Function at 0x140005658
Capabilities:
Check for time delay via gettickcount
Encode data using xor
Generate random numbers using the delphi lcg
Get file size
Read file via mapping

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4d8
xor edi, edi
mov qword [rsp + 0x40], rdi
mov r12, rdi
mov rbp, rdi
mov r14, rdi
mov rsi, rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x528], rdi
call fcn.140004618
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0x11
cmp eax, 0x111
je 0x14000570a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [rsp + 0x520]
mov r15d, dword [rsp + 0x520]
mov r13d, dword [rsp + 0x520]
mov dword [rsp + 0x520], edi
mov dword [0x140007054], eax
xor edi, edi
call main
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x140007054]
mov ecx, r11d
mul r11d
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
test r11d, 0xffff8000
je 0x14000584a
cmp ecx, edi
je 0x140005df3
cmp ecx, 1
jne 0x140005728
jmp 0x1400056cd
mov eax, dword [rsp + 0x520]
mov r15d, dword [rsp + 0x520]
mov r13d, dword [rsp + 0x520]
mov dword [rsp + 0x520], eax
mov ebx, r15d
mov r9d, 4
mov r8d, 0x1000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
call main
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x140007054]
mov ecx, r11d
mul r11d
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
test r11d, 0xffff8000
je 0x140005784
xor edi, edi
cmp ecx, edi
je 0x140005df1
cmp ecx, 1
je 0x1400056cd
jmp 0x14000572b
mov rax, qword [rsp + 0x48]
lea rcx, [rsp + 0x50]
mov edx, 4
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x68], r15d
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], rax
call fcn.140003360
cmp eax, 1
jne 0x140005e6f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call main
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x140007054]
mov ecx, r11d
mul r11d
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
test r11d, 0xffff8000
jne 0x14000576f
mov rcx, rdi
call fcn.140004fd8
mov edx, r15d
mov r8d, 0x8000
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test rbx, rbx
je 0x140005e86
mov rcx, rbx
call fcn.140004e68
lea rdx, [0x140001580]
mov rcx, rbx
call fcn.140004f08
mov rdi, rax
test rax, rax
jne 0x140005de4
lea rdx, [0x140001588]
jmp 0x140005e76
lea rdx, [0x140001360]
lea rcx, [0x140007060]
call fcn.1400060b0
mov dword [rsp + 0x4c4], edi
mov word [rsp + 0xb0], di
call main
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x140007054]
mov ecx, r11d
mul r11d
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
test r11d, 0xffff8000
jne 0x1400056fb
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 0x60]
movabs rax, 0x74636a6e696d7678
add rbx, 0xfe0
cmp qword [rbx], rax
je 0x1400058f6
call fcn.140004a08
cmp eax, edi
je 0x140005e86
mov rcx, rbx
cmp eax, 1
jne 0x1400058e2
call fcn.1400052a8
cmp al, dil
je 0x140005e86
jmp 0x1400058f6
call fcn.1400048b8
cmp eax, edi
je 0x140005e86
cmp eax, 2
cmove rbx, rdi
cmp rbx, rdi
je 0x140005961
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
xor r8d, r8d
lea r12d, [r9 + 6]
mov qword [rsp + 0x20], rdi
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x40], rax
cmp rax, rdi
je 0x140005cdc
mov ecx, dword [rax + 0x1c]
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
cmp rax, rdi
je 0x140005cd3
mov edx, dword [rax + 0x4c]
mov r8d, dword [rax + 0x48]
lea rcx, [rsp + 0xb0]
add rdx, rax
call fcn.140006030
jmp 0x14000599e
lea rdx, [rsp + 0xb0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r11, [rsp + 0xb0]
mov eax, edi
cmp word [rsp + 0xb0], di
je 0x140005997
add r11, 2
inc eax
cmp word [r11], di
jne 0x14000598b
mov dword [rsp + 0x4c4], eax
call main
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x140007054]
mul r11d
mov eax, r11d
shr edx, 1
lea ecx, [rdx + rdx*2]
sub eax, ecx
test r11d, 0xffff8000
je 0x1400059d8
cmp eax, edi
je 0x140005df3
cmp eax, 1
jmp 0x140005706
or ebx, 0xffffffff
lea rdx, [rsp + 0xb0]
lea rcx, [0x140007060]
mov r8d, ebx
call fcn.140006030
lea rdx, [0x14000124c]
lea rcx, [0x140007060]
mov r8d, ebx
call fcn.140006030
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0xb0]
lea r8d, [r9 + 7]
mov edx, 0x80000000
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140005dd5
lea rcx, [0x140001438]
call fcn.1400047c8
cmp eax, edi
jne 0x1400056cd
xor r9d, r9d
xor edx, edx
mov rcx, rbp
lea r8d, [r9 + 2]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
cmp rax, rdi
je 0x140005dc6
xor r9d, r9d
mov esi, 0x1000
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x140005db7
mov rcx, rax
call fcn.140004858
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea rdx, [rsp + 0x538]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor edi, edi
cmp eax, edi
je 0x140005dab
lea rcx, [rsi + rbx]
cmp qword [rsp + 0x538], rcx
jle 0x140005d5d
lea ecx, [rbx + 0x1000]
lea edx, [rdi + 4]
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rcx, r14
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
cmp rax, rdi
je 0x140005d54
call main
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x140007054]
mul r11d
shr edx, 1
lea ecx, [rdx + rdx*2]
mov edx, r11d
sub edx, ecx
test r11d, 0xffff8000
je 0x140005b47
cmp edx, edi
je 0x140005df1
cmp edx, 1
jmp 0x140005706
mov rcx, rsi
call fcn.140004858
mov r11d, eax
add r11, rsi
cmp dword [r11], 0x6d7678
jne 0x140005d48
cmp dword [r11 + 4], 3
jne 0x140005d3c
mov edx, dword [r11 + 8]
mov ebx, edx
imul ebx, ebx, 0x8088405
inc ebx
mov eax, ebx
xor eax, edx
cmp eax, dword [r11 + 0xc]
jne 0x140005d30
mov ecx, ebx
imul ecx, ecx, 0x8088405
inc ecx
mov eax, ecx
xor eax, ebx
cmp eax, dword [r11 + 0x10]
jne 0x140005d24
mov eax, dword [r11 + 0x18]
mov r15d, dword [r11 + 0x1c]
imul ecx, ecx, 0x2b9ad7e7
add r11, 0x20
mov r13d, 0x8088406
sub r13d, ecx
mov rcx, rsi
xor eax, r13d
imul r13d, r13d, 0x8088405
inc r13d
xor r15d, r13d
imul r13d, r13d, 0x8088405
inc r13d
xor r13d, dword [r11]
sub r11d, esi
lea edi, [r11 + rax + 4]
lea eax, [rdi + r13]
mov dword [rsp + 0x520], eax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
mov rcx, rbp
lea r8d, [r9 + 8]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
test rax, rax
je 0x140005d1b
mov eax, dword [rsp + 0x520]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
je 0x140005ce5
add rdi, rax
mov qword [rsp + 0x48], rdi
mov rcx, rdi
xor edi, edi
cmp r13d, edi
jbe 0x140005c83
mov edx, r13d
imul ebx, ebx, 0x343fd
add ebx, 0x269ec3
mov eax, ebx
shr eax, 0x10
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140005c67
mov r9d, 0x58
lea r8, [0x140001554]
lea rcx, [rsp + 0x50]
lea edx, [r9 - 0x49]
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rdi
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x50], rdi
call fcn.140004560
cmp eax, edi
je 0x140005728
lea rdx, [0x140001560]
jmp 0x140005e76
lea rdx, [0x140001408]
jmp 0x140005cec
lea rdx, [0x1400013f0]
jmp 0x140005cec
lea rdx, [0x140001540]
or r8d, 0xffffffff
lea rcx, [0x140007060]
call fcn.140006030
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140007060]
mov r8d, 0xa
call fcn.140005f80
jmp 0x140005e86
lea rdx, [0x140001528]
jmp 0x140005cec
lea rdx, [0x140001518]
jmp 0x140005e76
lea rdx, [0x140001508]
jmp 0x140005e76
lea rdx, [0x1400014f8]
jmp 0x140005e76
lea rdx, [0x1400014e8]
jmp 0x140005e76
lea rdx, [0x1400014d0]
jmp 0x140005cec
lea rdx, [0x1400014b8]
lea rcx, [0x140007060]
or r8d, 0xffffffff
call fcn.140006030
mov edx, dword [rsp + 0x538]
lea rcx, [0x140007060]
mov r8d, 0xa
call fcn.140005f80
lea rdx, [0x14000124c]
lea rcx, [0x140007060]
or r8d, 0xffffffff
call fcn.140006030
mov edx, ebx
jmp 0x140005d04
lea rdx, [0x1400014a0]
jmp 0x140005cec
mov r8d, ebx
lea rdx, [0x140001488]
jmp 0x140005cf0
mov r8d, ebx
lea rdx, [0x140001470]
jmp 0x140005cf0
mov r8d, ebx
lea rdx, [0x140001420]
jmp 0x140005cf0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
jmp 0x140005dfe
jmp 0x140005dfb
mov rdi, qword [rsp + 0x528]
mov rsi, rdi
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
lea r8d, [r9 + 2]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
test rax, rax
jne 0x140005e2f
lea rdx, [0x140001598]
jmp 0x140005cec
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, dword [rsp + 0x520]
mov rax, qword [rsp + 0x40]
mov r8, qword [rsp + 0x538]
add r9d, 0xffff
mov rdx, rbx
mov rcx, rsi
and r9d, 0xffff0000
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call rdi
jmp 0x140005ebb
lea rdx, [0x140001570]
lea rcx, [0x140007060]
or r8d, 0xffffffff
call fcn.140006030
lea rcx, [0x1400015c0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, [0x1400015b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [0x1400015d8]
lea rdx, [0x140007060]
mov r9d, 0x10
xor ecx, ecx
call rax
add rsp, 0x4d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret