Function at 0x748304
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb38
push ebx
push esi
push edi
mov dword [ebp - 0x434], ecx
mov dword [ebp - 0x430], edx
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jne 0x748337
mov byte [ebp - 0x435], 0
jmp 0x749a87
add esp, 0xfffffff8
fld dword [0x749a98]
fdiv qword [ebp + 0x24]
mov eax, esp
call fcn.004070f8
push 0x4ccc
push 0xcccccd7d
call fcn.0044d48c
fstp qword [ebp - 0x488]
wait
mov eax, dword [ebp + 8]
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x498], eax
fld qword [ebp - 0x488]
call fcn.00402c98
cmp eax, 0x28
jne 0x7483bc
xor eax, eax
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x484], 0x408ee800
fild dword [ebp - 0x498]
fmul qword [ebp + 0x24]
call fcn.00402c90
mov dword [ebp - 0x498], eax
fild dword [ebp - 0x49c]
fmul qword [ebp + 0x24]
call fcn.00402c90
mov dword [ebp - 0x49c], eax
fld qword [ebp - 0x488]
fcomp dword [0x749a9c]
fnstsw ax
sahf
jne 0x748410
cmp byte [0x952c84], 0
jne 0x748410
xor eax, eax
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x484], 0x408ef000
fild dword [ebp - 0x498]
fmul qword [ebp + 0x24]
call fcn.00402c90
mov dword [ebp - 0x498], eax
fild dword [ebp - 0x49c]
fmul qword [ebp + 0x24]
call fcn.00402c90
mov dword [ebp - 0x49c], eax
fld qword [ebp - 0x488]
fcomp dword [0x749aa0]
fnstsw ax
sahf
jne 0x74845b
xor eax, eax
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x484], 0x408ef800
fild dword [ebp - 0x498]
fmul qword [ebp + 0x24]
call fcn.00402c90
mov dword [ebp - 0x498], eax
fild dword [ebp - 0x49c]
fmul qword [ebp + 0x24]
call fcn.00402c90
mov dword [ebp - 0x49c], eax
fld qword [ebp - 0x488]
fcomp dword [0x749aa4]
fnstsw ax
sahf
jne 0x7484a6
xor eax, eax
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x484], 0x408f0000
fild dword [ebp - 0x498]
fmul qword [ebp + 0x24]
call fcn.00402c90
mov dword [ebp - 0x498], eax
fild dword [ebp - 0x49c]
fmul qword [ebp + 0x24]
call fcn.00402c90
mov dword [ebp - 0x49c], eax
fld qword [ebp - 0x488]
fcomp dword [0x749aa8]
fnstsw ax
sahf
jne 0x7484fa
cmp byte [0x952c85], 0
jne 0x7484fa
xor eax, eax
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x484], 0x408f0800
fild dword [ebp - 0x498]
fmul qword [ebp + 0x24]
call fcn.00402c90
mov dword [ebp - 0x498], eax
fild dword [ebp - 0x49c]
fmul qword [ebp + 0x24]
call fcn.00402c90
mov dword [ebp - 0x49c], eax
fld qword [ebp - 0x488]
fcomp dword [0x749aac]
fnstsw ax
sahf
jne 0x748545
xor eax, eax
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x484], 0x408f1000
fild dword [ebp - 0x498]
fmul qword [ebp + 0x24]
call fcn.00402c90
mov dword [ebp - 0x498], eax
fild dword [ebp - 0x49c]
fmul qword [ebp + 0x24]
call fcn.00402c90
mov dword [ebp - 0x49c], eax
fld qword [ebp - 0x488]
fcomp dword [0x749ab0]
fnstsw ax
sahf
jne 0x748590
xor eax, eax
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x484], 0x408f1800
fild dword [ebp - 0x498]
fmul qword [ebp + 0x24]
call fcn.00402c90
mov dword [ebp - 0x498], eax
fild dword [ebp - 0x49c]
fmul qword [ebp + 0x24]
call fcn.00402c90
mov dword [ebp - 0x49c], eax
fld qword [ebp - 0x488]
fcomp qword [0x952c7c]
fnstsw ax
sahf
je 0x748690
push dword [ebp - 0x484]
push dword [ebp - 0x488]
mov eax, dword [ebp - 0x42c]
call fcn.00746ca0
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0xffffffff
jne 0x7485e3
push 0x40590000
push 0
mov eax, dword [ebp - 0x42c]
call fcn.00746ca0
mov dword [ebp - 0x480], eax
mov edx, dword [ebp - 0x480]
mov eax, dword [ebp - 0x42c]
call fcn.00746d14
xor eax, eax
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x44c]
