Function at 0x14001c370
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xa0
mov r12, rdx
mov r14d, 1
mov edx, r14d
mov r15d, r9d
mov rdi, r8
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14001c702
mov ecx, dword [rbx]
test cl, 8
je 0x14001c3c7
lea eax, [r14 + 0xc]
jmp 0x14001c718
mov r13d, dword [rbp + 0x7f]
xor esi, esi
and ecx, 0xffffff0f
mov qword [rbx + 0x64], rsi
mov eax, r13d
mov dword [rbx + 0x80], esi
and eax, 0xffffffcf
mov dword [rbx + 0x1c], esi
mov dword [rbx], ecx
sub eax, r14d
je 0x14001c4ec
sub eax, r14d
je 0x14001c444
cmp eax, 6
je 0x14001c42d
test rdi, rdi
je 0x14001c702
test r15d, r15d
je 0x14001c702
or ecx, 0xa0
mov dword [rbx + 0x78], r15d
mov dword [rbx + 0x60], r15d
mov r15d, dword [rbp - 0x31]
mov dword [rbx], ecx
mov qword [rbx + 0x70], rdi
mov dword [rbx + 0x7c], esi
jmp 0x14001c551
mov dword [rbp - 0x31], 0x41c00010
mov r15d, dword [rbp - 0x31]
mov qword [rbx + 0x70], rsi
mov dword [rbx + 0x60], esi
jmp 0x14001c56e
test rdi, rdi
je 0x14001c702
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], esi
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
test r13b, 0x10
je 0x14001c47b
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x14001c484
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbx + 0x70], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x14001c52d
mov r9d, r14d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbx + 0x1c], eax
cmp eax, 0xffffffff
je 0x14001c4d3
or dword [rbx], 0x20
lea rdx, [rbp + 7]
mov rcx, rbx
call fcn.1400192d0
test eax, eax
je 0x14001c4dd
mov rcx, qword [rbx + 0x70]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r14d
jmp 0x14001c718
mov dword [rbx + 0x1c], esi
mov dword [rbx + 0x60], 0xffffffff
or dword [rbx], 0x40
test r12, r12
cmovne rdi, r12
mov r12, rdi
jmp 0x14001c545
lea rax, [rdi - 1]
mov qword [rbx + 0x70], rdi
cmp rax, 0xfffffffffffffffd
ja 0x14001c702
mov r9d, r14d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbx + 0x1c], eax
cmp eax, 0xffffffff
je 0x14001c535
or dword [rbx], 0x20
lea rdx, [rbp + 7]
mov rcx, rbx
call fcn.1400192d0
test eax, eax
je 0x14001c545
mov r14d, eax
mov eax, r14d
jmp 0x14001c718
or eax, 0xffffffff
mov dword [rbx + 0x1c], esi
test r15d, r15d
cmovne eax, r15d
mov dword [rbx + 0x60], eax
mov r15d, esi
test byte [rbx], 0x20
jne 0x14001c62e
mov edx, r13d
mov rcx, r12
mov edi, 0x81800000
call fcn.14001c2e0
test eax, eax
mov ecx, 0x81c00000
cmove edi, ecx
mov dword [rbp - 0x31], edi
test r13b, 0x20
jne 0x14001c634
lea rcx, [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov rax, qword [rbp - 1]
lea rdx, [rbp + 0x1f]
lea rcx, [rbp - 0x29]
mov qword [rbp - 0x29], rax
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movabs rcx, 0xfe624e212ac18000
movabs rax, 0xd6bf94d5e57a42bd
