Function at 0x2d8338e9
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push 0x4d8
mov eax, 0x2d8e592f
call fcn.2d8084f1
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x468]
push ecx
push 0x54
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
cmp eax, 0x54
je 0x2d83391b
push 0x40000003
call fcn.2d8cf86e
pop ecx
mov eax, dword [0x2d96a8d4]
xor ebx, ebx
push 0x428
mov dword [ebp - 0x4a8], ebx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x2d8fb384]
call esi
mov edi, eax
mov dword [ebp - 0x4e0], edi
pop ecx
test edi, edi
je 0x2d834305
mov dword [edi], 0x28
mov ecx, 0x100
mov eax, dword [ebp - 0x44c]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x448]
mov dword [edi + 8], eax
xor eax, eax
inc eax
mov dword [edi + 0x10], ebx
push 8
mov word [edi + 0xc], ax
pop eax
mov word [edi + 0xe], ax
mov eax, 0xd8
push 0x33
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov eax, ebx
pop esi
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [ebp - 0x48c], ebx
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x4bc], esi
mov dword [ebp - 0x47c], ecx
mov edx, ebx
mov esi, ebx
mov dword [ebp - 0x46c], esi
mov ecx, dword [ebp - 0x48c]
inc dword [ebp - 0x48c]
movsx ecx, cx
push 0x33
mov byte [edi + ecx*4 + 0x2a], al
mov al, byte [ebp - 0x46c]
mov byte [edi + ecx*4 + 0x28], al
pop eax
add esi, eax
mov byte [edi + ecx*4 + 0x29], dl
mov eax, dword [ebp - 0x488]
mov byte [edi + ecx*4 + 0x2b], bl
mov ecx, 0x100
mov dword [ebp - 0x46c], esi
cmp si, cx
jl 0x2d8339b4
push 0x33
pop esi
add edx, esi
cmp dx, cx
jl 0x2d8339ac
add eax, esi
mov dword [ebp - 0x488], eax
cmp ax, cx
jl 0x2d8339aa
mov eax, dword [0x2d96a8e8]
push 0x2d84ad10
mov dword [ebp - 0x4a0], ebx
mov dword [ebp - 0x4a4], ebx
mov esi, dword [eax + 8]
mov ecx, esi
push ebx
mov dword [ebp - 0x488], ebx
mov dword [ebp - 4], ebx
call dword [0x2d8fb384]
call esi
pop ecx
pop ecx
push ebx
push ebx
lea eax, [ebp - 0x4d0]
mov byte [ebp - 4], 1
push eax
push ebx
push edi
push ebx
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], ebx
je 0x2d83430a
mov esi, dword [ebp - 0x44c]
push dword [ebp - 0x448]
mov dword [ebp - 0x48c], esi
call sub.api_ms_win_crt_utility_l1_1_0.dll_labs
mov dword [ebp - 0x4c8], eax
movzx eax, word [ebp - 0x442]
imul eax, esi
pop ecx
push 2
add eax, 0x1f
sar eax, 3
and eax, 0xfffffffc
mov dword [ebp - 0x498], eax
movzx eax, word [edi + 0xe]
mov edi, dword [ebp - 0x454]
imul eax, esi
add esi, 2
push esi
add eax, 0x1f
sar eax, 3
and eax, 0xfffffffc
mov dword [ebp - 0x4c4], eax
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x480], eax
call fcn.2d8cf86e
mov dword [ebp - 0x4a0], eax
pop ecx
pop ecx
cmp dword [ebp - 0x4a0], ebx
jne 0x2d833b0a
mov eax, dword [0x2d96a8e8]
push 0x40000002
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x2d8fb384]
call esi
pop ecx
mov dword [ebp - 0x4d4], ebx
lea eax, [ebp - 0x4d4]
push 0x2d928034
jmp 0x2d834333
push 2
push esi
call fcn.2d8cf86e
mov dword [ebp - 0x4a4], eax
pop ecx
pop ecx
cmp dword [ebp - 0x4a4], ebx
jne 0x2d833b50
mov eax, dword [0x2d96a8e8]
push 0x40000002
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x2d8fb384]
call esi
pop ecx
mov dword [ebp - 0x4d8], ebx
lea eax, [ebp - 0x4d8]
push 0x2d928034
jmp 0x2d834333
push 2
push esi
call fcn.2d8cf86e
mov dword [ebp - 0x488], eax
pop ecx
pop ecx
cmp dword [ebp - 0x488], ebx
jne 0x2d833b96
mov eax, dword [0x2d96a8e8]
push 0x40000002
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x2d8fb384]
call esi
pop ecx
mov dword [ebp - 0x4dc], ebx
lea eax, [ebp - 0x4dc]
push 0x2d928034
jmp 0x2d834333
push 0x1a
pop eax
lea ecx, [ebp - 0x214]
mov esi, ebx
sub eax, ecx
mov dword [ebp - 0x4b8], eax
lea ecx, [ebp - 0x214]
add ecx, esi
add eax, ecx
cdq
idiv dword [ebp - 0x4bc]
mov byte [ecx], al
movzx ecx, al
imul ecx, ecx, 6
movzx eax, al
imul eax, eax, 0x33
mov byte [ebp + esi - 0x314], cl
movzx ecx, cl
imul ecx, ecx, 6
mov byte [ebp + esi - 0x114], al
mov eax, dword [ebp - 0x4b8]
mov byte [ebp + esi - 0x414], cl
inc esi
sub dword [ebp - 0x47c], 1
jne 0x2d833ba9
mov ecx, dword [ebp - 0x4a0]
mov esi, dword [ebp - 0x4a4]
add ecx, 2
mov edx, dword [ebp - 0x488]
add esi, 2
mov eax, dword [ebp - 0x4c8]
add edx, 2
mov dword [ebp - 0x478], ecx
mov dword [ebp - 0x484], esi
mov dword [ebp - 0x474], edx
mov dword [ebp - 0x4b8], ebx
test eax, eax
jle 0x2d834216
dec eax
mov dword [ebp - 0x4bc], ebx
mov dword [ebp - 0x4c0], eax
movzx eax, word [ecx]
mov dword [ebp - 0x494], eax
xor eax, eax
mov dword [ecx - 2], eax
movzx eax, word [esi]
mov dword [ebp - 0x490], eax
xor eax, eax
mov dword [esi - 2], eax
movzx eax, word [edx]
mov dword [ebp - 0x4b0], eax
xor eax, eax
cmp dword [ebp - 0x48c], eax
mov dword [edx - 2], eax
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x4b4], ebx
jle 0x2d833ebd
mov ecx, dword [ebp - 0x494]
mov esi, 0xff
movzx eax, byte [edi + 2]
sar cx, 4
add ax, cx
movzx edx, ax
movzx ecx, ax
test dx, dx
jns 0x2d833cac
mov dword [ebp - 0x470], ebx
jmp 0x2d833cb8
cmp dx, si
cmovg ecx, esi
mov dword [ebp - 0x470], ecx
mov ecx, dword [ebp - 0x490]
movzx eax, byte [edi + 1]
sar cx, 4
add ax, cx
movzx ecx, ax
movzx edx, ax
test cx, cx
jns 0x2d833cd8
mov edx, ebx
jmp 0x2d833cde
cmp cx, si
cmovg edx, esi
mov ecx, dword [ebp - 0x4b0]
movzx eax, byte [edi]
sar cx, 4
add cx, ax
mov dword [ebp - 0x47c], edx
movzx eax, cx
mov dword [ebp - 0x46c], eax
test ax, ax
jge 0x2d833d0a
mov dword [ebp - 0x46c], ebx
jmp 0x2d833d1a
cmp word [ebp - 0x46c], si
cmovg eax, esi
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x470]
add edi, 3
mov bx, word [ebp - 0x46c]
movsx ecx, ax
movsx esi, bx
movsx edx, dx
mov dword [ebp - 0x49c], edi
mov al, byte [ebp + ecx - 0x414]
mov edi, dword [ebp - 0x470]
add al, byte [ebp + edx - 0x314]
add al, byte [ebp + esi - 0x214]
mov esi, dword [ebp - 0x480]
inc dword [ebp - 0x480]
mov byte [esi], al
movzx eax, byte [ebp + ecx - 0x114]
sub di, ax
movsx esi, bx
movzx eax, byte [ebp + edx - 0x114]
mov edx, dword [ebp - 0x47c]
sub dx, ax
movzx ecx, di
movzx eax, byte [ebp + esi - 0x114]
sub bx, ax
mov esi, dword [ebp - 0x484]
mov word [ebp - 0x46c], bx
add esi, 2
mov ebx, dword [ebp - 0x478]
imul eax, ecx, 7
add ebx, 2
mov dword [ebp - 0x470], edi
mov ecx, dword [ebp - 0x470]
movzx edi, dx
mov dword [ebp - 0x47c], edx
add ax, word [ebx]
mov edx, dword [ebp - 0x474]
movzx eax, ax
add edx, 2
mov dword [ebp - 0x494], eax
imul eax, edi, 7
mov dword [ebp - 0x4ac], ebx
mov ebx, dword [ebp - 0x478]
add ax, word [esi]
movzx eax, ax
mov dword [ebp - 0x490], eax
imul eax, dword [ebp - 0x46c], 7
