Function at 0x426910
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5bc
mov eax, dword [0x61df64]
xor eax, esp
mov dword [esp + 0x5b8], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov dword [esp + 0x14], ecx
cmp dword [ebx + 0x14], 0
je 0x42695b
mov eax, 0x40000
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b8]
xor ecx, esp
call fcn.00567f8c
mov esp, ebp
pop ebp
ret 0x10
cmp byte [ebx + 0x2c], 0
je 0x42697d
mov eax, 0x50000
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b8]
xor ecx, esp
call fcn.00567f8c
mov esp, ebp
pop ebp
ret 0x10
push 0x103
xor esi, esi
mov ecx, 0xc
cmp dword [ebx], esi
push eax
lea eax, [esp + 0x3b8]
cmovne esi, ecx
push 0x104
push eax
mov dword [esp + 0x2c], esi
call fcn.0057ce6a
xor eax, eax
add esp, 0x10
mov word [esp + 0x5b6], ax
cmp word [esp + 0x3b0], ax
jne 0x4269d8
mov eax, 0x10000
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b8]
xor ecx, esp
call fcn.00567f8c
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x3b0]
mov ecx, 0x2f
cmp word [eax], 0x5c
jne 0x4269ed
mov word [eax], cx
add eax, 2
cmp word [eax], 0
jne 0x4269e4
lea ecx, [esp + 0x3b0]
mov edi, 8
call fcn.00425fd0
push dword [esp + 0x14]
xor ecx, ecx
test al, al
cmovne edi, ecx
mov ecx, ebx
mov dword [esp + 0x1c], edi
call fcn.00426480
test eax, eax
jne 0x426fb9
push 0x104
push eax
mov dword [esp + 0x384], eax
lea eax, [esp + 0x60]
push eax
call fcn.0056c4b0
add esp, 0xc
lea eax, [esp + 0x168]
push 0
push 0
push 0x104
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x3c4]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [esp + 0x168]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x426a70
push 0x104
lea eax, [esp + 0x270]
sub ecx, edx
push 0
push eax
mov dword [esp + 0x44], ecx
call fcn.0056c4b0
xor eax, eax
mov dword [esp + 0x170], 0
mov word [esp + 0x56], ax
add esp, 0xc
cmp dword [ebx], 0
mov eax, dword [ebx + 0x5c]
mov dword [esp + 0x28], eax
mov eax, 8
mov dword [esp + 0x44], 0
mov dword [esp + 0x370], 1
mov dword [esp + 0x378], 0
mov dword [esp + 0x20], 0x140b17
mov dword [esp + 0x2c], 0
mov word [esp + 0x24], ax
je 0x426af4
mov eax, 9
mov word [esp + 0x24], ax
mov word [esp + 0x4c], ax
mov word [esp + 0x26], di
test edi, edi
jne 0x426b11
mov eax, dword [ebx + 0x64]
test eax, eax
js 0x426b11
add eax, esi
mov dword [esp + 0x30], eax
jmp 0x426b19
mov dword [esp + 0x30], 0
mov eax, dword [ebx + 0x64]
mov dword [esp + 0x34], eax
xor eax, eax
mov word [esp + 0x48], ax
mov eax, dword [ebx + 0x4c]
mov edx, dword [ebx + 0x54]
mov dword [esp + 0x50], eax
mov eax, dword [ebx + 0x10]
add eax, dword [ebx + 0x18]
mov dword [esp + 0x54], eax
lea eax, [esp + 0x384]
mov dword [esp + 0x15c], eax
lea eax, [esp + 0x398]
mov ecx, dword [ebx + 0x50]
mov dword [esp + 0x160], eax
mov al, byte [ebx + 0x54]
mov byte [esp + 0x389], al
mov eax, edx
sar eax, 8
mov byte [esp + 0x38a], al
