Function at 0x586240
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5b4
mov eax, dword [0x6ba394]
xor eax, esp
mov dword [esp + 0x5b0], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [ebp + 8]
push esi
push edi
cmp dword [ebx + 0x14], 0
je 0x58628b
mov eax, 0x40000
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.005b168a
mov esp, ebp
pop ebp
ret 0x10
cmp byte [ebx + 0x2c], 0
je 0x5862ad
mov eax, 0x50000
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.005b168a
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp + 0x14]
xor eax, eax
mov dword [esp + 0x1c], eax
cmp dword [ebx], eax
je 0x5862c9
cmp esi, 4
mov edx, 0xc
cmovne eax, edx
mov dword [esp + 0x1c], eax
push ecx
lea eax, [esp + 0x3b4]
push 0x104
push eax
call fcn.005e4bd4
add esp, 0xc
cmp word [esp + 0x3b0], 0
je 0x5863de
lea eax, [esp + 0x3b0]
mov ecx, 0x2f
nop word [eax + eax]
cmp word [eax], 0x5c
jne 0x586309
mov word [eax], cx
add eax, 2
cmp word [eax], 0
jne 0x586300
cmp esi, 4
jne 0x586342
lea ecx, [esp + 0x3b0]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x586321
sub ecx, edx
sar ecx, 1
cmp word [esp + ecx*2 + 0x3ae], 0x2f
je 0x586342
mov byte [esp + 0x13], 1
jmp 0x586365
mov byte [esp + 0x13], 0
mov edi, 8
mov dword [esp + 0x18], edi
cmp esi, 4
je 0x586365
lea ecx, [esp + 0x3b0]
call fcn.00585690
test al, al
je 0x58636b
xor edi, edi
mov dword [esp + 0x18], edi
cmp esi, 2
jne 0x586381
mov eax, dword [esp + 0x14]
mov ecx, ebx
push eax
call fcn.00585c90
jmp 0x586406
cmp esi, 1
jne 0x586395
mov eax, dword [esp + 0x14]
push ecx
push eax
mov ecx, ebx
call fcn.00585d40
jmp 0x586406
cmp esi, 3
jne 0x5863fa
mov eax, dword [esp + 0x14]
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x84], eax
mov byte [ebx + 0x80], 0
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x90], 0
mov dword [ebx + 0x74], 0
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x8c], 0
mov eax, 0x10000
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.005b168a
mov esp, ebp
pop ebp
ret 0x10
cmp esi, 4
jne 0x5863de
mov ecx, ebx
call fcn.00585eb0
test eax, eax
jne 0x5863e3
push 0x63f32c
mov dword [esp + 0x380], eax
lea eax, [esp + 0x5c]
push 0x104
push eax
call fcn.005e4c38
add esp, 0xc
lea eax, [esp + 0x168]
push 0
push 0
push 0x104
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x3c4]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [esp + 0x168]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x586460
sub ecx, edx
mov dword [esp + 0x38], ecx
cmp byte [esp + 0x13], al
je 0x586491
push 0x67de54
lea eax, [esp + 0x16c]
push 0x104
push eax
call fcn.005e4c92
add esp, 0xc
inc dword [esp + 0x38]
push 0x63f32c
lea eax, [esp + 0x270]
push 0x104
push eax
call fcn.005e4c38
xor eax, eax
mov dword [esp + 0x170], 0
mov word [esp + 0x56], ax
add esp, 0xc
cmp dword [ebx], 0
mov eax, dword [ebx + 0x68]
mov dword [esp + 0x28], eax
mov eax, 8
mov dword [esp + 0x44], 0
mov dword [esp + 0x370], 1
mov dword [esp + 0x378], 0
mov dword [esp + 0x20], 0x140b17
mov dword [esp + 0x2c], 0
mov word [esp + 0x24], ax
je 0x586510
cmp esi, 4
je 0x586510
mov eax, 9
mov word [esp + 0x24], ax
mov word [esp + 0x4c], ax
mov word [esp + 0x26], di
test edi, edi
jne 0x586531
mov ecx, dword [ebx + 0x70]
test ecx, ecx
js 0x586531
mov eax, dword [esp + 0x1c]
add eax, ecx
mov dword [esp + 0x30], eax
jmp 0x586539
mov dword [esp + 0x30], 0
mov eax, dword [ebx + 0x70]
mov dword [esp + 0x34], eax
xor eax, eax
mov word [esp + 0x48], ax
mov eax, dword [ebx + 0x4c]
mov dword [esp + 0x50], eax
mov eax, dword [ebx + 0x10]
add eax, dword [ebx + 0x18]
mov dword [esp + 0x54], eax
lea eax, [esp + 0x384]
mov dword [esp + 0x15c], eax
lea eax, [esp + 0x398]
mov edx, dword [ebx + 0x5c]
mov ecx, dword [ebx + 0x58]
mov dword [esp + 0x160], eax
mov al, byte [ebx + 0x58]
mov byte [esp + 0x389], al
mov eax, edx
shrd ecx, eax, 8
mov dword [esp + 0x384], 0xd5455
