Function at 0x4f3c2c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xd0
push 0
push 0
dec ecx
jne 0x4f3c34
push ebx
push esi
push edi
mov byte [ebp - 0x25], dl
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.00405c70
xor eax, eax
push ebp
push 0x4f506e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x2d], 0
mov byte [ebp - 0x2e], 0
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00409dac
mov byte [ebp - 1], 0
mov eax, dword [0x502358]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov ebx, dword [ebp - 0x68]
test ebx, ebx
je 0x4f3c87
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x654]
push eax
mov ecx, ebx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00405ce0
mov eax, dword [ebp - 0x654]
mov edx, dword [0x502358]
mov edx, dword [edx]
call fcn.00405bcc
jne 0x4f3ce3
mov eax, dword [0x502358]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
je 0x4f3cd3
mov eax, dword [ebp - 0x70]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x70]
mov edx, 1
call fcn.00405d20
xor ebx, ebx
mov eax, dword [0x507264]
call fcn.00406eb4
dec eax
test eax, eax
jl 0x4f3d26
inc eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x34], 0
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov esi, dword [eax + edx*4]
mov eax, dword [esi + 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00405bcc
jne 0x4f3d1e
mov dword [ebp - 0x2c], esi
mov bl, 1
jmp 0x4f3d26
inc dword [ebp - 0x34]
dec dword [ebp - 0x60]
jne 0x4f3cff
test bl, bl
jne 0x4f3da8
mov eax, dword [0x507264]
call fcn.00406eb4
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
inc eax
push eax
mov eax, 0x507264
mov ecx, 1
mov edx, dword [0x4f2c80]
call fcn.00407070
add esp, 4
mov dl, 1
mov eax, dword [0x4f2be0]
call fcn.00404928
mov dword [ebp - 0x2c], eax
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x2c]
mov dword [eax + edx*4], ecx
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
add eax, 0x10
mov edx, dword [ebp - 0xc]
call fcn.00405810
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
mov byte [eax + 0x18], 0
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
movzx edx, byte [ebp - 0x25]
mov byte [eax + 0x19], dl
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4f3db4
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x4f3dd6
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0x2a
jne 0x4f3dd6
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, 1
call fcn.00405d20
mov byte [ebp - 0x2d], 1
mov eax, dword [ebp - 8]
test eax, eax
je 0x4f3de2
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x4f3e04
mov eax, dword [ebp - 8]
cmp byte [eax], 0x2a
jne 0x4f3e04
lea eax, [ebp - 8]
mov ecx, 1
mov edx, 1
call fcn.00405d20
mov byte [ebp - 0x2d], 1
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4f3e10
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x4f3e32
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0x23
jne 0x4f3e32
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, 1
call fcn.00405d20
mov byte [ebp - 0x2e], 1
mov eax, dword [ebp - 8]
test eax, eax
je 0x4f3e3e
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x4f3e60
mov eax, dword [ebp - 8]
cmp byte [eax], 0x23
jne 0x4f3e60
lea eax, [ebp - 8]
mov ecx, 1
mov edx, 1
call fcn.00405d20
mov byte [ebp - 0x2e], 1
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
call fcn.00405854
mov eax, dword [ebp - 0x2c]
inc dword [eax + 0x14]
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
cmp dword [eax + 0xc], 0
jne 0x4f5017
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
cmp byte [eax + 0x18], 0
jne 0x4f5017
