Function at 0x4f98c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0xf64]
sub esp, 0xf64
push 0xffffffffffffffff
push 0x554101
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x58cb30]
xor eax, ebp
mov dword [ebp + 0xf60], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xf78]
mov ebx, dword [ebp + 0xf70]
mov edi, dword [ebp + 0xf6c]
push 0x200
mov dword [ebp - 0x38], eax
xor eax, eax
push eax
mov word [ebp + 0xb30], ax
lea eax, [ebp + 0x930]
push eax
push str.PasswordData
push ebx
mov dword [ebp - 0x10], ebx
call fcn.004d0040
test eax, eax
jne 0x4f9a1e
push 0x400
push eax
lea eax, [ebp + 0x530]
push eax
call fcn.00532770
add esp, 0xc
lea eax, [ebp + 0x530]
push 0x400
push 0
push eax
push str.PasswordWide
push ebx
call fcn.004d0040
mov edx, eax
test edx, edx
jne 0x4f99d1
push 0x400
push eax
mov byte [ebp + 0x530], al
lea eax, [ebp + 0x530]
push eax
push str.Password
push ebx
call fcn.004d0040
xor edx, edx
test eax, eax
jle 0x4f99a3
lea ecx, [edx + 0x49]
xor byte [ebp + edx + 0x530], cl
je 0x4f99a3
inc edx
cmp edx, eax
jl 0x4f9992
push 0x200
lea eax, [ebp + 0xb30]
push eax
lea eax, [ebp + 0x530]
push eax
call fcn.004c1480
push 0x400
lea eax, [ebp + 0x530]
push eax
call fcn.004baf90
jmp 0x4f9c9d
xor ecx, ecx
test edx, edx
jle 0x4f99f0
jmp 0x4f99e0
mov al, cl
add al, 0x49
xor byte [ebp + ecx + 0x530], al
inc ecx
cmp ecx, edx
jl 0x4f99e0
push 0x200
lea eax, [ebp + 0xb30]
push eax
lea eax, [ebp + 0x530]
push eax
call fcn.004c1590
push 0x400
lea eax, [ebp + 0x530]
push eax
call fcn.004baf90
jmp 0x4f9c9d
lea ecx, [ebp - 0x30]
call fcn.004a79a0
mov dword [ebp - 4], 0
lea eax, [ebp + 0x930]
push 0x200
push eax
lea ecx, [ebp - 0x30]
call fcn.004a7ef0
lea ecx, [ebp - 0x30]
call fcn.004a7a30
cmp al, 1
jne 0x4f9c86
lea ecx, [ebp - 0x30]
call fcn.004a7a90
mov esi, eax
lea ecx, [ebp - 0x30]
push 0x10
lea eax, [ebp + 0xf30]
shr esi, 0x18
push eax
mov dword [ebp - 0x34], esi
call fcn.004a7be0
push 0x10
lea eax, [ebp + 0xf40]
push eax
lea ecx, [ebp - 0x30]
call fcn.004a7be0
push 8
lea eax, [ebp + 0xf58]
push eax
lea ecx, [ebp - 0x30]
call fcn.004a7be0
lea ecx, [ebp]
call fcn.00483630
mov byte [ebp - 4], 1
xor bl, bl
lea ecx, [ebp - 0x48]
call fcn.004ba930
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
cmp byte [0x5f53d0], 0
je 0x4f9ad8
push dword [ebp - 0x10]
push dword [0x5f53c8]
push dword [0x5f53c4]
call fcn.00404d10
mov al, byte [0x5f53d0]
mov byte [ebp - 0x3c], al
jmp 0x4f9ae2
push 0x55b978
call fcn.004baf20
lea eax, [ebp + 0xf50]
push eax
push 0
push esi
lea eax, [ebp + 0xf40]
push eax
lea eax, [ebp + 0xf30]
push eax
lea eax, [ebp - 0x48]
push eax
push 5
push 0
lea ecx, [ebp]
call fcn.00483e80
lea ecx, [ebp + 0xf58]
mov eax, dword [ecx]
lea edx, [ebp + 0xf50]
cmp eax, dword [edx]
jne 0x4f9b28
mov eax, dword [ecx + 4]
cmp eax, dword [edx + 4]
jne 0x4f9b28
xor al, al
jmp 0x4f9b2a
mov al, 1
test al, al
je 0x4f9b96
test bl, bl
je 0x4f9b57
push 0x66
call fcn.004b7300
push 0x606
mov esi, eax
call fcn.004b7300
push 0
push esi
push eax
push dword [0x5943e8]
call fcn.004feae0
mov esi, dword [ebp - 0x34]
push dword [ebp - 0x38]
push 0
push 0x5f53c4
push edi
call fcn.00465100
test al, al
je 0x4f9b7e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.004baa00
mov bl, 1
jmp 0x4f9aa2
mov byte [0x5b12de], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.004baa00
jmp 0x4f9c46
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.004baa00
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp]
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x18]
push edx
push eax
call fcn.00483c50
lea ecx, [ebp - 0x30]
call fcn.004a7a50
movzx esi, ax
lea ecx, [ebp - 0x30]
lea eax, [ebp + 0xb30]
cmp esi, 0x200
jae 0x4f9bf3
push esi
push eax
call fcn.004a7d30
cmp esi, 0x1ff
jae 0x4f9bfe
add esi, esi
cmp esi, 0x400
jae 0x4f9d34
jmp 0x4f9c03
push 0x200
push eax
call fcn.004a7d30
mov esi, 0x3fe
push dword [ebp - 0x18]
xor eax, eax
push dword [ebp - 0x30]
mov word [ebp + esi + 0xb30], ax
push 0xffffffffffffffff
call fcn.00482e80
mov esi, eax
lea ecx, [ebp - 0x30]
not esi
call fcn.004a7a90
cmp esi, eax
je 0x4f9c46
xor eax, eax
push 0x5d0
mov word [ebp + 0xb30], ax
call fcn.004b7300
push eax
call fcn.005037c0
add esp, 4
push dword [ebp - 0x1c]
push dword [ebp - 0x30]
call fcn.004baf90
mov byte [ebp - 4], 3
lea eax, [ebp + 0xf4]
push 0x464920
push 4
push 0x84
push eax
call fcn.00530503
mov byte [ebp - 4], 0
lea eax, [ebp]
push 0x4648a0
push 4
push 0x3c
push eax
call fcn.00530503
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x4f9c9d
push eax
call fcn.0053867f
add esp, 4
cmp byte [ebp + 0xf74], 0
je 0x4f9cc1
cmp byte [0x5b4504], 0
jne 0x4f9cfe
cmp byte [0x5aaf00], 0
jne 0x4f9cfe
cmp byte [0x5b22fb], 0
jne 0x4f9cfe
lea eax, [ebp + 0xb30]
mov ecx, 0x5b44f8
push eax
call fcn.004baf20
push 0
push str.EncryptHeaders
push ebx
call fcn.004cffa0
push 0
test eax, eax
push str.ZipLegacyEncrypt
push ebx
setne byte [0x5aaf00]
call fcn.004cffa0
test eax, eax
setne byte [0x5b22fb]
push 0x400
lea eax, [ebp + 0xb30]
push eax
call fcn.004baf90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xf60]
xor ecx, ebp
call fcn.00530218
lea esp, [ebp + 0xf64]
pop ebp
ret 0x10
call fcn.0053013d
int3