Function at 0x405658
Capabilities:
Check for time delay via gettickcount
Encode data using xor
Generate random numbers using the delphi lcg
Get file size
Read file via mapping

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4d8
xor edi, edi
mov qword [rsp + 0x40], rdi
mov r12, rdi
mov rbp, rdi
mov r14, rdi
mov rsi, rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x528], rdi
call fcn.00404618
call qword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0x11
cmp eax, 0x111
je 0x40570a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [rsp + 0x520]
mov r15d, dword [rsp + 0x520]
mov r13d, dword [rsp + 0x520]
mov dword [rsp + 0x520], edi
mov dword [0x00407054], eax
xor edi, edi
call main
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x00407054]
mov ecx, r11d
mul r11d
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
test r11d, 0xffff8000
je 0x40584a
cmp ecx, edi
je 0x405df3
cmp ecx, 1
jne 0x405728
jmp 0x4056cd
mov eax, dword [rsp + 0x520]
mov r15d, dword [rsp + 0x520]
mov r13d, dword [rsp + 0x520]
mov dword [rsp + 0x520], eax
mov ebx, r15d
mov r9d, 4
mov r8d, 0x1000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
call main
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x00407054]
mov ecx, r11d
mul r11d
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
test r11d, 0xffff8000
je 0x405784
xor edi, edi
cmp ecx, edi
je 0x405df1
cmp ecx, 1
je 0x4056cd
jmp 0x40572b
mov rax, qword [rsp + 0x48]
lea rcx, [rsp + 0x50]
mov edx, 4
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x68], r15d
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], rax
call fcn.00403360
cmp eax, 1
jne 0x405e6f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call main
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x00407054]
mov ecx, r11d
mul r11d
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
test r11d, 0xffff8000
jne 0x40576f
mov rcx, rdi
call fcn.00404fd8
mov edx, r15d
mov r8d, 0x8000
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test rbx, rbx
je 0x405e86
mov rcx, rbx
call fcn.00404e68
lea rdx, [0x00401580]
mov rcx, rbx
call fcn.00404f08
mov rdi, rax
test rax, rax
jne 0x405de4
lea rdx, [0x00401588]
jmp 0x405e76
lea rdx, [0x00401360]
lea rcx, [0x00407060]
call fcn.004060b0
mov dword [rsp + 0x4c4], edi
mov word [rsp + 0xb0], di
call main
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x00407054]
mov ecx, r11d
mul r11d
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
test r11d, 0xffff8000
jne 0x4056fb
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 0x60]
movabs rax, 0x74636a6e696d7678
add rbx, 0xfe0
cmp qword [rbx], rax
je 0x4058f6
call fcn.00404a08
cmp eax, edi
je 0x405e86
mov rcx, rbx
cmp eax, 1
jne 0x4058e2
call fcn.004052a8
cmp al, dil
je 0x405e86
jmp 0x4058f6
call fcn.004048b8
cmp eax, edi
je 0x405e86
cmp eax, 2
cmove rbx, rdi
cmp rbx, rdi
je 0x405961
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
xor r8d, r8d
lea r12d, [r9 + 6]
mov qword [rsp + 0x20], rdi
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x40], rax
cmp rax, rdi
je 0x405cdc
mov ecx, dword [rax + 0x1c]
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
cmp rax, rdi
je 0x405cd3
mov edx, dword [rax + 0x4c]
mov r8d, dword [rax + 0x48]
lea rcx, [rsp + 0xb0]
add rdx, rax
call fcn.00406030
jmp 0x40599e
lea rdx, [rsp + 0xb0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r11, [rsp + 0xb0]
mov eax, edi
cmp word [rsp + 0xb0], di
je 0x405997
add r11, 2
inc eax
cmp word [r11], di
jne 0x40598b
mov dword [rsp + 0x4c4], eax
call main
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x00407054]
mul r11d
mov eax, r11d
shr edx, 1
lea ecx, [rdx + rdx*2]
sub eax, ecx
test r11d, 0xffff8000
je 0x4059d8
cmp eax, edi
je 0x405df3
cmp eax, 1
jmp 0x405706
or ebx, 0xffffffff
lea rdx, [rsp + 0xb0]
lea rcx, [0x00407060]
mov r8d, ebx
call fcn.00406030
lea rdx, [0x0040124c]
lea rcx, [0x00407060]
mov r8d, ebx
call fcn.00406030
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0xb0]
lea r8d, [r9 + 7]
mov edx, 0x80000000
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x405dd5
lea rcx, [0x00401438]
call fcn.004047c8
cmp eax, edi
jne 0x4056cd
xor r9d, r9d
xor edx, edx
mov rcx, rbp
