Function at 0x41bc30
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x49c
push ebx
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x2c], edi
cmp dword [edi + 0x14], ebx
je 0x41bc54
pop edi
mov eax, 0x40000
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [edi + 0x2c], bl
je 0x41bc66
pop edi
mov eax, 0x50000
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x1c], ebx
cmp dword [edi], ebx
je 0x41bc7d
cmp esi, 4
je 0x41bc7d
mov dword [ebp - 0x1c], 0xc
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x49c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [ebp - 0x49c], bl
je 0x41c440
lea eax, [ebp - 0x49c]
cmp byte [eax], 0x5c
jne 0x41bca8
mov byte [eax], 0x2f
inc eax
cmp byte [eax], bl
jne 0x41bca0
cmp esi, 4
sete al
mov byte [ebp + 0x17], al
cmp al, bl
je 0x41bcda
lea edx, [ebp - 0x49c]
push edx
call sub.msvcrt.dll_strlen
lea ecx, [ebp - 0x49c]
add esp, 4
cmp byte [eax + ecx - 1], 0x2f
mov byte [ebp + 0xb], 1
jne 0x41bcdd
mov byte [ebp + 0xb], bl
mov dword [ebp - 4], 8
cmp byte [ebp + 0x17], bl
jne 0x41bcfc
lea edx, [ebp - 0x49c]
push edx
call fcn.00419b60
add esp, 4
test al, al
je 0x41bcff
mov dword [ebp - 4], ebx
cmp esi, 2
jne 0x41bd11
mov eax, dword [ebp + 0xc]
push eax
mov ecx, edi
call fcn.0041aeb0
jmp 0x41bd4d
cmp esi, 1
jne 0x41bd27
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
mov ecx, edi
call fcn.0041a1d0
jmp 0x41bd4d
cmp esi, 3
jne 0x41bd3d
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
mov ecx, edi
call fcn.0041a310
jmp 0x41bd4d
cmp esi, 4
jne 0x41c440
mov ecx, edi
call fcn.0041a400
cmp eax, ebx
jne 0x41c445
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4201f1
lea edx, [ebp - 0x360]
push edx
mov dword [ebp - 0x3c], ebx
call esi
lea eax, [ebp - 0x49c]
push eax
lea ecx, [ebp - 0x250]
push ecx
call esi
lea edx, [ebp - 0x250]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x380], eax
cmp byte [ebp + 0xb], bl
je 0x41bdac
push 0x423c24
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
inc dword [ebp - 0x380]
push 0x4201f1
lea ecx, [ebp - 0x14c]
push ecx
call esi
xor edx, edx
mov word [ebp - 0x36e], dx
mov edx, dword [edi + 0x68]
mov eax, 8
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x374], ebx
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x398], 0x140b17
mov dword [ebp - 0x390], edx
mov dword [ebp - 0x38c], ebx
mov word [ebp - 0x394], ax
cmp dword [edi], ebx
je 0x41be13
cmp byte [ebp + 0x17], bl
jne 0x41be13
mov eax, 9
mov word [ebp - 0x394], ax
mov word [ebp - 0x36c], ax
mov eax, dword [ebp - 4]
mov word [ebp - 0x392], ax
cmp eax, ebx
jne 0x41be3a
mov eax, dword [edi + 0x70]
cmp eax, ebx
jl 0x41be3a
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x388], eax
jmp 0x41be40
mov dword [ebp - 0x388], ebx
mov edx, dword [edi + 0x70]
mov ecx, dword [edi + 0x4c]
mov dword [ebp - 0x384], edx