cmp byte [0x50726c], 0
jne 0x4f3ed2
cmp byte [ebp - 0x25], 0
jne 0x4f3ed2
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x14], 1
jne 0x4f5017
inc dword [0x507270]
jmp 0x4f5017
inc dword [0x507274]
mov eax, dword [0x507268]
call fcn.00487fcc
mov edx, dword [0x507264]
mov ecx, dword [ebp - 0x34]
mov edx, dword [edx + ecx*4]
mov dword [edx + 0xc], eax
push ebp
mov eax, dword [ebp - 8]
call fcn.004f3bc4
pop ecx
test al, al
jne 0x4f3f8e
mov edx, dword [0x502358]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
call fcn.00405acc
push ebp
mov eax, dword [ebp - 8]
call fcn.004f3bc4
pop ecx
test al, al
jne 0x4f3f8e
mov edx, dword [ebp - 0x18]
mov eax, dword [0x507260]
call fcn.00492108
test eax, eax
jl 0x4f3f46
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x18]
call fcn.00405854
mov byte [ebp - 1], 1
jmp 0x4f3f8e
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
mov edx, dword [eax + 0xc]
mov eax, dword [0x507268]
call fcn.00488020
mov edx, eax
mov eax, dword [0x507268]
call fcn.0048804c
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
mov byte [eax + 0x18], 1
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
xor edx, edx
mov dword [eax + 0xc], edx
jmp 0x4f5017
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0xc]
add eax, 0x24
mov edx, dword [ebp - 0xc]
call fcn.00405810
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00405854
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4f3fbe
sub eax, 4
mov eax, dword [eax]
mov edx, eax
sub edx, 4
lea eax, [ebp - 0x10]
call fcn.00405f08
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x10]
call fcn.00405854
xor eax, eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x48], eax
push ebp
lea eax, [ebp - 0x658]
mov ecx, 0x4f5088
mov edx, dword [ebp - 0x10]
call fcn.00405acc
mov eax, dword [ebp - 0x658]
call fcn.004f3bc4
pop ecx
test al, al
je 0x4f41a7
cmp byte [ebp - 1], 0
je 0x4f4127
xor eax, eax
push ebp
push 0x4f4118
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
mov edx, dword [0x5022e0]
mov edx, dword [edx]
call fcn.00405854
push 0xffff
lea eax, [ebp - 0x65c]
mov ecx, 0x4f5094
mov edx, dword [ebp - 0x1c]
call fcn.00405acc
mov ecx, dword [ebp - 0x65c]
mov dl, 1
mov eax, dword [0x41a524]
call fcn.0041e794
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x660]
mov ecx, 0x4f5088
mov edx, dword [ebp - 0x10]
call fcn.00405acc
mov edx, dword [ebp - 0x660]
mov ecx, dword [ebp - 0x50]
mov eax, dword [0x507260]
call fcn.00492370
mov eax, dword [ebp - 0x50]
call fcn.00404958
lea eax, [ebp - 0x664]
mov ecx, 0x4f5094
mov edx, dword [ebp - 0x1c]
call fcn.00405acc
mov edx, dword [ebp - 0x664]
lea eax, [ebp - 0x250]
call fcn.004036b4
lea eax, [ebp - 0x250]
call fcn.00403438
call fcn.00402ecc
lea eax, [ebp - 0x250]
call fcn.00403bd0
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x250]
call fcn.00403d20
call fcn.00402ecc
lea eax, [ebp - 0x250]
call fcn.00403bd0
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x250]
call fcn.00403d20
call fcn.00402ecc
lea eax, [ebp - 0x250]
call fcn.0040377c
call fcn.00402ecc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4f41a7
lea eax, [ebp - 0x668]
mov ecx, 0x4f5088
mov edx, dword [ebp - 0x10]
call fcn.00405acc
mov edx, dword [ebp - 0x668]
lea eax, [ebp - 0x250]
call fcn.004036b4
lea eax, [ebp - 0x250]
call fcn.00403438
call fcn.00402ecc
lea eax, [ebp - 0x250]
call fcn.00403bd0
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x250]
call fcn.00403d20
call fcn.00402ecc
lea eax, [ebp - 0x250]
call fcn.00403bd0
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x250]
call fcn.00403d20
