Function at 0x2d825b6f
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push 0x4d0
mov eax, 0x2d8bd687
call fcn.2d806d20
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x468]
push ecx
push 0x54
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
cmp eax, 0x54
je 0x2d825ba1
push 0x40000003
call fcn.2d8ac5c8
pop ecx
mov eax, dword [0x2d93d6d4]
xor ebx, ebx
push 0x428
mov dword [ebp - 0x49c], ebx
call dword [eax + 4]
mov esi, eax
pop ecx
mov dword [ebp - 0x4bc], esi
cmp esi, ebx
jne 0x2d825bc8
call fcn.2d8ac5c8
mov dword [esi], 0x28
mov eax, dword [ebp - 0x44c]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x448]
mov dword [esi + 8], eax
xor eax, eax
inc eax
mov word [esi + 0xc], ax
push 8
pop eax
mov word [esi + 0xe], ax
mov eax, 0xd8
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
xor edi, edi
mov dword [ebp - 0x474], ebx
mov dword [ebp - 0x46c], ebx
mov dword [ebp - 0x470], ebx
mov dl, byte [ebp - 0x474]
movsx ecx, di
lea eax, [esi + ecx*4]
mov byte [eax + 0x2a], dl
mov dl, byte [ebp - 0x46c]
mov byte [eax + 0x29], dl
mov dl, byte [ebp - 0x470]
add dword [ebp - 0x470], 0x33
mov byte [eax + 0x2b], bl
mov eax, 0x100
inc edi
mov byte [esi + ecx*4 + 0x28], dl
cmp word [ebp - 0x470], ax
jl 0x2d825c19
add dword [ebp - 0x46c], 0x33
cmp word [ebp - 0x46c], ax
jl 0x2d825c13
add dword [ebp - 0x474], 0x33
cmp word [ebp - 0x474], ax
jl 0x2d825c0d
mov eax, dword [0x2d93d6d8]
mov dword [ebp - 0x498], ebx
push 0x2d83824b
mov dword [ebp - 0x48c], ebx
mov dword [ebp - 0x488], ebx
push ebx
mov dword [ebp - 0x4a4], ebx
mov dword [ebp - 4], ebx
call dword [eax + 8]
pop ecx
pop ecx
push ebx
push ebx
lea eax, [ebp - 0x4c8]
push eax
push ebx
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0x49c]
test eax, eax
jne 0x2d825cea
mov eax, dword [0x2d93d6d8]
push 0x40000001
call dword [eax + 4]
pop ecx
mov dword [ebp - 0x4d4], ebx
push 0x2d8f89a0
lea eax, [ebp - 0x4d4]
push eax
call sub.MSVCR100.dll__CxxThrowException
mov edi, dword [ebp - 0x44c]
push dword [ebp - 0x448]
mov dword [ebp - 0x4b4], edi
call sub.MSVCR100.dll_labs
mov dword [ebp - 0x4b8], eax
movzx eax, word [ebp - 0x442]
imul eax, edi
add eax, 0x1f
sar eax, 3
and eax, 0xfffffffc
mov dword [ebp - 0x4b0], eax
movzx eax, word [esi + 0xe]
imul eax, edi
add eax, 0x1f
sar eax, 3
and eax, 0xfffffffc
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x454]
pop ecx
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x4c8]
lea esi, [edi + 2]
push 2
push esi
mov dword [ebp - 0x47c], eax
call fcn.2d8ac5c8
mov dword [ebp - 0x498], eax
mov eax, dword [ebp - 0x498]
pop ecx
pop ecx
test eax, eax
jne 0x2d825d90
mov eax, dword [0x2d93d6d8]
push 0x40000002
call dword [eax + 4]
pop ecx
mov dword [ebp - 0x4d0], ebx
push 0x2d8f89a0
lea eax, [ebp - 0x4d0]
jmp 0x2d825ce4
push 2
push esi
call fcn.2d8ac5c8
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x48c]
