, dword [ebx + 0x54]
mov eax, edx
shrd ecx, eax, 8
movq xmm0, qword [esp + 0x384]
sar eax, 8
mov byte [esp + 0x38e], cl
mov eax, edx
mov ecx, dword [ebx + 0x50]
shrd ecx, eax, 0x10
movq qword [esp + 0x398], xmm0
sar eax, 0x10
mov eax, dword [ebx + 0x50]
shrd eax, edx, 0x18
mov byte [esp + 0x38f], cl
mov ecx, dword [ebx + 0x60]
mov byte [esp + 0x390], al
mov al, byte [ebx + 0x60]
mov byte [esp + 0x391], al
sar edx, 0x18
mov edx, dword [ebx + 0x64]
mov eax, edx
shrd ecx, eax, 8
push ebx
sar eax, 8
mov byte [esp + 0x396], cl
mov eax, edx
mov ecx, dword [ebx + 0x60]
shrd ecx, eax, 0x10
mov dword [esp + 0x40], 0x11
sar eax, 0x10
mov eax, dword [ebx + 0x60]
shrd eax, edx, 0x18
mov byte [esp + 0x397], cl
lea ecx, [esp + 0x24]
mov byte [esp + 0x398], al
mov eax, dword [esp + 0x18]
sar edx, 0x18
mov dword [esp + 0x44], 9
mov byte [esp + 0x3a4], al
mov byte [esp + 0x39e], 5
call fcn.0043f5b0
add esp, 4
test eax, eax
je 0x440be1
mov ecx, ebx
call fcn.00440670
mov eax, 0x400
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.004ce564
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esp + 0x3c]
add eax, 0x1e
add eax, dword [esp + 0x38]
add dword [ebx + 0x18], eax
cmp dword [ebx + 0x14], 0
je 0x440c16
mov ecx, ebx
call fcn.00440670
mov eax, dword [ebx + 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.004ce564
mov esp, ebp
pop ebp
ret 0x10
mov dword [ebx + 0x30], 0x12345678
mov dword [ebx + 0x34], 0x23456789
mov dword [ebx + 0x38], 0x34567890
mov edx, dword [ebx]
test edx, edx
je 0x440c7f
mov al, byte [edx]
test al, al
je 0x440c7f
mov ecx, dword [ebx + 0x30]
movsx eax, al
xor eax, dword [ebx + 0x30]
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x67e8a8]
xor eax, ecx
mov ecx, dword [ebx + 0x38]
mov dword [ebx + 0x30], eax
movzx eax, al
add eax, dword [ebx + 0x34]
imul eax, eax, 0x8088405
inc eax
mov dword [ebx + 0x34], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x67e8a8]
mov dword [ebx + 0x38], ecx
add edx, 1
jne 0x440c31
cmp byte [0x72856c], 0
jne 0x440ca1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
push esi
call fcn.004ee02a
add esp, 4
xor esi, esi
call fcn.004ee009
sar eax, 7
mov byte [esp + esi + 0x3a4], al
inc esi
cmp esi, 0xc
jl 0x440ca3
mov eax, dword [esp + 0x28]
shr eax, 8
xor edi, edi
mov byte [esp + 0x3af], al
nop dword [eax + eax]
mov al, byte [esp + edi + 0x3a4]
mov ecx, dword [ebx + 0x30]
mov byte [esp + 0x13], al
movsx eax, al
xor eax, dword [ebx + 0x30]
movzx eax, al
mov edx, dword [ebx + 0x38]
mov esi, edx
shr ecx, 8
and esi, 0xfffd
or esi, 2
mov eax, dword [eax*4 + 0x67e8a8]
xor eax, ecx
mov dword [ebx + 0x30], eax
movzx eax, al
add eax, dword [ebx + 0x34]
imul eax, eax, 0x8088405
inc eax
mov dword [ebx + 0x34], eax
shr eax, 0x18
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x67e8a8]
mov eax, esi
xor eax, 1
mov dword [ebx + 0x38], edx
imul eax, esi
shr eax, 8
