Function at 0x556d60
Capabilities:
Access peb ldr_data
Encrypt data using rc4 ksa

Disassembly:
push 0xffffffffffffffff
push 0x5e1a88
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x680f10]
xor eax, esp
mov dword [esp + 0x278], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x680f10]
xor eax, esp
push eax
lea eax, [esp + 0x290]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2a0]
mov edx, dword [esp + 0x2cc]
mov edi, ecx
mov ecx, dword [esp + 0x2c4]
mov dword [esp + 0x38], ecx
mov ecx, dword [edi + 0x10]
mov dword [esp + 0x44], eax
mov eax, dword [ecx]
mov dword [esp + 0x18], edx
mov edx, dword [eax + 0x20]
mov dword [esp + 0x28], edi
call edx
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x50]
call eax
mov edi, dword [edi + 0x20]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x2bc]
lea esi, [eax + eax*2]
lea esi, [esi*8 + 0x1f]
shr esi, 3
and esi, 0x1ffffffc
push edi
mov dword [esp + 0x24], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, dword [esp + 0x2c0]
mov ebp, eax
mov eax, ebx
cdq
mov edi, eax
xor edi, edx
sub edi, edx
mov ecx, edi
imul ecx, esi
add ecx, 0x28
push ecx
call fcn.00427501
mov edx, dword [esp + 0x2c0]
mov esi, eax
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
add esp, 4
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
push eax
mov dword [esi + 0x24], eax
push eax
lea eax, [esp + 0x90]
push eax
push 0
push esi
neg ebx
push ebp
mov dword [esi], 0x28
mov dword [esi + 4], edx
mov dword [esi + 8], ebx
mov word [esi + 0xe], 0x18
mov word [esi + 0xc], 1
call dword [sym.imp.GDI32.dll_CreateDIBSection]
push eax
push ebp
mov dword [esp + 0x2c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x30], eax
mov eax, dword [ecx + 8]
cdq
xor eax, edx
sub eax, edx
cmp edi, eax
je 0x556f0b
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edx, dword [esp + 0x18]
push 0
mov ebx, eax
mov eax, dword [esp + 0x3c]
push eax
push edx
push 4
push eax
push ebp
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
push eax
push ebx
mov dword [esp + 0x1c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x2b4]
mov edx, dword [esp + 0x2bc]
push 0xcc0020
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x2bc]
push eax
push ecx
push ebx
push edi
push edx
push 0
push 0
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x2c]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x556f40
mov eax, dword [esp + 0x18]
push 0xcc0020
push 0
mov edx, ecx
mov ecx, dword [esp + 0x2c0]
push edx
mov edx, dword [esp + 0x2c0]
push eax
mov eax, dword [esp + 0x2cc]
push edi
push eax
push ecx
push edx
push edi
push eax
push 0
push 0
push ebp
call dword [sym.imp.GDI32.dll_StretchDIBits]
mov eax, dword [esp + 0x30]
push eax
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
mov ebx, dword [esp + 0x24]
push 0
push esi
lea eax, [esi + 0x28]
push eax
push edi
push 0
push ebx
push ebp
call dword [sym.imp.GDI32.dll_GetDIBits]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ebx, dword [esp + 0x28]
cmp dword [ebx + 0x15c], 0
jne 0x556f8f
mov ecx, dword [ebx + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
push 0
call eax
mov dword [ebx + 0x15c], eax