call fcn.00402ecc
lea eax, [ebp - 0x250]
call fcn.0040377c
call fcn.00402ecc
cmp dword [ebp - 0x3c], 0
jne 0x4f41b4
mov dword [ebp - 0x3c], 1
cmp dword [ebp - 0x48], 0
jne 0x4f41c1
mov dword [ebp - 0x48], 1
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0xc]
mov dl, 2
call fcn.00487828
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0xc]
mov dl, 2
call fcn.00487834
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0xc]
mov edx, dword [0x507268]
movzx edx, byte [edx + 0x38]
call fcn.00485f58
mov dl, 1
mov eax, dword [0x426f48]
call fcn.0042cf64
mov esi, eax
cmp byte [ebp - 1], 0
je 0x4f426a
mov dl, 1
mov eax, dword [0x41a628]
call fcn.00404928
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 8]
mov eax, dword [0x507260]
call fcn.00492370
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x4c]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 8]
call fcn.00485440
mov byte [ebp - 0x51], al
movzx ecx, byte [ebp - 0x51]
mov edx, esi
mov eax, dword [ebp - 0x4c]
call fcn.00485514
mov eax, dword [ebp - 0x4c]
call fcn.00404958
jmp 0x4f4276
mov cl, 4
mov edx, esi
mov eax, dword [ebp - 8]
call fcn.00485590
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
cdq
idiv dword [ebp - 0x48]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
cdq
idiv dword [ebp - 0x3c]
lea ecx, [ebp - 0x670]
pop edx
call fcn.00407ed4
lea ecx, [ebp - 0x670]
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0xc]
mov edx, 1
call fcn.00487840
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
cdq
idiv dword [ebp - 0x48]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
cdq
idiv dword [ebp - 0x3c]
lea ecx, [ebp - 0x670]
pop edx
call fcn.00407ed4
lea ecx, [ebp - 0x670]
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0xc]
xor edx, edx
call fcn.00487840
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
cdq
idiv dword [ebp - 0x3c]
add eax, 2
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
and eax, 0x80000001
jns 0x4f4315
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jle 0x4f431c
inc dword [ebp - 0x40]
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
cdq
idiv dword [ebp - 0x48]
add eax, 2
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
and eax, 0x80000001
jns 0x4f433c
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jle 0x4f4343
inc dword [ebp - 0x44]
lea ecx, [ebp - 0x670]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
call fcn.00407ed4
lea edx, [ebp - 0x670]
mov eax, dword [0x507264]
mov ecx, dword [ebp - 0x34]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax + 0xc]
call fcn.00485f44
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x3c]
imul edx, dword [ebp - 0x48]
call fcn.0048786c
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x3c]
imul edx, dword [ebp - 0x48]
call fcn.004862c4
lea edx, [ebp - 0x674]
mov eax, dword [ebp - 8]
call fcn.0040acc0
mov eax, dword [ebp - 0x674]
lea edx, [ebp - 0x14]
call fcn.00409dac
mov eax, dword [ebp - 0x14]
mov edx, 0x4f50a4
call fcn.00405bcc
jne 0x4f4826
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0040ac88
mov edx, dword [ebp - 0x14]
mov eax, 0x4f50b4
call fcn.00405dc4
test eax, eax
je 0x4f45f8
mov edx, dword [ebp - 0x14]
mov eax, 0x4f50b4
call fcn.00405dc4
mov edx, eax
lea eax, [ebp - 0x14]
mov ecx, 0x3e8
call fcn.00405d20
cmp dword [ebp - 0x14], 0
je 0x4f45f8
lea edx, [ebp - 0x678]
mov eax, dword [ebp - 8]
call fcn.0040ac54
push dword [ebp - 0x678]
push dword [ebp - 0x14]
push 0x4f50c0
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405b40
push ebp
mov eax, dword [ebp - 0x10]
call fcn.004f3bc4
pop ecx
test al, al
je 0x4f45f8
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
imul ebx, eax
push ebx
lea eax, [ebp - 0x24]
mov ecx, 1
mov edx, dword [0x4f3ba0]
call fcn.00407070
add esp, 4
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
inc eax
sar eax, 1
jns 0x4f448a
adc eax, 0
add eax, eax
mov dword [ebp - 0x38], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
imul dword [ebp - 0x38]
push eax
lea eax, [ebp - 0x20]
mov ecx, 1
mov edx, dword [0x4f3b7c]
call fcn.00407070
add esp, 4
mov eax, dword [ebp - 0x20]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
imul dword [ebp - 0x38]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x68]
push eax
call sub.GDI32.dll_GetBitmapBits
cmp byte [ebp - 1], 0
je 0x4f4520
mov dl, 1
mov eax, dword [0x41a628]
call fcn.00404928
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x10]
mov eax, dword [0x507260]
call fcn.00492370
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x4c]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00485440
mov byte [ebp - 0x51], al
movzx ecx, byte [ebp - 0x51]
mov edx, esi
mov eax, dword [ebp - 0x4c]
call fcn.00485514
mov eax, dword [ebp - 0x4c]
call fcn.00404958
jmp 0x4f452c
mov cl, 4
mov edx, esi
mov eax, dword [ebp - 0x10]
call fcn.00485590
mov dl, 7
mov eax, esi
call fcn.0042e4b8
mov eax, dword [ebp - 0x24]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
imul ebx, eax
mov eax, ebx
add eax, eax
add eax, eax
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x68]
push eax
call sub.GDI32.dll_GetBitmapBits
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
dec eax
test eax, eax
jl 0x4f45cd
inc eax
mov dword [ebp - 0x60], eax
xor edi, edi
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
dec eax
test eax, eax
jl 0x4f45c7
inc eax
mov dword [ebp - 0x64], eax
xor ebx, ebx
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
imul ebx
add eax, edi
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + eax*4]
and eax, 0xffffff
mov edx, ebx
imul edx, dword [ebp - 0x38]
add edx, edi
mov ecx, dword [ebp - 0x20]
movzx edx, byte [ecx + edx]
shl edx, 0x18
or eax, edx
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
imul ebx
add eax, edi
mov edx, dword [ebp - 0x24]
pop ecx
mov dword [edx + eax*4], ecx
inc ebx
dec dword [ebp - 0x64]
jne 0x4f4584
inc edi
dec dword [ebp - 0x60]
jne 0x4f4572
mov eax, dword [ebp - 0x24]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
imul ebx, eax
mov eax, ebx
add eax, eax
add eax, eax
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x68]
push eax
call sub.GDI32.dll_SetBitmapBits
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0040ac88
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
je 0x4f461a
mov eax, dword [ebp - 0x74]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov edx, dword [ebp - 0x74]
sub edx, 3
lea eax, [ebp - 0x14]
mov ecx, 4
call fcn.00405d20
lea eax, [ebp - 0x14]
mov edx, 0x4f50b4
call fcn.00405a88
cmp dword [ebp - 0x14], 0
je 0x4f4826
lea edx, [ebp - 0x67c]
mov eax, dword [ebp - 8]
call fcn.0040ac54
push dword [ebp - 0x67c]
push dword [ebp - 0x14]
push 0x4f50c0
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405b40
push ebp
mov eax, dword [ebp - 0x10]
call fcn.004f3bc4
pop ecx
test al, al
je 0x4f4826
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
imul ebx, eax
push ebx
lea eax, [ebp - 0x24]
mov ecx, 1
mov edx, dword [0x4f3ba0]
call fcn.00407070
add esp, 4
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
inc eax
sar eax, 1
jns 0x4f46b8
adc eax, 0
add eax, eax
mov dword [ebp - 0x38], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