pop ecx
pop ecx
test eax, eax
jne 0x2d825dce
mov eax, dword [0x2d93d6d8]
push 0x40000002
call dword [eax + 4]
pop ecx
mov dword [ebp - 0x4d8], ebx
push 0x2d8f89a0
lea eax, [ebp - 0x4d8]
jmp 0x2d825ce4
push 2
push esi
call fcn.2d8ac5c8
mov dword [ebp - 0x488], eax
mov eax, dword [ebp - 0x488]
pop ecx
pop ecx
test eax, eax
jne 0x2d825e0c
mov eax, dword [0x2d93d6d8]
push 0x40000002
call dword [eax + 4]
pop ecx
mov dword [ebp - 0x4cc], ebx
push 0x2d8f89a0
lea eax, [ebp - 0x4cc]
jmp 0x2d825ce4
xor esi, esi
mov eax, 0x100
cmp si, ax
jge 0x2d825e55
movsx ecx, si
lea eax, [ecx + 0x1a]
cdq
push 0x33
pop edi
idiv edi
mov bl, 6
mov edx, eax
mov al, dl
imul bl
mov byte [ebp + ecx - 0x214], al
imul bl
mov byte [ebp + ecx - 0x414], al
mov al, dl
mov byte [ebp + ecx - 0x314], dl
mov dl, 0x33
imul dl
inc esi
mov byte [ebp + ecx - 0x114], al
xor ebx, ebx
jmp 0x2d825e0e
mov eax, dword [ebp - 0x484]
mov edi, dword [ebp - 0x47c]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x498]
mov ecx, dword [ebp - 0x48c]
mov esi, dword [ebp - 0x488]
add eax, 2
add ecx, 2
add esi, 2
mov dword [ebp - 0x484], ebx
movsx edx, word [ebp - 0x484]
cmp edx, dword [ebp - 0x4b8]
jge 0x2d8263cc
movzx edx, word [eax]
mov dword [ebp - 0x490], edx
xor edx, edx
mov word [eax], dx
mov word [eax - 2], dx
movzx edx, word [ecx]
mov dword [ebp - 0x494], edx
xor edx, edx
mov word [ecx], dx
mov word [ecx - 2], dx
movzx edx, word [esi]
mov dword [ebp - 0x47c], edx
xor edx, edx
and dword [ebp - 0x480], edx
mov word [esi], dx
mov word [esi - 2], dx
movsx edx, word [ebp - 0x480]
cmp edx, dword [ebp - 0x4b4]
mov edx, dword [ebp - 0x478]
jge 0x2d826101
movzx ebx, byte [edx + 2]
mov edx, dword [ebp - 0x490]
sar dx, 4
add bx, dx
movzx edx, bx
mov dword [ebp - 0x474], edx
test dx, dx
jge 0x2d825f18
and dword [ebp - 0x474], 0
jmp 0x2d825f2c
mov edx, 0xff
cmp word [ebp - 0x474], dx
jle 0x2d825f2c
mov dword [ebp - 0x474], edx
mov edx, dword [ebp - 0x478]
movzx ebx, byte [edx + 1]
mov edx, dword [ebp - 0x494]
sar dx, 4
add bx, dx
movzx edx, bx
mov dword [ebp - 0x46c], edx
test dx, dx
jge 0x2d825f5a
and dword [ebp - 0x46c], 0
jmp 0x2d825f6e
mov edx, 0xff
cmp word [ebp - 0x46c], dx
jle 0x2d825f6e
mov dword [ebp - 0x46c], edx
mov ebx, dword [ebp - 0x478]
mov edx, dword [ebp - 0x47c]
movzx ebx, byte [ebx]
sar dx, 4
add dx, bx
movzx edx, dx
mov dword [ebp - 0x470], edx
test dx, dx
jge 0x2d825f9b
and dword [ebp - 0x470], 0
jmp 0x2d825faf
mov edx, 0xff
cmp word [ebp - 0x470], dx
jle 0x2d825faf
mov dword [ebp - 0x470], edx
movsx ebx, word [ebp - 0x474]
mov bl, byte [ebp + ebx - 0x414]
movsx edx, word [ebp - 0x46c]
add bl, byte [ebp + edx - 0x214]
movsx edx, word [ebp - 0x470]
add bl, byte [ebp + edx - 0x314]
movsx edx, word [ebp - 0x474]
movzx edx, byte [ebp + edx - 0x114]
sub word [ebp - 0x474], dx
movsx edx, word [ebp - 0x46c]
