Function at 0x14000d7e0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push rbp
push rbx
push r12
lea rbp, [rsp - 0x450]
sub rsp, 0x550
mov rax, qword [0x140017040]
xor rax, rsp
mov qword [rbp + 0x420], rax
cmp dword [rcx + 0x24], 0
mov r12, r8
mov rbx, rcx
je 0x14000d81b
mov eax, 0x40000
jmp 0x14000dcc3
cmp byte [rcx + 0x40], 0
je 0x14000d82b
mov eax, 0x50000
jmp 0x14000dcc3
mov rax, qword [rcx]
lea rcx, [rbp + 0x310]
neg rax
mov qword [rsp + 0x548], rdi
mov qword [rsp + 0x540], r13
sbb r13d, r13d
and r13d, 0xc
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
movzx ecx, byte [rbp + 0x310]
test cl, cl
jne 0x14000d86a
mov eax, 0x10000
jmp 0x14000dcb3
mov qword [rsp + 0x588], rsi
lea rax, [rbp + 0x310]
mov qword [rsp + 0x538], r14
mov qword [rsp + 0x530], r15
nop dword [rax]
cmp cl, 0x5c
jne 0x14000d898
mov byte [rax], 0x2f
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
jne 0x14000d890
mov r14d, 8
lea rcx, [rbp + 0x310]
mov rsi, 0xffffffffffffffff
mov r15d, r14d
mov rax, rsi
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x14000d8c0
lea rdi, [rbp + 0x310]
xor ecx, ecx
add rdi, rax
lea rax, [rbp + 0x310]
cmp rdi, rax
jbe 0x14000d8f5
cmp byte [rdi], 0x2e
je 0x14000d90a
dec rdi
lea rax, [rbp + 0x310]
cmp rdi, rax
ja 0x14000d8e1
lea rax, [rbp + 0x310]
cmp rdi, rax
jne 0x14000d90a
cmp byte [rdi], 0x2e
jne 0x14000d9b7
lea rdx, [0x140011fbc]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x14000d9ae
lea rdx, str..zip
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x14000d9ae
lea rdx, str..zoo
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x14000d9ae
lea rdx, str..arc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x14000d9ae
lea rdx, str..lzh
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x14000d9ae
lea rdx, str..arj
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x14000d9ae
lea rdx, [0x140011fe8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x14000d9ae
lea rdx, str..tgz
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x14000d9b5
xor ecx, ecx
mov r15d, ecx
jmp 0x14000d9b7
xor ecx, ecx
mov qword [rbx + 0xa8], rcx
mov qword [rbx + 0xb8], rcx
mov byte [rbx + 0xb0], 0
mov qword [rbx + 0x9c], 0
mov dword [rbx + 0x98], ecx
mov dword [rbx + 0xc8], ecx
test r12, r12
jne 0x14000d9f4
mov edi, 0x10000
mov eax, edi
jmp 0x14000dc9b
mov qword [rsp + 0x30], rcx
xor r9d, r9d
mov dword [rsp + 0x28], ecx
mov edx, 0x80000000
mov rcx, r12
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
cmp rax, rsi
jne 0x14000da2e
mov edi, 0x200
mov eax, edi
jmp 0x14000dc9b
mov rdx, r12
mov rcx, rbx
call fcn.14000d180
mov edi, eax
test eax, eax
je 0x14000da4f
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x14000dc9b
xor r12d, r12d
mov byte [rbx + 0xb0], 1
lea rdx, [0x1400117a9]
mov qword [rbp + 0x2c0], r12
lea rcx, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, r12d
