Function at 0x1000bba0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x1c]
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov esi, dword [sym.imp.gdi32.dll_GetObjectW]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0x10
mov dword [esp], eax
call esi
mov dword [ebp - 0x20], 0
sub esp, 0xc
test eax, eax
je 0x1000bca0
test byte [0x10025878], 8
jne 0x1000bd29
mov eax, dword [ebp - 0x18]
mov dword [ebx + 0x78], eax
test byte [ebp - 0x1a], 1
jne 0x1000bbf9
cmp eax, 1
jle 0x1000bc11
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._PSDRV_XWStoDS
mov edx, eax
neg edx
test eax, eax
cmovs eax, edx
mov dword [ebx + 0x78], eax
mov dword [esp], 0x13
call dword [sym.imp.gdi32.dll_GetStockObject]
sub esp, 4
cmp dword [ebp + 0xc], eax
je 0x1000bf30
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov edx, eax
and edx, 0xf000
cmp edx, 0x1000
je 0x1000bdc8
cmp edx, 0x2000
setne byte [ebx + 0x7c]
and eax, 0xf00
cmp eax, 0x100
je 0x1000bdb8
cmp eax, 0x200
setne byte [ebx + 0x7d]
lea eax, [ebx + 0xc4]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._PSDRV_CreateColor
mov eax, dword [ebp - 0x1c]
and eax, 0xf
mov dword [ebx + 0x74], eax
cmp eax, 8
ja case.0x1000bc8f.0
jmp dword [eax*4 + 0x1002bdec]
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call esi
mov edi, eax
sub esp, 0xc
xor eax, eax
test edi, edi
je 0x1000bdac
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp + 0xc]
sub esp, 0xc
mov dword [ebp - 0x20], eax
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], ecx
call esi
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x14], 0
sub esp, 0xc
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], eax
test byte [0x10025878], 8
je 0x1000bbe8
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], str.hpen___p_colour___08lx_n
mov dword [esp + 8], str.PSDRV_SelectPen
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0x10025878
mov dword [esp + 0x10], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_13
jmp 0x1000bbe8
mov dword [ebx + 0x80], 1
mov dword [ebx + 0xc0], 1
lea esi, [esi]
mov edi, dword [ebp - 0x20]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edi
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xd4], 0
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov byte [ebx + 0x7d], 2
jmp 0x1000bc67
mov byte [ebx + 0x7c], 2
jmp 0x1000bc4e
mov dword [ebx + 0xc0], 0
jmp 0x1000bd78
mov dword [ebx + 0x80], 0x32
mov dword [ebx + 0x84], 0x1e
mov dword [ebx + 0xc0], 2
cmp dword [ebx + 0x78], 1
jle 0x1000bd78
mov dword [ebx + 0x74], 0
mov dword [ebx + 0xc0], 0
jmp 0x1000bd78
mov dword [ebx + 0x80], 0x14
mov dword [ebx + 0xc0], 1
jmp 0x1000be06
mov edx, dword [0x1002d8e0]
mov dword [ebx + 0xc0], 4
mov dword [ebx + 0x80], edx
mov edx, dword [0x1002d8e4]
mov dword [ebx + 0x84], edx
mov edx, dword [0x1002d8e8]
mov dword [ebx + 0x88], edx
mov edx, dword [0x1002d8ec]
mov dword [ebx + 0x8c], edx
jmp 0x1000be06
mov edx, dword [0x1002d8f0]
mov dword [ebx + 0xc0], 6
mov dword [ebx + 0x80], edx
mov edx, dword [0x1002d8f4]
mov dword [ebx + 0x84], edx
mov edx, dword [0x1002d8f8]
mov dword [ebx + 0x88], edx
mov edx, dword [0x1002d8fc]
mov dword [ebx + 0x8c], edx
mov edx, dword [0x1002d900]
mov dword [ebx + 0x90], edx
mov edx, dword [0x1002d904]
mov dword [ebx + 0x94], edx
jmp 0x1000be06
mov edi, dword [ebp - 0x20]
mov ecx, 0x10
lea eax, [ebx + 0x80]
cmp dword [edi + 0x14], 0x10
cmovbe ecx, dword [edi + 0x14]
lea esi, [edi + 0x18]
mov dword [ebx + 0xc0], ecx
shl ecx, 2
cmp ecx, 4
jae 0x1000bf50
test ecx, ecx
je 0x1000bd78
movzx eax, byte [esi]
mov byte [ebx + 0x80], al
jmp 0x1000bd78
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GetDCPenColor]
mov dword [ebp - 0x10], eax
sub esp, 4
mov ecx, eax
jmp 0x1000bc2d
mov edx, dword [esi + ecx - 4]
mov edi, eax
mov dword [eax + ecx - 4], edx
dec ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
jmp 0x1000bd78