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
cdq
mov ebp, eax
xor ebp, edx
push 0x10
mov dword [esp + 0x38], ecx
sub ebp, edx
call sub.gdiplus.dll_GdipAlloc
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x24], 0
je 0x5573c9
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x24]
push edx
push 0
push 0x26200a
push 0
push ebp
push eax
mov dword [ebx], vtable.Gdiplus::Bitmap.0
call sub.gdiplus.dll_GdipCreateBitmapFromScan0
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x34]
mov dword [ebx + 8], eax
xor eax, eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x48]
push eax
push 0x26200a
mov dword [ebx + 4], ecx
push 2
lea ecx, [esp + 0x74]
mov dword [esp + 0x7c], edx
mov edx, dword [ebx + 4]
push ecx
push edx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x88], ebp
call sub.gdiplus.dll_GdipBitmapLockBits
test eax, eax
je 0x557024
mov dword [ebx + 8], eax
cmp byte [esp + 0x2e4], 0
mov eax, dword [esp + 0x2d8]
je 0x557073
cmp dword [esp + 0x2e8], 0
je 0x557073
cmp dword [esp + 0x2f0], 0
je 0x557073
test eax, eax
je 0x557069
cmp eax, 0xffcc0020
je 0x557069
cmp eax, 0xcc0020
je 0x557069
cmp eax, 0xccff0062
je 0x557069
cmp eax, 0xcc000042
jne 0x557073
mov byte [esp + 0x2e4], 1
jmp 0x55707b
mov byte [esp + 0x2e4], 0
test eax, eax
je 0x557092
cmp eax, 0xffcc0020
je 0x557092
cmp eax, 0xcc0020
mov byte [esp + 0x1f], 0
jne 0x557097
mov byte [esp + 0x1f], 1
mov eax, dword [esp + 0x58]
test eax, eax
mov ebp, dword [esp + 0x2e0]
mov ebx, eax
mov dword [esp + 0x14], ebx
je 0x5571a4
test ebp, ebp
je 0x557141
movzx ecx, byte [ebp + 1]
mov ch, byte [ebp]
movzx edx, byte [ebp + 2]
shl ecx, 8
or ecx, edx
test edi, edi
mov dword [esp + 0x3c], ecx
jle 0x5571a4
mov ebp, dword [esp + 0x2bc]
lea ecx, [esi + 0x2a]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x14], edi
test ebp, ebp
jle 0x557128
lea eax, [ebx + 2]
lea ecx, [ecx]
movzx edx, byte [ecx - 2]
mov byte [eax - 2], dl
movzx edx, byte [ecx - 1]
mov byte [eax - 1], dl
movzx edx, byte [ecx]
mov byte [eax], dl
mov edx, dword [eax - 2]
and edx, 0xffffff
cmp dword [esp + 0x3c], edx
je 0x557116
mov byte [eax + 1], 0xff
add ecx, 3
add eax, 4
sub ebp, 1
jne 0x5570f0
mov ebp, dword [esp + 0x2bc]
mov ecx, dword [esp + 0x30]
add ecx, dword [esp + 0x20]
add ebx, dword [esp + 0x50]
sub dword [esp + 0x14], 1
mov dword [esp + 0x30], ecx
jne 0x5570e6
jmp 0x557199
test edi, edi
jle 0x5571a4
mov dword [esp + 0x30], edi
mov edi, dword [esp + 0x2bc]
lea edx, [esi + 0x2a]
test edi, edi
jle 0x557186
lea eax, [ebx + 2]
mov ecx, edx
mov ebp, edi
mov edi, edi
movzx ebx, byte [ecx - 2]
mov byte [eax - 2], bl
movzx ebx, byte [ecx - 1]
mov byte [eax - 1], bl
movzx ebx, byte [ecx]
mov byte [eax], bl
mov byte [eax + 1], 0xff
add ecx, 3
add eax, 4
sub ebp, 1
jne 0x557160
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 0x50]
add edx, dword [esp + 0x20]
sub dword [esp + 0x30], 1
mov dword [esp + 0x14], ebx
jne 0x557153
mov ebp, dword [esp + 0x2e0]
mov eax, dword [esp + 0x58]
cmp dword [esp + 0x2d4], 1
jne 0x557222
test eax, eax
mov ebx, eax
mov dword [esp + 0x20], ebx
je 0x5572fb
mov edi, dword [esp + 0x38]
mov eax, dword [edi + 8]
cdq
