Function at 0x41246b
Capabilities:
Check for debugger via api

Disassembly:
push ebx
push esi
push edi
xor esi, esi
mov ebx, ecx
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
mov edi, dword [sym.imp.GDI32.dll_GetObjectW]
push esi
push 0x5cdabf15
push esi
call edi
push esi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
call esi
push 0
push 0x4ddfc6df
push 0
call edi
push 0
push 0x9345854e
push 0
call edi
push 0
push 0x3d97b5c
push 0
call edi
xor edi, edi
push edi
push edi
call esi
push edi
mov edi, dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0x10
push 0x80ad1dbb
push 0x963a2e04
call edi
push 0
push 0x10759fd0
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x53e89ef
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x1b268a2f
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call esi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xc946a3c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x9351a0b1
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xbfaac0d8
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call esi
push 0
push 0xa795ddf3
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x926285c3
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xe65f7a28
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 2
push 0x75e252c0
push 0xf9cffcf0
call edi
push 0
push 0x4b52d431
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x99baaa68
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 8
push 0xfce00959
push 0x906622c8
call edi
push 0
push 0
call esi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x60115a42
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0x932481e0
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call esi
push 0
push 0x35c644e3
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xffffffffffffffff
push 0x84588f61
push 0xd89cec4e
call edi
push ebx
call dword [0x41c190]
push 0
push 0xfbb1e907
push 0
mov edi, eax
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x13447641
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xfffffffffffffff6
push 0x97099fba
push 0x657899f
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x77fb4c0a
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xb068bc42
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xfffffffffffffff8
push 0xde2cf0aa
push 0x2b0ecde6
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0
call esi
push 0
push 0xf1ab6383
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 6
push 0xa4224f1d
push 0xe1b6d5b
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call esi
push 0
push 0xa148a903
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call esi
push 0
push 0xa2134bf6
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 1
push 0x7329e161
push 0xfb2e4c2d
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 1
push 0xffe3e3c8
push 0x74303c3b
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 3
push 0xb18891ea
push 0x7db49fc2
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call esi
push 0
push 0
call esi
mov esi, dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0
push 0x4cf5e0e2
push 0xde55caea
call esi
push 0
push 0xa053f613
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xa39bea23
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xe77d606a
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xc6da7c31
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xc00fac6e
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x799a827f
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xe1fb8f43
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xda87689e
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xfffffffffffffff7
push 0x907c8ab6
push 0x5236c70e
call esi
push 0
push 0x600e992a
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xfffffffffffffff3
push 0x6985cd9d
push 0x18d4f301
call esi
mov esi, dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x754eb90b
push 0
call esi
push 0
push 0xa15009c6
push 0
call esi
lea eax, [edi*2 + 0x10]
push eax
push 0x40
call dword [0x41c048]
push 0
push 0x13
push 0xe6edd4b6
push 0x89a54897
mov esi, eax
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x9eb4f3ee
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xc9b1194a
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x8e58a972
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xfffffffffffffff0
push 0x642fa9bf
push 0x1ab899df
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0x15
push 0x537d7e5
push 0xd5b404a
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0xe6d608e9
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xb
push 0x4086bc05
push 0x7f4d42a8
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0x2ed4eedf
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x745b06a1
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x340790a1
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xfa6f18ae
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x74984f39
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xcf25f8b7
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x16
push 0xda88cb66
push 0x67820e56
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 6
push 0x99e56278
push 0x4338787
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0xefadf05f
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 9
push 0x9346182e
push 0x98e4724c
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0xa
push 0x411cd338
push 0x9732f7ab
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xbab329a0
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x2c88d349
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x6fe7c522
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xfffffffffffffff6
push 0x4f34b340
push 0xc610a919
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0x7d3ebe49
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x67a73fa7
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push edi
push esi
push 0xffffffffffffffff
push ebx
xor ebx, ebx
push ebx
push 0xfde9
call dword [0x41c0a8]
push ebx
push 0x249581b0
push ebx
call dword [sym.imp.GDI32.dll_GetObjectW]
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
call ebx
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call ebx
push 0
push 0x551bb991
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call ebx
push 0
push 0x5be2616b
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x5ba48fb7
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x15473f3c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x76a1bfd0
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xa9bccf62
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x3859f8cd
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call ebx
push 0
push 0
call ebx
push 0
push 0x2f3025cc
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call ebx
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x79d3fba0
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call ebx
push 0
push 0x63a2962c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xb39c8c2d
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x482bc72a
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xa8550efe
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xba964ec3
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x7f3a1e61
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x12ce6877
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xd65732be
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xc89a210e
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call ebx
push 0
push 0xffffffffffffffff
push 0x4965a1a1
push 0xf2998697
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0
call ebx
xor eax, eax
push eax
push 0x53433777
mov word [esi + edi*2], ax
mov edi, dword [sym.imp.GDI32.dll_GetObjectW]
push eax
call edi
push 0
push 0xc5a57c37
push 0
call edi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
mov edi, dword [sym.imp.ole32.dll_CoDecodeProxy]
push 4
push 0xe6c699b
push 0xdd8976e1
call edi
push 0
push 0x24ca6f28
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xb7e134bd
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x4fc11472
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x10
push 0xaa5151cb
push 0x8a52eb09
call edi
push 0
push 0x199d828b
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xffffffffffffffef
push 0x556ba1b1
push 0x35429c69
call edi
push 0
push 0
call ebx
push 0
push 0xfffffffffffffff6
push 0x2dc76904
push 0xf08f6744
call edi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 9
push 0xd51ad086
push 0x915a3bf
call edi
push 0
push 0xffffffffffffffed
push 0x1c8c565a
push 0x488a9392
call edi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call ebx
push 0
push 0xf26b9ce3
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x15a7a084
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x2becea5c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xbc9ee6e9
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x340f46f7
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x1856ac78
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x6e45289a
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x65f7b24e
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x1b5d125a
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call ebx
mov ebx, dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call ebx
push 0
push 0xffffffffffffffee
push 0xb9bedf2a
push 0x3bf8b794
call edi
push 0
call ebx
mov ebx, dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x72bd7458
push 0
call ebx
push 0
push 0x231f5085
push 0
call ebx
push 0
push 0x16
push 0xf5f314ac
push 0x3965362
call edi
pop edi
mov eax, esi
pop esi
pop ebx
ret