Function at 0x4f7fd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b3b96
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x6244f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x134], ebx
lea eax, [ebx + 0x574]
mov dword [ebp - 0x110], 0xffffffff
mov ecx, eax
mov dword [ebp - 0x10c], 0xb4c6eafc
mov dword [ebp - 0x108], 0xfcc6b4b4
mov dword [ebp - 0x104], 0xffffffff
mov dword [ebp - 0x100], 0xeaffffff
mov dword [ebp - 0xfc], 0xc6eaeaea
mov dword [ebp - 0xf8], 0x7e7e90b4
mov dword [ebp - 0xf4], 0xffffffc6
mov dword [ebp - 0xf0], 0xfceaffff
mov dword [ebp - 0xec], 0xc6eaeafc
mov dword [ebp - 0xe8], 0x6c7e90b4
mov dword [ebp - 0xe4], 0xffff905a
mov dword [ebp - 0xe0], 0xfcfceaff
mov dword [ebp - 0xdc], 0xc6eaeafc
mov dword [ebp - 0xd8], 0x6c7e90b4
mov dword [ebp - 0xd4], 0xff7e365a
mov dword [ebp - 0xd0], 0xfcfcfcea
mov dword [ebp - 0xcc], 0xc6eaeafc
mov dword [ebp - 0xc8], 0x6c7e90b4
mov dword [ebp - 0xc4], 0xea24365a
mov dword [ebp - 0xc0], 0xfcfcfcea
mov dword [ebp - 0xbc], 0xc6eaeafc
mov dword [ebp - 0xb8], 0x6c7e90b4
mov dword [ebp - 0xb4], 0x5a243648
mov dword [ebp - 0xb0], 0xeaeaeaea
mov dword [ebp - 0xac], 0xb4c6eaea
mov dword [ebp - 0xa8], 0x6c7e9090
mov dword [ebp - 0xa4], 0x24122448
mov dword [ebp - 0xa0], 0xeaeaeac6
mov dword [ebp - 0x9c], 0xb4c6c6c6
mov dword [ebp - 0x98], 0x487e7e90
mov dword [ebp - 0x94], 0x12122436
mov dword [ebp - 0x90], 0xc6c6c6c6
mov dword [ebp - 0x8c], 0x90b4b4c6
mov dword [ebp - 0x88], 0x486c7e7e
mov dword [ebp - 0x84], 0x121236
mov dword [ebp - 0x80], 0xb4b4b4c6
mov dword [ebp - 0x7c], 0x7e90b4b4
mov dword [ebp - 0x78], 0x365a6c7e
mov dword [ebp - 0x74], 0x1224
mov dword [ebp - 0x70], 0x909090c6
mov dword [ebp - 0x6c], 0x7e7e9090
mov dword [ebp - 0x68], 0x36486c6c
mov dword [ebp - 0x64], 0x36001224
mov dword [ebp - 0x60], 0x7e7e90fc
mov dword [ebp - 0x5c], 0x6c6c7e7e
mov dword [ebp - 0x58], 0x24365a5a
mov dword [ebp - 0x54], 0xb4000012
mov dword [ebp - 0x50], 0x6c6cc6ff
mov dword [ebp - 0x4c], 0x5a5a6c6c
mov dword [ebp - 0x48], 0x2436485a
mov dword [ebp - 0x44], 0xff480012
mov dword [ebp - 0x40], 0x6cb4ffff
mov dword [ebp - 0x3c], 0x485a5a5a
mov dword [ebp - 0x38], 0x12243648
mov dword [ebp - 0x34], 0xffff3600
mov dword [ebp - 0x30], 0xc6ffffff
mov dword [ebp - 0x2c], 0x4848485a
mov dword [ebp - 0x28], 0x12242436
mov dword [ebp - 0x24], 0xffffff6c
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x1c], 0x486cb4fc
mov dword [ebp - 0x18], 0xea7e5a36
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x130], eax
call fcn.0054933b
mov ecx, dword [ebx + 0x4cc]
mov dword [ebp - 0x118], ecx
cmp ecx, 0xffffffff
jne 0x4f8262
mov eax, dword [ebx + 0x4c8]
mov dword [ebp - 0x118], eax
mov eax, dword [ebx + 0x4d8]
mov dword [ebp - 0x114], eax
cmp eax, 0xffffffff
jne 0x4f8281
mov ebx, dword [ebx + 0x4d4]
mov dword [ebp - 0x114], ebx
jmp 0x4f8287
mov ebx, dword [ebp - 0x114]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.0053bdcf
push eax
lea ecx, [ebp - 0x158]
call fcn.00545808
lea ecx, [ebp - 0x144]
mov dword [ebp - 4], 0
call fcn.0054579f
push dword [ebp - 0x154]
mov byte [ebp - 4], 1
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [ebp - 0x144]
call fcn.005460a8
mov dword [ebp - 0x11c], 0
mov dword [ebp - method.CBitmap.virtual_0], vtable.CBitmap.0
push 0x10
push 0x10
push dword [ebp - 0x154]
mov byte [ebp - 4], 2
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
lea ecx, [ebp - 0x120]
call fcn.005460ea
push dword [ebp - 0x11c]
push dword [ebp - 0x140]
call fcn.0054679b
mov dword [ebp - 0x12c], eax
xor esi, esi
lea ebx, [ebx]
movzx edx, byte [ebp + esi - 0x110]
mov dword [ebp - 0x124], edx
cmp edx, 0xff
jne 0x4f8340
mov edi, 0xff00
jmp 0x4f83f3
mov eax, dword [ebp - 0x114]
shr eax, 8
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x118]
shr eax, 0x10
movzx eax, al
shr ebx, 0x10
movzx ecx, bl
sub ecx, eax
mov eax, 0x80808081
imul ecx, edx
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub bl, al
mov eax, dword [ebp - 0x118]
movzx eax, ax
shr eax, 8
movzx edi, bl
mov ebx, dword [ebp - 0x128]
movzx ecx, bl
sub ecx, eax
shl edi, 8
imul ecx, dword [ebp - 0x124]
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub bl, al
movzx eax, bl
mov ebx, dword [ebp - 0x114]
or edi, eax
mov eax, dword [ebp - 0x118]
movzx eax, al
movzx ecx, bl
sub ecx, eax
shl edi, 8
imul ecx, dword [ebp - 0x124]
mov eax, 0x80808081
imul ecx
mov al, bl
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub al, cl
movzx eax, al
or edi, eax
push edi
mov eax, esi
and eax, 0xf
push eax
mov eax, esi
shr eax, 4
push eax
push dword [ebp - 0x140]
call dword [sym.imp.GDI32.dll_SetPixel]
inc esi
cmp esi, 0x100
jl 0x4f8320
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0x4f8426
mov eax, dword [eax + 4]
push eax
push dword [ebp - 0x140]
call fcn.0054679b
mov ecx, dword [ebp - 0x130]
push 0
push 1
push 0x19
push 0x10
push 0x10
call fcn.00549232
mov eax, dword [ebp - 0x134]
push 0xff00
push dword [ebp - 0x11c]
push dword [eax + 0x578]
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
lea ecx, [ebp - 0x120]
mov dword [ebp - method.CBitmap.virtual_0], vtable.CBitmap.0
call fcn.0040c42b
lea ecx, [ebp - 0x144]
call fcn.005458b1
lea ecx, [ebp - 0x158]
call fcn.00545956
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056e41f
mov esp, ebp
pop ebp
ret