mov dword [eax*4 + 0x951d2c], 0xffffffff
inc dword [ebp - 0x44c]
cmp dword [ebp - 0x44c], 0x12c
jne 0x7485fc
xor eax, eax
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x44c]
xor edx, edx
mov dword [eax*4 + 0x9521e0], edx
inc dword [ebp - 0x44c]
cmp dword [ebp - 0x44c], 0x12c
jne 0x748627
mov eax, dword [ebp - 0x42c]
add eax, 0x4a0
push eax
push pe_nt_image_headers32
push 0
mov eax, dword [0x841604]
mov eax, dword [eax]
call fcn.004202f0
call fcn.0041b8cc
push eax
call sub.GDI32.DLL_SetDIBColorTable
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x488]
mov dword [0x952c7c], eax
mov eax, dword [ebp - 0x484]
mov dword [0x952c80], eax
mov eax, dword [ebp - 0x430]
mov eax, dword [eax]
call fcn.004032dc
mov dl, 1
mov eax, dword [0x41960c]
call fcn.0041fdbc
mov edx, dword [ebp - 0x430]
mov dword [edx], eax
add esp, 0xfffffff8
fld dword [0x749a98]
fdiv qword [ebp + 0x24]
mov eax, esp
call fcn.004070f8
push 0x4ccc
push 0xcccccd7d
call fcn.0044d48c
fstp qword [ebp - 0x490]
wait
fld qword [ebp - 0x490]
fcomp dword [0x749aa8]
fnstsw ax
sahf
jne 0x748706
cmp byte [0x952c85], 0
je 0x748706
xor eax, eax
mov dword [ebp - 0x490], eax
mov dword [ebp - 0x48c], 0x408f3800
fld qword [ebp - 0x490]
fcomp dword [0x749a9c]
fnstsw ax
sahf
jne 0x748732
cmp byte [0x952c84], 0
je 0x748732
xor eax, eax
mov dword [ebp - 0x490], eax
mov dword [ebp - 0x48c], 0x408f3800
fld qword [ebp - 0x490]
call fcn.00402c98
cmp eax, 0x28
je 0x7487ac
fld qword [ebp - 0x490]
fcomp dword [0x749a9c]
fnstsw ax
sahf
je 0x7487ac
fld qword [ebp - 0x490]
fcomp dword [0x749aa0]
fnstsw ax
sahf
je 0x7487ac
fld qword [ebp - 0x490]
fcomp dword [0x749aa4]
fnstsw ax
sahf
je 0x7487ac
fld qword [ebp - 0x490]
fcomp dword [0x749aa8]
fnstsw ax
sahf
je 0x7487ac
fld qword [ebp - 0x490]
fcomp dword [0x749aac]
fnstsw ax
sahf
je 0x7487ac
fld qword [ebp - 0x490]
fcomp dword [0x749ab0]
fnstsw ax
sahf
jne 0x748d11
mov eax, dword [ebp - 0x434]
add eax, dword [ebp + 0x20]
dec eax
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp + 0x1c]
add eax, dword [ebp + 0x18]
dec eax
mov dword [ebp - 0x458], eax
mov eax, dword [ebp + 0x18]
and eax, 0x80000003
jns 0x7487d8
dec eax
or eax, 0xfffffffc
inc eax
mov edx, 4
sub edx, eax
mov dword [ebp - 0x448], edx
cmp dword [ebp - 0x448], 4
jne 0x7487f6
xor eax, eax
mov dword [ebp - 0x448], eax
mov eax, dword [ebp + 0x18]
add eax, dword [ebp - 0x448]
mov dword [ebp - 0x444], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
jns 0x74880f
add eax, 0x3f
sar eax, 6
mov dword [ebp - 0x470], eax
mov eax, dword [ebp - 0x434]
test eax, eax
jns 0x748825
add eax, 0x3f
sar eax, 6
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0x458]
test eax, eax
jns 0x74883b
add eax, 0x3f
sar eax, 6
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x45c]
test eax, eax
jns 0x748851
add eax, 0x3f
sar eax, 6
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x428], 0x28
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp - 0x498]
neg eax
mov dword [ebp - 0x420], eax
mov word [ebp - 0x41c], 1
xor eax, eax
mov dword [ebp - 0x410], eax
xor eax, eax
mov dword [ebp - 0x410], eax
mov word [ebp - 0x41a], 8
xor eax, eax
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x49c]
imul dword [ebp - 0x498]
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x408], pe_nt_image_headers32
mov dword [ebp - 0x404], pe_nt_image_headers32
xor eax, eax
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x44c]
mov al, byte [eax + edx*4 + 0x4a2]
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x3fe], al