add ax, word [edx]
movzx eax, ax
mov dword [ebp - 0x4b0], eax
movzx eax, cx
mov ecx, dword [ebp - 0x484]
imul eax, eax, 3
mov dword [ebp - 0x484], esi
add word [ebx - 2], ax
mov ebx, dword [ebp - 0x474]
imul eax, edi, 3
add word [ecx - 2], ax
imul eax, dword [ebp - 0x46c], 3
add word [ebx - 2], ax
mov ebx, dword [ebp - 0x470]
movzx eax, bx
mov ebx, dword [ebp - 0x478]
imul eax, eax, 5
add word [ebx], ax
mov ebx, ecx
mov ecx, dword [ebp - 0x474]
imul eax, edi, 5
mov dword [ebp - 0x474], edx
add word [ebx], ax
imul eax, dword [ebp - 0x46c], 5
mov ebx, dword [ebp - 0x4ac]
add word [ecx], ax
mov ecx, dword [ebp - 0x470]
movzx eax, cx
mov ecx, dword [ebp - 0x47c]
mov word [ebx], ax
movzx eax, cx
mov ecx, ebx
mov word [esi], ax
mov ax, word [ebp - 0x46c]
mov word [edx], ax
mov dword [ebp - 0x478], ecx
mov eax, dword [ebp - 0x4b4]
mov edi, dword [ebp - 0x49c]
inc eax
mov dword [ebp - 0x4b4], eax
cwde
push 0
pop ebx
cmp eax, dword [ebp - 0x48c]
jl 0x2d833c83
mov eax, dword [ebp - 0x498]
add eax, 0xfffffffd
mov dword [ebp - 0x494], edx
mov edx, dword [ebp - 0x474]
add edi, eax
mov eax, dword [ebp - 0x4c4]
sub edx, 2
dec eax
mov dword [ebp - 0x490], esi
add dword [ebp - 0x480], eax
sub esi, 2
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x4ac], ecx
sub ecx, 2
mov dword [ebp - 0x478], ecx
mov dword [ebp - 0x484], esi
mov dword [ebp - 0x474], edx
cmp dword [ebp - 0x4bc], eax
je 0x2d8341ec
movzx eax, word [ecx]
mov dword [ebp - 0x4b4], eax
xor eax, eax
mov word [ecx], ax
xor ecx, ecx
mov eax, dword [ebp - 0x4ac]
mov word [eax], cx
movzx eax, word [esi]
mov dword [ebp - 0x4b0], eax
xor eax, eax
mov word [esi], ax
mov eax, dword [ebp - 0x490]
mov word [eax], cx
movzx eax, word [edx]
mov dword [ebp - 0x490], eax
xor eax, eax
cmp dword [ebp - 0x48c], ecx
mov word [edx], ax
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x494], ebx
mov word [eax], cx
mov ecx, dword [ebp - 0x478]
mov eax, dword [ebp - 0x498]
jle 0x2d8341b3
mov ecx, dword [ebp - 0x4b4]
mov esi, 0xff
movzx eax, byte [edi + 2]
sar cx, 4
add ax, cx
movzx edx, ax
movzx ecx, ax
test dx, dx
jns 0x2d833fa2
mov dword [ebp - 0x470], ebx
jmp 0x2d833fae
cmp dx, si
cmovg ecx, esi
mov dword [ebp - 0x470], ecx
mov ecx, dword [ebp - 0x4b0]
movzx eax, byte [edi + 1]
sar cx, 4
add ax, cx
movzx ecx, ax
movzx edx, ax
test cx, cx
jns 0x2d833fce
mov edx, ebx
jmp 0x2d833fd4
cmp cx, si
cmovg edx, esi
mov ecx, dword [ebp - 0x490]
movzx eax, byte [edi]
sar cx, 4
add cx, ax
mov dword [ebp - 0x47c], edx
movzx eax, cx
mov dword [ebp - 0x46c], eax
test ax, ax
jge 0x2d834000
mov dword [ebp - 0x46c], ebx
jmp 0x2d834010
cmp word [ebp - 0x46c], si
cmovg eax, esi
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x470]
sub edi, 3
mov bx, word [ebp - 0x46c]
movsx ecx, ax
movsx esi, bx
movsx edx, dx
mov dword [ebp - 0x49c], edi
mov al, byte [ebp + ecx - 0x414]
mov edi, dword [ebp - 0x470]
add al, byte [ebp + edx - 0x314]
add al, byte [ebp + esi - 0x214]
mov esi, dword [ebp - 0x480]
dec dword [ebp - 0x480]
mov byte [esi], al
movzx eax, byte [ebp + ecx - 0x114]
sub di, ax
movsx esi, bx
movzx eax, byte [ebp + edx - 0x114]
mov edx, dword [ebp - 0x47c]
sub dx, ax
movzx ecx, di
movzx eax, byte [ebp + esi - 0x114]
sub bx, ax
mov esi, dword [ebp - 0x484]
mov word [ebp - 0x46c], bx