lea r8d, [r9 + 2]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
cmp rax, rdi
je 0x405dc6
xor r9d, r9d
mov esi, 0x1000
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x405db7
mov rcx, rax
call fcn.00404858
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea rdx, [rsp + 0x538]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor edi, edi
cmp eax, edi
je 0x405dab
lea rcx, [rsi + rbx]
cmp qword [rsp + 0x538], rcx
jle 0x405d5d
lea ecx, [rbx + 0x1000]
lea edx, [rdi + 4]
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rcx, r14
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
cmp rax, rdi
je 0x405d54
call main
mov r11d, eax
mov eax, 0xaaaaaaab
sub r11d, dword [0x00407054]
mul r11d
shr edx, 1
lea ecx, [rdx + rdx*2]
mov edx, r11d
sub edx, ecx
test r11d, 0xffff8000
je 0x405b47
cmp edx, edi
je 0x405df1
cmp edx, 1
jmp 0x405706
mov rcx, rsi
call fcn.00404858
mov r11d, eax
add r11, rsi
cmp dword [r11], 0x6d7678
jne 0x405d48
cmp dword [r11 + 4], 3
jne 0x405d3c
mov edx, dword [r11 + 8]
mov ebx, edx
imul ebx, ebx, 0x8088405
inc ebx
mov eax, ebx
xor eax, edx
cmp eax, dword [r11 + 0xc]
jne 0x405d30
mov ecx, ebx
imul ecx, ecx, 0x8088405
inc ecx
mov eax, ecx
xor eax, ebx
cmp eax, dword [r11 + 0x10]
jne 0x405d24
mov eax, dword [r11 + 0x18]
mov r15d, dword [r11 + 0x1c]
imul ecx, ecx, 0x2b9ad7e7
add r11, 0x20
mov r13d, 0x8088406
sub r13d, ecx
mov rcx, rsi
xor eax, r13d
imul r13d, r13d, 0x8088405
inc r13d
xor r15d, r13d
imul r13d, r13d, 0x8088405
inc r13d
xor r13d, dword [r11]
sub r11d, esi
lea edi, [r11 + rax + 4]
lea eax, [rdi + r13]
mov dword [rsp + 0x520], eax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
mov rcx, rbp
lea r8d, [r9 + 8]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
test rax, rax
je 0x405d1b
mov eax, dword [rsp + 0x520]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
je 0x405ce5
add rdi, rax
mov qword [rsp + 0x48], rdi
mov rcx, rdi
xor edi, edi
cmp r13d, edi
jbe 0x405c83
mov edx, r13d
imul ebx, ebx, 0x343fd
add ebx, 0x269ec3
mov eax, ebx
shr eax, 0x10
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x405c67
mov r9d, 0x58
lea r8, [0x00401554]
lea rcx, [rsp + 0x50]
lea edx, [r9 - 0x49]
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rdi
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x50], rdi
call fcn.00404560
cmp eax, edi
je 0x405728
lea rdx, [0x00401560]
jmp 0x405e76
lea rdx, [0x00401408]
jmp 0x405cec
lea rdx, [0x004013f0]
jmp 0x405cec
lea rdx, [0x00401540]
or r8d, 0xffffffff
lea rcx, [0x00407060]
call fcn.00406030
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x00407060]
mov r8d, 0xa
call fcn.00405f80
jmp 0x405e86
lea rdx, [0x00401528]
jmp 0x405cec
lea rdx, [0x00401518]
jmp 0x405e76
lea rdx, [0x00401508]
jmp 0x405e76
lea rdx, [0x004014f8]
jmp 0x405e76
lea rdx, [0x004014e8]
jmp 0x405e76
lea rdx, [0x004014d0]
jmp 0x405cec
lea rdx, [0x004014b8]
lea rcx, [0x00407060]
or r8d, 0xffffffff
call fcn.00406030
mov edx, dword [rsp + 0x538]
lea rcx, [0x00407060]
mov r8d, 0xa
call fcn.00405f80
lea rdx, [0x0040124c]
lea rcx, [0x00407060]
or r8d, 0xffffffff
call fcn.00406030
mov edx, ebx
jmp 0x405d04
lea rdx, [0x004014a0]
jmp 0x405cec
mov r8d, ebx
lea rdx, [0x00401488]
jmp 0x405cf0
mov r8d, ebx
lea rdx, [0x00401470]
jmp 0x405cf0
mov r8d, ebx
lea rdx, [0x00401420]
jmp 0x405cf0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
jmp 0x405dfe
jmp 0x405dfb
mov rdi, qword [rsp + 0x528]
mov rsi, rdi
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
lea r8d, [r9 + 2]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
test rax, rax
jne 0x405e2f
lea rdx, [0x00401598]
jmp 0x405cec
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, dword [rsp + 0x520]
mov rax, qword [rsp + 0x40]
mov r8, qword [rsp + 0x538]
add r9d, 0xffff
mov rdx, rbx
mov rcx, rsi
and r9d, 0xffff0000
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call rdi
jmp 0x405ebb
lea rdx, [0x00401570]
lea rcx, [0x00407060]
or r8d, 0xffffffff
call fcn.00406030
lea rcx, [0x004015c0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, [0x004015b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [0x004015d8]
lea rdx, [0x00407060]
mov r9d, 0x10
xor ecx, ecx
call rax
add rsp, 0x4d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret