Implement PAT ops.
diff --git a/protocols/rdp/src/rdp_gdi.c b/protocols/rdp/src/rdp_gdi.c
index 575419f..4d4a5b4 100644
--- a/protocols/rdp/src/rdp_gdi.c
+++ b/protocols/rdp/src/rdp_gdi.c
@@ -158,6 +158,9 @@
     /* Layer for actual transfer */
     guac_layer* buffer;
 
+    /* Transfer function (if necessary) */
+    guac_transfer_function transfer;
+
     /*
      * Warn that rendering is a fallback, as the server should not be sending
      * this order.
@@ -185,17 +188,7 @@
 
         /* If operation is just SRC, send background only */
         case 0xCC:
-            guac_protocol_send_rect(client->socket, current_layer,
-                    patblt->nLeftRect, patblt->nTopRect,
-                    patblt->nWidth, patblt->nHeight);
-
-            guac_protocol_send_cfill(client->socket,
-                    GUAC_COMP_OVER, current_layer,
-                    0x00, 0x00, 0x00, 0xFF);
-            break;
-
-        /* If whiteness, send white rectangle */
-        case 0xFF:
+        case 0xF0:
             guac_protocol_send_rect(client->socket, current_layer,
                     patblt->nLeftRect, patblt->nTopRect,
                     patblt->nWidth, patblt->nHeight);
@@ -208,13 +201,40 @@
                     0xFF);
             break;
 
+        /* If whiteness, send white rectangle */
+        case 0xFF:
+            guac_protocol_send_rect(client->socket, current_layer,
+                    patblt->nLeftRect, patblt->nTopRect,
+                    patblt->nWidth, patblt->nHeight);
+
+            guac_protocol_send_cfill(client->socket,
+                    GUAC_COMP_OVER, current_layer,
+                    0xFF, 0xFF, 0xFF, 0xFF);
+            break;
+
         /* Otherwise, use transfer */
         default:
 
             /* Allocate buffer for transfer */
             buffer = guac_client_alloc_buffer(client);
 
-            /* Get transfer function for ROP */
+            /* Get reasonable transfer function for ROP */
+            switch (patblt->bRop) {
+
+                /* PATINVERT */
+                case 0x5A:
+                    transfer = GUAC_TRANSFER_BINARY_XOR;
+                    break;
+
+                /* PATPAINT */
+                case 0xFB:
+                    transfer = GUAC_TRANSFER_BINARY_OR;
+                    break;
+
+                default: 
+                    transfer = guac_rdp_rop3_transfer_function(
+                                   client, patblt->bRop);
+            }
 
             /* Send rectangle stroke */
             guac_protocol_send_rect(client->socket, buffer,
@@ -234,8 +254,7 @@
                     buffer, 0, 0, patblt->nWidth, patblt->nHeight,
 
                     /* ... using specified transfer function */
-                    guac_rdp_rop3_transfer_function(
-                       client, patblt->bRop),
+                    transfer,
 
                     /* ... to current layer */
                     current_layer, patblt->nLeftRect, patblt->nTopRect);