imul dword [ebp - 0x38]
push eax
lea eax, [ebp - 0x20]
mov ecx, 1
mov edx, dword [0x4f3b7c]
call fcn.00407070
add esp, 4
mov eax, dword [ebp - 0x20]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
imul dword [ebp - 0x38]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x68]
push eax
call sub.GDI32.dll_GetBitmapBits
cmp byte [ebp - 1], 0
je 0x4f474e
mov dl, 1
mov eax, dword [0x41a628]
call fcn.00404928
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x10]
mov eax, dword [0x507260]
call fcn.00492370
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x4c]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00485440
mov byte [ebp - 0x51], al
movzx ecx, byte [ebp - 0x51]
mov edx, esi
mov eax, dword [ebp - 0x4c]
call fcn.00485514
mov eax, dword [ebp - 0x4c]
call fcn.00404958
jmp 0x4f475a
mov cl, 4
mov edx, esi
mov eax, dword [ebp - 0x10]
call fcn.00485590
mov dl, 7
mov eax, esi
call fcn.0042e4b8
mov eax, dword [ebp - 0x24]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
imul ebx, eax
mov eax, ebx
add eax, eax
add eax, eax
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x68]
push eax
call sub.GDI32.dll_GetBitmapBits
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
dec eax
test eax, eax
jl 0x4f47fb
inc eax
mov dword [ebp - 0x60], eax
xor edi, edi
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
dec eax
test eax, eax
jl 0x4f47f5
inc eax
mov dword [ebp - 0x64], eax
xor ebx, ebx
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
imul ebx
add eax, edi
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + eax*4]
and eax, 0xffffff
mov edx, ebx
imul edx, dword [ebp - 0x38]
add edx, edi
mov ecx, dword [ebp - 0x20]
movzx edx, byte [ecx + edx]
shl edx, 0x18
or eax, edx
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
imul ebx
add eax, edi
mov edx, dword [ebp - 0x24]
pop ecx
mov dword [edx + eax*4], ecx
inc ebx
dec dword [ebp - 0x64]
jne 0x4f47b2
inc edi
dec dword [ebp - 0x60]
jne 0x4f47a0
mov eax, dword [ebp - 0x24]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
imul ebx, eax
mov eax, ebx
add eax, eax
add eax, eax
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x68]
push eax
call sub.GDI32.dll_SetBitmapBits
mov eax, dword [ebp - 0x14]
mov edx, 0x4f50d0
call fcn.00405bcc
jne 0x4f4a6a
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0040ac88
mov edx, dword [ebp - 0x14]
mov eax, 0x4f50b4
call fcn.00405dc4
test eax, eax
je 0x4f4a6a
mov edx, dword [ebp - 0x14]
mov eax, 0x4f50b4
call fcn.00405dc4
mov edx, eax
lea eax, [ebp - 0x14]
mov ecx, 0x3e8
call fcn.00405d20
cmp dword [ebp - 0x14], 0
je 0x4f4a6a
lea edx, [ebp - 0x680]
mov eax, dword [ebp - 8]
call fcn.0040ac54
push dword [ebp - 0x680]
push dword [ebp - 0x14]
push 0x4f50e0
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00405b40
push ebp
mov eax, dword [ebp - 0x10]
call fcn.004f3bc4
pop ecx
test al, al
je 0x4f4a6a
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
imul ebx, eax
push ebx
lea eax, [ebp - 0x24]
mov ecx, 1
mov edx, dword [0x4f3ba0]
call fcn.00407070
add esp, 4
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
inc eax
sar eax, 1
jns 0x4f48f3
adc eax, 0
add eax, eax
mov dword [ebp - 0x38], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
imul dword [ebp - 0x38]
push eax
lea eax, [ebp - 0x20]
mov ecx, 1
mov edx, dword [0x4f3b7c]
call fcn.00407070
add esp, 4
mov dl, 7
mov eax, esi
call fcn.0042e4b8
mov eax, dword [ebp - 0x24]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
imul ebx, eax
mov eax, ebx
add eax, eax
add eax, eax
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x68]
