Function at 0x419750
Capabilities:
Access peb ldr_data
Check os version
Get kernel32 base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x57a570
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x5ecfcc]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x34], ecx
mov ecx, dword [eax + 8]
mov edi, ecx
sub edi, dword [eax]
mov dword [esp + 0x38], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x10], edi
push 6
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], edx
sar edi, 1
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push 1
push 0
lea ecx, [esp + 0x30]
call fcn.00537e5f
mov esi, dword [ebp + 8]
lea eax, [esp + 0x24]
push eax
mov ecx, esi
mov dword [esp + 0x54], 0
call fcn.00537d8b
mov ecx, dword [ebx + 0x9c]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], eax
call fcn.00537ea8
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
mov byte [esp + 0x54], 1
call fcn.00537d8b
mov ecx, ebx
mov dword [esp + 0x18], eax
call fcn.0053000a
test al, 8
je 0x4198c7
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push 2
push 2
push eax
mov eax, dword [esp + 0x40]
push ecx
mov ecx, dword [esi + 4]
push edx
push eax
push ecx
call dword [sym.imp.GDI32.dll_RoundRect]
mov edx, dword [ebx + 0xa8]
mov eax, 1
add dword [esp + 0x34], eax
add dword [esp + 0x38], eax
sub dword [esp + 0x3c], eax
sub dword [esp + 0x40], eax
mov eax, dword [ebx + 0xa0]
push edx
push eax
lea ecx, [esp + 0x3c]
push ecx
mov ecx, esi
call fcn.005400fa
mov eax, dword [ebx + 0xa4]
mov edx, dword [esp + 0x38]
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.GDI32.dll_SetPixel]
push eax
mov eax, dword [esp + 0x38]
push edx
push eax
push ecx
call edi
mov eax, dword [ebx + 0x9c]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push eax
mov eax, dword [esi + 4]
push edx
dec ecx
push ecx
push eax
call edi
mov eax, dword [ebx + 0xac]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
push eax
dec ecx
push ecx
mov ecx, dword [esi + 4]
dec edx
push edx
push ecx
call edi
mov eax, dword [ebx + 0x9c]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [esi + 4]
dec ecx
push ecx
push edx
push eax
call edi
jmp 0x419d1b
test al, 4
mov eax, dword [esp + 0x34]
je 0x419af3
mov ecx, dword [esp + 0x38]
lea edx, [ecx + edi - 1]
push edx
push eax
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.005376ee
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x34]
add edx, 0xfffffffe
push edx
push eax
mov ecx, esi
call fcn.0053731b
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x34]
dec ecx
push ecx
inc edx
push edx
mov ecx, esi
call fcn.0053731b
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
dec eax
add ecx, 0xfffffffe
push eax
push ecx
mov ecx, esi
call fcn.0053731b
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
add edx, 0xfffffffe
push edx
dec eax
push eax
mov ecx, esi
call fcn.0053731b
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
lea edx, [ecx + edi - 1]
push edx
dec eax
push eax
mov ecx, esi
call fcn.0053731b
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
push ecx
sub edx, edi
push edx
mov ecx, esi
call fcn.0053731b
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea edx, [ecx + edi - 1]
push eax
push edx
mov ecx, esi
call fcn.0053731b
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
lea ecx, [eax + edi - 1]
push ecx
push edx
mov ecx, esi
call fcn.0053731b
push 6
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [esi + 4]
add ecx, edi
push ecx
add edx, edi
push edx
push eax
call dword [sym.imp.GDI32.dll_FloodFill]
cmp dword [esp + 0x10], 5
jle 0x419adc
lea ecx, [ebx + 0x5c]
push ecx
mov ecx, esi
call fcn.00537d8b
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
add edx, edi
push edx
inc eax
push eax
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.005376ee
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x34]
add edx, 0xfffffffe
push edx
inc eax
push eax
mov ecx, esi
call fcn.0053731b
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
inc ecx
push ecx
sub edx, edi
push edx
lea eax, [esp + 0x34]
push eax
mov ecx, esi
call fcn.005376ee
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