mov edx, dword [edi + 0x18]
add edx, dword [edi + 0x10]
xor eax, eax
mov dword [ebp - 0x364], edx
mov dl, byte [edi + 0x58]
mov word [ebp - 0x370], ax
mov dword [ebp - 0x368], ecx
mov byte [ebp - 0x13], dl
lea eax, [ebp - 0x18]
mov dword [ebp - 0x25c], eax
mov eax, dword [edi + 0x5c]
mov esi, eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x258], ecx
mov ecx, dword [edi + 0x58]
mov edx, ecx
shrd edx, esi, 8
sar esi, 8
mov byte [ebp - 0x12], dl
mov esi, eax
mov edx, ecx
shrd edx, esi, 0x10
shrd ecx, eax, 0x18
sar eax, 0x18
movzx eax, byte [edi + 0x50]
sar esi, 0x10
mov byte [ebp - 0x11], dl
mov byte [ebp - 0xf], al
mov eax, dword [edi + 0x54]
mov byte [ebp - 0x10], cl
mov ecx, dword [edi + 0x50]
mov esi, eax
mov edx, ecx
shrd edx, esi, 8
sar esi, 8
mov byte [ebp - 0xe], dl
mov edx, ecx
shrd ecx, eax, 0x18
mov esi, eax
shrd edx, esi, 0x10
sar eax, 0x18
movzx eax, byte [edi + 0x60]
sar esi, 0x10
mov byte [ebp - 0xc], cl
mov ecx, dword [edi + 0x60]
mov byte [ebp - 0xb], al
mov eax, dword [edi + 0x64]
mov byte [ebp - 0xd], dl
mov edx, ecx
mov esi, eax
shrd edx, esi, 8
mov byte [ebp - 0xa], dl
mov edx, ecx
shrd ecx, eax, 0x18
sar esi, 8
mov esi, eax
shrd edx, esi, 0x10
sar eax, 0x18
push 9
lea eax, [ebp - 0x18]
mov byte [ebp - 8], cl
push eax
lea ecx, [ebp - 0x38]
push ecx
mov dword [ebp - 0x37c], 0x11
mov dword [ebp - 0x378], 9
mov dword [ebp - 0x18], 0xd5455
mov byte [ebp - 0x14], 7
sar esi, 0x10
mov byte [ebp - 9], dl
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x258]
push edi
lea eax, [ebp - 0x398]
push 0x41ae90
push eax
mov byte [edx + 2], 5
call fcn.004191b0
add esp, 0x18
test eax, eax
je 0x41bf77
mov ecx, edi
call fcn.0041a5b0
pop esi
pop edi
mov eax, 0x400
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 0x37c]
mov edx, dword [ebp - 0x380]
lea eax, [ecx + edx + 0x1e]
add dword [edi + 0x18], eax
cmp dword [edi + 0x14], ebx
je 0x41bfa2
mov ecx, edi
call fcn.0041a5b0
mov eax, dword [edi + 0x14]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea esi, [edi + 0x30]
mov dword [edi + 0x34], 0x23456789
mov dword [edi + 0x38], 0x34567890
mov edi, dword [edi]
mov dword [esi], 0x12345678
cmp edi, ebx
je 0x41bfd4
nop
movzx eax, byte [edi]
cmp al, bl
je 0x41bfd4
push eax
push esi
call fcn.00419b10
add esp, 8
inc edi
jne 0x41bfc0
cmp byte [0xb39c60], bl
jne 0x41bff5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, eax
push edi
call sub.msvcrt.dll_srand
add esp, 4
xor edi, edi
call sub.msvcrt.dll_rand
sar eax, 7
mov byte [ebp + edi - 0x28], al
inc edi
cmp edi, 0xc
jl 0x41bff7
mov ecx, dword [ebp - 0x390]
mov edi, dword [esi + 4]
mov eax, dword [esi + 8]
shr ecx, 8
xor edx, edx
mov byte [ebp - 0x1d], cl
mov ecx, dword [esi]
mov dword [ebp + 0xc], edx
mov dword [ebp + 8], edi
mov dl, byte [ebp + edx - 0x28]
movsx edx, dl
xor edx, ecx
and edx, 0xff
mov edi, ecx