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x44c]
mov al, byte [eax + edx*4 + 0x4a1]
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x3ff], al
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x44c]
mov al, byte [eax + edx*4 + 0x4a0]
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x400], al
inc dword [ebp - 0x44c]
cmp dword [ebp - 0x44c], 0x100
jne 0x7488d6
mov dl, 1
mov eax, dword [0x41960c]
call fcn.0041fdbc
mov dword [ebp - 0x4a4], eax
push 0
push 0
lea eax, [ebp - 0x494]
push eax
push 0
lea eax, [ebp - 0x428]
push eax
push 0
call sub.GDI32.DLL_CreateDIBSection
mov edx, eax
mov eax, dword [ebp - 0x4a4]
call fcn.00420ee0
mov eax, dword [ebp - 0x4a4]
mov edx, dword [eax]
call dword [edx + 0x60]
test eax, eax
jne 0x7489a7
mov eax, 0x749abc
call fcn.0044b3e4
mov byte [ebp - 0x435], 0
jmp 0x749a87
mov eax, dword [ebp - 0x49c]
and eax, 0x80000003
jns 0x7489b9
dec eax
or eax, 0xfffffffc
inc eax
mov edx, 4
sub edx, eax
mov dword [ebp - 0x448], edx
cmp dword [ebp - 0x448], 4
jne 0x7489d7
xor eax, eax
mov dword [ebp - 0x448], eax
mov eax, dword [ebp - 0x49c]
add eax, dword [ebp - 0x448]
mov dword [ebp - 0x444], eax
mov eax, dword [0x951d24]
dec eax
test eax, eax
jl 0x748ac1
inc eax
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
mov eax, dword [eax*4 + 0x951d2c]
mov dword [ebp - 0x450], eax
mov eax, dword [ebp - 0x42c]
movsx eax, word [eax + 0x440]
push eax
mov eax, dword [ebp - 0x450]
pop edx
mov ecx, edx
cdq
idiv ecx
mov dword [ebp - 0x468], edx
mov eax, dword [ebp - 0x42c]
movsx eax, word [eax + 0x440]
push eax
mov eax, dword [ebp - 0x450]
pop edx
mov ecx, edx
cdq
idiv ecx
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x468]
cmp eax, dword [ebp - 0x470]
jl 0x748aa2
mov eax, dword [ebp - 0x468]
cmp eax, dword [ebp - 0x478]
jg 0x748aa2
mov eax, dword [ebp - 0x46c]
cmp eax, dword [ebp - 0x474]
jl 0x748aa2
mov eax, dword [ebp - 0x46c]
cmp eax, dword [ebp - 0x47c]
jg 0x748aa2
mov eax, dword [ebp - 0x44c]
mov byte [eax + 0x952b48], 1
jmp 0x748aaf
mov eax, dword [ebp - 0x44c]
mov byte [eax + 0x952b48], 0
inc dword [ebp - 0x44c]
dec dword [ebp - 0x4c0]
jne 0x748a08
mov eax, dword [ebp - 0x474]
mov edx, dword [ebp - 0x47c]
sub edx, eax
jl 0x748b59
inc edx
mov dword [ebp - 0x4c0], edx
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x470]
mov edx, dword [ebp - 0x478]
sub edx, eax
jl 0x748b4b
inc edx
mov dword [ebp - 0x4c4], edx
mov dword [ebp - 0x468], eax
mov eax, dword [ebp - 0x468]
push eax
mov eax, dword [ebp - 0x46c]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp - 0x434]
push eax
mov eax, dword [ebp - 0x458]
push eax
mov eax, dword [ebp - 0x45c]
push eax
mov ecx, dword [ebp - 0x444]
mov edx, dword [ebp - 0x494]
mov eax, dword [ebp - 0x42c]
call fcn.007480d0
inc dword [ebp - 0x468]
dec dword [ebp - 0x4c4]
jne 0x748aff
inc dword [ebp - 0x46c]
dec dword [ebp - 0x4c0]
jne 0x748ae2
mov eax, dword [ebp + 8]
lea eax, [eax + eax*2]
and eax, 0x80000003
jns 0x748b6b
dec eax
or eax, 0xfffffffc
inc eax
mov edx, 4
sub edx, eax
mov dword [ebp - 0x448], edx
cmp dword [ebp - 0x448], 4
jne 0x748b89
xor eax, eax
mov dword [ebp - 0x448], eax
mov eax, dword [ebp + 8]
lea eax, [eax + eax*2]
add eax, dword [ebp - 0x448]
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x428], 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
neg eax
mov dword [ebp - 0x420], eax
mov word [ebp - 0x41c], 1
mov word [ebp - 0x41a], 0x18
xor eax, eax
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x454]
imul dword [ebp + 0x10]
mov dword [ebp - 0x414], eax
xor eax, eax