mov ecx, eax
mov eax, dword [edi + 4]
xor ecx, edx
sub ecx, edx
cdq
mov edi, eax
mov eax, dword [esp + 0x18]
xor edi, edx
sub edi, edx
add eax, 3
test ecx, ecx
jle 0x5572fb
mov dword [esp + 0x14], ecx
test edi, edi
lea ecx, [ebx + 3]
jle 0x557201
mov edx, eax
sub edx, ecx
mov ebp, edi
mov bl, byte [edx + ecx]
mov byte [ecx], bl
add ecx, 4
sub ebp, 1
jne 0x5571f4
mov ebx, dword [esp + 0x20]
add ebx, dword [esp + 0x50]
lea ecx, [edi*4]
add eax, ecx
sub dword [esp + 0x14], 1
mov dword [esp + 0x20], ebx
jne 0x5571e7
jmp 0x5572fb
test ebp, ebp
jne 0x5572fb
cmp byte [esp + 0x2e4], 0
je 0x5572fb
test eax, eax
mov dword [esp + 0x18], eax
je 0x5572fb
mov eax, dword [esp + 0x2e8]
mov eax, dword [eax + 8]
cdq
mov ecx, eax
mov eax, dword [esp + 0x2f4]
xor ecx, edx
sub ecx, edx
xor edx, edx
div ecx
lea edx, [eax*8]
cmp dword [esp + 0x34], edx
jle 0x557271
mov dword [esp + 0x34], edx
test ecx, ecx
jbe 0x5572fb
lea ebp, [ecx - 1]
imul ebp, eax
mov edx, eax
neg edx
add ebp, dword [esp + 0x2f0]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x20], ecx
xor edi, edi
cmp dword [esp + 0x34], edi
jle 0x5572e8
mov ebx, dword [esp + 0x18]
add ebx, 3
mov eax, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
movzx eax, byte [eax + ebp]
mov ecx, edi
and ecx, reloc.OLEAUT32.dll_VariantInit
jns 0x5572bf
dec ecx
or ecx, 0xfffffff8
inc ecx
shl eax, cl
and al, 0x80
neg al
sbb al, al
and eax, 0xff
cmp byte [esp + 0x1f], 0
jne 0x5572da
or cl, 0xff
sub cl, al
mov al, cl
mov byte [ebx], al
add edi, 1
add ebx, 4
cmp edi, dword [esp + 0x34]
jl 0x5572a1
mov edx, dword [esp + 0x50]
add dword [esp + 0x18], edx
add ebp, dword [esp + 0x3c]
sub dword [esp + 0x20], 1
jne 0x557292
mov eax, dword [esp + 0x2dc]
cmp eax, 0x660046
je 0x55731f
cmp eax, 0x8800c6
je 0x557488
cmp eax, 0xee0086
jne 0x5573b0
mov dword [esp + 0x14], 0
mov edi, dword [esp + 0x2c]
mov ecx, dword [edi + 4]
lea eax, [esp + 0x20]
push eax
xor ebx, ebx
push ecx
mov dword [esp + 0x28], ebx
call sub.gdiplus.dll_GdipGetImageWidth
cmp eax, ebx
je 0x557346
mov dword [edi + 8], eax
mov eax, dword [edi + 4]
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x20], ebx
call sub.gdiplus.dll_GdipGetImageHeight
cmp eax, ebx
je 0x55735f
mov dword [edi + 8], eax
mov edx, dword [esp + 0x58]
cmp edx, ebx
je 0x5573b0
xor edi, edi
cmp dword [esp + 0x18], ebx
jbe 0x5573b0
mov ebx, dword [esp + 0x20]
xor ecx, ecx
test ebx, ebx
jbe 0x5573a7
lea esp, [esp]
mov eax, edi
imul eax, dword [esp + 0x50]
shr eax, 2
add eax, ecx
mov ebp, dword [edx + eax*4]
and ebp, 0xffffff
cmp ebp, dword [esp + 0x14]
jne 0x5573a0
mov byte [edx + eax*4 + 3], 0
add ecx, 1
cmp ecx, ebx
jb 0x557380
add edi, 1
cmp edi, dword [esp + 0x18]
jb 0x557373
mov edi, dword [esp + 0x2c]
mov edx, dword [edi + 4]
lea ecx, [esp + 0x48]
push ecx
push edx
call sub.gdiplus.dll_GdipBitmapUnlockBits
test eax, eax
je 0x5573c9
mov dword [edi + 8], eax
push esi
call fcn.004274fc
mov edi, dword [esp + 0x2c]
add esp, 4
cmp byte [edi + 0x1c8], 0
je 0x5573f8
cmp byte [edi + 0x17d], 0
je 0x5573f8
push 4
mov ecx, edi
mov byte [edi + 0x17d], 0
call fcn.005549e0
cmp dword [esp + 0x2dc], 0x660046
mov esi, dword [esp + 0x24]