movzx edx, byte [ebp + edx - 0x114]
sub word [ebp - 0x46c], dx
movsx edx, word [ebp - 0x470]
movzx edx, byte [ebp + edx - 0x114]
sub word [ebp - 0x470], dx
mov byte [edi], bl
mov ebx, dword [ebp - 0x474]
imul ebx, ebx, 7
lea edx, [eax + 2]
add bx, word [edx]
mov dword [ebp - 0x4ac], edx
movzx edx, bx
mov ebx, dword [ebp - 0x46c]
imul ebx, ebx, 7
mov dword [ebp - 0x490], edx
lea edx, [ecx + 2]
add bx, word [edx]
mov dword [ebp - 0x4a8], edx
movzx edx, bx
mov ebx, dword [ebp - 0x470]
imul ebx, ebx, 7
mov dword [ebp - 0x494], edx
lea edx, [esi + 2]
add bx, word [edx]
mov dword [ebp - 0x4a0], edx
movzx edx, bx
mov dword [ebp - 0x47c], edx
mov edx, dword [ebp - 0x474]
mov ebx, edx
imul edx, edx, 5
imul ebx, ebx, 3
add word [eax - 2], bx
mov ebx, dword [ebp - 0x46c]
imul ebx, ebx, 3
add word [ecx - 2], bx
mov ebx, dword [ebp - 0x470]
imul ebx, ebx, 3
add word [esi - 2], bx
add word [eax], dx
mov eax, dword [ebp - 0x46c]
imul eax, eax, 5
add word [ecx], ax
mov eax, dword [ebp - 0x470]
mov cx, word [ebp - 0x474]
imul eax, eax, 5
add word [esi], ax
mov eax, dword [ebp - 0x4ac]
mov dx, word [ebp - 0x46c]
mov esi, dword [ebp - 0x4a0]
add dword [ebp - 0x478], 3
mov word [eax], cx
mov ecx, dword [ebp - 0x4a8]
mov word [ecx], dx
mov dx, word [ebp - 0x470]
inc edi
inc dword [ebp - 0x480]
mov word [esi], dx
jmp 0x2d825ed7
mov ebx, dword [ebp - 0x4b0]
lea edx, [edx + ebx - 3]
movsx ebx, word [ebp - 0x484]
mov dword [ebp - 0x478], edx
mov edx, dword [ebp - 0x4c0]
lea edi, [edi + edx - 1]
mov edx, dword [ebp - 0x4b8]
sub eax, 2
sub ecx, 2
sub esi, 2
dec edx
cmp ebx, edx
je 0x2d8263c0
movzx edx, word [eax]
mov dword [ebp - 0x490], edx
xor edx, edx
mov word [eax], dx
mov word [eax + 2], dx
movzx edx, word [ecx]
mov dword [ebp - 0x494], edx
xor edx, edx
mov word [ecx], dx
mov word [ecx + 2], dx
movzx edx, word [esi]
mov dword [ebp - 0x47c], edx
xor edx, edx
and dword [ebp - 0x480], edx
mov word [esi], dx
mov word [esi + 2], dx
movsx edx, word [ebp - 0x480]
cmp edx, dword [ebp - 0x4b4]
mov edx, dword [ebp - 0x478]
jge 0x2d82639d
movzx ebx, byte [edx + 2]
mov edx, dword [ebp - 0x490]
sar dx, 4
add bx, dx
movzx edx, bx
mov dword [ebp - 0x474], edx
test dx, dx
jge 0x2d8261b7
and dword [ebp - 0x474], 0
jmp 0x2d8261cb
mov edx, 0xff
cmp word [ebp - 0x474], dx
jle 0x2d8261cb
mov dword [ebp - 0x474], edx
mov edx, dword [ebp - 0x478]
movzx ebx, byte [edx + 1]
mov edx, dword [ebp - 0x494]
sar dx, 4
add bx, dx
movzx edx, bx
mov dword [ebp - 0x46c], edx
test dx, dx
jge 0x2d8261f9
and dword [ebp - 0x46c], 0
jmp 0x2d82620d
mov edx, 0xff
cmp word [ebp - 0x46c], dx
jle 0x2d82620d
mov dword [ebp - 0x46c], edx
mov ebx, dword [ebp - 0x478]
mov edx, dword [ebp - 0x47c]
movzx ebx, byte [ebx]
sar dx, 4
add dx, bx
movzx edx, dx
mov dword [ebp - 0x470], edx
test dx, dx
jge 0x2d82623a
and dword [ebp - 0x470], 0
jmp 0x2d82624e
mov edx, 0xff