mov ecx, dword [edx*4 + 0x424138]
shr edi, 8
xor ecx, edi
movzx edi, cl
add edi, dword [ebp + 8]
mov ebx, eax
imul edi, edi, 0x8088405
and ebx, 0xfffd
or ebx, 2
inc edi
mov edx, edi
shr edx, 0x18
xor edx, eax
shr eax, 8
mov dword [esi], ecx
mov dword [esi + 4], edi
and edx, 0xff
xor eax, dword [edx*4 + 0x424138]
mov edx, ebx
xor edx, 1
imul edx, ebx
mov ebx, dword [ebp + 0xc]
shr edx, 8
xor dl, byte [ebp + ebx - 0x28]
mov dword [esi + 8], eax
mov byte [ebp + ebx - 0x28], dl
mov edx, ebx
movzx ebx, byte [ebp + edx - 0x27]
mov byte [ebp + 0xc], bl
mov ebx, eax
and ebx, 0xfffd
or ebx, 2
mov dword [ebp + 0x10], ebx
movsx ebx, byte [ebp + 0xc]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x424138]
shr ecx, 8
xor ebx, ecx
movzx ecx, bl
add ecx, edi
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi], ebx
mov edi, ecx
shr edi, 0x18
xor edi, eax
shr eax, 8
mov dword [ebp + 8], ebx
and edi, 0xff
mov dword [esi + 4], ecx
xor eax, dword [edi*4 + 0x424138]
mov edi, eax
mov eax, dword [ebp + 0x10]
mov ebx, eax
xor ebx, 1
imul ebx, eax
shr ebx, 8
xor bl, byte [ebp + 0xc]
mov eax, edi
mov byte [ebp + edx - 0x27], bl
mov bl, byte [ebp + edx - 0x26]
and eax, 0xfffd
or eax, 2
mov byte [ebp + 0xc], bl
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 8]
movsx ebx, bl
xor ebx, eax
shr eax, 8
and ebx, 0xff
mov dword [ebp + 8], eax
mov dword [esi + 8], edi
mov eax, dword [ebx*4 + 0x424138]
xor eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov dword [esi], eax
movzx eax, al
add eax, ecx
imul eax, eax, 0x8088405
inc eax
mov ecx, eax
shr ecx, 0x18
xor ecx, edi
mov dword [esi + 4], eax
and ecx, 0xff
shr edi, 8
xor edi, dword [ecx*4 + 0x424138]
mov ecx, dword [ebp + 0x10]
mov ebx, ecx
xor ebx, 1
imul ebx, ecx
shr ebx, 8
xor bl, byte [ebp + 0xc]
mov ecx, edi
mov byte [ebp + edx - 0x26], bl
mov bl, byte [ebp + edx - 0x25]
mov byte [ebp + 0xc], bl
and ecx, 0xfffd
movsx ebx, bl
or ecx, 2
mov dword [ebp + 0x10], ecx
mov ecx, dword [ebp + 8]
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
mov dword [esi + 8], edi
mov dword [ebp + 8], ecx
mov ecx, dword [ebx*4 + 0x424138]
xor ecx, dword [ebp + 8]
add edx, 4
movzx ebx, cl
add eax, ebx
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 4], eax
mov dword [ebp + 8], eax
shr eax, 0x18
xor eax, edi
and eax, 0xff
shr edi, 8
mov dword [esi], ecx
xor edi, dword [eax*4 + 0x424138]
mov eax, edi
mov edi, dword [ebp + 0x10]
mov ebx, edi
xor ebx, 1
imul ebx, edi
shr ebx, 8
xor bl, byte [ebp + 0xc]
mov dword [esi + 8], eax
mov byte [ebp + edx - 0x29], bl
mov dword [ebp + 0xc], edx
cmp edx, 0xc
jl 0x41c025
mov esi, dword [ebp - 0x2c]
mov bl, byte [ebp + 0x17]
xor edi, edi
cmp dword [esi], edi
je 0x41c22d
test bl, bl
jne 0x41c21e
push 0xc
lea edx, [ebp - 0x28]
push edx
mov ecx, esi
call fcn.0041a000
add dword [esi + 0x18], 0xc
cmp dword [esi], edi