mov eax, edx
sar eax, 0x10
mov byte [esp + 0x38b], al
mov al, byte [ebx + 0x50]
mov byte [esp + 0x38d], al
mov eax, ecx
sar eax, 8
mov byte [esp + 0x38e], al
mov eax, ecx
sar eax, 0x10
mov byte [esp + 0x38f], al
mov al, byte [ebx + 0x58]
sar ecx, 0x18
mov byte [esp + 0x390], cl
mov ecx, dword [ebx + 0x58]
mov byte [esp + 0x391], al
mov eax, ecx
sar eax, 8
mov byte [esp + 0x392], al
mov eax, ecx
sar ecx, 0x18
mov dword [esp + 0x384], 0xd5455
mov byte [esp + 0x388], 7
movq xmm0, qword [esp + 0x384]
sar edx, 0x18
sar eax, 0x10
mov byte [esp + 0x394], cl
lea ecx, [esp + 0x20]
movq qword [esp + 0x398], xmm0
push ebx
mov dword [esp + 0x40], 0x11
mov dword [esp + 0x44], 9
mov byte [esp + 0x390], dl
mov byte [esp + 0x397], al
mov byte [esp + 0x3a4], dl
mov byte [esp + 0x39e], 5
call fcn.004254b0
add esp, 4
test eax, eax
je 0x426c59
mov ecx, ebx
call fcn.00426700
mov eax, 0x400
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b8]
xor ecx, esp
call fcn.00567f8c
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esp + 0x3c]
add eax, 0x1e
add eax, dword [esp + 0x38]
add dword [ebx + 0x18], eax
cmp dword [ebx + 0x14], 0
je 0x426c8e
mov ecx, ebx
call fcn.00426700
mov eax, dword [ebx + 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b8]
xor ecx, esp
call fcn.00567f8c
mov esp, ebp
pop ebp
ret 0x10
mov dword [ebx + 0x30], 0x12345678
mov dword [ebx + 0x34], 0x23456789
mov dword [ebx + 0x38], 0x34567890
mov edx, dword [ebx]
test edx, edx
je 0x426cfe
nop dword [eax]
mov al, byte [edx]
test al, al
je 0x426cfe
mov ecx, dword [ebx + 0x30]
movsx eax, al
xor eax, dword [ebx + 0x30]
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x5ed858]
xor eax, ecx
mov ecx, dword [ebx + 0x38]
mov dword [ebx + 0x30], eax
movzx eax, al
add eax, dword [ebx + 0x34]
imul eax, eax, 0x8088405
inc eax
mov dword [ebx + 0x34], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x5ed858]
mov dword [ebx + 0x38], ecx
add edx, 1
jne 0x426cb0
cmp byte [0x62b474], 0
jne 0x426d20
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
push esi
call fcn.0057ce96
add esp, 4
xor esi, esi
call fcn.0057ce75
sar eax, 7
mov byte [esp + esi + 0x3a4], al
inc esi
cmp esi, 0xc
jl 0x426d22
mov eax, dword [esp + 0x28]
shr eax, 8
xor edi, edi
mov byte [esp + 0x3af], al
nop word [eax + eax]
mov al, byte [esp + edi + 0x3a4]
mov ecx, dword [ebx + 0x30]
mov byte [esp + 0x13], al
movsx eax, al
xor eax, dword [ebx + 0x30]
movzx eax, al
mov edx, dword [ebx + 0x38]
mov esi, edx
shr ecx, 8
and esi, 0xfffd
or esi, 2
mov eax, dword [eax*4 + 0x5ed858]
xor eax, ecx
mov dword [ebx + 0x30], eax
movzx eax, al
add eax, dword [ebx + 0x34]
imul eax, eax, 0x8088405
inc eax
mov dword [ebx + 0x34], eax
shr eax, 0x18
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x5ed858]
mov eax, esi
xor eax, 1
mov dword [ebx + 0x38], edx
imul eax, esi
shr eax, 8
xor al, byte [esp + 0x13]
