Function at 0x4d5304
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
mov esi, ecx
lea edi, [ebp - 0x68]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d5bca
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x94]
xor ecx, ecx
mov edx, 0x2c
call fcn.004035f8
mov eax, dword [ebp - 4]
call fcn.004d5268
mov eax, dword [eax + 0x454]
mov dword [0x5c1794], eax
mov eax, dword [ebp - 4]
call fcn.004d5268
mov eax, dword [eax + 0x458]
neg eax
mov dword [0x5c1798], eax
mov esi, 0x5c1790
lea edi, [ebp - 0x94]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4d53bb
lea edx, [ebp - 0x98]
mov eax, dword [0x5c6350]
call fcn.00407200
mov ecx, dword [ebp - 0x98]
mov edx, dword [0x4d02e8]
mov eax, dword [ebp - 4]
call fcn.004d51f8
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_CreateDIBSection
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4d53e4
cmp dword [ebp - 0x10], 0
jne 0x4d5420
cmp dword [ebp - 0x18], 0
je 0x4d53f3
mov eax, dword [ebp - 0x18]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteDC
lea edx, [ebp - 0x9c]
mov eax, dword [0x5c6350]
call fcn.00407200
mov ecx, dword [ebp - 0x9c]
mov edx, dword [0x4d02e8]
mov eax, dword [ebp - 4]
call fcn.004d51f8
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x14], eax
push 0xcc0020
mov eax, dword [ebp - 4]
call fcn.004d5268
mov eax, dword [eax + 0x458]
push eax
mov eax, dword [ebp - 4]
call fcn.004d5268
mov eax, dword [eax + 0x454]
push eax
mov eax, dword [ebp - 0x64]
push eax
mov eax, dword [ebp - 0x68]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004d5268
mov eax, dword [eax + 0x458]
push eax
mov eax, dword [ebp - 4]
call fcn.004d5268
mov eax, dword [eax + 0x454]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_StretchBlt
mov eax, dword [ebp - 4]
call fcn.004d5268
mov eax, dword [eax + 0x454]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x2c]
movzx edx, word [ebp - 0x86]
imul edx
add eax, 0x1f
and eax, 0xffffffe0
test eax, eax
jns 0x4d54b9
add eax, 7
sar eax, 3
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.004d5268
movzx ebx, word [eax + 0x2b]
mov eax, dword [ebp - 4]
call fcn.004d5268
imul ebx, dword [eax + 0x454]
add ebx, 0x1f
and ebx, 0xffffffe0
shr ebx, 3
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
call fcn.004d5268
mov eax, dword [eax + 0x450]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
call fcn.004d5268
mov ebx, dword [eax + 0x448]
mov eax, dword [ebp - 4]
call fcn.004d5268
mov eax, dword [eax + 0x458]
dec eax
imul ebx, eax
mov eax, dword [ebp - 4]
call fcn.004d5268
add ebx, dword [eax + 0x44c]
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 4]
call fcn.004d5268
mov ax, word [eax + 0x2b]
dec ax
je 0x4d5833
sub ax, 3
je 0x4d5833
sub ax, 4
je 0x4d5833
sub ax, 0x10
jne 0x4d5b33
mov eax, dword [ebp - 4]
call fcn.004d5268
mov eax, dword [eax + 0x458]
test eax, eax
jle 0x4d5b33
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], 1
mov eax, dword [ebp - 4]
call fcn.004d5268
mov eax, dword [eax + 0x454]
dec eax
test eax, eax
jl 0x4d5810
inc eax
mov dword [ebp - 0x54], eax
xor esi, esi
mov eax, dword [ebp - 0x44]
lea edi, [eax + esi*4]
cmp dword [ebp + 0x14], 0
jle 0x4d55c2
mov eax, dword [ebp - 0x40]
xor ebx, ebx
mov bl, byte [eax + esi]
mov eax, 0xff
sub eax, dword [ebp + 0x14]
imul ebx, eax
shr ebx, 8
jmp 0x4d55c8
mov eax, dword [ebp - 0x40]
mov bl, byte [eax + esi]
cmp byte [ebp + 0x10], 0
je 0x4d5688
lea eax, [esi + esi*2]
add eax, 2
mov edx, dword [ebp - 0x3c]
movzx eax, byte [edx + eax]
lea edx, [esi + esi*2]
inc edx
mov ecx, dword [ebp - 0x3c]
movzx edx, byte [ecx + edx]
add eax, edx
lea edx, [esi + esi*2]
mov ecx, dword [ebp - 0x3c]