mov dword [ebp - 0x410], eax
xor eax, eax
mov dword [ebp - 0x40c], eax
xor eax, eax
mov dword [ebp - 0x408], eax
xor eax, eax
mov dword [ebp - 0x404], eax
push 0
push 0
lea eax, [ebp - 0x494]
push eax
push 0
lea eax, [ebp - 0x428]
push eax
push 0
call sub.GDI32.DLL_CreateDIBSection
mov edx, eax
mov eax, dword [ebp - 0x430]
mov eax, dword [eax]
call fcn.00420ee0
mov eax, dword [ebp - 0x430]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x60]
test eax, eax
jne 0x748c49
mov byte [ebp - 0x435], 0
jmp 0x749a87
xor eax, eax
push ebp
push 0x748cf7
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x430]
mov edx, dword [edx]
mov eax, dword [ebp - 0x4a4]
call fcn.00539a38
mov eax, dword [ebp + 8]
lea eax, [eax + eax*2]
and eax, 0x80000003
jns 0x748c7c
dec eax
or eax, 0xfffffffc
inc eax
mov edx, 4
sub edx, eax
mov dword [ebp - 0x448], edx
cmp dword [ebp - 0x448], 4
jne 0x748c9a
xor eax, eax
mov dword [ebp - 0x448], eax
mov eax, dword [ebp + 8]
lea eax, [eax + eax*2]
add eax, dword [ebp - 0x448]
mov dword [ebp - 0x450], eax
mov eax, dword [ebp + 0x10]
dec eax
test eax, eax
jl 0x748ced
inc eax
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 0x44c], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x494]
call fcn.00747c6c
mov eax, dword [ebp - 0x450]
add dword [ebp - 0x494], eax
inc dword [ebp - 0x44c]
dec dword [ebp - 0x4c0]
jne 0x748cc5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x748d01
mov eax, dword [ebp - 0x4a4]
call fcn.004032dc
jmp 0x749a87
fld qword [ebp + 0x24]
fcomp dword [0x749ae8]
fnstsw ax
sahf
jb 0x7492d8
mov eax, dword [ebp + 0x14]
add eax, dword [ebp + 0x10]
dec eax
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 8]
dec eax
mov dword [ebp - 0x458], eax
mov eax, dword [ebp + 8]
and eax, 0x80000003
jns 0x748d4c
dec eax
or eax, 0xfffffffc
inc eax
mov edx, 4
sub edx, eax
mov dword [ebp - 0x448], edx
cmp dword [ebp - 0x448], 4
jne 0x748d6a
xor eax, eax
mov dword [ebp - 0x448], eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x448]
mov dword [ebp - 0x444], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jns 0x748d83
add eax, 0x3f
sar eax, 6
mov dword [ebp - 0x470], eax
mov eax, dword [ebp + 0x14]
test eax, eax
jns 0x748d96
add eax, 0x3f
sar eax, 6
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0x458]
test eax, eax
jns 0x748dac
add eax, 0x3f
sar eax, 6
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x45c]
test eax, eax
jns 0x748dc2
add eax, 0x3f
sar eax, 6
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x428], 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
neg eax
mov dword [ebp - 0x420], eax
mov word [ebp - 0x41c], 1
mov word [ebp - 0x41a], 8
xor eax, eax
mov dword [ebp - 0x418], eax
mov eax, dword [ebp + 8]
imul dword [ebp + 0x10]
mov dword [ebp - 0x414], eax
xor eax, eax
mov dword [ebp - 0x410], eax
xor eax, eax
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x408], pe_nt_image_headers32
mov dword [ebp - 0x404], pe_nt_image_headers32
mov eax, dword [0x841884]
cmp byte [eax], 0
jne 0x748ebc
xor eax, eax
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x44c]
mov al, byte [eax + edx*4 + 0x4a2]
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x3fe], al
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x44c]
mov al, byte [eax + edx*4 + 0x4a1]
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x3ff], al
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x44c]
mov al, byte [eax + edx*4 + 0x4a0]
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x400], al
inc dword [ebp - 0x44c]
cmp dword [ebp - 0x44c], 0x100
jne 0x748e45
jmp 0x74903f
mov eax, dword [0x8418d8]
cmp dword [eax], 0
jne 0x748f1c
xor eax, eax
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x44c]
mov al, byte [eax + edx*4 + 0x4a2]
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x3fe], al
mov eax, dword [ebp - 0x44c]
mov byte [ebp + eax*4 - 0x3ff], 0
mov eax, dword [ebp - 0x44c]
mov byte [ebp + eax*4 - 0x400], 0
inc dword [ebp - 0x44c]
cmp dword [ebp - 0x44c], 0x100
jne 0x748ece
mov eax, dword [0x8418d8]
cmp dword [eax], 1
jne 0x748f7c
xor eax, eax
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x44c]
mov byte [ebp + eax*4 - 0x3fe], 0
mov eax, dword [ebp - 0x44c]
mov byte [ebp + eax*4 - 0x3ff], 0
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x44c]
mov al, byte [eax + edx*4 + 0x4a0]
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x400], al
inc dword [ebp - 0x44c]
cmp dword [ebp - 0x44c], 0x100
jne 0x748f2e
mov eax, dword [0x8418d8]
cmp dword [eax], 2
jne 0x74903f
xor eax, eax
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x44c]
movzx eax, byte [eax + edx*4 + 0x4a0]
imul eax, eax, 0x1d
mov edx, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0x44c]
movzx edx, byte [edx + ecx*4 + 0x4a1]
imul edx, edx, 0x96
add eax, edx
mov edx, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0x44c]
movzx edx, byte [edx + ecx*4 + 0x4a2]
imul edx, edx, 0x4d
add eax, edx
test eax, eax
jns 0x748fe7
add eax, 0xff
sar eax, 8
mov byte [ebp - 0x4b1], al
mov eax, dword [ebp - 0x44c]
mov dl, byte [ebp - 0x4b1]
mov byte [ebp + eax*4 - 0x3fe], dl
mov eax, dword [ebp - 0x44c]
mov dl, byte [ebp - 0x4b1]
mov byte [ebp + eax*4 - 0x3ff], dl
mov eax, dword [ebp - 0x44c]
mov dl, byte [ebp - 0x4b1]
mov byte [ebp + eax*4 - 0x400], dl
inc dword [ebp - 0x44c]
cmp dword [ebp - 0x44c], 0x100
jne 0x748f92
mov eax, dword [0x840fac]
cmp byte [eax], 0
je 0x74911f
xor eax, eax
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x44c]
movzx eax, byte [ebp + eax*4 - 0x3fe]
mov edx, dword [0x841748]
imul dword [edx]
mov dword [ebp - 0x4c8], eax
fild dword [ebp - 0x4c8]
fld xword [0x749aec]
fmulp st(1)
call fcn.00402c90
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x3fe], al
mov eax, dword [ebp - 0x44c]
movzx eax, byte [ebp + eax*4 - 0x3ff]
mov edx, dword [0x841748]
imul dword [edx]
mov dword [ebp - 0x4c8], eax
fild dword [ebp - 0x4c8]
fld xword [0x749aec]
fmulp st(1)
call fcn.00402c90
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x3ff], al
mov eax, dword [ebp - 0x44c]
movzx eax, byte [ebp + eax*4 - 0x400]
mov edx, dword [0x841748]
imul dword [edx]
mov dword [ebp - 0x4c8], eax
fild dword [ebp - 0x4c8]
fld xword [0x749aec]
fmulp st(1)
call fcn.00402c90
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x400], al
inc dword [ebp - 0x44c]
cmp dword [ebp - 0x44c], 0x100
jne 0x749055
push 0
push 0
lea eax, [ebp - 0x494]
push eax
push 0
lea eax, [ebp - 0x428]
push eax
push 0
call sub.GDI32.DLL_CreateDIBSection
mov edx, eax
mov eax, dword [ebp - 0x430]
mov eax, dword [eax]
call fcn.00420ee0
mov eax, dword [ebp - 0x430]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x60]
test eax, eax
jne 0x749166
mov byte [ebp - 0x435], 0
jmp 0x749a87
mov eax, dword [0x951d24]
dec eax
test eax, eax
jl 0x74923e
inc eax
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
mov eax, dword [eax*4 + 0x951d2c]
mov dword [ebp - 0x450], eax
mov eax, dword [ebp - 0x42c]
movsx eax, word [eax + 0x440]
push eax
mov eax, dword [ebp - 0x450]
pop edx
mov ecx, edx
cdq
idiv ecx
mov dword [ebp - 0x468], edx
mov eax, dword [ebp - 0x42c]
movsx eax, word [eax + 0x440]
push eax
mov eax, dword [ebp - 0x450]
pop edx
mov ecx, edx
cdq
idiv ecx
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x468]
cmp eax, dword [ebp - 0x470]
jl 0x74921f
mov eax, dword [ebp - 0x468]
cmp eax, dword [ebp - 0x478]
jg 0x74921f
mov eax, dword [ebp - 0x46c]
cmp eax, dword [ebp - 0x474]
jl 0x74921f
mov eax, dword [ebp - 0x46c]
cmp eax, dword [ebp - 0x47c]
jg 0x74921f
mov eax, dword [ebp - 0x44c]
mov byte [eax + 0x952b48], 1
jmp 0x74922c
mov eax, dword [ebp - 0x44c]
mov byte [eax + 0x952b48], 0
inc dword [ebp - 0x44c]
dec dword [ebp - 0x4c0]
jne 0x749185
mov eax, dword [ebp - 0x474]
mov edx, dword [ebp - 0x47c]
sub edx, eax
jl 0x749a87
inc edx
mov dword [ebp - 0x4c0], edx
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x470]
mov edx, dword [ebp - 0x478]
sub edx, eax
jl 0x7492c5
inc edx
mov dword [ebp - 0x4c4], edx
mov dword [ebp - 0x468], eax
mov eax, dword [ebp - 0x468]
push eax
mov eax, dword [ebp - 0x46c]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 0x458]
push eax
mov eax, dword [ebp - 0x45c]
push eax
mov ecx, dword [ebp - 0x444]
mov edx, dword [ebp - 0x494]
mov eax, dword [ebp - 0x42c]
call fcn.007480d0
inc dword [ebp - 0x468]
dec dword [ebp - 0x4c4]
jne 0x74927c
inc dword [ebp - 0x46c]
dec dword [ebp - 0x4c0]
jne 0x74925f
jmp 0x749a87
mov eax, dword [ebp + 0x14]
add eax, dword [ebp + 0x20]
dec eax
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 0x18]
dec eax
mov dword [ebp - 0x458], eax
mov eax, dword [ebp + 0x18]
and eax, 0x80000003
jns 0x749301
dec eax
or eax, 0xfffffffc
inc eax
mov edx, 4
sub edx, eax
mov dword [ebp - 0x448], edx
cmp dword [ebp - 0x448], 4
jne 0x74931f
xor eax, eax
mov dword [ebp - 0x448], eax
mov eax, dword [ebp + 0x18]
add eax, dword [ebp - 0x448]
mov dword [ebp - 0x444], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jns 0x749338
add eax, 0x3f
sar eax, 6
mov dword [ebp - 0x470], eax
mov eax, dword [ebp + 0x14]
test eax, eax
jns 0x74934b
add eax, 0x3f
sar eax, 6
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0x458]
test eax, eax
jns 0x749361
add eax, 0x3f
sar eax, 6
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x45c]
test eax, eax
jns 0x749377
add eax, 0x3f
sar eax, 6
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x428], 0x28
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x20]
neg eax
mov dword [ebp - 0x420], eax
mov word [ebp - 0x41c], 1
mov word [ebp - 0x41a], 8
xor eax, eax
mov dword [ebp - 0x418], eax
mov eax, dword [ebp + 0x18]
imul dword [ebp + 0x20]
mov dword [ebp - 0x414], eax
xor eax, eax
mov dword [ebp - 0x410], eax
xor eax, eax
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x408], pe_nt_image_headers32
mov dword [ebp - 0x404], pe_nt_image_headers32
xor eax, eax
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x44c]
mov al, byte [eax + edx*4 + 0x4a2]
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x3fe], al
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x44c]
mov al, byte [eax + edx*4 + 0x4a1]
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x3ff], al
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x44c]
mov al, byte [eax + edx*4 + 0x4a0]
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x400], al
inc dword [ebp - 0x44c]
cmp dword [ebp - 0x44c], 0x100
jne 0x7493f0
mov dl, 1
mov eax, dword [0x41960c]
call fcn.0041fdbc
mov dword [ebp - 0x4a4], eax
push 0
push 0
lea eax, [ebp - 0x494]
push eax
push 0
lea eax, [ebp - 0x428]
push eax
push 0
call sub.GDI32.DLL_CreateDIBSection
mov edx, eax
mov eax, dword [ebp - 0x4a4]
call fcn.00420ee0
mov eax, dword [ebp - 0x4a4]
mov edx, dword [eax]
call dword [edx + 0x60]
test eax, eax
jne 0x7494b7
mov byte [ebp - 0x435], 0
jmp 0x749a87
mov eax, dword [0x951d24]
dec eax
test eax, eax
jl 0x74958f
inc eax
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
mov eax, dword [eax*4 + 0x951d2c]
mov dword [ebp - 0x450], eax
mov eax, dword [ebp - 0x42c]
movsx eax, word [eax + 0x440]
push eax
mov eax, dword [ebp - 0x450]
pop edx
mov ecx, edx
cdq
idiv ecx
mov dword [ebp - 0x468], edx
mov eax, dword [ebp - 0x42c]
movsx eax, word [eax + 0x440]
push eax
mov eax, dword [ebp - 0x450]
pop edx
mov ecx, edx
cdq
idiv ecx
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x468]
cmp eax, dword [ebp - 0x470]
jl 0x749570
mov eax, dword [ebp - 0x468]
cmp eax, dword [ebp - 0x478]
jg 0x749570
mov eax, dword [ebp - 0x46c]
cmp eax, dword [ebp - 0x474]
jl 0x749570
mov eax, dword [ebp - 0x46c]
cmp eax, dword [ebp - 0x47c]
jg 0x749570
mov eax, dword [ebp - 0x44c]
mov byte [eax + 0x952b48], 1
jmp 0x74957d
mov eax, dword [ebp - 0x44c]
mov byte [eax + 0x952b48], 0
inc dword [ebp - 0x44c]
dec dword [ebp - 0x4c0]
jne 0x7494d6
mov eax, dword [ebp - 0x474]
mov edx, dword [ebp - 0x47c]
sub edx, eax
jl 0x749624
inc edx
mov dword [ebp - 0x4c0], edx
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x470]
mov edx, dword [ebp - 0x478]
sub edx, eax
jl 0x749616
inc edx
mov dword [ebp - 0x4c4], edx
mov dword [ebp - 0x468], eax
mov eax, dword [ebp - 0x468]
push eax
mov eax, dword [ebp - 0x46c]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 0x458]
push eax
mov eax, dword [ebp - 0x45c]
push eax
mov ecx, dword [ebp - 0x444]
mov edx, dword [ebp - 0x494]
mov eax, dword [ebp - 0x42c]
call fcn.007480d0
inc dword [ebp - 0x468]
dec dword [ebp - 0x4c4]
jne 0x7495cd
inc dword [ebp - 0x46c]
dec dword [ebp - 0x4c0]
jne 0x7495b0
mov dword [ebp - 0x428], 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
neg eax
mov dword [ebp - 0x420], eax
mov word [ebp - 0x41c], 1
mov word [ebp - 0x41a], 8
xor eax, eax
mov dword [ebp - 0x418], eax
mov eax, dword [ebp + 8]
imul dword [ebp + 0x10]
mov dword [ebp - 0x414], eax
xor eax, eax
mov dword [ebp - 0x410], eax
xor eax, eax
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x408], pe_nt_image_headers32
mov dword [ebp - 0x404], pe_nt_image_headers32
xor eax, eax
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x44c]
mov al, byte [eax + edx*4 + 0x4a2]
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x3fe], al
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x44c]
mov al, byte [eax + edx*4 + 0x4a1]
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x3ff], al
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x44c]
mov al, byte [eax + edx*4 + 0x4a0]
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x400], al
inc dword [ebp - 0x44c]
cmp dword [ebp - 0x44c], 0x100
jne 0x749694
mov eax, dword [0x841884]
cmp byte [eax], 0
jne 0x74978f
xor eax, eax
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x44c]
mov al, byte [eax + edx*4 + 0x4a2]
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x3fe], al
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x44c]
mov al, byte [eax + edx*4 + 0x4a1]
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x3ff], al
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x44c]
mov al, byte [eax + edx*4 + 0x4a0]
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x400], al
inc dword [ebp - 0x44c]
cmp dword [ebp - 0x44c], 0x100
jne 0x749718
jmp 0x749912
mov eax, dword [0x8418d8]
cmp dword [eax], 0
jne 0x7497ef
