Function at 0x508940
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x104
push esi
push edi
xor edi, edi
cmp dword [0x8e8144], edi
mov esi, eax
jne 0x509f63
call fcn.004ebdf0
cmp eax, 1
jne 0x50896f
call fcn.004ebe00
test eax, eax
je 0x509f63
test esi, esi
push ebx
js 0x5089ca
mov eax, esi
and eax, 0x78000000
cmp eax, 0x20000000
jne 0x5089ca
mov eax, esi
and eax, 0xffff
cmp eax, 0x28
jge 0x5089ca
mov ebx, dword [eax*4 + 0x8ec5e0]
cmp ebx, edi
mov dword [esp + 0x38], ebx
je 0x5089ca
mov ecx, dword [ebx]
shl ecx, 0x10
and esi, 0x7ff0000
cmp ecx, esi
jne 0x5089ca
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
cmp esi, edi
mov dword [esp + 0x7c], esi
jne 0x5089d6
push 0x6a8de8
call fcn.004e5100
add esp, 4
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x104
ret
mov edx, dword [ebx + 0x89f6c]
push ebp
push edx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ebp, eax
cmp ebp, edi
mov dword [esp + 0xa0], ebp
jne 0x508a13
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
push 0x6a8de8
call fcn.004e5100
add esp, 4
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x104
ret
lea eax, [esp + 0xdc]
push eax
push esi
call dword [sym.imp.GDI32.dll_GetTextMetricsA]
test byte [ebx + 0x89f70], 1
je 0x508a42
mov eax, dword [ebx + 0x89f78]
lea ecx, [eax + eax]
mov dword [esp + 0x70], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x74], ecx
jmp 0x508a4e
mov dword [esp + 0x70], edi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x74], edi
cmp dword [esp + 0x118], edi
mov edx, dword [esp + 0x11c]
mov dword [esp + 0x78], edx
mov dword [esp + 0x88], edi
jle 0x509f43
lea ecx, [ecx]
mov eax, dword [ebx + 0x89e3c]
lea eax, [eax + eax*4]
cmp byte [ebx + eax*4 + 8], 0
lea edi, [ebx + eax*4 + 8]
mov dword [esp + 0x7c], edi
je 0x508a9e
mov ecx, dword [edi + 0x10]
mov dword [ecx], 0
mov edx, dword [edi + 0x10]
mov dword [edx + 4], 0
mov byte [edi], 0
mov eax, dword [esp + 0x78]
movzx ecx, word [eax]
mov eax, dword [edi + 8]
lea edx, [ebx + ecx*8 + 0x9e3c]
mov ecx, dword [ebx + 0x89f84]
mov dword [esp + 0xa4], edx
cdq
idiv ecx
mov ecx, dword [ebx + 0x89f68]
mov ebp, ecx
mov esi, ecx
imul ebp, eax
imul esi, edx
mov eax, dword [ebx + 0x8a3d0]
cmp eax, 1
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], esi
jne 0x508aef
add ebp, 1
add esi, eax
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], esi
test eax, eax
jne 0x508b16
mov eax, dword [ebx + 0x89e48]
mov edx, eax
imul eax, esi
add eax, dword [ebx + 0x89e44]
imul edx, ecx
push edx
xor ebp, ebp
push ebp
push eax
call fcn.004dc0b0
add esp, 0xc
jmp 0x508b55
push ecx
push ecx
push esi
lea eax, [ebx + 0x89f94]
push ebp
push eax
call fcn.0051d050
add esp, 0x14
test byte [ebx + 0x89f70], 1
je 0x508b53
mov eax, dword [ebx + 0x89f68]
push eax
push eax
mov eax, dword [ebx + 0x89f7c]
add eax, ebp
push esi
push eax
lea eax, [ebx + 0x89f94]
push eax
call fcn.0051d050
add esp, 0x14
xor ebp, ebp
mov eax, dword [ebx + 0x89f70]
cmp eax, 3
ja case.default.0x508b60
jmp dword [eax*4 + 0x509f70]
mov ecx, 1
mov dword [esp + 0x68], ecx
jmp 0x508b7f
mov dword [esp + 0x68], 5
mov ecx, 1
mov esi, dword [esp + 0x78]
mov al, byte [esi]
cmp al, 0x20
mov word [esp + 0x90], bp
mov word [esp + 0x92], cx
mov word [esp + 0x94], bp
mov word [esp + 0x96], bp
mov word [esp + 0x98], bp
mov word [esp + 0x9a], bp
mov word [esp + 0x9c], bp
mov word [esp + 0x9e], cx
je 0x508bd9
xor ecx, ecx
cmp word [esi], 0x4081
setne cl
sub ecx, 1
and ecx, 2
mov dword [esp + 0x14], ecx
mov cl, byte [esi + 1]
test cl, cl
mov dword [esp + 0x20], ebp
je 0x508bf2
mov byte [esp + 0x21], al
mov byte [esp + 0x20], cl
jmp 0x508bfb
mov byte [esp + 0x20], al
mov byte [esp + 0x21], 0
push 0x14
lea edx, [esp + 0xac]
push ebp
push edx
call fcn.004dc0b0