add rcx, qword [rbp - 1]
imul rcx
lea r14, [rcx + rdx]
movzx ecx, word [rbp + 0x1f]
sub cx, 0x3c
sar r14, 0x17
shl cx, 4
mov rax, r14
shr rax, 0x3f
add r14, rax
movzx eax, word [rbp + 0x21]
and ax, 0xf
mov dword [rbp + 0xb], r14d
or cx, ax
movzx eax, word [rbp + 0x25]
and eax, 0x1f
shl cx, 5
movzx edx, cx
movzx ecx, word [rbp + 0x29]
or edx, eax
movzx eax, word [rbp + 0x27]
and cx, 0x3f
shl ax, 6
or cx, ax
shl edx, 0x10
shl cx, 5
movzx eax, cx
or edx, eax
movzx eax, word [rbp + 0x2b]
add ax, ax
and eax, 0x1f
or edx, eax
mov dword [rbp - 0x29], edx
jmp 0x14001c63e
mov eax, dword [rbp + 0x17]
mov dword [rbp - 0x31], eax
mov eax, dword [rbp + 0x13]
mov r14d, dword [rbp + 0xb]
mov dword [rbp - 0x29], eax
mov edx, 0x159
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
jne 0x14001c65b
lea esi, [rax + 2]
jmp 0x14001c707
xor edx, edx
mov r8d, 0x150
mov rcx, rdi
call fcn.1400c7510
mov eax, r13d
and eax, 0x20
mov dword [rbp - 1], eax
je 0x14001c69c
mov eax, 8
mov r12b, 8
mov word [rdi + 2], ax
mov eax, dword [rbx + 0x60]
mov dword [rdi + 0xc], eax
mov dword [rdi + 0x10], eax
mov eax, dword [rbx + 0x18]
mov dword [rdi + 0x2c], eax
or dword [rbx], 0x80000000
jmp 0x14001c9dd
lea r15, [rdi + 0x40]
test r13b, 0x10
je 0x14001c6dc
mov qword [rsp + 0x38], rsi
or r9d, 0xffffffff
mov qword [rsp + 0x30], rsi
mov r8, r12
mov dword [rsp + 0x28], 0x104
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rdi + 0x14], eax
test eax, eax
je 0x14001c6f4
dec eax
jmp 0x14001c6f1
mov rdx, r12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [rdi + 0x14], eax
cmp dword [rdi + 0x14], esi
jne 0x14001c739
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov esi, 9
test byte [rbx], 0x40
je 0x14001c716
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rax, r15
cmp byte [r15], sil
je 0x14001c751
cmp byte [rax], 0x5c
jne 0x14001c749
mov byte [rax], 0x2f
inc rax
cmp byte [rax], sil
jne 0x14001c741
mov dword [rbp - 0x19], 0xd5455
lea rcx, [rdi + 0x150]
mov qword [rdi + 0x38], rcx
mov eax, 8
mov word [rdi], ax
mov edx, 9
mov eax, dword [rbp - 0x29]
xor r12b, r12b
mov dword [rdi + 4], eax
mov r15d, esi
mov eax, dword [rbp - 0x31]
mov dword [rdi + 0x28], eax
lea rax, [rbp - 0x19]
mov qword [rdi + 0x30], rax
movzx eax, byte [rbp + 0xb]
mov byte [rbp - 0x14], al
mov eax, r14d
shr eax, 8
mov byte [rbp - 0x13], al
mov eax, r14d
shr eax, 0x10
mov byte [rbp - 0x12], al
mov byte [rbp - 0x15], 7
movsd xmm0, qword [rbp - 0x19]
mov dword [rdi + 0x18], reloc.OLEAUT32.dll_SafeArrayGetElemsize
mov dword [rdi + 0x1c], edx
shr r14d, 0x18
mov byte [rbp - 0x11], r14b
movsd qword [rcx], xmm0
movzx eax, byte [rbp - 0x11]
mov byte [rcx + 8], al
mov rax, qword [rdi + 0x38]
mov byte [rax + 2], 5
mov rax, qword [rdi + 0x38]
mov byte [rax + 4], 1
cmp dword [rbx], esi