xor al, byte [esp + 0x13]
mov byte [esp + edi + 0x3a4], al
inc edi
cmp edi, 0xc
jl 0x440cd0
cmp dword [ebx], 0
je 0x440d5f
push 0xc
lea eax, [esp + 0x3a8]
mov ecx, ebx
push eax
call fcn.004402c0
add dword [ebx + 0x18], 0xc
mov esi, dword [esp + 0x18]
xor eax, eax
xor edi, edi
cmp dword [ebx], eax
setne al
mov byte [ebx + 0x2d], al
cmp esi, 8
jne 0x440d82
lea eax, [esp + 0x20]
mov ecx, ebx
push eax
call fcn.004406d0
jmp 0x440d8d
test esi, esi
jne 0x440d8f
mov ecx, ebx
call fcn.00440800
mov edi, eax
cmp byte [ebx + 0x80], 0
mov byte [ebx + 0x2d], 0
je 0x440daa
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x440daa
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx + 0x90]
add dword [ebx + 0x18], ecx
mov eax, dword [ebx + 0x14]
mov edx, dword [ebx + 0x74]
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x70], edx
test eax, eax
jne 0x440f49
test edi, edi
jne 0x440bc5
add ecx, dword [esp + 0x1c]
cmp dword [esp + 0x30], ecx
mov eax, dword [ebx + 0x78]
sete byte [esp + 0x13]
mov dword [esp + 0x2c], eax
cmp byte [ebx + 0x1c], 0
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
je 0x440e6b
cmp dword [ebx], edi
jne 0x440e6b
mov ax, word [esp + 0x24]
mov word [esp + 0x26], si
test al, 1
jne 0x440e14
mov ecx, 0xfff7
and ax, cx
mov word [esp + 0x24], ax
mov word [esp + 0x4c], ax
mov ecx, ebx
mov eax, dword [esp + 0x54]
sub eax, dword [ebx + 0x10]
push eax
call fcn.00440410
test al, al
je 0x440e4f
push ebx
lea ecx, [esp + 0x24]
call fcn.0043f5b0
add esp, 4
test eax, eax
jne 0x440bc5
push dword [ebx + 0x18]
mov ecx, ebx
call fcn.00440410
test al, al
jne 0x440ebc
mov eax, 0x2000000
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.004ce564
mov esp, ebp
pop ebp
ret 0x10
cmp word [esp + 0x26], si
je 0x440e8e
mov eax, 0x4000000
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.004ce564
mov esp, ebp
pop ebp
ret 0x10
test esi, esi
jne 0x440e99
cmp byte [esp + 0x13], 0
je 0x440e72
push ebx
lea ecx, [esp + 0x24]
call fcn.0043f860
add esp, 4
test eax, eax
jne 0x440bc5
mov ax, word [esp + 0x4c]
add dword [ebx + 0x18], 0x10
mov word [esp + 0x24], ax
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x440f49
push dword [esp + 0x40]
call fcn.004cec81
add esp, 4
mov esi, eax
push dword [esp + 0x40]
push dword [esp + 0x164]
push esi
call fcn.004e80a0
add esp, 0xc
mov dword [esp + 0x160], esi
push 0x360
call fcn.004ce575
mov edx, eax
lea esi, [esp + 0x24]
mov ecx, 0xd8
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x44]
add esp, 4
test ecx, ecx
jne 0x440f18
mov dword [ebx + 0x44], edx
jmp 0x440f47
cmp dword [ecx + 0x35c], 0
lea eax, [ecx + 0x35c]
je 0x440f41
nop word [eax + eax]
mov ecx, dword [eax]
cmp dword [ecx + 0x35c], 0
lea eax, [ecx + 0x35c]
jne 0x440f30
mov dword [ecx + 0x35c], edx
xor eax, eax
mov ecx, dword [esp + 0x5bc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004ce564
mov esp, ebp
pop ebp
ret 0x10