mov edx, dword [esp + 0x74]
add esp, 0xc
lea eax, [esp + 0x90]
push eax
mov eax, dword [esp + 0x24]
push ebp
push ebp
lea ecx, [esp + 0xb4]
push ecx
mov ecx, dword [esp + 0x90]
push edx
push eax
push ecx
call dword [sym.imp.GDI32.dll_GetGlyphOutlineA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x508c51
push str.GetGlyphOutline
call fcn.004e16a0
add esp, 4
jmp 0x509f06
cmp dword [esp + 0x14], ebp
je 0x508c70
mov dx, word [esp + 0xb8]
mov word [edi + 6], dx
mov word [edi + 0xc], bp
mov word [edi + 0xe], bp
jmp 0x509ec5
xor edx, edx
mov eax, esi
div dword [esp + 0xac]
shr eax, 2
add eax, eax
add eax, eax
cmp esi, ebp
mov dword [esp + 0x38], eax
jne 0x508c8c
xor esi, esi
mov eax, dword [esp + 0x38]
push 0
lea eax, [esi + eax*2]
push 0x69d8f9
push eax
call fcn.004e0700
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x509f39
mov ecx, dword [esp + 0x38]
lea eax, [esi + ecx*2]
push eax
push 0
push ebp
call fcn.004dc0b0
add ebp, dword [esp + 0x44]
mov ecx, dword [esp + 0x74]
add esp, 0xc
lea edx, [esp + 0x90]
push edx
mov edx, dword [esp + 0x24]
push ebp
push esi
lea eax, [esp + 0xb4]
push eax
mov eax, dword [esp + 0x90]
push ecx
push edx
push eax
mov dword [esp + 0xa8], ebp
call dword [sym.imp.GDI32.dll_GetGlyphOutlineA]
cmp eax, 0xffffffff
jne 0x508d0c
push str.GetGlyphOutline
call fcn.004e16a0
add esp, 4
jmp 0x509f06
movzx ecx, word [esp + 0xb0]
mov eax, dword [esp + 0xa8]
mov esi, dword [esp + 0xac]
mov word [edi + 2], cx
mov edx, dword [esp + 0xe0]
sub edx, dword [esp + 0xb4]
movzx ecx, word [esp + 0xb8]
mov word [edi + 4], dx
mov word [edi + 0xc], ax
mov word [edi + 0xe], si
mov word [edi + 6], cx
mov ecx, dword [ebx + 0x89f70]
test cl, 1
movsx edx, ax
jne 0x50900f
cmp dword [ebx + 0x8a3d0], 0
movsx edi, si
mov dword [esp + 0x20], edx
mov dword [esp + 0x40], edi
mov dword [esp + 0x28], ebp
jne 0x508e1b
mov edx, dword [ebx + 0x89e48]
mov esi, edx
imul esi, dword [esp + 0x58]
add esi, dword [ebx + 0x89e44]
mov eax, ecx
sub eax, 0
mov dword [esp + 0x2c], edx
je 0x508de9
sub eax, 2
jne 0x509ea4
test edi, edi
jle 0x509ea4
mov dword [esp + 0x14], edi
mov edi, ebp
mov ebp, dword [esp + 0x20]
test ebp, ebp
jle 0x508dd7
mov edx, esi
mov ecx, edi
sub edx, edi
mov ebx, ebp
nop
mov al, byte [ecx]
test al, al
je 0x508dcb
sub al, 1
mov byte [edx + ecx], al
add ecx, 1
sub ebx, 1
jne 0x508dc0
mov edx, dword [esp + 0x2c]
add edi, dword [esp + 0x38]
add esi, edx
sub dword [esp + 0x14], 1
jne 0x508db3
jmp 0x509ea4
test edi, edi
jle 0x509ea4
mov ebx, dword [esp + 0x38]
mov ebp, edi
mov edi, dword [esp + 0x28]
jmp 0x508e00
push ebx
push edi
push esi
call fcn.004dc130
add esi, dword [esp + 0x38]
add esp, 0xc
add edi, ebx
sub ebp, 1
jne 0x508e00
jmp 0x509ea4
mov ecx, dword [ebx + 0x8a3c4]
movzx eax, word [ebx + 0x89f96]
imul eax, dword [esp + 0x54]
mov esi, dword [ebx + 0x89fa0]
mov edx, dword [ebx + 0x89fa4]
lea edi, [ebx + 0x89f94]
mov dword [esp + 0x64], ecx
imul ecx, dword [esp + 0x58]
add eax, ecx
mov ecx, dword [edi + 0x14]
add eax, dword [edi + 0x434]
mov ebp, esi
or ebp, edx
or ebp, ecx
mov ecx, dword [esp + 0x68]
sub ecx, 1
je 0x508f61
sub ecx, 4
jne 0x508fc2
cmp dword [edi + 0x18], 0xf000
jne 0x508ef3
cmp esi, 0xf00
jne 0x508ef3
cmp edx, 0xf0
jne 0x508ef3
cmp dword [edi + 0x14], 0xf
jne 0x508ef3
mov ecx, dword [esp + 0x40]
test ecx, ecx
jle 0x508fc2
mov dword [esp + 0x14], ecx
mov edi, edi
xor ecx, ecx
cmp dword [esp + 0x20], ecx
jle 0x508edb
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x20]
mov dl, byte [ecx + esi]
test dl, dl
je 0x508ece
movzx dx, dl
shl dx, 0xc
sub dx, 1
or dx, 0xfff
mov word [eax + ecx*2], dx
jmp 0x508ed4
mov word [eax + ecx*2], 0xfff
add ecx, 1
cmp ecx, ebp
jl 0x508eb0
mov ecx, dword [esp + 0x38]
add dword [esp + 0x28], ecx
add eax, dword [esp + 0x64]
sub dword [esp + 0x14], 1
jne 0x508ea0
jmp 0x508fc2
mov ecx, dword [esp + 0x40]
test ecx, ecx
jle 0x508fc2
mov dword [esp + 0x14], ecx
xor esi, esi
cmp dword [esp + 0x20], esi
jle 0x508f4c
jmp 0x508f10
mov edx, dword [esp + 0x28]
mov dl, byte [esi + edx]
test dl, dl
je 0x508f3f
movzx ebx, byte [edi + 7]
movzx ecx, byte [edi + 0xb]
movzx dx, dl
lea ecx, [ecx + ebx - 4]
mov ebx, dword [esp + 0x3c]
shl dx, cl
sub dx, 1
or dx, bp
mov word [eax + esi*2], dx
jmp 0x508f43
mov word [eax + esi*2], bp
add esi, 1
cmp esi, dword [esp + 0x20]
jl 0x508f10
mov ecx, dword [esp + 0x38]
add dword [esp + 0x28], ecx
add eax, dword [esp + 0x64]
sub dword [esp + 0x14], 1
jne 0x508f03
jmp 0x508fc2
mov ecx, dword [esp + 0x40]
test ecx, ecx
jle 0x508fc2
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x20]
xor edx, edx
test ecx, ecx
jle 0x508faf
test dl, 7
jne 0x508f8c
mov esi, dword [esp + 0x28]
mov ecx, edx
sar ecx, 3
mov cl, byte [ecx + esi]
mov byte [esp + 0x4b], cl
test byte [esp + 0x4b], 0x80
je 0x508f98
mov ecx, dword [edi + 0x18]
jmp 0x508f9a
xor ecx, ecx
shl byte [esp + 0x4b], 1
or ecx, ebp
mov word [eax + edx*2], cx
mov ecx, dword [esp + 0x20]
add edx, 1
cmp edx, ecx
jl 0x508f77
mov edx, dword [esp + 0x38]
add dword [esp + 0x28], edx
add eax, dword [esp + 0x64]
sub dword [esp + 0x14], 1
jne 0x508f71
mov eax, dword [ebx + 0x89f68]
mov ebp, dword [esp + 0x58]
mov esi, dword [esp + 0x54]
lea ecx, [eax + ebp]
push ecx
add eax, esi
push eax
push ebp
push esi
lea edx, [esp + 0xdc]
push edx
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebx + 0x89f88]
push eax
push ebp
push esi
lea ecx, [esp + 0xd8]
push ecx
push 0
push edi
push 0
push 0
push 0
push edi
call fcn.004f35e0
add esp, 0x28
jmp 0x509ea4
movsx eax, si
mov dword [esp + 0x30], edx
mov edx, dword [ebx + 0x89f78]
mov esi, edx
imul esi, esi, 0x51
cmp dword [ebx + 0x8a3d0], 0
lea esi, [esi + 0x6cf6ef]
mov dword [esp + 0x50], eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x28], edx
mov dword [esp + 0x64], esi
jne 0x509618
sub ecx, 1
mov edi, dword [ebx + 0x89e48]
mov dword [esp + 0x24], edi
je 0x50938f
sub ecx, 2
jne 0x509ea4
mov ecx, dword [esp + 0x58]
mov esi, dword [esp + 0x70]
lea ebp, [ecx + esi]
imul ebp, edi
add ebp, dword [ebx + 0x89e44]
add ebp, dword [esp + 0x54]
add ebp, dword [esp + 0x6c]
cmp edx, 1
jne 0x509150
test eax, eax
jle 0x509ea4
mov dword [esp + 0x14], eax
xor ecx, ecx
cmp dword [esp + 0x30], ecx
jle 0x509136
mov eax, ebp
sub eax, edi
mov dword [esp + 0x34], eax
mov edx, dword [esp + 0x1c]
mov al, byte [ecx + edx]
test al, al
je 0x509129
mov edx, dword [esp + 0x34]
movzx eax, al
sub eax, 1
lea esi, [edx + ecx]
or byte [esi + edi], al
mov dl, byte [esi]
movzx ebx, dl
shl eax, 4
and ebx, 0xf0
cmp ebx, eax
jge 0x5090d9
and dl, 0xf
or dl, al
mov byte [esi], dl
lea edx, [ecx + ebp]
lea esi, [edx + edi]
mov dl, byte [esi]
movzx ebx, dl
and ebx, 0xf0
cmp ebx, eax
jge 0x5090f5
and dl, 0xf
or dl, al
mov byte [esi], dl
mov dl, byte [ecx + ebp + 1]
movzx ebx, dl
and ebx, 0xf0
cmp ebx, eax
jge 0x50910f
and dl, 0xf
or dl, al
mov byte [ecx + ebp + 1], dl
mov dl, byte [ecx + ebp - 1]
movzx ebx, dl
and ebx, 0xf0
cmp ebx, eax
jge 0x509129
and dl, 0xf
or dl, al
mov byte [ecx + ebp - 1], dl
add ecx, 1
cmp ecx, dword [esp + 0x30]
jl 0x5090a5
mov eax, dword [esp + 0x38]
add dword [esp + 0x1c], eax
add ebp, edi
sub dword [esp + 0x14], 1
jne 0x509091
jmp 0x509ea4
cmp edx, 4
jg 0x50928a
test eax, eax
jle 0x509ea4
mov dword [esp + 0x2c], eax
jmp 0x509170
cmp dword [esp + 0x30], 0
mov dword [esp + 0x44], 0
jle 0x50926e
mov eax, dword [esp + 0x1c]
sub eax, ebp
mov dword [esp + 0x58], ebp
mov dword [esp + 0x4c], eax
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x58]
mov al, byte [ecx + edx]
test al, al