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbp + rcx + 0x310]
mov byte [rbp + rcx + 0xa8], al
lea rcx, [rcx + 1]
test al, al
jne 0x14000da80
lea rax, [rbp + 0xa8]
nop
inc rsi
cmp byte [rax + rsi], r12b
jne 0x14000daa0
lea rdx, [0x1400117a9]
mov qword [rsp + 0x58], rsi
lea rcx, [rbp + 0x1ac]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, 9
mov eax, dword [rbx + 0x90]
mov dword [rsp + 0x48], eax
mov qword [rbp + 0xa0], r12
mov qword [rsp + 0x70], r12
mov dword [rbp + 0x2b0], 1
mov dword [rbp + 0x2b8], r12d
mov word [rsp + 0x7a], r12w
mov dword [rsp + 0x40], 0x140b17
mov dword [rsp + 0x4c], r12d
mov word [rsp + 0x44], r14w
cmp qword [rbx], r12
je 0x14000db15
movzx r14d, cx
mov word [rsp + 0x44], cx
mov word [rsp + 0x7c], r14w
mov word [rsp + 0x46], r15w
test r15d, r15d
jne 0x14000db39
mov eax, dword [rbx + 0x98]
test eax, eax
js 0x14000db39
add eax, r13d
mov dword [rsp + 0x50], eax
jmp 0x14000db3e
mov dword [rsp + 0x50], r12d
mov eax, dword [rbx + 0x98]
mov r8, rbx
mov rdx, qword [rbx + 0x80]
mov dword [rsp + 0x54], eax
mov eax, dword [rbx + 0x70]
mov dword [rbp - 0x80], eax
mov eax, dword [rbx + 0x20]
add eax, dword [rbx + 0x28]
mov dword [rbp - 0x7c], eax
lea rax, [rbp + 0x2e0]
mov qword [rbp + 0x90], rax
lea rax, [rbp + 0x2f8]
mov qword [rbp + 0x98], rax
movzx eax, byte [rbx + 0x80]
mov byte [rbp + 0x2e5], al
mov rax, rdx
sar rax, 8
mov byte [rbp + 0x2e6], al
mov rax, rdx
sar rax, 0x10
mov byte [rbp + 0x2e7], al
movzx eax, byte [rbx + 0x78]
mov byte [rbp + 0x2e9], al
mov qword [rsp + 0x68], rcx
mov rcx, qword [rbx + 0x78]
mov rax, rcx
sar rdx, 0x18
sar rax, 8
mov byte [rbp + 0x2ea], al
mov rax, rcx
sar rax, 0x10
mov byte [rbp + 0x2eb], al
movzx eax, byte [rbx + 0x88]
sar rcx, 0x18
mov byte [rbp + 0x2ed], al
mov byte [rbp + 0x2ec], cl
mov rcx, qword [rbx + 0x88]
mov rax, rcx
mov dword [rbp + 0x2e0], 0xd5455
sar rax, 8
mov byte [rbp + 0x2ee], al
mov rax, rcx
sar rcx, 0x18
mov byte [rbp + 0x2e4], 7
movsd xmm0, qword [rbp + 0x2e0]
mov byte [rbp + 0x2f0], cl
lea rcx, [rsp + 0x40]
sar rax, 0x10
movsd qword [rbp + 0x2f8], xmm0
mov word [rsp + 0x78], r12w
mov qword [rsp + 0x60], 0x11
mov byte [rbp + 0x2e8], dl
mov byte [rbp + 0x2ef], al
mov byte [rbp + 0x300], dl
mov byte [rbp + 0x2fa], 5
call fcn.14000bec0
test eax, eax
je 0x14000dcde
cmp byte [rbx + 0xb0], r12b
je 0x14000dc83
mov rcx, qword [rbx + 0xa8]
test rcx, rcx
je 0x14000dc83
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbx + 0x9c]
mov dword [rbx + 0x98], eax
mov qword [rbx + 0xa8], r12
mov eax, 0x400
mov r14, qword [rsp + 0x538]
mov rsi, qword [rsp + 0x588]
mov r15, qword [rsp + 0x530]
mov rdi, qword [rsp + 0x548]
mov r13, qword [rsp + 0x540]
mov rcx, qword [rbp + 0x420]
xor rcx, rsp
call fcn.14000f110
add rsp, 0x550
pop r12
pop rbx
pop rbp
ret
mov ecx, dword [rsp + 0x58]
add ecx, 0x1e
