Function at 0x10041b9
Capabilities:
Check for time delay via gettickcount
Encode data using xor
Generate random numbers using the delphi lcg
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xce4
push ebx
push esi
push edi
call fcn.01003d85
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
and eax, 0x11
mov ebx, 0x1005010
cmp eax, 0x111
je 0x1004606
call esi
mov dword [0x100500c], eax
call fcn.01003e41
mov ecx, eax
sub ecx, dword [0x100500c]
push 3
xor edx, edx
mov eax, ecx
pop esi
div esi
test ecx, 0xffff8000
jne 0x10044b7
xor eax, eax
xor edi, edi
mov dword [esp + 0x8d4], edi
mov word [esp + 0x4c0], ax
mov dword [esp + 0x4bc], edi
mov word [esp + 0xa8], ax
call fcn.01003e41
mov ecx, eax
sub ecx, dword [0x100500c]
xor edx, edx
mov eax, ecx
div esi
test ecx, 0xffff8000
jne 0x100439f
push 0x10010bc
lea eax, [esp + 0x8dc]
call fcn.010049ac
push 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [esp + 0x8dc]
call fcn.010048f0
mov esi, dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov eax, ecx
push eax
push edi
push 4
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call esi
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
cmp dword [esp + 0x10], edi
je 0x1004351
push edi
push edi
push edi
push 4
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esp + 0x30], eax
cmp eax, edi
je 0x10046fc
push 0x1001198
lea eax, [esp + 0x8dc]
call fcn.01004990
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0x210]
push 0x10
lea ecx, [esp + 0x8dc]
call fcn.010048f0
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x8d8]
push eax
push edi
push 4
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
call esi
mov dword [esp + 0xc], eax
cmp dword [esp + 0x10], edi
je 0x1004725
push edi
push edi
push edi
push 4
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esp + 0x34], eax
cmp eax, edi
je 0x100471c
add eax, 0xc
push eax
lea eax, [esp + 0x4c4]
call fcn.01004990
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1004381
cmp eax, 2
jne 0x1004877
push 0x104
lea eax, [esp + 0x4c4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x4c0]
call fcn.010048df
mov dword [esp + 0x8d4], eax
call fcn.01003e41
mov ecx, eax
sub ecx, dword [0x100500c]
push 3
xor edx, edx
mov eax, ecx
pop esi
div esi
test ecx, 0xffff8000
je 0x10043a6
cmp edx, edi
jmp 0x10044b9
lea eax, [esp + 0x4c0]
push eax
lea esi, [esp + 0xac]
call fcn.01004956
push 0x1001210
call fcn.01004956
push edi
push edi
push 3
push edi
push 7
push 0x80000000
lea eax, [esp + 0x4d8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x100472f
call fcn.01003dbe
test eax, eax
jne 0x10041ef
xor edi, edi
push edi
push edi
push edi
push 2
push edi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esp + 0x1c], eax
cmp eax, edi
je 0x100473c
mov esi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0x1000
push edi
push edi
push 4
push eax
call esi
mov dword [esp + 0x14], eax
cmp eax, edi
je 0x1004749
mov edi, eax
call fcn.01003df4
push dword [esp + 0x14]
mov edi, eax
mov dword [esp + 0x30], edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea eax, [esp + 0x74]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x1004756
xor eax, eax
cmp dword [esp + 0x94], eax
jne 0x100447a
cmp dword [esp + 0x98], edi
jbe 0x10048d8
add edi, 0x1000
push edi
push eax
push eax
push 4
push dword [esp + 0x2c]
call esi
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
je 0x1004763
call fcn.01003e41
mov ecx, eax
sub ecx, dword [0x100500c]
push 3
xor edx, edx
mov eax, ecx
pop edi
div edi
test ecx, 0xffff8000
je 0x10044cd
test edx, edx
je 0x1004820
cmp edx, 1
je 0x10041ef
jmp 0x1004606
mov edi, esi
call fcn.01003df4
add eax, esi
mov ecx, dword [eax]
mov dword [esp + 0xc], eax
lea esi, [eax + 4]
cmp ecx, 0x6d7678
jne 0x1004770
mov eax, dword [esi]
add esi, 4
cmp eax, 1
jne 0x1004786
mov eax, dword [esi]
mov edi, eax
imul edi, edi, 0x8088405
add esi, 4
mov ecx, dword [esi]
inc edi
mov edx, edi
xor edx, eax
add esi, 4
cmp edx, ecx
jne 0x100479c
mov ecx, dword [esi]
mov eax, edi
imul eax, eax, 0x8088405
inc eax
mov edx, eax
xor edx, edi
add esi, 4
cmp edx, ecx
jne 0x10047b2