movzx edx, byte [ecx + edx]
add eax, edx
mov ecx, 3
xor edx, edx
div ecx
mov byte [ebp - 0x49], al
xor eax, eax
mov al, byte [ebp - 0x49]
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi + 2]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi + 2], al
xor eax, eax
mov al, byte [ebp - 0x49]
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi + 1]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi + 1], al
xor eax, eax
mov al, byte [ebp - 0x49]
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi], al
jmp 0x4d5806
cmp dword [ebp + 8], 0
jg 0x4d5698
cmp dword [ebp + 0xc], 0
jle 0x4d5774
lea eax, [esi + esi*2]
add eax, 2
mov edx, dword [ebp - 0x3c]
movzx eax, byte [edx + eax]
add eax, dword [ebp + 8]
mov edx, 0xff
call fcn.004377d0
sub eax, dword [ebp + 0xc]
xor edx, edx
call fcn.00437854
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi + 2]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi + 2], al
lea eax, [esi + esi*2]
inc eax
mov edx, dword [ebp - 0x3c]
movzx eax, byte [edx + eax]
add eax, dword [ebp + 8]
mov edx, 0xff
call fcn.004377d0
sub eax, dword [ebp + 0xc]
xor edx, edx
call fcn.00437854
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi + 1]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi + 1], al
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x3c]
movzx eax, byte [edx + eax]
add eax, dword [ebp + 8]
mov edx, 0xff
call fcn.004377d0
sub eax, dword [ebp + 0xc]
xor edx, edx
call fcn.00437854
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi], al
jmp 0x4d5806
lea eax, [esi + esi*2]
add eax, 2
mov edx, dword [ebp - 0x3c]
movzx eax, byte [edx + eax]
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi + 2]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi + 2], al
lea eax, [esi + esi*2]
inc eax
mov edx, dword [ebp - 0x3c]
movzx eax, byte [edx + eax]
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi + 1]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi + 1], al
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x3c]
movzx eax, byte [edx + eax]
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi], al
inc esi
dec dword [ebp - 0x54]
jne 0x4d559e
mov eax, dword [ebp - 0x30]
add dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
sub dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
add dword [ebp - 0x40], eax
inc dword [ebp - 0x48]
dec dword [ebp - 0x50]
jne 0x4d5581
jmp 0x4d5b33
mov eax, dword [ebp - 4]
call fcn.004d5268
cmp byte [eax + 0x45d], 4
jne 0x4d5966
mov eax, dword [ebp - 4]
call fcn.004d5268
mov eax, dword [eax + 0x458]
test eax, eax
jle 0x4d5b33
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], 1
mov eax, dword [ebp - 4]
call fcn.004d5268
mov eax, dword [eax + 0x454]
dec eax
test eax, eax
jl 0x4d5943
inc eax
mov dword [ebp - 0x54], eax
xor esi, esi
mov eax, dword [ebp - 0x44]
lea ebx, [eax + esi*4]
mov eax, dword [ebp - 4]
call fcn.004d5268
add eax, 0x1d
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x3c]
movzx edx, byte [edx + esi]
mov eax, dword [ebp - 0x40]
mov al, byte [eax + esi]
xor ecx, ecx
mov cl, al
imul edx, ecx
add edx, 0xff
and eax, 0xff
mov ecx, 0xff
sub ecx, eax
xor eax, eax
mov al, byte [ebx + 2]
imul ecx, eax
add edx, ecx
shr edx, 8
mov byte [ebx + 2], dl
mov edx, dword [ebp - 0x3c]
movzx edx, byte [edx + esi]
mov eax, dword [ebp - 0x40]
mov al, byte [eax + esi]
xor ecx, ecx
mov cl, al
imul edx, ecx
add edx, 0xff
and eax, 0xff
mov ecx, 0xff
sub ecx, eax
xor eax, eax
mov al, byte [ebx + 1]
imul ecx, eax
add edx, ecx
shr edx, 8
mov byte [ebx + 1], dl
mov edx, dword [ebp - 0x3c]
movzx edx, byte [edx + esi]
mov eax, dword [ebp - 0x40]