je 0x509254
mov ecx, dword [esp + 0x28]
movzx edx, al
mov eax, dword [esp + 0x58]
sub edx, 1
or byte [eax], dl
mov eax, ecx
neg eax
shl edx, 4
add ecx, 1
cmp eax, ecx
mov dword [esp + 0x54], edx
mov dword [esp + 0x20], eax
jge 0x509254
mov esi, eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x28]
add eax, 1
mov edi, esi
imul edi, dword [esp + 0x24]
mov ecx, eax
sub ecx, esi
mov dword [esp + 0x14], ecx
mov edi, edi
cmp esi, eax
jge 0x509244
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x40], ecx
lea esp, [esp]
mov eax, dword [esp + 0x40]
cmp byte [eax], 0
je 0x50922d
lea eax, [edi + esi]
add eax, dword [esp + 0x44]
mov cl, byte [eax + ebp]
add eax, ebp
movzx ebx, cl
and ebx, 0xf0
cmp ebx, edx
mov edx, dword [esp + 0x54]
jge 0x50922d
and cl, 0xf
or cl, dl
mov byte [eax], cl
mov eax, dword [esp + 0x28]
add dword [esp + 0x40], 1
add esi, 1
add eax, 1
cmp esi, eax
jl 0x509200
mov esi, dword [esp + 0x20]
add dword [esp + 0x50], 9
add edi, dword [esp + 0x24]
sub dword [esp + 0x14], 1
jne 0x5091f0
mov eax, dword [esp + 0x44]
add dword [esp + 0x58], 1
add eax, 1
cmp eax, dword [esp + 0x30]
mov dword [esp + 0x44], eax
jl 0x509191
mov ecx, dword [esp + 0x38]
add dword [esp + 0x1c], ecx
add ebp, dword [esp + 0x24]
sub dword [esp + 0x2c], 1
jne 0x509170
jmp 0x509ea4
test eax, eax
jle 0x509ea4
mov dword [esp + 0x40], eax
jmp 0x5092a0
cmp dword [esp + 0x30], 0
mov dword [esp + 0x44], 0
jle 0x509373
mov eax, dword [esp + 0x1c]
sub eax, ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x4c], eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x4c]
mov al, byte [edx + eax]
test al, al
je 0x509359
mov ebx, dword [esp + 0x28]
movzx edx, al
mov eax, dword [esp + 0x20]
sub edx, 1
or byte [eax], dl
mov edi, ebx
shl edx, 4
neg edi
lea ecx, [ebx + 1]
cmp edi, ecx
mov dword [esp + 0x54], edx
jge 0x509359
mov eax, edi
imul eax, dword [esp + 0x24]
sub ecx, edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c], ecx
lea esi, [ebx + 1]
cmp edi, esi
jge 0x50934a
add eax, edi
add eax, dword [esp + 0x44]
add eax, ebp
sub esi, edi
jmp 0x509320
mov cl, byte [eax]
movzx ebx, cl
and ebx, 0xf0
cmp ebx, edx
mov edx, dword [esp + 0x54]
jge 0x50933a
and cl, 0xf
or cl, dl
mov byte [eax], cl
add eax, 1
sub esi, 1
jne 0x509320
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x24]
sub dword [esp + 0x2c], 1
mov dword [esp + 0x14], eax
jne 0x509307
mov eax, dword [esp + 0x44]
add dword [esp + 0x20], 1
add eax, 1
cmp eax, dword [esp + 0x30]
mov dword [esp + 0x44], eax
jl 0x5092c1
mov ecx, dword [esp + 0x38]
add dword [esp + 0x1c], ecx
add ebp, dword [esp + 0x24]
sub dword [esp + 0x40], 1
jne 0x5092a0
jmp 0x509ea4
mov ecx, dword [esp + 0x70]
mov esi, dword [esp + 0x58]
lea ebx, [esi + ecx]
mov ecx, dword [esp + 0x3c]
imul ebx, edi
add ebx, dword [ecx + 0x89e44]
add ebx, dword [esp + 0x54]
add ebx, dword [esp + 0x6c]
cmp edx, 1
mov dword [esp + 0x40], ebx
jne 0x50945c
test eax, eax
jle 0x509ea4
mov ecx, edi
neg ecx
or edx, 0xffffffff
lea ebp, [ebx + 1]
sub edx, ebx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x14], eax
lea esp, [esp]
cmp dword [esp + 0x30], 0
jle 0x509446
or esi, 0xffffffff
mov eax, ebp
sub esi, edi
mov edi, edi
lea ecx, [edx + eax]
test cl, 7
jne 0x509400
shr ecx, 3
mov cl, byte [ecx + ebx]
jmp 0x509404
mov cl, byte [esp + 0x1b]
test cl, cl
jns 0x509434
cmp byte [eax - 2], 1
mov byte [eax - 1], 1
je 0x509416
mov byte [eax - 2], 2
cmp byte [eax], 1
je 0x50941e
mov byte [eax], 2
cmp byte [esi + eax], 1
je 0x509428
mov byte [esi + eax], 2
cmp byte [edi + eax - 1], 1
je 0x509434
mov byte [edi + eax - 1], 2
add cl, cl
add eax, 1
mov byte [esp + 0x1b], cl
lea ecx, [edx + eax]
cmp ecx, dword [esp + 0x30]
jl 0x5093f0
add ebx, dword [esp + 0x38]
add edx, dword [esp + 0x34]