inc ecx
sub edx, edi
push ecx
sub edx, 2
push edx
mov ecx, esi
call fcn.0053731b
lea eax, [ebx + 0x64]
push eax
mov ecx, esi
call fcn.00537d8b
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
lea edx, [ecx + edi - 1]
push edx
inc eax
push eax
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.005376ee
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
push edx
add eax, edi
push eax
mov ecx, esi
call fcn.0053731b
lea ecx, [ebx + 0x6c]
push ecx
mov ecx, esi
call fcn.00537d8b
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x34]
add edx, 0xfffffffe
push edx
add eax, 2
push eax
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.005376ee
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
add edx, 0xfffffffe
push edx
add eax, 0xfffffffe
push eax
mov ecx, esi
call fcn.0053731b
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
add ecx, 0xfffffffe
push ecx
add edx, 0xfffffffe
push edx
mov ecx, esi
call fcn.0053731b
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
lea ecx, [eax + edi - 1]
push ecx
add edx, 0xfffffffe
push edx
mov ecx, esi
call fcn.0053731b
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
inc eax
sub ecx, edi
push eax
push ecx
mov ecx, esi
call fcn.0053731b
add dword [esp + 0x38], 2
mov eax, 1
add dword [esp + 0x34], eax
sub dword [esp + 0x3c], eax
jmp 0x419d15
mov edx, dword [esp + 0x38]
inc edx
push edx
push eax
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.005376ee
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x34]
sub edx, edi
push edx
push eax
mov ecx, esi
call fcn.0053731b
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x34]
dec ecx
push ecx
lea eax, [edx + edi - 1]
push eax
mov ecx, esi
call fcn.0053731b
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
dec ecx
push ecx
sub edx, edi
push edx
mov ecx, esi
call fcn.0053731b
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
sub eax, edi
dec ecx
push eax
push ecx
mov ecx, esi
call fcn.0053731b
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
inc edx
push edx
dec eax
push eax
mov ecx, esi
call fcn.0053731b
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
push ecx
add edx, 0xfffffffe
push edx
mov ecx, esi
call fcn.0053731b
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push eax
push ecx
mov ecx, esi
call fcn.0053731b
push 6
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [esp + 0x38]
lea ecx, [edx + edi]
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [esi + 4]
push ecx
add edx, edi
push edx
push eax
call dword [sym.imp.GDI32.dll_FloodFill]
cmp dword [esp + 0x10], 5
jle 0x419d03
mov eax, dword [ebx + 0xa4]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
inc ecx
push ecx
mov ecx, dword [esi + 4]
inc edx
push edx
push ecx
call dword [sym.imp.GDI32.dll_SetPixel]
lea edx, [ebx + 0x5c]
push edx
mov ecx, esi
call fcn.00537d8b
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
add eax, 2
push eax
inc ecx
push ecx
lea edx, [esp + 0x34]
push edx
mov ecx, esi
call fcn.005376ee
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x34]
sub eax, edi
inc eax
inc ecx
push eax
push ecx
mov ecx, esi
call fcn.0053731b
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
inc edx
push edx
add eax, 2
push eax
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.005376ee
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
inc edx
push edx
add eax, 0xfffffffe
push eax
mov ecx, esi
call fcn.0053731b
lea ecx, [ebx + 0x6c]
push ecx
mov ecx, esi
call fcn.00537d8b
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x34]
sub edx, edi
inc edx
push edx
add eax, 2
push eax
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.005376ee
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x34]
add edx, 0xfffffffe
lea ecx, [eax + edi - 1]
push edx
push ecx
mov ecx, esi
call fcn.0053731b
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
add edx, 0xfffffffe
push edx
sub eax, edi
push eax
mov ecx, esi
call fcn.0053731b
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
sub ecx, edi
dec ecx
push ecx
add edx, 0xfffffffe
push edx
lea eax, [esp + 0x34]
push eax
mov ecx, esi
call fcn.005376ee
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
inc ecx
push ecx
add edx, 0xfffffffe
push edx
mov ecx, esi
call fcn.0053731b
lea eax, [ebx + 0x74]
push eax
mov ecx, esi
call fcn.00537d8b
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
add ecx, 0xfffffffe
push ecx
sub edx, edi
push edx
lea eax, [esp + 0x34]
push eax
mov ecx, esi
call fcn.005376ee
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
sub ecx, edi
dec ecx
push ecx
dec edx
push edx
mov ecx, esi
call fcn.0053731b
mov eax, 1
add dword [esp + 0x34], eax
sub dword [esp + 0x3c], eax
sub dword [esp + 0x40], 2
mov edi, dword [sym.imp.GDI32.dll_SetPixel]
mov ecx, ebx
call fcn.0053015f
test eax, eax
je 0x419f33
cmp dword [esp + 0x10], 5
jle 0x419f33
lea eax, [ebx + 0x5c]
push eax
mov ecx, esi
call fcn.00537d8b
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
add ecx, 5
push ecx
inc edx
push edx
lea eax, [esp + 0x34]
push eax
mov ecx, esi
call fcn.005376ee
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x34]
add ecx, 0xfffffffb
push ecx
inc edx
push edx
mov ecx, esi
call fcn.0053731b
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
add eax, 5
push eax
add ecx, 3
push ecx
lea edx, [esp + 0x34]
push edx
mov ecx, esi
call fcn.005376ee
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x34]
add eax, 0xfffffffb
add ecx, 3
push eax
push ecx
mov ecx, esi
call fcn.0053731b
cmp dword [esp + 0x10], 9
jle 0x419e0f
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
add edx, 5
push edx
add eax, 5
push eax
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.005376ee
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x34]
add edx, 0xfffffffb
push edx
add eax, 5
push eax
mov ecx, esi
call fcn.0053731b
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
add ecx, 5
push ecx
add edx, 7
push edx
lea eax, [esp + 0x34]
push eax
mov ecx, esi
call fcn.005376ee
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x34]
add ecx, 0xfffffffb
push ecx
add edx, 7
push edx
mov ecx, esi
call fcn.0053731b
lea eax, [ebx + 0x74]
push eax
mov ecx, esi
call fcn.00537d8b
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
add ecx, 5
push ecx
add edx, 2
push edx
lea eax, [esp + 0x34]
push eax
mov ecx, esi
call fcn.005376ee
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x34]
add ecx, 0xfffffffc
push ecx
add edx, 2
push edx
mov ecx, esi
call fcn.0053731b
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
add eax, 5
push eax
add ecx, 4
push ecx
lea edx, [esp + 0x34]
push edx
mov ecx, esi
call fcn.005376ee
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x34]
add eax, 0xfffffffc
add ecx, 4
push eax
push ecx
mov ecx, esi
call fcn.0053731b
cmp dword [esp + 0x10], 9
jle 0x419eba
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
add edx, 5
push edx
add eax, 6
push eax
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.005376ee
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x34]
add edx, 0xfffffffc
push edx
add eax, 6
push eax
mov ecx, esi
call fcn.0053731b
mov eax, dword [ebx + 0xa4]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
add ecx, 4
push ecx
mov ecx, dword [esi + 4]
inc edx
push edx
push ecx
call edi
mov eax, dword [ebx + 0xa4]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
add ecx, 4
add edx, 3
push ecx
push edx
mov edx, dword [esi + 4]
push edx
call edi
cmp dword [esp + 0x10], 9
jle 0x419f33
mov eax, dword [ebx + 0xa4]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [esi + 4]
add ecx, 4
push ecx
add edx, 5
push edx
push eax
call edi
mov ebx, dword [ebx + 0xa4]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push ebx
add eax, 4
add ecx, 7
push eax
push ecx
mov ecx, dword [esi + 4]
push ecx
call edi
mov edx, dword [esp + 0x14]
push edx
mov ecx, esi
call fcn.00537d8b
mov eax, dword [esp + 0x18]
push eax
mov ecx, esi
call fcn.00537d8b
lea ecx, [esp + 0x1c]
mov byte [esp + 0x50], 0
mov dword [esp + 0x1c], vtable.CBrush.0
call fcn.00407110
lea ecx, [esp + 0x24]
mov dword [esp + 0x50], 0xffffffff
mov dword [esp + 0x24], vtable.CPen.0
call fcn.00407110
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8