jne 0x5574ab
cmp byte [edi + 0x1c8], 0
je 0x557475
xor ebx, ebx
cmp esi, ebx
je 0x557475
cmp dword [edi + 0x1cc], ebx
je 0x557475
mov ecx, dword [esi + 4]
lea eax, [esp + 0x28]
push eax
push ecx
mov dword [esp + 0x30], ebx
call sub.gdiplus.dll_GdipGetImageWidth
cmp eax, ebx
je 0x55743d
mov dword [esi + 8], eax
mov edx, dword [esp + 0x28]
cmp edx, dword [edi + 0x1b4]
jne 0x557475
mov ecx, dword [esi + 4]
lea eax, [esp + 0x2c]
push eax
push ecx
mov dword [esp + 0x34], ebx
call sub.gdiplus.dll_GdipGetImageHeight
cmp eax, ebx
je 0x557462
mov dword [esi + 8], eax
mov edx, dword [esp + 0x2c]
cmp edx, dword [edi + 0x1b8]
jne 0x557475
mov ecx, edi
call fcn.005540c0
push esi
lea ecx, [edi + 0x1a8]
call fcn.0055ebd0
xor eax, eax
jmp 0x557673
cmp eax, 0xee0086
je 0x55731f
cmp eax, 0x8800c6
jne 0x557327
mov dword [esp + 0x14], 0xffffff
jmp 0x557327
test esi, esi
mov dword [esp + 0x28], 0xffffffff
je 0x5574d8
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
call edx
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x50]
push esi
call eax
mov ecx, eax
call fcn.0047f690
mov ebp, eax
test ebp, ebp
jne 0x557520
mov ecx, dword [esp + 0x40]
push 0
push ecx
push 0x74
call fcn.004b5290
add esp, 0xc
test eax, eax
je 0x557507
mov ecx, eax
call fcn.004f8930
mov ebp, eax
test ebp, ebp
je 0x557509
push esi
mov ecx, ebp
call fcn.004ff9e0
jmp 0x5575c4
xor ebp, ebp
test esi, esi
je 0x5575c4
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
jmp 0x5575c4
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
xor esi, esi
cmp dword [edi + 0x158], esi
jbe 0x5575c4
jmp 0x557540
push esi
lea ecx, [esp + 0x90]
push 0x637a50
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x8c]
push edx
lea ecx, [esp + 0x4c]
call fcn.0048cd50
mov ecx, dword [edi + 0x15c]
lea eax, [esp + 0x48]
push eax
mov dword [esp + 0x29c], 0
call fcn.004b7950
cmp eax, ebp
sete bl
cmp dword [esp + 0x64], 0x10
mov dword [esp + 0x298], 0xffffffff
mov dword [esp + 0x48], 0x5f1558
jb 0x5575af
mov ecx, dword [esp + 0x50]
push ecx
call fcn.004274fc
add esp, 4
test bl, bl
jne 0x5575c0
add esi, 1
cmp esi, dword [edi + 0x158]
jb 0x557540
jmp 0x5575c4
mov dword [esp + 0x28], esi
mov eax, dword [esp + 0x44]
test eax, eax
je 0x5575ce
mov dword [eax], ebp
mov eax, dword [esp + 0x28]
cmp eax, 0xffffffff
jne 0x557673
mov edx, dword [edi + 0x158]
push edx
lea eax, [esp + 0x190]
push 0x637a54
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esp + 0x4c]
push 0
push ecx
push 0x10
call fcn.004b5290
add esp, 0x18
test eax, eax
je 0x557616
push ebp
mov ecx, eax
call fcn.004b5410
mov esi, eax
jmp 0x557618
xor esi, esi
lea edx, [esp + 0x18c]
push edx
lea ecx, [esp + 0x6c]
call fcn.0048cd50
mov ecx, dword [edi + 0x15c]
push esi
lea eax, [esp + 0x6c]
push eax
mov dword [esp + 0x2a0], 1
call fcn.004ba020
cmp dword [esp + 0x84], 0x10
mov dword [esp + 0x68], 0x5f1558
jb 0x557664
mov ecx, dword [esp + 0x70]
push ecx
call fcn.004274fc
add esp, 4
mov eax, dword [edi + 0x158]
lea edx, [eax + 1]
mov dword [edi + 0x158], edx
mov ecx, dword [esp + 0x290]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x278]
xor ecx, esp
call fcn.0044abb9
add esp, 0x288
ret 0x58