Function at 0x140002dfc
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Encode data using xor
Generate random numbers using the delphi lcg
Get file size
Read file via mapping
Set environment variable
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x808]
sub rsp, 0x908
xor edi, edi
xor ecx, ecx
mov r13d, ecx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rcx
mov r14d, edi
mov qword [rsp + 0x50], rdi
mov r12d, edi
mov r15d, edi
mov qword [rbp + 0x868], rdi
mov qword [rsp + 0x40], rdi
call fcn.140002494
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [0x140007058]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [rbp + 0x850]
mov dword [0x140007080], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [0x140007080]
cmp ecx, 0x8000
jb 0x140002eb2
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
je 0x140003804
cmp ecx, 1
jmp 0x1400033cd
lea rcx, [0x140007090]
call fcn.1400029a4
call fcn.140002940
lea rcx, [rsp + 0x70]
call fcn.1400029a4
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [0x140007080]
cmp ecx, 0x8000
jae 0x140002e96
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 0x60]
add rbx, 0xfe0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [0x140001320]
call qword [0x140007010]
test rax, rax
setne r15b
test rax, rax
je 0x140002f4f
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [0x140001190]
call qword [0x140007010]
test rax, rax
je 0x140002f4f
mov rcx, rbx
mov r14b, 1
call fcn.140003aec
test al, al
je 0x140003950
jmp 0x140002f7a
movabs rax, 0x74636a6e696d7678
mov r14b, dil
cmp qword [rbx], rax
je 0x140002f7a
mov rcx, rbx
call fcn.1400039a8
test eax, eax
je 0x140003950
cmp eax, 2
je 0x1400031b8
test rbx, rbx
je 0x1400031b8
movsxd rcx, dword [rbx + 0x18]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r13, rax
test rax, rax
je 0x140003698
movsxd rcx, dword [rax + 0x1c]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x68], rax
mov rbx, rax
test rax, rax
je 0x14000368c
cmp dword [rax + 0x48], 0x3fc
jae 0x14000366d
mov r8d, dword [rax + 0x48]
lea rcx, [rbp + 8]
mov edx, dword [rax + 0x4c]
add r8, r8
add rdx, rax
call qword [0x140007038]
mov eax, dword [rbx + 0x48]
lea r8, [r13 + 0x43c8]
mov ecx, 0x11
mov word [rbp + rax*2 + 8], di
lea rax, [0x1400016b0]
cmp dword [r13], ecx
cmovb ecx, dword [r13]
mov eax, dword [rax + rcx*4]
add rax, r13
cmp r8, rax
ja 0x14000303c
mov edx, dword [r13 + 0x43cc]
lea rcx, [rsp + 0x70]
mov r8d, dword [r8]
add rdx, r13
call fcn.1400028ac
mov eax, dword [r13 + 0x40]
xor ecx, ecx
mov esi, ecx
test eax, eax
je 0x14000308e
cmp dword [r13 + 0x44], ecx
je 0x14000308e
lea ebx, [rax + 1]
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor ecx, ecx
mov rdi, rax
test rax, rax
jne 0x140003097
lea rdx, [0x1400013b8]
or r8d, 0xffffffff
lea rcx, [0x140007090]
call fcn.1400028ac
jmp 0x140003950
test r14b, r14b
jne 0x140003661
mov eax, dword [r13 + 0x50]
test eax, eax
je 0x1400030d3
cmp dword [r13 + 0x54], ecx
je 0x1400030d3
lea ebx, [rax + 1]
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r14d, r14d
mov rsi, rax
test rax, rax
jne 0x1400030df
lea rdx, [0x1400013e8]
jmp 0x140003079
test r15b, r15b
jne 0x140003655
xor r14d, r14d
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rbx, qword [rcx + 0x20]
test rdi, rdi
je 0x140003122
mov r8d, dword [r13 + 0x40]
mov rcx, rdi
mov edx, dword [r13 + 0x44]
add r8, r8
add rdx, r13
call qword [0x140007038]
mov eax, dword [r13 + 0x40]
lea rcx, [rbx + 0x60]
mov rdx, rdi
mov word [rdi + rax*2], r14w
call qword [0x140007068]
xor edi, edi
test rsi, rsi
je 0x1400031dd
mov r8d, dword [r13 + 0x50]
mov rcx, rsi
mov edx, dword [r13 + 0x54]
add r8, r8
add rdx, r13
call qword [0x140007038]
mov eax, dword [r13 + 0x50]
mov rdx, rsi
mov word [rsi + rax*2], di
lea rdi, [rbx + 0x70]
mov rcx, rdi
call qword [0x140007068]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
mov rdx, rsi
call qword [section..data]
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rbx, rax
test rax, rax
je 0x1400031ad
xor edx, edx
lea rcx, [rbp - 0x80]
lea r8d, [rdx + 0x10]
call qword [0x140007030]
mov r8b, 1
lea rcx, [rbp - 0x80]
mov rdx, rdi