mov byte [esp + edi + 0x3a4], al
inc edi
cmp edi, 0xc
jl 0x426d50
cmp dword [ebx], 0
mov edi, dword [esp + 0x18]
je 0x426de3
push 0xc
lea eax, [esp + 0x3a8]
mov ecx, ebx
push eax
call fcn.00426250
add dword [ebx + 0x18], 0xc
xor eax, eax
xor esi, esi
cmp dword [ebx], eax
setne al
mov byte [ebx + 0x2d], al
cmp edi, 8
jne 0x426e02
lea eax, [esp + 0x20]
mov ecx, ebx
push eax
call fcn.00426760
jmp 0x426e0d
test edi, edi
jne 0x426e0f
mov ecx, ebx
call fcn.004268a0
mov esi, eax
cmp byte [ebx + 0x74], 0
mov byte [ebx + 0x2d], 0
je 0x426e27
mov eax, dword [ebx + 0x70]
test eax, eax
je 0x426e27
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx + 0x84]
add dword [ebx + 0x18], ecx
mov eax, dword [ebx + 0x14]
mov edx, dword [ebx + 0x68]
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x64], edx
test eax, eax
jne 0x426fb9
test esi, esi
jne 0x426c3d
add ecx, dword [esp + 0x1c]
cmp dword [esp + 0x30], ecx
mov eax, dword [ebx + 0x6c]
sete byte [esp + 0x13]
mov dword [esp + 0x2c], eax
cmp byte [ebx + 0x1c], 0
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
je 0x426ee8
cmp dword [ebx], esi
jne 0x426ee8
mov ax, word [esp + 0x24]
mov word [esp + 0x26], di
test al, 1
jne 0x426e91
mov ecx, 0xfff7
and ax, cx
mov word [esp + 0x24], ax
mov word [esp + 0x4c], ax
mov ecx, ebx
mov eax, dword [esp + 0x54]
sub eax, dword [ebx + 0x10]
push eax
call fcn.004263a0
test al, al
je 0x426ecc
push ebx
lea ecx, [esp + 0x24]
call fcn.004254b0
add esp, 4
test eax, eax
jne 0x426c3d
push dword [ebx + 0x18]
mov ecx, ebx
call fcn.004263a0
test al, al
jne 0x426f39
mov eax, 0x2000000
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b8]
xor ecx, esp
call fcn.00567f8c
mov esp, ebp
pop ebp
ret 0x10
cmp word [esp + 0x26], di
je 0x426f0b
mov eax, 0x4000000
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5b8]
xor ecx, esp
call fcn.00567f8c
mov esp, ebp
pop ebp
ret 0x10
test edi, edi
jne 0x426f16
cmp byte [esp + 0x13], 0
je 0x426eef
push ebx
lea ecx, [esp + 0x24]
call fcn.00425760
add esp, 4
test eax, eax
jne 0x426c3d
mov ax, word [esp + 0x4c]
add dword [ebx + 0x18], 0x10
mov word [esp + 0x24], ax
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x426fb9
push dword [esp + 0x40]
call fcn.0043847b
add esp, 4
mov esi, eax
push dword [esp + 0x40]
push dword [esp + 0x164]
push esi
call fcn.0056bf30
add esp, 0xc
mov dword [esp + 0x160], esi
push 0x360
call fcn.00438444
mov edx, eax
lea esi, [esp + 0x24]
mov ecx, 0xd8
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x44]
add esp, 4
test ecx, ecx
jne 0x426f91
mov dword [ebx + 0x44], edx
jmp 0x426fb7
cmp dword [ecx + 0x35c], 0
lea eax, [ecx + 0x35c]
je 0x426fb1
mov ecx, dword [eax]
cmp dword [ecx + 0x35c], 0
lea eax, [ecx + 0x35c]
jne 0x426fa0
mov dword [ecx + 0x35c], edx
xor eax, eax
mov ecx, dword [esp + 0x5c4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00567f8c
mov esp, ebp
pop ebp
ret 0x10