Function at 0x140016480
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push rbx
push rbp
sub rsp, 0x48
mov rbx, qword [rcx + 0x818]
mov rbp, rcx
mov rbx, qword [rbx]
cmp byte [rbx + 0x1f5c], 0
je 0x1400164a6
xor eax, eax
add rsp, 0x48
pop rbp
pop rbx
ret
mov rax, qword [rbx + 0x70]
test byte [rax + 0x7e], 8
jne 0x1400164d7
mov r9, qword [rbx + 0x78]
cmp r9, 0xc
jge 0x1400164d7
lea r8, str.Truncated_Zip_encrypted_body:_only__jd_bytes_available
mov edx, 0x2a
call fcn.14003edd0
mov eax, 0xffffffe2
add rsp, 0x48
pop rbp
pop rbx
ret
xor r8d, r8d
mov qword [rsp + 0x30], r15
lea edx, [r8 + 0xc]
call fcn.140048400
mov r15, rax
mov rcx, rbp
test rax, rax
jne 0x140016512
lea r8, str.Truncated_ZIP_file_data
lea edx, [rax + 0x2a]
call fcn.14003edd0
lea eax, [r15 - 0x1e]
mov r15, qword [rsp + 0x30]
add rsp, 0x48
pop rbp
pop rbx
ret
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r14
xor r14d, r14d
call fcn.140048f20
mov rsi, rax
test rax, rax
je 0x1400166b7
lea rax, [rsp + 0x20]
sub r15, rax
nop dword [rax]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140016547
mov dword [rbx + 0x1f50], 0x12345678
mov ecx, 0x34567890
mov dword [rbx + 0x1f54], 0x23456789
mov dword [rbx + 0x1f58], 0x34567890
test rdi, rdi
je 0x1400165f1
nop dword [rax + rax]
mov ecx, dword [rbx + 0x1f50]
lea rdx, [rsp + 0x60]
movzx eax, byte [rsi]
not ecx
mov r8d, 1
mov byte [rsp + 0x60], al
call fcn.14003b4d0
not eax
lea rdx, [rsp + 0x68]
mov dword [rbx + 0x1f50], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 0x1f54]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 0x1f54], ecx
shr ecx, 0x18
mov byte [rsp + 0x68], cl
mov ecx, dword [rbx + 0x1f58]
not ecx
call fcn.14003b4d0
lea rsi, [rsi + 1]
mov ecx, eax
not ecx
mov dword [rbx + 0x1f58], ecx
sub rdi, 1
jne 0x140016580
lea rdi, [rsp + 0x20]
mov esi, ntohl
nop dword [rax + rax]
or ecx, 2
lea rdx, [rsp + 0x60]
mov eax, ecx
mov r8d, 1
xor eax, 1
imul eax, ecx
mov ecx, dword [rbx + 0x1f50]
not ecx
shr eax, 8
xor al, byte [r15 + rdi]
mov byte [rdi], al
mov byte [rsp + 0x60], al
call fcn.14003b4d0
not eax
lea rdx, [rsp + 0x70]
mov dword [rbx + 0x1f50], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 0x1f54]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 0x1f54], ecx
shr ecx, 0x18
mov byte [rsp + 0x70], cl
mov ecx, dword [rbx + 0x1f58]
not ecx
call fcn.14003b4d0
lea rdi, [rdi + 1]
mov ecx, eax
not ecx
mov dword [rbx + 0x1f58], ecx
sub rsi, 1
jne 0x140016600
mov rax, qword [rbx + 0x70]
movzx ecx, byte [rax + 0x83]
cmp byte [rsp + 0x2b], cl
mov rcx, rbp
je 0x140016702
cmp r14d, 0x2710
jg 0x1400166f9
inc r14d
call fcn.140048f20
mov rsi, rax
test rax, rax
jne 0x140016540
test r14d, r14d
lea rax, str.Incorrect_passphrase
lea r8, str.Passphrase_required_for_this_entry
mov rcx, rbp
cmovg r8, rax
mov edx, 0xffffffff
call fcn.14003edd0
mov eax, 0xffffffe7
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x30]
add rsp, 0x48
pop rbp
pop rbx
ret
lea r8, str.Too_many_incorrect_passphrases
jmp 0x1400166cf
mov edx, ntohl
call fcn.140048a30
mov rax, qword [rbx + 0x70]
mov byte [rbx + 0x1f5c], 1
test byte [rax + 0x7e], 8
jne 0x140016722
add qword [rbx + 0x78], 0xfffffffffffffff4
add qword [rbx + 0x80], 0xc
mov rcx, rbp
mov qword [rbx + 0x1f40], 0
call fcn.140016400
jmp 0x1400166de