add ebp, edi
sub dword [esp + 0x14], 1
jne 0x5093e0
jmp 0x509ea4
cmp edx, 4
jg 0x50954d
test eax, eax
jle 0x509ea4
mov dword [esp + 0x2c], eax
xor esi, esi
cmp dword [esp + 0x30], esi
jle 0x50952f
lea ecx, [ecx]
mov edx, esi
and edx, 0x80000007
jns 0x50948f
dec edx
or edx, 0xfffffff8
inc edx
jne 0x5094a7
mov ecx, dword [esp + 0x1c]
mov eax, esi
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dl, byte [eax + ecx]
mov byte [esp + 0x1b], dl
test byte [esp + 0x1b], 0x80
je 0x50951e
mov ebp, dword [esp + 0x28]
mov eax, ebp
neg eax
add ebp, 1
cmp eax, ebp
mov byte [esi + ebx], 1
mov dword [esp + 0x20], eax
jge 0x50951e
mov ecx, eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x4c], eax
mov edx, ecx
mov eax, ebp
imul edx, edi
sub eax, ecx
mov dword [esp + 0x14], eax
lea esp, [esp]
cmp ecx, ebp
jge 0x509510
mov ebx, dword [esp + 0x4c]
cmp byte [ebx], 0
je 0x5094fe
lea eax, [edx + ecx]
add eax, esi
add eax, dword [esp + 0x40]
cmp byte [eax], 1
je 0x5094fe
mov byte [eax], 2
add ecx, 1
add ebx, 1
cmp ecx, ebp
jl 0x5094e8
mov ebx, dword [esp + 0x40]
mov ecx, dword [esp + 0x20]
add dword [esp + 0x4c], 9
add edx, edi
sub dword [esp + 0x14], 1
jne 0x5094e0
shl byte [esp + 0x1b], 1
add esi, 1
cmp esi, dword [esp + 0x30]
jl 0x509480
mov ecx, dword [esp + 0x38]
add dword [esp + 0x1c], ecx
add ebx, edi
sub dword [esp + 0x2c], 1
mov dword [esp + 0x40], ebx
jne 0x509471
jmp 0x509ea4
test eax, eax
jle 0x509ea4
mov dword [esp + 0x2c], eax
lea esp, [esp]
xor ebp, ebp
cmp dword [esp + 0x30], ebp
jle 0x5095fc
lea esp, [esp]
mov edx, ebp
and edx, 0x80000007
jns 0x50957f
dec edx
or edx, 0xfffffff8
inc edx
jne 0x509597
mov ecx, dword [esp + 0x1c]
mov eax, ebp
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dl, byte [eax + ecx]
mov byte [esp + 0x1b], dl
test byte [esp + 0x1b], 0x80
je 0x5095eb
mov edi, dword [esp + 0x28]
mov edx, edi
neg edx
add edi, 1
cmp edx, edi
mov byte [ebx + ebp], 1
jge 0x5095eb
mov esi, edx
imul esi, dword [esp + 0x24]
mov eax, edi
sub eax, edx
mov dword [esp + 0x14], eax
cmp edx, edi
jge 0x5095e0
lea eax, [esi + edx]
add eax, ebp
mov ecx, edi
add eax, ebx
sub ecx, edx
nop
cmp byte [eax], 1
je 0x5095d8
mov byte [eax], 2
add eax, 1
sub ecx, 1
jne 0x5095d0
add esi, dword [esp + 0x24]
sub dword [esp + 0x14], 1
jne 0x5095c0
shl byte [esp + 0x1b], 1
add ebp, 1
cmp ebp, dword [esp + 0x30]
jl 0x509570
mov eax, dword [esp + 0x38]
add dword [esp + 0x1c], eax
add ebx, dword [esp + 0x24]
sub dword [esp + 0x2c], 1
jne 0x509560
jmp 0x509ea4
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x70]
mov edx, dword [esp + 0x58]
mov esi, dword [ecx + 0x8a3c4]
add edx, eax
movzx eax, word [ecx + 0x89f96]
imul edx, esi
imul eax, dword [esp + 0x54]
add ecx, 0x89f94
mov ebp, dword [ecx + 0x14]
or ebp, dword [ecx + 0x10]
add edx, eax
add edx, dword [ecx + 0x434]
mov eax, dword [esp + 0x6c]
or ebp, dword [ecx + 0xc]
lea ebx, [edx + eax*2]
mov eax, dword [ecx + 0x428]
mov ecx, dword [esp + 0x8c]
cdq
sub eax, edx
mov edx, eax
mov eax, dword [esp + 0x68]
sar edx, 1
sub eax, 1
mov dword [esp + 0x24], esi
mov dword [esp + 0x84], ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x40], ebp
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x5c], ebx
je 0x509a92
sub eax, 4
jne 0x509e0b
mov eax, dword [esp + 0x28]
cmp eax, 1
jne 0x5097ac
cmp dword [esp + 0x50], 0
jle 0x5099b8
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x2c], edx
xor esi, esi
test ecx, ecx
jle 0x509790
mov eax, dword [esp + 0x20]
mov edi, 2
sub edi, dword [esp + 0x24]
lea eax, [ebx + eax*2 + 2]
mov dword [esp + 0x14], edi
mov edx, dword [esp + 0x1c]
movzx edx, byte [edx + esi]
test edx, edx
jbe 0x509782
mov word [ebx + esi*2], dx
mov ecx, 0x10
sub ecx, edx
movzx edx, word [eax + edi - 4]
mov edi, 0x10