mov al, byte [eax + esi]
xor ecx, ecx
mov cl, al
imul edx, ecx
add edx, 0xff
and eax, 0xff
mov ecx, 0xff
sub ecx, eax
xor eax, eax
mov al, byte [ebx]
imul ecx, eax
add edx, ecx
shr edx, 8
mov byte [ebx], dl
inc esi
dec dword [ebp - 0x54]
jne 0x4d5885
mov eax, dword [ebp - 0x30]
add dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
sub dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
add dword [ebp - 0x40], eax
inc dword [ebp - 0x48]
dec dword [ebp - 0x50]
jne 0x4d5868
jmp 0x4d5b33
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x238]
mov edx, dword [0x4d0ca4]
call fcn.004d189c
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x238]
mov edx, dword [0x4d0c38]
call fcn.004d189c
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
call fcn.004d5268
mov eax, dword [eax + 0x458]
test eax, eax
jle 0x4d5b33
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], 1
xor esi, esi
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
call fcn.004d5268
mov al, byte [eax + 0x45c]
dec al
je 0x4d59dd
dec al
je 0x4d5a01
sub al, 2
je 0x4d5a01
jmp 0x4d5a2a
mov eax, esi
and eax, 0x80000007
jns 0x4d59eb
dec eax
or eax, 0xfffffff8
inc eax
mov ecx, 7
sub ecx, eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
shr eax, cl
and al, 1
mov byte [ebp - 0x21], al
jmp 0x4d5a32
mov eax, esi
and eax, 0x80000001
jns 0x4d5a0f
dec eax
or eax, 0xfffffffe
inc eax
mov edx, 1
sub edx, eax
mov ecx, edx
shl ecx, 2
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
shr eax, cl
and al, 0xf
mov byte [ebp - 0x21], al
jmp 0x4d5a32
mov eax, dword [ebp - 0x2c]
mov al, byte [eax]
mov byte [ebp - 0x21], al
mov eax, dword [ebp - 0x44]
lea edi, [eax + esi*4]
xor eax, eax
mov al, byte [ebp - 0x21]
mov edx, dword [ebp - 0x1c]
mov bl, byte [edx + eax + 0x15]
mov dl, byte [ebp - 0x21]
mov eax, dword [ebp - 0x20]
call fcn.004d49d4
shr eax, 0x10
and eax, 0xff
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi + 2]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi + 2], al
mov dl, byte [ebp - 0x21]
mov eax, dword [ebp - 0x20]
call fcn.004d49d4
shr eax, 8
and eax, 0xff
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi + 1]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi + 1], al
mov dl, byte [ebp - 0x21]
mov eax, dword [ebp - 0x20]
call fcn.004d49d4
and eax, 0xff
xor edx, edx
mov dl, bl
imul edx
add eax, 0xff
xor edx, edx
mov dl, bl
mov ecx, 0xff
sub ecx, edx
xor edx, edx
mov dl, byte [edi]
imul ecx, edx
add eax, ecx
shr eax, 8
mov byte [edi], al
inc esi
mov eax, dword [ebp - 4]
call fcn.004d5268
movzx eax, word [eax + 0x2b]
add dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 8
jl 0x4d59c1
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004d5268
cmp esi, dword [eax + 0x454]
jl 0x4d59bc
mov eax, dword [ebp - 0x30]
add dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
sub dword [ebp - 0x3c], eax
inc dword [ebp - 0x48]
dec dword [ebp - 0x50]
jne 0x4d59b4
push 0xcc0020
mov eax, dword [ebp - 4]
call fcn.004d5268
mov eax, dword [eax + 0x458]
push eax
mov eax, dword [ebp - 4]
call fcn.004d5268
mov eax, dword [eax + 0x454]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004d5268
mov eax, dword [eax + 0x458]
push eax
mov eax, dword [ebp - 4]
call fcn.004d5268
mov eax, dword [eax + 0x454]
push eax
mov eax, dword [ebp - 0x64]
push eax
mov eax, dword [ebp - 0x68]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_StretchBlt
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 0x18]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteDC
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5bd1
lea eax, [ebp - 0x9c]
mov edx, 2
call fcn.00404ca4
ret