Function at 0x4d1080
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1018
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x1014], eax
cmp byte [0x5dfbe4], 0
je 0x4d10af
cmp byte [esp + 0x1020], 0
je 0x4d14e0
cmp dword [0x589b2c], 0
push esi
je 0x4d10f5
xor ecx, ecx
xor esi, esi
lea ecx, [ecx]
xor byte [esi + str.8g30w1_5r7_2ta], cl
mov eax, 0xaaaaaaab
mul ecx
add ecx, 3
inc esi
shr edx, 1
add ecx, edx
and ecx, 0xffffff
cmp esi, 0x480
jb 0x4d10c0
cmp dword [0x589b2c], 0
je 0x4d1191
jmp 0x4d117d
push 0x4fd
call fcn.004b68d0
mov esi, eax
cmp word [esi], 0x23
jne 0x4d1127
cmp word [esi + 2], 0x23
jne 0x4d1127
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d1113
sub ecx, edx
sar ecx, 1
cmp ecx, 0x64
jae 0x4d112d
mov esi, dword [str.0C69__3V_hwrqw_nlrhbngw.qgshf_clk._kckgvgfa:_Ipitvdg8RBTMEEiambhj_rdgf_gmuqqucswnmk_Peuamiwcbprp__G5_9hwrqw_nlrhbngw.qgshf_clk._kckgvgfa:_Ipitvdg8RBTMEEiambhj_rdgf_gmuqqexvhvbfvftrmhl8_U_vdjltfeuqug8_B__QMoH0V5hwrqw_nlrhbngw.qgshf_clk._kckgvgfa:_Ipitvdg8RBTMEEiambhj_rdgf_dxwkwegwauqlom__Rcwckouadvprf__Ek9]
push 0x1000
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00531c60
add esp, 0xc
lea eax, [esp + 0x18]
push 0x1000
push eax
lea eax, [esi + 4]
push eax
call fcn.004c0d50
lea ecx, [esp + 0x18]
lea edx, [ecx + 1]
jmp 0x4d1160
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d1160
sub ecx, edx
lea eax, [esp + 0x18]
push ecx
push eax
mov ecx, str.8g30w1_5r7_2ta
call fcn.004d05d0
test al, al
jne 0x4d1191
push 0x480
push 0
push str.8g30w1_5r7_2ta
call fcn.00531c60
add esp, 0xc
push ebx
call fcn.0047ebe0
test al, al
jne 0x4d11ad
mov eax, dword [0x59340c]
cmp eax, 0x28
jg 0x4d11a9
test eax, eax
jns 0x4d11ad
mov bl, 1
jmp 0x4d11af
xor bl, bl
cmp byte [esp + 0x1024], 0
je 0x4d14b4
call fcn.00495590
cmp eax, 0x501
ja 0x4d11d9
test dword [0x589b28], 0x200
je 0x4d14de
cmp byte [0x589e98], 0
je 0x4d14de
mov byte [0x589c43], 0
mov byte [0x589d47], 0
mov byte [0x589f97], 0
test bl, bl
jne 0x4d1213
mov al, byte [0x589b28]
and al, 0x80
movzx eax, al
neg eax
sbb eax, eax
and dword [0x589b30], eax
xor bh, bh
cmp dword [0x589b40], 0
jbe 0x4d126f
call fcn.0047ebe0
test al, al
jne 0x4d126f
push 0
push str.RemShown
push str.InterfaceMisc
call fcn.004cf550
cmp eax, dword [0x589b40]
jae 0x4d126f
inc eax
push eax
push str.RemShown
push str.InterfaceMisc
call fcn.004d0410
cmp byte [0x589b44], 0
mov bh, 1
je 0x4d1318
push 0x100
push 0x589b44
jmp 0x4d130e
cmp dword [0x589c44], 0
jbe 0x4d12bd
test bl, bl
je 0x4d12bd
push 0
push str.ExpRemShown
push str.InterfaceMisc
call fcn.004cf550
cmp eax, dword [0x589c44]
jae 0x4d12bd
inc eax
push eax
push str.ExpRemShown
push str.InterfaceMisc
call fcn.004d0410
cmp byte [0x589c48], 0
mov bh, 1
je 0x4d1318
push 0x100
push 0x589c48
jmp 0x4d130e
cmp dword [0x589d48], 0
jbe 0x4d1318
call fcn.0047ebe0
test al, al
je 0x4d1318
push 0
push str.RegRemShown
push str.InterfaceMisc
call fcn.004cf550
cmp eax, dword [0x589d48]
jae 0x4d1318
inc eax
push eax
push str.RegRemShown
push str.InterfaceMisc
call fcn.004d0410
cmp byte [0x589d4c], 0
mov bh, 1
je 0x4d1318
push 0x100
push 0x589d4c
push 0x589e98
call fcn.004bcf80
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov esi, edx
shr esi, 6
call fcn.0047ebe0
test al, al
je 0x4d134b
mov ecx, dword [0x589b3c]
test ecx, ecx
je 0x4d136b
xor edx, edx
mov eax, esi
div ecx
test edx, edx
jne 0x4d136b
jmp 0x4d1373
test bl, bl
jne 0x4d1357
mov ecx, dword [0x589b34]
jmp 0x4d133b
mov ecx, dword [0x589b38]
test ecx, ecx
je 0x4d136b
xor edx, edx
mov eax, esi
div ecx
test edx, edx
je 0x4d1373
test bh, bh
je 0x4d14de
push ebp
push edi
mov edi, dword [0x589b28]
shl edi, 0x11
not edi
and edi, 0x40000
or edi, 0x16c80000
test byte [0x589b28], 8
jne 0x4d139b
or edi, 0x30000
mov eax, dword [0x589e50]
mov ebp, SysReAllocString
mov dword [esp + 0x10], SysStringLen
mov esi, ebp
mov ebx, esi
test eax, eax
je 0x4d144f
cmp dword [0x589e4c], 0
je 0x4d144f
push eax
call fcn.004fd900
push 0x21
mov esi, eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 4
lea ebx, [esi + eax*2]
call dword [sym.imp.USER32.dll_GetSystemMetrics]
add ebx, eax
test byte [0x589b28], 0x40
jne 0x4d13f8
test dword [0x589b28], 0x100
jne 0x4d13fe
add ebx, dword [0x5dfbe0]
push dword [0x589e4c]
call fcn.004fd8a0
push 0x20
mov esi, eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
lea esi, [esi + eax*2]
lea eax, [esp + 0x18]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [esp + 0x1c]
cmp esi, eax
jl 0x4d1431
mov esi, eax
sub eax, esi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
cmp ebx, eax
jl 0x4d1446
mov ebx, eax
sub eax, ebx
cdq
sub eax, edx
mov ebp, eax
sar ebp, 1
push 0x100
push 0x589e98
call fcn.004d0780
push 0
push dword [0x5d275c]
push 0
push 0
push ebx
push esi
push ebp
push dword [esp + 0x2c]
push edi
push 0x55affc
push str.RarReminder
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test byte [0x589b28], 1
pop edi
pop ebp
je 0x4d14a2
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [0x5933f0], 0
je 0x4d14de
mov byte [0x5dfbe4], 1
jmp 0x4d14de
test bl, bl
je 0x4d14de
mov byte [0x5dfbe4], 1
call dword [sym.imp.USER32.dll_GetFocus]
push 0
push 0x5119c0
push eax
push str.REMINDER
push dword [0x5d2758]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop ebx
pop esi
mov ecx, dword [esp + 0x1014]
xor ecx, esp
call fcn.0052f708
add esp, 0x1018
ret 8