add ecx, dword [rsp + 0x60]
add dword [rbx + 0x28], ecx
cmp dword [rbx + 0x24], r12d
je 0x14000dd28
cmp byte [rbx + 0xb0], r12b
je 0x14000dd0d
mov rcx, qword [rbx + 0xa8]
test rcx, rcx
je 0x14000dd0d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbx + 0x9c]
mov dword [rbx + 0x98], eax
mov eax, dword [rbx + 0x24]
mov qword [rbx + 0xa8], r12
jmp 0x14000dc9b
mov dword [rbx + 0x44], 0x12345678
lea rsi, [0x140012000]
mov dword [rbx + 0x48], 0x23456789
mov dword [rbx + 0x4c], 0x34567890
mov r8, qword [rbx]
test r8, r8
je 0x14000dd99
nop dword [rax]
movzx eax, byte [r8]
test al, al
je 0x14000dd99
mov edx, dword [rbx + 0x44]
mov ecx, edx
xor rcx, rax
shr edx, 8
movzx eax, cl
xor edx, dword [rsi + rax*4]
movzx eax, dl
add eax, dword [rbx + 0x48]
imul ecx, eax, 0x8088405
mov dword [rbx + 0x44], edx
mov edx, dword [rbx + 0x4c]
inc ecx
mov dword [rbx + 0x48], ecx
movzx eax, byte [rbx + 0x4b]
movzx ecx, dl
xor rcx, rax
shr edx, 8
xor edx, dword [rsi + rcx*4]
mov dword [rbx + 0x4c], edx
add r8, 1
jne 0x14000dd50
cmp byte [0x140017b4c], r12b
jne 0x14000ddbb
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, eax
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov rdi, r12
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
sar eax, 7
mov byte [rbp + rdi + 0x2d0], al
inc rdi
cmp rdi, 0xc
jl 0x14000ddc0
mov eax, dword [rsp + 0x48]
mov rdi, r12
shr eax, 8
mov byte [rbp + 0x2db], al
nop dword [rax]
mov r8d, dword [rbx + 0x4c]
mov edx, dword [rbx + 0x44]
mov r11d, r8d
movsx r9, byte [rbp + rdi + 0x2d0]
and r8d, 0xfffd
or r8d, 2
mov rax, r9
xor rax, rdx
shr edx, 8
movzx ecx, al
xor edx, dword [rsi + rcx*4]
mov r10d, edx
movzx eax, dl
add eax, dword [rbx + 0x48]
movsx rdx, byte [rbp + rdi + 0x2d1]
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0x48], eax
mov ecx, eax
shr rcx, 0x18
movzx eax, r11b
xor rcx, rax
shr r11d, 8
mov eax, r8d
xor eax, 1
imul eax, r8d
xor r11d, dword [rsi + rcx*4]
movsx r8, byte [rbp + rdi + 0x2d2]
mov dword [rbx + 0x4c], r11d
and r11d, 0xfffd
or r11d, 2
shr eax, 8
xor al, r9b
mov byte [rbp + rdi + 0x2d0], al
mov rax, rdx
xor rax, r10
shr r10d, 8
movzx ecx, al
xor r10d, dword [rsi + rcx*4]
mov dword [rbx + 0x44], r10d
movzx eax, r10b
add eax, dword [rbx + 0x48]
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0x48], eax
mov r9d, dword [rbx + 0x4c]
mov ecx, eax
movzx eax, r9b
shr rcx, 0x18
xor rcx, rax
shr r9d, 8
mov eax, r11d
xor eax, 1
imul eax, r11d
xor r9d, dword [rsi + rcx*4]
mov dword [rbx + 0x4c], r9d
and r9d, 0xfffd
or r9d, 2
shr eax, 8
xor al, dl
mov edx, dword [rbx + 0x44]
mov byte [rbp + rdi + 0x2d1], al
mov rax, r8
xor rax, rdx
shr edx, 8
movzx ecx, al
xor edx, dword [rsi + rcx*4]
mov dword [rbx + 0x44], edx
movzx eax, dl
add eax, dword [rbx + 0x48]
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0x48], eax
mov r10d, dword [rbx + 0x4c]