sar eax, 8
mov byte [esp + 0x38a], cl
mov eax, edx
mov ecx, dword [ebx + 0x58]
shrd ecx, eax, 0x10
mov byte [esp + 0x388], 7
sar eax, 0x10
mov eax, dword [ebx + 0x58]
shrd eax, edx, 0x18
mov byte [esp + 0x38b], cl
mov ecx, dword [ebx + 0x50]
mov dword [esp + 0x14], eax
mov byte [esp + 0x38c], al
mov al, byte [ebx + 0x50]
mov byte [esp + 0x38d], al
sar edx, 0x18
mov edx, dword [ebx + 0x54]
mov eax, edx
shrd ecx, eax, 8
movq xmm0, qword [esp + 0x384]
sar eax, 8
mov byte [esp + 0x38e], cl
mov eax, edx
mov ecx, dword [ebx + 0x50]
shrd ecx, eax, 0x10
movq qword [esp + 0x398], xmm0
sar eax, 0x10
mov eax, dword [ebx + 0x50]
shrd eax, edx, 0x18
mov byte [esp + 0x38f], cl
mov ecx, dword [ebx + 0x60]
mov byte [esp + 0x390], al
mov al, byte [ebx + 0x60]
mov byte [esp + 0x391], al
sar edx, 0x18
mov edx, dword [ebx + 0x64]
mov eax, edx
shrd ecx, eax, 8
push ebx
sar eax, 8
mov byte [esp + 0x396], cl
mov eax, edx
mov ecx, dword [ebx + 0x60]
shrd ecx, eax, 0x10
mov dword [esp + 0x40], 0x11
sar eax, 0x10
mov eax, dword [ebx + 0x60]
shrd eax, edx, 0x18
mov byte [esp + 0x397], cl
lea ecx, [esp + 0x24]
mov byte [esp + 0x398], al
mov eax, dword [esp + 0x18]
sar edx, 0x18
mov dword [esp + 0x44], 9
mov byte [esp + 0x3a4], al
mov byte [esp + 0x39e], 5
call fcn.00584bd0
add esp, 4
test eax, eax
je 0x5866dd
cmp byte [ebx + 0x80], 0
je 0x5866b4
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x5866b4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 0x74]
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x70], eax
mov eax, 0x400
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.005b168a
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esp + 0x3c]
add eax, 0x1e
add eax, dword [esp + 0x38]
add dword [ebx + 0x18], eax
cmp dword [ebx + 0x14], 0
je 0x58672f
cmp byte [ebx + 0x80], 0
je 0x586708
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x586708
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 0x74]
mov dword [ebx + 0x70], eax
mov eax, dword [ebx + 0x14]
mov dword [ebx + 0x7c], 0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.005b168a
mov esp, ebp
pop ebp
ret 0x10
mov dword [ebx + 0x30], 0x12345678
mov dword [ebx + 0x34], 0x23456789
mov dword [ebx + 0x38], 0x34567890
mov edx, dword [ebx]
test edx, edx
je 0x58679e
nop word [eax + eax]
mov al, byte [edx]
test al, al
je 0x58679e
mov ecx, dword [ebx + 0x30]
movsx eax, al
xor eax, dword [ebx + 0x30]
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x63ed70]
xor eax, ecx
mov ecx, dword [ebx + 0x38]
mov dword [ebx + 0x30], eax
movzx eax, al
add eax, dword [ebx + 0x34]
imul eax, eax, 0x8088405
inc eax
mov dword [ebx + 0x34], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x63ed70]
mov dword [ebx + 0x38], ecx
add edx, 1
jne 0x586750
cmp byte [0x6c8614], 0
jne 0x5867c0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
push esi
call fcn.005e3c3b
add esp, 4
xor esi, esi
call fcn.005e3c1a
sar eax, 7
mov byte [esp + esi + 0x3a4], al
inc esi
cmp esi, 0xc
jl 0x5867c2
mov eax, dword [esp + 0x28]
shr eax, 8
xor edi, edi
mov byte [esp + 0x3af], al
nop word [eax + eax]
mov al, byte [esp + edi + 0x3a4]
mov ecx, dword [ebx + 0x30]
mov byte [esp + 0x13], al
movsx eax, al
xor eax, dword [ebx + 0x30]
movzx eax, al
mov edx, dword [ebx + 0x38]
mov esi, edx
shr ecx, 8
and esi, 0xfffd
or esi, 2
mov eax, dword [eax*4 + 0x63ed70]
xor eax, ecx
mov dword [ebx + 0x30], eax
movzx eax, al
add eax, dword [ebx + 0x34]
imul eax, eax, 0x8088405
inc eax
mov dword [ebx + 0x34], eax
shr eax, 0x18
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x63ed70]
mov eax, esi
xor eax, 1
mov dword [ebx + 0x38], edx
imul eax, esi
shr eax, 8
xor al, byte [esp + 0x13]
mov byte [esp + edi + 0x3a4], al
inc edi
cmp edi, 0xc
jl 0x5867f0
cmp dword [ebx], 0
mov esi, dword [ebp + 0x14]
je 0x586887
cmp esi, 4
je 0x586887
push 0xc
lea eax, [esp + 0x3a8]