cmp word [ebp - 0x470], dx
jle 0x2d82624e
mov dword [ebp - 0x470], edx
movsx ebx, word [ebp - 0x474]
mov bl, byte [ebp + ebx - 0x414]
movsx edx, word [ebp - 0x46c]
add bl, byte [ebp + edx - 0x214]
movsx edx, word [ebp - 0x470]
add bl, byte [ebp + edx - 0x314]
movzx edx, byte [ebp + edx - 0x114]
mov byte [edi], bl
sub word [ebp - 0x470], dx
dec edi
mov dword [ebp - 0x4c4], edi
movsx edi, word [ebp - 0x474]
movzx edi, byte [ebp + edi - 0x114]
sub word [ebp - 0x474], di
mov edx, dword [ebp - 0x474]
movsx edi, word [ebp - 0x46c]
movzx edi, byte [ebp + edi - 0x114]
sub word [ebp - 0x46c], di
mov ebx, edx
imul ebx, ebx, 7
lea edi, [eax - 2]
add bx, word [edi]
mov dword [ebp - 0x4a0], edi
movzx edi, bx
mov ebx, dword [ebp - 0x46c]
imul ebx, ebx, 7
mov dword [ebp - 0x490], edi
lea edi, [ecx - 2]
add bx, word [edi]
mov dword [ebp - 0x4a8], edi
movzx edi, bx
mov ebx, dword [ebp - 0x470]
imul ebx, ebx, 7
mov dword [ebp - 0x494], edi
lea edi, [esi - 2]
add bx, word [edi]
mov dword [ebp - 0x4ac], edi
movzx edi, bx
mov dword [ebp - 0x47c], edi
mov edi, edx
imul edx, edx, 5
imul edi, edi, 3
add word [eax + 2], di
mov edi, dword [ebp - 0x46c]
mov ebx, edi
imul edi, edi, 5
imul ebx, ebx, 3
add word [ecx + 2], bx
mov ebx, dword [ebp - 0x470]
imul ebx, ebx, 3
add word [esi + 2], bx
add word [eax], dx
mov eax, dword [ebp - 0x470]
add word [ecx], di
imul eax, eax, 5
add word [esi], ax
mov cx, word [ebp - 0x474]
mov eax, dword [ebp - 0x4a0]
mov dx, word [ebp - 0x46c]
mov esi, dword [ebp - 0x4ac]
sub dword [ebp - 0x478], 3
inc dword [ebp - 0x480]
mov edi, dword [ebp - 0x4c4]
mov word [eax], cx
mov ecx, dword [ebp - 0x4a8]
mov word [ecx], dx
mov dx, word [ebp - 0x470]
mov word [esi], dx
jmp 0x2d826176
mov ebx, dword [ebp - 0x4b0]
lea edx, [edx + ebx + 3]
mov dword [ebp - 0x478], edx
mov edx, dword [ebp - 0x4c0]
add eax, 2
add ecx, 2
lea edi, [edi + edx + 1]
add esi, 2
add dword [ebp - 0x484], 2
jmp 0x2d825e88
mov eax, dword [0x2d93d6d8]
mov byte [ebp - 4], 0
call dword [eax + 0xc]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x4bc], 0
je 0x2d8263f4
push dword [ebp - 0x4bc]
mov eax, dword [0x2d93d6d4]
call dword [eax + 0xc]
pop ecx
mov eax, dword [ebp - 0x498]
test eax, eax
je 0x2d82640d
push dword [ebp - 0x498]
mov eax, dword [0x2d93d6d4]
call dword [eax + 0xc]
pop ecx
mov eax, dword [ebp - 0x48c]
test eax, eax
je 0x2d826426
push dword [ebp - 0x48c]
mov eax, dword [0x2d93d6d4]
call dword [eax + 0xc]
pop ecx
mov eax, dword [ebp - 0x488]
test eax, eax
je 0x2d82643f
push dword [ebp - 0x488]
mov eax, dword [0x2d93d6d4]
call dword [eax + 0xc]
pop ecx
cmp dword [ebp - 0x4a4], 0
je 0x2d82646a
mov eax, dword [ebp - 0x49c]
test eax, eax
je 0x2d82645e
push dword [ebp - 0x49c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x4a4]
call fcn.2d8ac5c8
pop ecx
mov eax, dword [ebp - 0x49c]
call fcn.2d806e1c
ret