mov ecx, eax
movzx eax, r10b
shr rcx, 0x18
xor rcx, rax
shr r10d, 8
xor r10d, dword [rsi + rcx*4]
mov dword [rbx + 0x4c], r10d
mov edx, dword [rbx + 0x44]
mov eax, r9d
xor eax, 1
and r10d, 0xfffd
imul eax, r9d
or r10d, 2
shr eax, 8
xor al, r8b
movsx r8, byte [rbp + rdi + 0x2d3]
mov byte [rbp + rdi + 0x2d2], al
mov rax, r8
xor rax, rdx
shr edx, 8
movzx ecx, al
xor edx, dword [rsi + rcx*4]
mov dword [rbx + 0x44], edx
movzx eax, dl
add eax, dword [rbx + 0x48]
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0x48], eax
mov r11d, dword [rbx + 0x4c]
mov ecx, eax
shr rcx, 0x18
movzx eax, r11b
xor rcx, rax
shr r11d, 8
mov eax, r10d
xor eax, 1
imul eax, r10d
xor r11d, dword [rsi + rcx*4]
mov dword [rbx + 0x4c], r11d
and r11d, 0xfffd
mov edx, dword [rbx + 0x44]
or r11d, 2
shr eax, 8
xor al, r8b
movsx r8, byte [rbp + rdi + 0x2d4]
mov byte [rbp + rdi + 0x2d3], al
mov rax, r8
xor rax, rdx
shr edx, 8
movzx ecx, al
xor edx, dword [rsi + rcx*4]
mov dword [rbx + 0x44], edx
movzx eax, dl
add eax, dword [rbx + 0x48]
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0x48], eax
mov r9d, dword [rbx + 0x4c]
mov ecx, eax
movzx eax, r9b
shr rcx, 0x18
xor rcx, rax
shr r9d, 8
mov eax, r11d
xor eax, 1
imul eax, r11d
xor r9d, dword [rsi + rcx*4]
mov dword [rbx + 0x4c], r9d
and r9d, 0xfffd
mov edx, dword [rbx + 0x44]
or r9d, 2
shr eax, 8
xor al, r8b
movsx r8, byte [rbp + rdi + 0x2d5]
mov byte [rbp + rdi + 0x2d4], al
mov rax, r8
xor rax, rdx
shr edx, 8
movzx ecx, al
xor edx, dword [rsi + rcx*4]
mov dword [rbx + 0x44], edx
movzx eax, dl
add eax, dword [rbx + 0x48]
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0x48], eax
mov edx, dword [rbx + 0x4c]
mov ecx, eax
movzx eax, dl
shr rcx, 0x18
xor rcx, rax
shr edx, 8
mov eax, r9d
xor eax, 1
imul eax, r9d
xor edx, dword [rsi + rcx*4]
mov dword [rbx + 0x4c], edx
shr eax, 8
xor al, r8b
mov byte [rbp + rdi + 0x2d5], al
add rdi, 6
cmp rdi, 0xc
jl 0x14000ddf0
cmp qword [rbx], r12
je 0x14000e0ae
mov r8d, 0xc
lea rdx, [rbp + 0x2d0]
mov rcx, rbx
call fcn.14000cfe0
add dword [rbx + 0x28], 0xc
mov edi, r12d
cmp qword [rbx], rdi
setne al
mov byte [rbx + 0x41], al
cmp r15d, 8
jne 0x14000e0d1
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14000d470
mov edi, eax
jmp 0x14000e13b
test r15d, r15d
jne 0x14000e13b
mov r8d, 0x4000
lea rdx, [rbx + 0xcc]
mov rcx, rbx
mov r14d, r12d
call fcn.14000d380
mov edi, eax
test eax, eax
je 0x14000e131
cmp edi, 0xffffffff
je 0x14000e131
mov r8d, edi
lea rdx, [rbx + 0xcc]
mov rcx, rbx
call fcn.14000cfe0
cmp eax, edi
jne 0x14000e1f5
mov r8d, 0x4000
lea rdx, [rbx + 0xcc]
mov rcx, rbx
add r14d, edi
call fcn.14000d380
mov edi, eax
test eax, eax
jne 0x14000e0f4
mov dword [rbx + 0xc8], r14d
mov edi, r12d
mov byte [rbx + 0x41], r12b
cmp byte [rbx + 0xb0], r12b
je 0x14000e15a
mov rcx, qword [rbx + 0xa8]
test rcx, rcx