mov ecx, dword [esi]
imul eax, eax, 0x8088405
push dword [esp + 0x14]
inc eax
xor ecx, eax
imul eax, eax, 0x8088405
add esi, 4
inc eax
xor eax, dword [esi]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push eax
push eax
push eax
push 8
push eax
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x10047c8
sub esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
add esi, 4
add ecx, esi
add ecx, dword [esp + 0x2c]
mov dword [esp + 0x38], esi
push ecx
push 0
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor ecx, ecx
mov dword [esp + 0x14], eax
cmp eax, ecx
je 0x10047d8
mov eax, dword [esp + 0x2c]
add eax, esi
add eax, dword [esp + 0x14]
mov esi, dword [esp + 0x20]
mov dword [esp + 0x28], eax
cmp esi, ecx
jbe 0x10045e1
imul edi, edi, 0x343fd
add edi, 0x269ec3
mov edx, edi
shr edx, 0x10
xor byte [eax], dl
inc eax
dec esi
jne 0x10045ca
lea esi, [esp + 0x3c]
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x3c], ecx
call fcn.01003d10
test eax, eax
jne 0x10047e8
push 4
push 0x1000
push dword [esp + 0x2c]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
call fcn.01003e41
mov ecx, eax
sub ecx, dword [0x100500c]
push 3
xor edx, edx
mov eax, ecx
pop edi
div edi
test ecx, 0xffff8000
je 0x100464b
test edx, edx
je 0x1004820
cmp edx, 1
jne 0x1004606
jmp 0x10041ef
mov eax, dword [esp + 0x20]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x4c], esi
call fcn.01002e20
pop ecx
cmp eax, 1
jne 0x10047fe
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.01003e41
mov ecx, eax
sub ecx, dword [0x100500c]
push 3
xor edx, edx
mov eax, ecx
pop edi
div edi
test ecx, 0xffff8000
jne 0x10044b7
push esi
call fcn.01003f08
mov dword [esp], 0x8000
push dword [esp + 0x28]
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test edi, edi
je 0x10048b5
push edi
call fcn.01003e6e
pop ecx
mov dword [esp + 0xc], eax
test eax, eax
jne 0x1004814
push 0x1001108
mov eax, ebx
call fcn.01004990
push 0x1001344
jmp 0x10048ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10010f0
lea esi, [esp + 0xac]
mov edi, eax
call fcn.01004956
mov eax, edi
jmp 0x100488c
call esi
push 0x10011d4
jmp 0x1004707
push 0x10011e8
jmp 0x100487c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1001218
jmp 0x1004707
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1001264
jmp 0x1004707
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1001278
jmp 0x1004707
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x100128c
jmp 0x1004707
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10012a0
jmp 0x1004707
push 0x1001108
mov eax, ebx
call fcn.01004990
push 0x10012b4
jmp 0x10048ae
push 0x1001108
mov eax, ebx
call fcn.01004990
push 0x10012c4
jmp 0x10048ae
push 0x1001108
mov eax, ebx
call fcn.01004990
push 0x10012d4
jmp 0x10048ae
push 0x1001108
mov eax, ebx
call fcn.01004990
push 0x10012e4
jmp 0x10048ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10012f4
jmp 0x1004707
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1001308
jmp 0x1004707
push 0x1001108
mov eax, ebx
call fcn.01004990
push 0x100131c
jmp 0x10048ae
push 0x1001108
mov eax, ebx
call fcn.01004990
push 0x100132c
jmp 0x10048ae
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp + 0x28], eax
xor edi, edi
push edi
push edi
push edi
push 2
push edi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
cmp esi, edi
jne 0x1004848
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1001354
jmp 0x1004707
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x34]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x3c]
push dword [esp + 0x34]
add eax, ecx
add eax, dword [esp + 0x34]
push eax
push esi
push dword [esp + 0x38]
call dword [esp + 0x20]
add esp, 0x14
jmp 0x10048d8
push 0x10011fc
lea esi, [esp + 0xac]
call fcn.01004956
mov eax, dword [esp + 0xc]
push 0xa
lea ecx, [esp + 0xac]
call fcn.010048f0
push 0x1001108
mov eax, ebx
call fcn.01004990
lea eax, [esp + 0xa8]
push eax
mov esi, ebx
call fcn.01004956
push 0x1001368
push 0x1001374
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10
push 0x1001390
push ebx
push 0
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret