Function at 0x4ff840
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x68
push ebx
push esi
mov esi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push edi
xor edi, edi
push edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
call esi
mov ebx, eax
mov dword [esp + 0x24], ebx
cmp ebx, edi
je 0x4ffb2e
push ebp
mov ebp, dword [esp + 0x8c]
cmp dword [esp + 0xa0], edi
je 0x4ffaa8
push edi
call esi
mov esi, eax
mov dword [esp + 0x2c], esi
test esi, esi
jne 0x4ff898
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x68
ret
push 0x2c
lea eax, [esp + 0x50]
push 0
push eax
call fcn.004948b0
mov eax, dword [esp + 0x9c]
cdq
idiv dword [esp + 0xa8]
add esp, 0xc
push 0
push 0
mov ecx, 0x20
mov word [esp + 0x62], cx
lea ecx, [esp + 0x54]
mov edx, 1
mov dword [esp + 0x54], 0x28
mov dword [esp + 0x58], ebp
mov dword [esp + 0x64], 0
mov word [esp + 0x60], dx
mov edi, eax
lea eax, [esp + 0x24]
push eax
push 0
push ecx
push esi
mov dword [esp + 0x6c], edi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
push 0
push 0
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x1c], eax
push 0
lea eax, [esp + 0x5c]
push eax
push ebx
call dword [sym.imp.GDI32.dll_CreateDIBSection]
cmp dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
je 0x4ffa94
test eax, eax
je 0x4ffa94
mov edx, dword [esp + 0x88]
lea ecx, [esp + 0x34]
push ecx
push 0x18
push edx
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
jne 0x4ff970
mov edi, dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call edi
push esi
call edi
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x68
ret
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x48]
push eax
push esi
mov dword [esp + 0x2c], edx
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [esp + 0x94], 0
mov eax, dword [esp + 0x84]
jne 0x4ff997
sub eax, edi
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x7c]
push 0xcc0020
push eax
push ecx
push edx
push edi
push ebp
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x14]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x9c]
sub edx, dword [esp + 0x98]
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
dec edx
imul edx, edi
imul edx, ebp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x18]
lea esi, [esi + edx*4]
test edi, edi
jle 0x4ffa74
mov dword [esp + 0x24], edi
test ebp, ebp
jle 0x4ffa6d
mov dword [esp + 0x20], ebp
nop
movzx ebp, byte [esi + 3]
movzx ebx, byte [ecx]
movzx edx, byte [esi]
imul edx, ebp
mov edi, 0xff
sub edi, ebp
imul ebx, edi
add edx, ebx
shr edx, 8
mov byte [eax], dl
movzx ebx, byte [ecx + 1]
movzx edx, byte [esi + 1]
imul ebx, edi
inc ecx
imul edx, ebp
inc esi
add edx, ebx
shr edx, 8
mov byte [eax + 1], dl
movzx ebx, byte [ecx + 1]
movzx edx, byte [esi + 1]
imul ebx, edi
inc eax
imul edx, ebp
inc ecx
inc esi
add edx, ebx
inc eax
shr edx, 8
mov byte [eax], dl
mov dl, byte [ecx + 1]
inc ecx
inc eax
mov byte [eax], dl
inc eax
inc ecx
add esi, 2
sub dword [esp + 0x20], 1
jne 0x4ffa00
mov ebp, dword [esp + 0x8c]
mov ebx, dword [esp + 0x28]
sub dword [esp + 0x24], 1
jne 0x4ff9f7
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x30]
jmp 0x4ffab9
mov edi, dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call edi
push esi
call edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x68
ret
mov edx, dword [esp + 0x88]
push edx
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, eax
cmp dword [esp + 0x94], 0
mov ecx, dword [esp + 0x84]
jne 0x4ffadb
mov eax, dword [esp + 0x90]
cdq
idiv dword [esp + 0x9c]
sub ecx, eax
mov eax, dword [esp + 0x90]
cdq
idiv dword [esp + 0x9c]
push 0xcc0020
push 0
push 0
push ebx
push eax
mov eax, dword [esp + 0x94]
push ebp
push ecx
mov ecx, dword [esp + 0x98]
push eax
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [esp + 0xa0], 0
je 0x4ffb2d
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x68
ret