sub edi, edx
imul edi, ecx
mov edx, 0x100
sub edx, edi
mov edi, dword [esp + 0x14]
shr edx, 4
mov word [eax + edi - 4], dx
mov edx, dword [esp + 0x24]
movzx edx, word [edx + eax - 2]
mov edi, 0x10
sub edi, edx
imul edi, ecx
mov edx, 0x100
sub edx, edi
mov edi, dword [esp + 0x24]
shr edx, 4
mov word [edi + eax - 2], dx
movzx edx, word [eax - 4]
mov edi, 0x10
sub edi, edx
imul edi, ecx
mov edx, 0x100
sub edx, edi
shr edx, 4
mov word [eax - 4], dx
movzx edx, word [eax]
mov edi, 0x10
sub edi, edx
imul edi, ecx
mov ecx, 0x100
sub ecx, edi
mov edi, dword [esp + 0x14]
shr ecx, 4
mov word [eax], cx
mov ecx, dword [esp + 0x30]
add esi, 1
add eax, 2
cmp esi, ecx
jl 0x5096e1
mov edx, dword [esp + 0x38]
add dword [esp + 0x1c], edx
add ebx, dword [esp + 0x24]
sub dword [esp + 0x2c], 1
jne 0x5096c2
jmp 0x5099b8
cmp eax, 4
jg 0x5098cc
cmp dword [esp + 0x50], 0
jle 0x5099b8
mov eax, dword [esp + 0x50]
mov dword [esp + 0x34], eax
jmp 0x5097d0
xor eax, eax
cmp dword [esp + 0x30], eax
mov dword [esp + 0x44], eax
jle 0x5098ac
mov ecx, dword [esp + 0x1c]
movzx ecx, byte [ecx + eax]
test ecx, ecx
mov dword [esp + 0x14], ecx
jbe 0x50989b
mov word [ebx + eax*2], cx
mov ecx, dword [esp + 0x28]
mov edi, ecx
neg edi
add ecx, 1
cmp edi, ecx
jge 0x50989b
mov edx, dword [esp + 0x64]
mov esi, edi
imul esi, dword [esp + 0x24]
sub ecx, edi
mov dword [esp + 0x2c], edx
mov dword [esp + 0x60], ecx
mov edx, dword [esp + 0x28]
add edx, 1
cmp edi, edx
jge 0x50988b
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x20]
add ecx, edi
add ecx, eax
add ecx, ecx
sub edx, edi
nop
mov eax, dword [esp + 0x4c]
cmp byte [eax], 0
je 0x50987a
lea eax, [ebx + esi]
movzx ebx, word [eax + ecx]
add eax, ecx
mov ebp, 0x10
sub ebp, ebx
mov ebx, 0x10
sub ebx, dword [esp + 0x14]
imul ebp, ebx
mov ebx, 0x100
sub ebx, ebp
mov ebp, dword [esp + 0x40]
shr ebx, 4
mov word [eax], bx
mov ebx, dword [esp + 0x5c]
add dword [esp + 0x4c], 1
add ecx, 2
sub edx, 1
jne 0x509840
mov eax, dword [esp + 0x44]
add dword [esp + 0x2c], 9
add esi, dword [esp + 0x24]
sub dword [esp + 0x60], 1
jne 0x509820
add eax, 1
cmp eax, dword [esp + 0x30]
mov dword [esp + 0x44], eax
jl 0x5097e0
mov ecx, dword [esp + 0x38]
add ebx, dword [esp + 0x24]
add dword [esp + 0x1c], ecx
sub dword [esp + 0x34], 1
mov dword [esp + 0x5c], ebx
jne 0x5097d0
jmp 0x5099b8
cmp dword [esp + 0x50], 0
jle 0x5099b8
mov edx, dword [esp + 0x50]
mov dword [esp + 0x60], edx
nop
xor edi, edi
cmp dword [esp + 0x30], edi
mov dword [esp + 0x44], edi
jle 0x5099a1
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + edi]
test eax, eax
mov dword [esp + 0x14], eax
jbe 0x509990
mov word [ebx + edi*2], ax
mov eax, dword [esp + 0x28]
mov esi, eax
neg esi
lea ecx, [eax + 1]
cmp esi, ecx
jge 0x509990
mov eax, esi
imul eax, dword [esp + 0x24]
sub ecx, esi
mov dword [esp + 0x34], eax
mov dword [esp + 0x5c], ecx
jmp 0x509930
mov ecx, dword [esp + 0x28]
add ecx, 1
cmp esi, ecx
jge 0x509981
mov ebp, dword [esp + 0x20]
add ebp, esi
add ebp, edi
mov edx, 0x10
sub edx, dword [esp + 0x14]
lea eax, [eax + ebp*2]
add eax, ebx
sub ecx, esi
movzx edi, word [eax]
mov ebp, 0x10
sub ebp, edi
imul ebp, edx
mov edi, 0x100
sub edi, ebp
shr edi, 4
mov word [eax], di
add eax, 2
sub ecx, 1
jne 0x509953
mov ebp, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
mov eax, dword [esp + 0x34]
add eax, dword [esp + 0x24]
sub dword [esp + 0x5c], 1
mov dword [esp + 0x34], eax
jne 0x509930
add edi, 1
cmp edi, dword [esp + 0x30]
mov dword [esp + 0x44], edi
jl 0x5098f0
mov ecx, dword [esp + 0x38]
add dword [esp + 0x1c], ecx
add ebx, dword [esp + 0x24]
sub dword [esp + 0x60], 1
jne 0x5098e0
mov edx, dword [esp + 0x24]
imul edx, dword [esp + 0x70]
mov edi, dword [esp + 0x6c]
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x74]