xor eax, eax
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x44c]
mov al, byte [eax + edx*4 + 0x4a2]
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x3fe], al
mov eax, dword [ebp - 0x44c]
mov byte [ebp + eax*4 - 0x3ff], 0
mov eax, dword [ebp - 0x44c]
mov byte [ebp + eax*4 - 0x400], 0
inc dword [ebp - 0x44c]
cmp dword [ebp - 0x44c], 0x100
jne 0x7497a1
mov eax, dword [0x8418d8]
cmp dword [eax], 1
jne 0x74984f
xor eax, eax
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x44c]
mov byte [ebp + eax*4 - 0x3fe], 0
mov eax, dword [ebp - 0x44c]
mov byte [ebp + eax*4 - 0x3ff], 0
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x44c]
mov al, byte [eax + edx*4 + 0x4a0]
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x400], al
inc dword [ebp - 0x44c]
cmp dword [ebp - 0x44c], 0x100
jne 0x749801
mov eax, dword [0x8418d8]
cmp dword [eax], 2
jne 0x749912
xor eax, eax
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x44c]
movzx eax, byte [eax + edx*4 + 0x4a0]
imul eax, eax, 0x1d
mov edx, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0x44c]
movzx edx, byte [edx + ecx*4 + 0x4a1]
imul edx, edx, 0x96
add eax, edx
mov edx, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0x44c]
movzx edx, byte [edx + ecx*4 + 0x4a2]
imul edx, edx, 0x4d
add eax, edx
test eax, eax
jns 0x7498ba
add eax, 0xff
sar eax, 8
mov byte [ebp - 0x4b1], al
mov eax, dword [ebp - 0x44c]
mov dl, byte [ebp - 0x4b1]
mov byte [ebp + eax*4 - 0x3fe], dl
mov eax, dword [ebp - 0x44c]
mov dl, byte [ebp - 0x4b1]
mov byte [ebp + eax*4 - 0x3ff], dl
mov eax, dword [ebp - 0x44c]
mov dl, byte [ebp - 0x4b1]
mov byte [ebp + eax*4 - 0x400], dl
inc dword [ebp - 0x44c]
cmp dword [ebp - 0x44c], 0x100
jne 0x749865
mov eax, dword [0x840fac]
cmp byte [eax], 0
je 0x7499f2
xor eax, eax
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x44c]
movzx eax, byte [ebp + eax*4 - 0x3fe]
mov edx, dword [0x841748]
imul dword [edx]
mov dword [ebp - 0x4c8], eax
fild dword [ebp - 0x4c8]
fld xword [0x749aec]
fmulp st(1)
call fcn.00402c90
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x3fe], al
mov eax, dword [ebp - 0x44c]
movzx eax, byte [ebp + eax*4 - 0x3ff]
mov edx, dword [0x841748]
imul dword [edx]
mov dword [ebp - 0x4c8], eax
fild dword [ebp - 0x4c8]
fld xword [0x749aec]
fmulp st(1)
call fcn.00402c90
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x3ff], al
mov eax, dword [ebp - 0x44c]
movzx eax, byte [ebp + eax*4 - 0x400]
mov edx, dword [0x841748]
imul dword [edx]
mov dword [ebp - 0x4c8], eax
fild dword [ebp - 0x4c8]
fld xword [0x749aec]
fmulp st(1)
call fcn.00402c90
mov edx, dword [ebp - 0x44c]
mov byte [ebp + edx*4 - 0x400], al
inc dword [ebp - 0x44c]
cmp dword [ebp - 0x44c], 0x100
jne 0x749928
push 0
push 0
lea eax, [ebp - 0x494]
push eax
push 0
lea eax, [ebp - 0x428]
push eax
push 0
call sub.GDI32.DLL_CreateDIBSection
mov edx, eax
mov eax, dword [ebp - 0x430]
mov eax, dword [eax]
call fcn.00420ee0
mov eax, dword [ebp - 0x430]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x60]
test eax, eax
jne 0x749a36
mov byte [ebp - 0x435], 0
jmp 0x749a87
push 0xcc0020
mov eax, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x18]
push eax
push 0
push 0
mov eax, dword [ebp - 0x4a4]
call fcn.004202f0
call fcn.0041b8cc
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0
mov eax, dword [ebp - 0x430]
mov eax, dword [eax]
call fcn.004202f0
call fcn.0041b8cc
push eax
call sub.GDI32.DLL_StretchBlt
mov eax, dword [ebp - 0x4a4]
call fcn.004032dc
mov al, byte [ebp - 0x435]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24