push eax
call sub.GDI32.dll_GetBitmapBits
cmp byte [ebp - 1], 0
je 0x4f49a1
mov dl, 1
mov eax, dword [0x41a628]
call fcn.00404928
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x10]
mov eax, dword [0x507260]
call fcn.00492370
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x4c]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00485440
mov byte [ebp - 0x51], al
movzx ecx, byte [ebp - 0x51]
mov edx, esi
mov eax, dword [ebp - 0x4c]
call fcn.00485514
mov eax, dword [ebp - 0x4c]
call fcn.00404958
jmp 0x4f49ad
mov cl, 4
mov edx, esi
mov eax, dword [ebp - 0x10]
call fcn.00485590
mov eax, dword [ebp - 0x20]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
imul dword [ebp - 0x38]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x68]
push eax
call sub.GDI32.dll_GetBitmapBits
mov dl, 7
mov eax, esi
call fcn.0042e4b8
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
dec eax
test eax, eax
jl 0x4f4a3f
inc eax
mov dword [ebp - 0x60], eax
xor edi, edi
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
dec eax
test eax, eax
jl 0x4f4a39
inc eax
mov dword [ebp - 0x64], eax
xor ebx, ebx
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
imul ebx
add eax, edi
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + eax*4]
and eax, 0xffffff
mov edx, ebx
imul edx, dword [ebp - 0x38]
add edx, edi
mov ecx, dword [ebp - 0x20]
movzx edx, byte [ecx + edx]
shl edx, 0x18
or eax, edx
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
imul ebx
add eax, edi
mov edx, dword [ebp - 0x24]
pop ecx
mov dword [edx + eax*4], ecx
inc ebx
dec dword [ebp - 0x64]
jne 0x4f49f6
inc edi
dec dword [ebp - 0x60]
jne 0x4f49e4
mov eax, dword [ebp - 0x24]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
imul ebx, eax
mov eax, ebx
add eax, eax
add eax, eax
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x68]
push eax
call sub.GDI32.dll_SetBitmapBits
mov eax, esi
call fcn.0042d624
cmp al, 7
jne 0x4f4e6e
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
dec eax
mov edx, dword [0x507264]
mov ecx, dword [ebp - 0x34]
mov edx, dword [edx + ecx*4]
mov dword [edx + 0x1a], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
dec eax
mov edx, dword [0x507264]
mov ecx, dword [ebp - 0x34]
mov edx, dword [edx + ecx*4]
mov dword [edx + 0x1e], eax
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
xor edx, edx
mov dword [eax + 0x22], edx
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
xor edx, edx
mov dword [eax + 0x26], edx
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
imul ebx, eax
push ebx
lea eax, [ebp - 0x24]
mov ecx, 1
mov edx, dword [0x4f3ba0]
call fcn.00407070
add esp, 4
mov eax, dword [ebp - 0x24]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
imul ebx, eax
mov eax, ebx
add eax, eax
add eax, eax
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x68]
push eax
call sub.GDI32.dll_GetBitmapBits
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
dec eax
test eax, eax
jl 0x4f4bda
inc eax
mov dword [ebp - 0x60], eax
xor edi, edi
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
dec eax
test eax, eax
jl 0x4f4bd0
inc eax
mov dword [ebp - 0x64], eax
xor ebx, ebx
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
imul ebx
add eax, edi
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + eax*4]
shr eax, 0x18
je 0x4f4bc6
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
mov edx, dword [eax + 0x1a]
cmp edi, edx
jle 0x4f4b75
mov dword [ebp - 0x78], edx
jmp 0x4f4b78
mov dword [ebp - 0x78], edi
mov edx, dword [ebp - 0x78]
mov dword [eax + 0x1a], edx
mov edx, dword [eax + 0x22]
cmp edi, edx