jge 0x14001c7e2
mov dword [rdi + 0x18], esi
jmp 0x14001c822
test r13b, 8
je 0x14001c7ff
mov edx, dword [rdi + 0x14]
lea eax, [rdx - 1]
cmp byte [rax + rdi + 0x40], 0x2f
je 0x14001c825
mov byte [rdx + rdi + 0x40], 0x2f
inc dword [rdi + 0x14]
jmp 0x14001c825
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14001c80b
mov word [rdi], dx
neg rax
lea rcx, [rdi + 0x40]
sbb r15d, r15d
and r15d, 0xc
call fcn.14001c250
test eax, eax
jne 0x14001c825
mov r12b, 8
movzx eax, word [rdi]
mov word [rdi + 0x24], ax
movzx eax, r12b
mov word [rdi + 2], ax
test r12b, r12b
jne 0x14001c847
mov eax, dword [rbx + 0x60]
cmp eax, 0xffffffff
je 0x14001c847
add eax, r15d
mov dword [rdi + 0xc], eax
mov eax, dword [rbx + 0x60]
mov rdx, rbx
mov dword [rdi + 0x10], eax
mov rcx, rdi
mov eax, dword [rbx + 0x1c]
add eax, dword [rbx + 0x18]
mov dword [rdi + 0x2c], eax
mov dword [rbx + 0x20], esi
call fcn.14001b720
mov eax, dword [rbx + 0x20]
test eax, eax
jne 0x14001ca75
mov eax, dword [rdi + 0x14]
cmp dword [rbx], esi
jge 0x14001c881
add eax, 0xb
mov dword [rbx + 0x18], eax
jmp 0x14001c9dd
mov ecx, dword [rdi + 0x18]
add ecx, 0x1e
add ecx, eax
add dword [rbx + 0x18], ecx
test r15d, r15d
je 0x14001c9dd
mov dword [rbx + 0x38], 0x12345678
lea r13, [0x1400faf40]
mov dword [rbx + 0x3c], 0x23456789
mov dword [rbx + 0x40], 0x34567890
mov r8, qword [rbx + 0x10]
test r8, r8
je 0x14001c913
nop word [rax + rax]
movzx eax, byte [r8]
test al, al
je 0x14001c913
movsx rcx, al
mov eax, dword [rbx + 0x38]
xor rcx, rax
movzx edx, cl
shr eax, 8
mov ecx, dword [r13 + rdx*4]
mov edx, dword [rbx + 0x40]
xor ecx, eax
movzx eax, cl
add eax, dword [rbx + 0x3c]
mov dword [rbx + 0x38], ecx
imul ecx, eax, 0x8088405
movzx eax, dl
shr edx, 8
inc ecx
mov dword [rbx + 0x3c], ecx
movzx ecx, byte [rbx + 0x3f]
xor rcx, rax
mov eax, dword [r13 + rcx*4]
xor eax, edx
mov dword [rbx + 0x40], eax
add r8, 1
jne 0x14001c8c0
mov r14, rsi
call fcn.1400cc628
sar eax, 7
mov byte [rbp + r14 - 0x29], al
inc r14
cmp r14, 0xc
jl 0x14001c916
movzx eax, byte [rdi + 5]
mov byte [rbp - 0x1e], al
nop dword [rax]
nop word [rax + rax]
movsx r10, byte [rbp + rsi - 0x29]
mov r8d, dword [rbx + 0x40]
mov eax, dword [rbx + 0x38]
mov r9d, r8d
mov ecx, dword [rbx + 0x38]
and r9d, 0xfffd
shr eax, 8
xor rcx, r10
movzx edx, cl
or r9d, 2
mov ecx, dword [r13 + rdx*4]
xor ecx, eax
movzx eax, cl
add eax, dword [rbx + 0x3c]
mov dword [rbx + 0x38], ecx
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 0x3c], ecx
movzx eax, byte [rbx + 0x3f]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
mov eax, dword [r13 + rcx*4]
xor eax, r8d
mov dword [rbx + 0x40], eax
mov eax, r9d
xor eax, 1
imul eax, r9d
shr eax, 8
xor al, r10b
mov byte [rbp + rsi - 0x29], al
inc rsi
cmp rsi, 0xc
jl 0x14001c940