neg edi
add edi, edi
sub edi, edx
add edi, dword [esp + 0x84]
add eax, ecx
test eax, eax
jle 0x509e0b
mov edx, dword [esp + 0x30]
lea ebx, [edx + ecx]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x84], ebx
mov dword [esp + 0x34], eax
lea ebx, [ebx]
xor esi, esi
test ebx, ebx
jle 0x509a7e
mov edx, dword [esp + 0x20]
lea edx, [edi + edx*2]
lea ecx, [ecx]
movzx eax, word [edi + esi*2]
test ax, ax
je 0x509a3c
movzx ebx, byte [ecx + 0x89f9f]
movzx ecx, byte [ecx + 0x89f9b]
lea ecx, [ebx + ecx - 4]
shl eax, cl
mov ecx, dword [esp + 0x3c]
sub eax, 1
or eax, ebp
mov word [edi + esi*2], ax
jmp 0x509a40
mov word [edi + esi*2], bp
movzx eax, word [edx]
test ax, ax
je 0x509a6a
movzx ebx, byte [ecx + 0x89f9f]
movzx ecx, byte [ecx + 0x89f9b]
lea ecx, [ebx + ecx - 4]
shl eax, cl
mov ecx, dword [esp + 0x3c]
sub eax, 1
or eax, ebp
mov word [edx], ax
jmp 0x509a6d
mov word [edx], bp
mov ebx, dword [esp + 0x84]
add esi, 1
add edx, 2
cmp esi, ebx
jl 0x509a10
add edi, dword [esp + 0x24]
sub dword [esp + 0x34], 1
jne 0x509a00
jmp 0x509e0b
mov edi, dword [esp + 0x28]
cmp edi, 1
mov eax, dword [esp + 0x50]
jne 0x509baf
test eax, eax
jle 0x509e0b
mov dword [esp + 0x34], eax
nop
xor ecx, ecx
cmp dword [esp + 0x30], ecx
jle 0x509b95
mov edi, 2
lea eax, [ebx + edx*2 + 2]
sub edi, esi
test cl, 7
jne 0x509adc
mov esi, dword [esp + 0x1c]
mov edx, ecx
sar edx, 3
mov dl, byte [edx + esi]
mov byte [esp + 0x13], dl
test byte [esp + 0x13], 0x80
je 0x509b79
mov edx, dword [esp + 0x3c]
mov si, word [edx + 0x89fac]
or si, bp
mov word [ebx + ecx*2], si
movzx esi, word [edi + eax - 4]
test dword [edx + 0x89fac], esi
jne 0x509b15
mov dx, word [edx + 0x89fac]
or dx, bp
mov word [edi + eax - 4], dx
mov edx, dword [esp + 0x24]
movzx edx, word [edx + eax - 2]
mov esi, dword [esp + 0x3c]
test dword [esi + 0x89fac], edx
jne 0x509b3f
mov edx, esi
mov dx, word [edx + 0x89fac]
mov esi, dword [esp + 0x24]
or dx, bp
mov word [esi + eax - 2], dx
movzx edx, word [eax - 4]
mov esi, dword [esp + 0x3c]
test dword [esi + 0x89fac], edx
jne 0x509b5f
mov edx, esi
mov dx, word [edx + 0x89fac]
or dx, bp
mov word [eax - 4], dx
movzx edx, word [eax]
test dword [esi + 0x89fac], edx
jne 0x509b79
mov edx, esi
mov dx, word [edx + 0x89fac]
or dx, bp
mov word [eax], dx
shl byte [esp + 0x13], 1
add ecx, 1
add eax, 2
cmp ecx, dword [esp + 0x30]
jl 0x509ac7
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x38]
add dword [esp + 0x1c], eax
add ebx, esi
sub dword [esp + 0x34], 1
jne 0x509ab0
jmp 0x509e0b
cmp edi, 4
jg 0x509cfc
test eax, eax
jle 0x509e0b
mov dword [esp + 0x5c], eax
xor ecx, ecx
cmp dword [esp + 0x30], ecx
mov dword [esp + 0x44], ecx
jle 0x509ce0
mov edx, ecx
and edx, 0x80000007
jns 0x509be3
dec edx
or edx, 0xfffffff8
inc edx
jne 0x509bfb
mov eax, ecx
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x1c]
sar eax, 3
mov al, byte [eax + edx]
mov byte [esp + 0x13], al
test byte [esp + 0x13], 0x80
je 0x509ccb
mov eax, dword [esp + 0x3c]
mov edi, dword [esp + 0x28]
mov dx, word [eax + 0x89fac]
add eax, 0x89f94
mov esi, edi
or dx, bp
neg esi
lea eax, [edi + 1]
cmp esi, eax
mov word [ebx + ecx*2], dx
jge 0x509ccb
mov edx, esi
imul edx, dword [esp + 0x24]
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0x64]
sub eax, esi
mov dword [esp + 0x2c], edx
mov dword [esp + 0x34], eax
lea esp, [esp]
lea edx, [edi + 1]
cmp esi, edx
jge 0x509cb7
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
add eax, esi
add eax, ecx
add eax, eax
sub edx, esi
jmp 0x509c70
mov ecx, dword [esp + 0x14]
cmp byte [ecx], 0
je 0x509ca2
mov ecx, dword [esp + 0x4c]
mov edi, dword [esp + 0x3c]
add ecx, ebx
movzx ebp, word [ecx + eax]
add ecx, eax
add edi, 0x89f94
test dword [edi + 0x18], ebp
mov ebp, dword [esp + 0x40]
jne 0x509ca2