jge 0x4f4b8a
mov dword [ebp - 0x7c], edx
jmp 0x4f4b8d
mov dword [ebp - 0x7c], edi
mov edx, dword [ebp - 0x7c]
mov dword [eax + 0x22], edx
mov edx, dword [eax + 0x1e]
cmp ebx, edx
jle 0x4f4b9f
mov dword [ebp - 0x80], edx
jmp 0x4f4ba2
mov dword [ebp - 0x80], ebx
mov edx, dword [ebp - 0x80]
mov dword [eax + 0x1e], edx
mov edx, dword [eax + 0x26]
cmp ebx, edx
jge 0x4f4bb7
mov dword [ebp - 0x84], edx
jmp 0x4f4bbd
mov dword [ebp - 0x84], ebx
mov edx, dword [ebp - 0x84]
mov dword [eax + 0x26], edx
inc ebx
dec dword [ebp - 0x64]
jne 0x4f4b48
inc edi
dec dword [ebp - 0x60]
jne 0x4f4b32
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0x22]
mov edx, dword [0x507264]
mov ecx, dword [ebp - 0x34]
mov edx, dword [edx + ecx*4]
cmp eax, dword [edx + 0x1a]
jl 0x4f4c18
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0x26]
mov edx, dword [0x507264]
mov ecx, dword [ebp - 0x34]
mov edx, dword [edx + ecx*4]
cmp eax, dword [edx + 0x1e]
jge 0x4f4c66
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
dec eax
mov edx, dword [0x507264]
mov ecx, dword [ebp - 0x34]
mov edx, dword [edx + ecx*4]
mov dword [edx + 0x22], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
dec eax
mov edx, dword [0x507264]
mov ecx, dword [ebp - 0x34]
mov edx, dword [edx + ecx*4]
mov dword [edx + 0x26], eax
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
xor edx, edx
mov dword [eax + 0x1a], edx
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
xor edx, edx
mov dword [eax + 0x1e], edx
cmp byte [ebp - 0x2d], 0
je 0x4f4d3b
mov eax, dword [ebp - 0x24]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
imul ebx, eax
mov eax, ebx
add eax, eax
add eax, eax
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x68]
push eax
call sub.GDI32.dll_GetBitmapBits
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
dec eax
test eax, eax
jl 0x4f4d10
inc eax
mov dword [ebp - 0x60], eax
xor edi, edi
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
dec eax
test eax, eax
jl 0x4f4d0a
inc eax
mov dword [ebp - 0x64], eax
xor ebx, ebx
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
imul ebx
add eax, edi
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + eax*4]
shr eax, 0x18
mov dword [ebp - 0x58], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
imul ebx
add eax, edi
mov edx, dword [ebp - 0x24]
lea eax, [edx + eax*4]
push eax
mov eax, dword [ebp - 0x58]
shl eax, 8
or eax, dword [ebp - 0x58]
mov edx, dword [ebp - 0x58]
shl edx, 0x10
or eax, edx
mov edx, dword [ebp - 0x58]
shl edx, 0x18
or eax, edx
pop edx
mov dword [edx], eax
inc ebx
dec dword [ebp - 0x64]
jne 0x4f4cbf
inc edi
dec dword [ebp - 0x60]
jne 0x4f4cad
mov eax, dword [ebp - 0x24]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
imul ebx, eax
mov eax, ebx
add eax, eax
add eax, eax
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x68]
push eax
call sub.GDI32.dll_SetBitmapBits
cmp byte [ebp - 0x2e], 0
je 0x4f4ebc
mov eax, dword [ebp - 0x24]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
imul ebx, eax
mov eax, ebx
add eax, eax
add eax, eax
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x68]
push eax
call sub.GDI32.dll_GetBitmapBits
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
dec eax
test eax, eax
jl 0x4f4e41
inc eax
mov dword [ebp - 0x60], eax
xor edi, edi
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
dec eax
test eax, eax
jl 0x4f4e37
inc eax
mov dword [ebp - 0x64], eax
xor ebx, ebx
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
imul ebx
add eax, edi
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
and eax, 0xff