je 0x14000e15a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rbx + 0xc8]
add dword [rbx + 0x28], r8d
mov eax, dword [rbx + 0x24]
mov edx, dword [rbx + 0x9c]
mov qword [rbx + 0xa8], r12
mov dword [rbx + 0x98], edx
test eax, eax
jne 0x14000dc9b
test edi, edi
jne 0x14000dc96
mov eax, dword [rbx + 0xa0]
lea ecx, [r8 + r13]
cmp dword [rsp + 0x50], ecx
mov dword [rsp + 0x4c], eax
sete r8b
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x54], edx
cmp byte [rbx + 0x2c], r12b
je 0x14000e29e
cmp qword [rbx], r12
jne 0x14000e29e
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x46], r15w
test al, 1
jne 0x14000e1d8
mov ecx, 0xfff7
and ax, cx
mov word [rsp + 0x44], ax
mov ecx, dword [rbx + 0x20]
mov word [rsp + 0x7c], ax
mov eax, dword [rbp - 0x7c]
sub eax, ecx
cmp qword [rbx + 0x30], r12
je 0x14000e1ff
cmp eax, dword [rbx + 0x3c]
jae 0x14000e258
mov dword [rbx + 0x38], eax
jmp 0x14000e21e
mov edi, 0x60000
jmp 0x14000e13b
mov r10, qword [rbx + 8]
test r10, r10
je 0x14000e28d
lea edx, [rcx + rax]
xor r9d, r9d
mov rcx, r10
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8, rbx
lea rcx, [rsp + 0x40]
call fcn.14000bec0
test eax, eax
jne 0x14000dc96
mov ecx, dword [rbx + 0x28]
cmp byte [rbx + 0x2c], r12b
jne 0x14000e24d
mov dword [rbx + 0x24], 0x2000000
mov eax, 0x2000000
jmp 0x14000dc9b
cmp qword [rbx + 0x30], r12
je 0x14000e26e
cmp ecx, dword [rbx + 0x3c]
jb 0x14000e269
mov dword [rbx + 0x24], 0x30000
mov eax, 0x2000000
jmp 0x14000dc9b
mov dword [rbx + 0x38], ecx
jmp 0x14000e2db
mov r10, qword [rbx + 8]
test r10, r10
je 0x14000e28d
mov edx, dword [rbx + 0x20]
xor r9d, r9d
add edx, ecx
xor r8d, r8d
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x14000e2db
mov dword [rbx + 0x24], 0x1000000
mov eax, 0x2000000
jmp 0x14000dc9b
cmp word [rsp + 0x46], r15w
jne 0x14000e3cd
test r15d, r15d
jne 0x14000e2b8
test r8b, r8b
je 0x14000e3cd
mov r8, rbx
lea rcx, [rsp + 0x40]
call fcn.14000c240
test eax, eax
jne 0x14000dc96
movzx eax, word [rsp + 0x7c]
add dword [rbx + 0x28], 0x10
mov word [rsp + 0x44], ax
mov eax, dword [rbx + 0x24]
test eax, eax
jne 0x14000dc9b
mov rcx, qword [rsp + 0x68]
call fcn.14000f484
mov r8, qword [rsp + 0x68]
mov rcx, rax
mov rdx, qword [rbp + 0x98]
mov rdi, rax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, 0x388
mov qword [rbp + 0x98], rdi
call fcn.14000f138
mov r8, rax
mov rcx, rax
lea rax, [rsp + 0x40]
mov edx, 7
nop dword [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x14000e330
mov rax, qword [rax]
mov qword [rcx], rax
mov rcx, qword [rbx + 0x60]
test rcx, rcx
jne 0x14000e39d
mov qword [rbx + 0x60], r8
xor eax, eax
jmp 0x14000dc9b
mov rax, qword [rcx + 0x380]
test rax, rax
je 0x14000e3bf
nop dword [rax]
mov rcx, rax
mov rax, qword [rax + 0x380]
test rax, rax
jne 0x14000e3b0
mov qword [rcx + 0x380], r8
xor eax, eax
jmp 0x14000dc9b
mov eax, 0x4000000
jmp 0x14000dc9b