call qword [0x140007060]
test eax, eax
js 0x1400031b1
mov rdx, qword [rbp - 0x78]
mov rcx, rbx
call qword [0x140007018]
xor edi, edi
jmp 0x1400031dd
xor edi, edi
mov byte [rbx], dil
jmp 0x1400031dd
mov r8d, 0x3fc
lea rdx, [rbp + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140003926
cmp eax, 0x3fc
je 0x140003926
cmp word [rbp + 8], 0x5c
jne 0x1400031f1
cmp word [rbp + 0xa], 0x5c
jne 0x1400031f1
lea rbx, [rbp + 8]
jmp 0x14000320c
mov r8d, 8
lea rdx, [0x1400016a0]
lea rcx, [rbp]
call qword [0x140007038]
lea rbx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
sub r8d, dword [0x140007080]
cmp r8d, 0x8000
jb 0x14000324b
mov eax, 0xaaaaaaab
mul r8d
shr edx, 1
lea ecx, [rdx + rdx*2]
sub r8d, ecx
je 0x140003804
mov r14, qword [rsp + 0x50]
jmp 0x1400033bc
or esi, 0xffffffff
lea rcx, [0x140007090]
mov r8d, esi
mov rdx, rbx
call fcn.1400028ac
mov r8d, esi
lea rdx, [0x14000127c]
lea rcx, [0x140007090]
call fcn.1400028ac
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x60], rax
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14000391d
call fcn.140003ebc
mov r14, qword [rsp + 0x50]
mov r15, qword [rbp + 0x868]
mov ebx, dword [rbp + 0x850]
test eax, eax
jne 0x140002e7a
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov dword [rsp + 0x20], edi
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x50], rax
mov r14, rax
test rax, rax
je 0x140003914
xor r9d, r9d
mov r12d, 0x1000
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rcx, rax
lea r15d, [r9 + 4]
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r11, rax
test rax, rax
je 0x14000390b
mov rcx, rax
call fcn.140002a1c
mov rcx, r11
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea rdx, [rsp + 0x58]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140003902
lea rcx, [r12 + rbx]
cmp qword [rsp + 0x58], rcx
jle 0x1400038d0
lea ecx, [rbx + 0x1000]
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, r14
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
test rax, rax
je 0x1400038c7
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
sub r8d, dword [0x140007080]
cmp r8d, 0x8000
jb 0x1400033d8
mov eax, 0xaaaaaaab
mul r8d
shr edx, 1
lea ecx, [rdx + rdx*2]
sub r8d, ecx
je 0x140003804
mov r15, qword [rbp + 0x868]
cmp r8d, 1
mov ebx, dword [rbp + 0x850]
je 0x140002e7a
jmp 0x140003569
mov rcx, r12
call fcn.140002a1c
mov r11d, eax
add r11, r12
mov eax, dword [r11]
add r11, r15
cmp eax, 0x6d7678
jne 0x1400038bb
mov eax, dword [r11]
add r11, r15
cmp eax, 3
jne 0x1400038af
mov edx, dword [r11]
add r11, r15
imul ebx, edx, 0x8088405
mov ecx, dword [r11]
add r11, r15
inc ebx
mov eax, ebx
xor eax, edx
cmp eax, ecx
jne 0x1400038a3
imul ecx, ebx, 0x8088405
inc ecx
mov eax, ecx
xor eax, ebx
cmp eax, dword [r11]
jne 0x140003897
imul eax, ecx, 0x2b9ad7e7
add r11, 8
mov ecx, 0x8088406
sub ecx, eax
imul eax, ecx, 0x8088405
mov edi, ecx
xor edi, dword [r11]
add r11, r15
inc eax
mov ecx, eax
imul eax, eax, 0x8088405
xor ecx, dword [r11]
add r11, r15
mov dword [rbp + 0x850], ecx
mov rcx, r12
inc eax
xor eax, dword [r11]
sub r11d, r12d
add r11d, r15d
mov dword [rbp + 0x858], eax
add edi, r11d
lea r15d, [rdi + rax]
mov dword [rbp + 0x860], r15d
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r14d, r14d
cmp dword [rsp + 0x78], r14d
jne 0x140003752
mov qword [rsp + 0x28], r14
lea r8d, [r14 + 8]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x50], rax
mov r14, rax
test rax, rax
je 0x140003746
xor r9d, r9d
mov eax, r15d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, r14
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
test rax, rax
je 0x14000373a
mov r15d, edi
xor edi, edi
add r15, rax
mov eax, dword [rbp + 0x858]
mov qword [rbp + 0x868], r15
mov rcx, r15
test eax, eax
je 0x14000353d
mov edx, eax
imul ebx, ebx, 0x343fd
add ebx, 0x269ec3
mov eax, ebx
shr eax, 0x10
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140003521
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rdi
mov dword [rbp - 0x58], edi
mov qword [rbp - 0x60], rdi
call fcn.140004270
mov ebx, eax
test eax, eax
jne 0x140003731
mov ebx, dword [rbp + 0x850]
mov esi, ebx