mov di, word [edi + 0x18]
or di, bp
mov word [ecx], di
add dword [esp + 0x14], 1
add eax, 2
sub edx, 1
jne 0x509c70
mov ecx, dword [esp + 0x44]
mov edi, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
add dword [esp + 0x2c], 9
add dword [esp + 0x4c], edx
sub dword [esp + 0x34], 1
jne 0x509c50
shl byte [esp + 0x13], 1
add ecx, 1
cmp ecx, dword [esp + 0x30]
mov dword [esp + 0x44], ecx
jl 0x509bd4
mov eax, dword [esp + 0x38]
add dword [esp + 0x1c], eax
add ebx, dword [esp + 0x24]
sub dword [esp + 0x5c], 1
jne 0x509bc4
jmp 0x509e0b
test eax, eax
jle 0x509e0b
mov dword [esp + 0x60], eax
jmp 0x509d10
xor esi, esi
cmp dword [esp + 0x30], esi
mov dword [esp + 0x44], esi
jle 0x509df4
mov ecx, esi
and ecx, 0x80000007
jns 0x509d2f
dec ecx
or ecx, 0xfffffff8
inc ecx
jne 0x509d47
mov eax, esi
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x1c]
sar eax, 3
mov al, byte [eax + edx]
mov byte [esp + 0x13], al
test byte [esp + 0x13], 0x80
je 0x509ddf
mov eax, dword [esp + 0x3c]
mov cx, word [eax + 0x89fac]
add eax, 0x89f94
or cx, bp
mov edx, edi
mov word [ebx + esi*2], cx
neg edx
lea ecx, [edi + 1]
cmp edx, ecx
jge 0x509ddf
mov eax, edx
imul eax, dword [esp + 0x24]
sub ecx, edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x5c], ecx
lea ecx, [edi + 1]
cmp edx, ecx
jge 0x509dd0
mov edi, dword [esp + 0x20]
add edi, edx
add edi, esi
lea eax, [eax + edi*2]
add eax, ebx
sub ecx, edx
jmp 0x509da0
movzx edi, word [eax]
mov esi, dword [esp + 0x3c]
add esi, 0x89f94
test dword [esi + 0x18], edi
jne 0x509dbc
mov si, word [esi + 0x18]
or si, bp
mov word [eax], si
add eax, 2
sub ecx, 1
jne 0x509da0
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x34]
add eax, dword [esp + 0x24]
sub dword [esp + 0x5c], 1
mov dword [esp + 0x34], eax
jne 0x509d85
shl byte [esp + 0x13], 1
add esi, 1
cmp esi, dword [esp + 0x30]
mov dword [esp + 0x44], esi
jl 0x509d20
mov edx, dword [esp + 0x38]
add dword [esp + 0x1c], edx
add ebx, dword [esp + 0x24]
sub dword [esp + 0x60], 1
jne 0x509d10
mov eax, dword [esp + 0x7c]
movsx edx, word [eax + 0xe]
movsx eax, word [eax + 0xc]
mov edi, dword [esp + 0x58]
mov ecx, dword [esp + 0x74]
mov esi, dword [esp + 0x54]
add edx, edi
add edx, ecx
push edx
add eax, esi
add eax, ecx
push eax
push edi
push esi
lea ecx, [esp + 0xcc]
push ecx
call dword [sym.imp.USER32.dll_SetRect]
mov ebx, dword [esp + 0x3c]
mov edx, dword [ebx + 0x89f88]
push edx
push edi
push esi
lea eax, [esp + 0xc8]
push eax
push 0
lea ebp, [ebx + 0x89f94]
push ebp
push 0
push 0
push 0
push ebp
call fcn.004f35e0
mov ecx, dword [ebx + 0x89f88]
mov eax, dword [esp + 0x48]
mov edx, dword [ebx + 0x89f7c]
add dword [esp + 0xe4], eax
add dword [esp + 0xec], eax
push ecx
push edi
add edx, esi
push edx
lea eax, [esp + 0xf0]
push eax
push 0
push ebp
push 0
push 0
push 0
push ebp
call fcn.004f35e0
add esp, 0x50
mov eax, dword [esp + 0x8c]
sub eax, dword [esp + 0x38]
push eax
call fcn.004e0760
mov ebx, dword [esp + 0x40]
mov edi, dword [esp + 0x80]
add esp, 4
xor ebp, ebp
mov eax, dword [esp + 0x74]
add word [edi + 6], ax
add word [edi + 0xc], ax
add word [edi + 0xe], ax
mov eax, dword [esp + 0xa4]
mov dword [eax], 1
mov dword [eax + 4], edi
mov dword [edi + 0x10], eax
mov byte [edi], 1
add dword [ebx + 0x89e3c], 1
mov eax, dword [ebx + 0x89e3c]
cmp eax, dword [ebx + 0x89e40]
jne 0x509f06
mov dword [ebx + 0x89e3c], ebp
mov eax, dword [esp + 0x88]
add dword [esp + 0x78], 3
add eax, 1
cmp eax, dword [esp + 0x118]
mov dword [esp + 0x88], eax
jl 0x508a70
mov esi, dword [esp + 0x80]
mov ebp, dword [esp + 0xa0]
jmp 0x509f47
push 0x6a8d8c
jmp 0x5089fe
mov edi, dword [esp + 0x7c]
push ebp
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
add esp, 0x104
ret
pop edi
xor eax, eax
pop esi
add esp, 0x104
ret