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, [rbp - 0x29]
mov rcx, rbx
call fcn.14001bcf0
mov eax, dword [rbx + 0x20]
test eax, eax
jne 0x14001ca75
add dword [rbx + 0x18], 0xc
or dword [rbx], 0x10
cmp qword [rbx + 0x70], 0
je 0x14001ca27
mov rcx, rbx
cmp r12b, 8
jne 0x14001c9f7
mov rdx, rdi
call fcn.14001bff0
jmp 0x14001c9fc
call fcn.14001c1a0
mov eax, dword [rbx + 0x20]
test eax, eax
jne 0x14001ca75
and dword [rbx], 0xffffffef
test byte [rbx], 0x40
je 0x14001ca15
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbx + 0x64]
and dword [rbx], 0xffffffbf
mov dword [rbx + 0x60], eax
mov eax, dword [rbx + 0x80]
add dword [rbx + 0x18], eax
mov eax, dword [rbx]
test eax, eax
jns 0x14001ca85
or eax, 8
cmp dword [rbp - 1], 0
mov dword [rbx], eax
jne 0x14001cb97
mov edx, dword [rbx + 0x68]
mov rcx, rbx
call fcn.14001bb50
movzx edx, word [rbx + 0x6a]
mov rcx, rbx
call fcn.14001bb50
mov edx, dword [rbx + 0x64]
mov rcx, rbx
call fcn.14001bb50
movzx edx, word [rbx + 0x66]
mov rcx, rbx
call fcn.14001bb50
mov eax, dword [rbx + 0x20]
test eax, eax
je 0x14001cb97
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14001c707
mov edx, dword [rbx + 0x80]
mov eax, dword [rbx + 0x68]
add edx, r15d
mov r8d, dword [rdi + 0xc]
mov dword [rdi + 8], eax
mov ecx, dword [rbx + 0x80]
add ecx, r15d
mov dword [rdi + 0xc], ecx
mov eax, dword [rbx + 0x60]
mov dword [rdi + 0x10], eax
test byte [rbx], 4
je 0x14001cb1f
test r15d, r15d
jne 0x14001cb1f
movzx eax, r12b
mov word [rdi + 2], ax
movzx eax, word [rdi]
test al, 1
jne 0x14001cace
mov ecx, 0xfff7
and ax, cx
mov word [rdi], ax
movzx eax, word [rdi]
mov rcx, rbx
mov edx, dword [rdi + 0x2c]
mov word [rdi + 0x24], ax
sub edx, dword [rbx + 0x1c]
call fcn.14001beb0
test eax, eax
je 0x14001cb0c
mov rdx, rbx
mov rcx, rdi
call fcn.14001b720
mov eax, dword [rbx + 0x20]
test eax, eax
jne 0x14001ca75
mov edx, dword [rbx + 0x18]
mov rcx, rbx
call fcn.14001beb0
test eax, eax
jne 0x14001cb54
mov rcx, rdi
mov esi, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14001c707
movzx eax, r12b
cmp word [rdi + 2], ax
jne 0x14001cb9e
test r12b, r12b
jne 0x14001cb33
cmp r8d, edx
jne 0x14001cb9e
mov rdx, rbx
mov rcx, rdi
call fcn.14001b610
mov eax, dword [rbx + 0x20]
test eax, eax
jne 0x14001ca75
add dword [rbx + 0x18], 0x10
movzx eax, word [rdi + 0x24]
mov word [rdi], ax
mov rcx, qword [rbx + 0x58]
test rcx, rcx
jne 0x14001cb68
mov qword [rbx + 0x58], rdi
xor eax, eax
jmp 0x14001c718
lea rax, [rcx + 0x148]
cmp qword [rax], 0
je 0x14001cb90
nop word [rax + rax]
mov rcx, qword [rax]
lea rax, [rcx + 0x148]
cmp qword [rax], 0
jne 0x14001cb80
mov qword [rcx + 0x148], rdi
xor eax, eax
jmp 0x14001c718
mov rcx, rdi
mov esi, reloc.OLEAUT32.dll_SafeArrayGetElemsize
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14001c707