mov ecx, ebx
push eax
call fcn.00585ad0
add dword [ebx + 0x18], 0xc
cmp dword [ebx], 0
mov dword [esp + 0x14], 0
je 0x5868a0
cmp esi, 4
je 0x5868a0
mov eax, 1
jmp 0x5868a2
xor eax, eax
mov edi, dword [esp + 0x18]
mov byte [ebx + 0x2d], al
cmp esi, 4
je 0x5868d6
cmp edi, 8
jne 0x5868c5
lea eax, [esp + 0x20]
mov ecx, ebx
push eax
call fcn.005860a0
mov dword [esp + 0x14], eax
jmp 0x5868e0
test edi, edi
jne 0x5868e0
mov ecx, ebx
call fcn.005861d0
mov dword [esp + 0x14], eax
jmp 0x5868e0
mov dword [ebx + 0x90], 0
cmp byte [ebx + 0x80], 0
mov byte [ebx + 0x2d], 0
je 0x5868fb
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x5868fb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx + 0x90]
add dword [ebx + 0x18], ecx
mov eax, dword [ebx + 0x14]
mov edx, dword [ebx + 0x74]
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x70], edx
test eax, eax
jne 0x5863e3
cmp dword [esp + 0x14], eax
jne 0x5866c1
add ecx, dword [esp + 0x1c]
cmp dword [esp + 0x30], ecx
mov eax, dword [ebx + 0x78]
sete byte [esp + 0x13]
mov dword [esp + 0x2c], eax
cmp byte [ebx + 0x1c], 0
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
je 0x586a5d
cmp dword [ebx], 0
je 0x58695a
cmp esi, 4
jne 0x586a5d
mov ax, word [esp + 0x24]
mov word [esp + 0x26], di
test al, 1
jne 0x586975
mov ecx, 0xfff7
and ax, cx
mov word [esp + 0x24], ax
mov edx, dword [ebx + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov word [esp + 0x4c], ax
mov eax, dword [esp + 0x54]
sub eax, edx
cmp dword [ebx + 0x20], 0
je 0x5869bc
cmp eax, dword [ebx + 0x28]
jb 0x5869b7
mov dword [ebx + 0x14], 0x30000
mov eax, 0x2000000
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.005b168a
mov esp, ebp
pop ebp
ret 0x10
mov dword [ebx + 0x24], eax
jmp 0x5869cd
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x586a3a
push 0
push 0
add eax, edx
push eax
push ecx
call esi
push ebx
lea ecx, [esp + 0x24]
call fcn.00584bd0
add esp, 4
test eax, eax
jne 0x5866c1
mov ecx, dword [ebx + 0x18]
cmp byte [ebx + 0x1c], al
jne 0x586a0d
mov dword [ebx + 0x14], 0x2000000
mov eax, 0x2000000
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.005b168a
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebx + 0x20], 0
je 0x586a24
cmp ecx, dword [ebx + 0x28]
jae 0x586994
mov dword [ebx + 0x24], ecx
jmp 0x586aae
mov edx, dword [ebx + 4]
test edx, edx
je 0x586a3a
mov eax, dword [ebx + 0x10]
push 0
push 0
add eax, ecx
push eax
push edx
call esi
jmp 0x586aae
mov dword [ebx + 0x14], 0x1000000
mov eax, 0x2000000
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.005b168a
mov esp, ebp
pop ebp
ret 0x10
cmp word [esp + 0x26], di
je 0x586a80
mov eax, 0x4000000
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.005b168a
mov esp, ebp
pop ebp
ret 0x10
test edi, edi
jne 0x586a8b
cmp byte [esp + 0x13], 0
je 0x586a64
push ebx
lea ecx, [esp + 0x24]
call fcn.00584e80
add esp, 4
test eax, eax
jne 0x5866c1
mov ax, word [esp + 0x4c]
add dword [ebx + 0x18], 0x10
mov word [esp + 0x24], ax
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x5863e3
push dword [esp + 0x40]
call fcn.005b1ceb
add esp, 4
mov esi, eax
push dword [esp + 0x40]
push dword [esp + 0x164]
push esi
call fcn.005ca980
add esp, 0xc
mov dword [esp + 0x160], esi
push 0x360
call fcn.005b1b6c
mov edx, eax
lea esi, [esp + 0x24]
mov ecx, 0xd8
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x44]
add esp, 4
test ecx, ecx
jne 0x586b21
mov dword [ebx + 0x44], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b0]
xor ecx, esp
call fcn.005b168a
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ecx + 0x35c], 0
lea eax, [ecx + 0x35c]
je 0x586b41
mov ecx, dword [eax]
cmp dword [ecx + 0x35c], 0
lea eax, [ecx + 0x35c]
jne 0x586b30
pop edi
mov dword [ecx + 0x35c], edx
xor eax, eax
mov ecx, dword [esp + 0x5b8]
pop esi
pop ebx
xor ecx, esp
call fcn.005b168a
mov esp, ebp
pop ebp
ret 0x10