mov edx, dword [ebp - 0x58]
shr edx, 8
and edx, 0xff
add eax, edx
mov edx, dword [ebp - 0x58]
shr edx, 0x10
and edx, 0xff
add eax, edx
mov dword [ebp - 0x670], eax
xor eax, eax
mov dword [ebp - 0x66c], eax
fild qword [ebp - 0x670]
fld dword [0x4f50e8]
call fcn.00403928
call fcn.00403394
mov dword [ebp - 0x5c], eax
shr dword [ebp - 0x58], 0x18
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
imul ebx
add eax, edi
mov edx, dword [ebp - 0x24]
lea eax, [edx + eax*4]
push eax
mov eax, dword [ebp - 0x5c]
shl eax, 8
or eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x5c]
shl edx, 0x10
or eax, edx
mov edx, dword [ebp - 0x58]
shl edx, 0x18
or eax, edx
pop edx
mov dword [edx], eax
inc ebx
dec dword [ebp - 0x64]
jne 0x4f4d9c
inc edi
dec dword [ebp - 0x60]
jne 0x4f4d86
mov eax, dword [ebp - 0x24]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
imul ebx, eax
mov eax, ebx
add eax, eax
add eax, eax
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x68]
push eax
call sub.GDI32.dll_SetBitmapBits
jmp 0x4f4ebc
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
dec eax
mov edx, dword [0x507264]
mov ecx, dword [ebp - 0x34]
mov edx, dword [edx + ecx*4]
mov dword [edx + 0x22], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
dec eax
mov edx, dword [0x507264]
mov ecx, dword [ebp - 0x34]
mov edx, dword [edx + ecx*4]
mov dword [edx + 0x26], eax
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
xor edx, edx
mov dword [eax + 0x1a], edx
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
xor edx, edx
mov dword [eax + 0x1e], edx
push 0
lea eax, [ebp - 0x24]
mov ecx, 1
mov edx, dword [0x4f3ba0]
call fcn.00407070
add esp, 4
push 0
lea eax, [ebp - 0x20]
mov ecx, 1
mov edx, dword [0x4f3b7c]
call fcn.00407070
add esp, 4
push 0
push 0
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0xc]
xor ecx, ecx
mov edx, esi
call fcn.004879b0
test al, al
jne 0x4f4f4e
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
mov edx, dword [eax + 0xc]
mov eax, dword [0x507268]
call fcn.00488020
mov edx, eax
mov eax, dword [0x507268]
call fcn.0048804c
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
mov byte [eax + 0x18], 1
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
imul ebx, eax
mov eax, ebx
add eax, eax
add eax, eax
mov edx, dword [0x507264]
mov ecx, dword [ebp - 0x34]
mov edx, dword [edx + ecx*4]
mov dword [edx + 8], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ebx, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
imul ebx, eax
mov eax, ebx
add eax, eax
add eax, eax
add dword [0x507280], eax
mov eax, esi
call fcn.00404958
mov eax, dword [0x507264]
mov edx, dword [ebp - 0x34]
mov eax, dword [eax + edx*4]
mov edx, dword [0x50727c]
mov dword [eax + 4], edx
mov eax, dword [0x501e24]
mov eax, dword [eax]
cmp dword [eax + 0x110], 0x17d7840
jle 0x4f5001
mov eax, dword [0x507280]
mov dword [ebp - 0x670], eax
xor eax, eax
mov dword [ebp - 0x66c], eax
fild qword [ebp - 0x670]
mov eax, dword [0x501e24]
mov eax, dword [eax]
fild dword [eax + 0x110]
call fcn.00403928
fld xword [0x4f50ec]
fcompp
wait
fnstsw ax
sahf
jae 0x4f5001
call fcn.004f3a60
mov eax, dword [0x5023a0]
cmp byte [eax], 0
je 0x4f5017
mov eax, dword [0x501e24]
mov eax, dword [eax]
call fcn.004a3724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f5075
lea eax, [ebp - 0x680]
mov edx, 4
call fcn.004057e0
lea eax, [ebp - 0x668]
mov edx, 6
call fcn.004057e0
lea eax, [ebp - 0x24]
mov edx, dword [0x4f3ba0]
call fcn.0040707c
lea eax, [ebp - 0x20]
mov edx, dword [0x4f3b7c]
call fcn.0040707c
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.004057e0
ret