mov r9d, 4
mov r8d, 0x1000
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
sub r8d, dword [0x140007080]
cmp r8d, 0x8000
jb 0x1400035cb
mov eax, 0xaaaaaaab
mul r8d
shr edx, 1
lea ecx, [rdx + rdx*2]
sub r8d, ecx
je 0x140003804
mov edi, 0
cmp r8d, 1
je 0x140002e7a
jmp 0x14000356b
mov eax, dword [rbp + 0x858]
lea rcx, [rbp - 0x60]
mov edx, 4
mov dword [rbp - 0x58], eax
mov qword [rbp - 0x60], r15
mov dword [rbp - 0x48], ebx
mov qword [rbp - 0x50], rdi
call fcn.140004390
mov ebx, eax
cmp eax, 1
jne 0x140003713
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
sub r8d, dword [0x140007080]
cmp r8d, 0x8000
jb 0x1400036a4
mov eax, 0xaaaaaaab
mul r8d
shr edx, 1
lea ecx, [rdx + rdx*2]
sub r8d, ecx
je 0x140003804
cmp r8d, ebx
mov ebx, dword [rbp + 0x850]
jne 0x14000356b
xor edi, edi
jmp 0x140002e7a
lea rdx, [0x140001400]
jmp 0x140003079
lea rdx, [0x1400013d0]
jmp 0x140003079
or r8d, 0xffffffff
lea rdx, [0x1400013a0]
lea rcx, [0x140007090]
call fcn.1400028ac
mov edx, dword [rbx + 0x48]
jmp 0x140003945
lea rdx, [0x140001388]
jmp 0x14000392d
lea rdx, [0x140001370]
jmp 0x14000392d
mov rcx, rdi
call fcn.140002b34
mov rbx, rax
test rax, rax
je 0x140003950
mov edx, dword [rbp + 0x850]
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rbp - 0x70]
call fcn.1400029a4
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.140002738
mov rdx, qword [rbp - 0x70]
lea rcx, [0x1400015a8]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rbx
call fcn.140002a68
mov rsi, rax
test rax, rax
jne 0x1400037f7
lea rdx, [0x1400015c0]
jmp 0x140003079
lea rdx, [0x140001578]
or r8d, 0xffffffff
lea rcx, [0x140007090]
call fcn.1400028ac
mov edx, ebx
jmp 0x140003945
lea rdx, [0x140001568]
jmp 0x14000371a
lea rdx, [0x140001550]
jmp 0x14000392d
lea rdx, [0x140001538]
jmp 0x14000392d
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [0x140007050]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword gs:[0x30]
mov edi, eax
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [0x140007058]
test rbx, rbx
jne 0x1400036cd
or r8d, 0xffffffff
lea rdx, [0x140001588]
lea rcx, [0x140007090]
call fcn.1400028ac
lea rcx, [rsp + 0x70]
call fcn.140002440
mov rdx, rax
lea rcx, [0x140007090]
or r8d, 0xffffffff
call fcn.1400028ac
or r8d, 0xffffffff
lea rdx, [0x1400015a0]
lea rcx, [0x140007090]
call fcn.1400028ac
mov edx, edi
jmp 0x140003945
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r14, rax
jmp 0x14000380c
mov rsi, qword [rsp + 0x40]
mov r14, rsi
mov rdi, qword [rsp + 0x60]
xor r15d, r15d
mov qword [rsp + 0x28], r15
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r15d
mov rcx, rdi
lea r8d, [r15 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
test rax, rax
jne 0x140003844
lea rdx, [0x1400015d0]
jmp 0x14000392d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140002970
mov r9d, dword [rbp + 0x860]
mov rdx, rbx
mov rax, qword [rsp + 0x68]
add r9d, 0xffff
mov r8, qword [rsp + 0x58]
and r9d, 0xffff0000
mov qword [rsp + 0x28], rax
mov rcx, r14
mov qword [rsp + 0x20], r13
call rsi
add rsp, 0x908
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rdx, [0x140001528]
jmp 0x140003079
lea rdx, [0x140001518]
jmp 0x140003079
lea rdx, [0x140001508]
jmp 0x140003079
lea rdx, [0x1400014f8]
jmp 0x140003079
lea rdx, [0x1400014e0]
jmp 0x14000392d
or r8d, 0xffffffff
lea rdx, [0x1400014c8]
lea rcx, [0x140007090]
call fcn.1400028ac
mov edx, dword [rsp + 0x58]
mov r8d, 0xa
call fcn.1400027dc
lea rdx, [0x14000127c]
jmp 0x14000371a
lea rdx, [0x1400014b0]
jmp 0x14000392d
lea rdx, [0x140001498]
jmp 0x14000392d
lea rdx, [0x140001480]
jmp 0x14000392d
lea rdx, [0x140001430]
jmp 0x14000392d
lea rdx, [0x140001418]
or r8d, 0xffffffff
lea rcx, [0x140007090]
call fcn.1400028ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov r8d, 0xa
call fcn.1400027dc
lea rcx, [0x1400015f8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, [0x1400015e8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140007090]
mov r10, rax
call fcn.140002440
mov rdx, rax
lea r8, [0x140001610]
mov r9d, 0x10
xor ecx, ecx
call r10
call fcn.140002970
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]