add esi, 0xfffffffe
mov ebx, dword [ebp - 0x478]
imul eax, ecx, 7
add ebx, 0xfffffffe
mov dword [ebp - 0x470], edi
mov ecx, dword [ebp - 0x470]
movzx edi, dx
mov dword [ebp - 0x47c], edx
add ax, word [ebx]
mov edx, dword [ebp - 0x474]
movzx eax, ax
add edx, 0xfffffffe
mov dword [ebp - 0x4b4], eax
imul eax, edi, 7
mov dword [ebp - 0x4ac], ebx
mov ebx, dword [ebp - 0x478]
add ax, word [esi]
movzx eax, ax
mov dword [ebp - 0x4b0], eax
imul eax, dword [ebp - 0x46c], 7
add ax, word [edx]
movzx eax, ax
mov dword [ebp - 0x490], eax
movzx eax, cx
mov ecx, dword [ebp - 0x484]
imul eax, eax, 3
mov dword [ebp - 0x484], esi
add word [ebx + 2], ax
mov ebx, dword [ebp - 0x474]
imul eax, edi, 3
add word [ecx + 2], ax
imul eax, dword [ebp - 0x46c], 3
add word [ebx + 2], ax
mov ebx, dword [ebp - 0x470]
movzx eax, bx
mov ebx, dword [ebp - 0x478]
imul eax, eax, 5
add word [ebx], ax
mov ebx, ecx
mov ecx, dword [ebp - 0x474]
imul eax, edi, 5
mov dword [ebp - 0x474], edx
add word [ebx], ax
imul eax, dword [ebp - 0x46c], 5
mov ebx, dword [ebp - 0x4ac]
add word [ecx], ax
mov ecx, dword [ebp - 0x470]
movzx eax, cx
mov ecx, dword [ebp - 0x47c]
mov word [ebx], ax
movzx eax, cx
mov ecx, ebx
mov word [esi], ax
mov ax, word [ebp - 0x46c]
mov word [edx], ax
mov dword [ebp - 0x478], ecx
mov eax, dword [ebp - 0x494]
mov edi, dword [ebp - 0x49c]
inc eax
mov dword [ebp - 0x494], eax
cwde
push 0
pop ebx
cmp eax, dword [ebp - 0x48c]
jl 0x2d833f79
mov eax, dword [ebp - 0x498]
mov edx, dword [ebp - 0x480]
add edi, 3
inc edx
add ecx, 2
add edx, dword [ebp - 0x4c4]
add esi, 2
mov dword [ebp - 0x480], edx
add edi, eax
mov edx, dword [ebp - 0x474]
add edx, 2
mov dword [ebp - 0x478], ecx
mov dword [ebp - 0x484], esi
mov dword [ebp - 0x474], edx
mov ecx, dword [ebp - 0x4b8]
add ecx, 2
mov dword [ebp - 0x4b8], ecx
movsx ecx, cx
cmp ecx, dword [ebp - 0x4c8]
mov dword [ebp - 0x4bc], ecx
mov ecx, dword [ebp - 0x478]
jl 0x2d833c41
mov eax, dword [0x2d96a8e8]
mov byte [ebp - 4], 2
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2d8fb384]
call esi
or dword [ebp - 4], 0xffffffff
mov edi, ebx
jmp 0x2d83425e
mov eax, dword [0x2d96a8d4]
push dword [ebp - 0x4e0]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2d8fb384]
call esi
pop ecx
cmp dword [ebp - 0x4a0], ebx
je 0x2d834298
mov eax, dword [0x2d96a8d4]
push dword [ebp - 0x4a0]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2d8fb384]
call esi
pop ecx
cmp dword [ebp - 0x4a4], ebx
je 0x2d8342b9
mov eax, dword [0x2d96a8d4]
push dword [ebp - 0x4a4]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2d8fb384]
call esi
pop ecx
cmp dword [ebp - 0x488], ebx
je 0x2d8342da
mov eax, dword [0x2d96a8d4]
push dword [ebp - 0x488]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2d8fb384]
call esi
pop ecx
test edi, edi
je 0x2d8342f9
cmp dword [ebp - 0x4a8], ebx
je 0x2d8342f2
push dword [ebp - 0x4a8]
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call fcn.2d8cf86e
pop ecx
mov eax, dword [ebp - 0x4a8]
call fcn.2d80866d
ret
call fcn.2d8cf86e
mov eax, dword [0x2d96a8e8]
push 0x40000001
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x2d8fb384]
call esi
pop ecx
mov dword [ebp - 0x4cc], ebx
lea eax, [ebp - 0x4cc]
push 0x2d928034
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3