je 0x41c22d
test bl, bl
jne 0x41c22d
mov eax, 1
jmp 0x41c22f
xor eax, eax
test bl, bl
mov ebx, dword [ebp - 4]
mov byte [esi + 0x2d], al
jne 0x41c25f
cmp ebx, 8
jne 0x41c250
lea eax, [ebp - 0x398]
push eax
mov ecx, esi
call fcn.0041bb10
mov edi, eax
jmp 0x41c265
test ebx, ebx
jne 0x41c265
mov ecx, esi
call fcn.0041a610
mov edi, eax
jmp 0x41c265
mov dword [esi + 0x90], edi
cmp byte [esi + 0x80], 0
mov byte [esi + 0x2d], 0
je 0x41c280
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x41c280
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esi + 0x90]
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x74]
add dword [esi + 0x18], edx
mov dword [esi + 0x7c], 0
mov dword [esi + 0x70], ecx
test eax, eax
jne 0x41c445
test edi, edi
jne 0x41bf69
mov eax, dword [ebp - 0x1c]
mov edi, dword [esi + 0x78]
add eax, edx
cmp dword [ebp - 0x388], eax
mov dword [ebp - 0x38c], edi
sete dl
cmp byte [esi + 0x1c], 0
mov dword [ebp - 0x388], eax
mov dword [ebp - 0x384], ecx
je 0x41c35a
cmp dword [esi], 0
je 0x41c2e1
cmp byte [ebp + 0x17], 0
je 0x41c35a
test byte [ebp - 0x394], 1
mov word [ebp - 0x392], bx
jne 0x41c2fd
mov ecx, 0xfff7
and word [ebp - 0x394], cx
mov eax, dword [ebp - 0x364]
sub eax, dword [esi + 0x10]
mov dx, word [ebp - 0x394]
push eax
mov ecx, esi
mov word [ebp - 0x36c], dx
call fcn.0041a160
test al, al
je 0x41c34c
push esi
lea ecx, [ebp - 0x398]
push 0x41ae90
push ecx
call fcn.004191b0
add esp, 0xc
test eax, eax
jne 0x41bf69
mov edx, dword [esi + 0x18]
push edx
mov ecx, esi
call fcn.0041a160
test al, al
jne 0x41c3a8
pop esi
pop edi
mov eax, 0x2000000
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp word [ebp - 0x392], bx
jne 0x41c36b
test ebx, ebx
jne 0x41c379
test dl, dl
jne 0x41c379
pop esi
pop edi
mov eax, 0x4000000
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push esi
lea eax, [ebp - 0x398]
push 0x41ae90
push eax
call fcn.004193f0
add esp, 0xc
test eax, eax
jne 0x41bf69
mov cx, word [ebp - 0x36c]
add dword [esi + 0x18], 0x10
mov word [ebp - 0x394], cx
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x41c445
mov edx, dword [ebp - 0x378]
push edx
call fcn.00410bd0
mov ecx, dword [ebp - 0x258]
mov edi, eax
mov eax, dword [ebp - 0x378]
push eax
push ecx
push edi
call sub.msvcrt.dll_memcpy
push 0x360
mov dword [ebp - 0x258], edi
call fcn.00410bd0
push 0x360
lea edx, [ebp - 0x398]
mov edi, eax
push edx
push edi
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 0x44]
add esp, 0x20
test eax, eax
jne 0x41c40f
mov dword [esi + 0x44], edi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [eax + 0x35c], 0
je 0x41c42f
jmp 0x41c420
mov eax, dword [eax + 0x35c]
cmp dword [eax + 0x35c], 0
jne 0x41c420
pop esi
mov dword [eax + 0x35c], edi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x10000
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10