Function at 0x40b670
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x524d8e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x593a34]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
lea eax, [ebp - 0x10]
mov dword [edi + 4], vtable.Gdiplus::Bitmap.0
push eax
push 0
push 0x26200a
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0x10], 0
push dword [ebp + 8]
call sub.gdiplus.dll_GdipCreateBitmapFromScan0
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [edi + 8], eax
mov dword [edi + 0x14], 0xff000000
lea esi, [edi + 0x34]
mov dword [edi + 0x18], 0xffe6e6e6
mov dword [edi + 0x1c], 0x96ffffff
push esi
mov dword [edi + 0x20], 0xffffffff
mov dword [edi + 0x24], 0xffffd700
push 0
mov dword [edi + 0x28], 0x4c000000
push ecx
mov dword [edi + 0x2c], 0x7d000000
mov dword [esp], 0x3f800000
mov dword [edi + 0x30], 0xe6000000
push 0xff000000
mov dword [ebp - 4], 0
mov dword [esi], 0
call sub.gdiplus.dll_GdipCreatePen1
mov dword [esi + 4], eax
lea esi, [edi + 0x3c]
mov dword [esi], 0
push esi
push 0
push ecx
mov dword [esp], 0x3f800000
push dword [edi + 0x18]
call sub.gdiplus.dll_GdipCreatePen1
mov dword [esi + 4], eax
lea esi, [edi + 0x44]
mov dword [esi], 0
push esi
push 0
push ecx
mov dword [esp], 0x3f800000
push dword [edi + 0x1c]
call sub.gdiplus.dll_GdipCreatePen1
mov dword [esi + 4], eax
lea esi, [edi + 0x4c]
mov dword [esi], 0
push esi
push 0
push ecx
mov dword [esp], 0x3f800000
push dword [edi + 0x20]
call sub.gdiplus.dll_GdipCreatePen1
mov dword [esi + 4], eax
lea eax, [ebp + 0xc]
mov dword [edi + 0x5c], 6
push eax
mov dword [edi + 0x54], vtable.Gdiplus::SolidBrush.0
push dword [edi + 0x14]
mov dword [ebp + 0xc], 0
call sub.gdiplus.dll_GdipCreateSolidFill
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x58], eax
lea eax, [ebp + 0xc]
mov dword [edi + 0x68], 6
push eax
mov dword [edi + 0x60], vtable.Gdiplus::SolidBrush.0
push dword [edi + 0x18]
mov dword [ebp + 0xc], 0
call sub.gdiplus.dll_GdipCreateSolidFill
mov dword [edi + 0x68], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x64], eax
lea eax, [ebp + 0xc]
mov dword [edi + 0x74], 6
push eax
mov dword [edi + 0x6c], vtable.Gdiplus::SolidBrush.0
push dword [edi + 0x1c]
mov dword [ebp + 0xc], 0
call sub.gdiplus.dll_GdipCreateSolidFill
mov dword [edi + 0x74], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x70], eax
lea eax, [ebp + 0xc]
mov dword [edi + 0x80], 6
push eax
mov dword [edi + 0x78], vtable.Gdiplus::SolidBrush.0
push dword [edi + 0x20]
mov dword [ebp + 0xc], 0
call sub.gdiplus.dll_GdipCreateSolidFill
mov dword [edi + 0x80], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x7c], eax
lea eax, [ebp + 0xc]
mov dword [edi + 0x8c], 6
push eax
mov dword [edi + 0x84], vtable.Gdiplus::SolidBrush.0
push dword [edi + 0x24]
mov dword [ebp + 0xc], 0
call sub.gdiplus.dll_GdipCreateSolidFill
mov dword [edi + 0x8c], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x88], eax
lea eax, [ebp + 0xc]
mov dword [edi + 0x98], 6
push eax
mov dword [edi + 0x90], vtable.Gdiplus::SolidBrush.0
push dword [edi + 0x28]
mov dword [ebp + 0xc], 0
call sub.gdiplus.dll_GdipCreateSolidFill
mov dword [edi + 0x98], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x94], eax
lea eax, [ebp + 0xc]
mov dword [edi + 0xa4], 6
push eax
mov dword [edi + 0x9c], vtable.Gdiplus::SolidBrush.0
push dword [edi + 0x2c]
mov dword [ebp + 0xc], 0
call sub.gdiplus.dll_GdipCreateSolidFill
mov dword [edi + 0xa4], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0xa0], eax
lea eax, [ebp + 0xc]
mov dword [edi + 0xb0], 6
push eax
mov dword [edi + 0xa8], vtable.Gdiplus::SolidBrush.0
push dword [edi + 0x30]
mov dword [ebp + 0xc], 0
call sub.gdiplus.dll_GdipCreateSolidFill
mov dword [edi + 0xb0], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0xac], eax
lea ebx, [edi + 0xb4]
mov dword [ebx], 0
push ebx
push 0
push 0
call sub.gdiplus.dll_GdipCreateStringFormat
mov dword [ebx + 4], eax
lea ebx, [edi + 0xbc]
mov dword [ebx], 0
push ebx
push 0
push 0
call sub.gdiplus.dll_GdipCreateStringFormat
mov dword [ebx + 4], eax
lea ebx, [edi + 0xc4]
mov dword [ebx], 0
push ebx
push 0
push 0
call sub.gdiplus.dll_GdipCreateStringFormat
mov dword [ebx + 4], eax
lea ebx, [edi + 0xcc]
mov dword [ebx], 0
push ebx
push 0
push 0
call sub.gdiplus.dll_GdipCreateStringFormat
mov dword [ebx + 4], eax
mov esi, dword [ebp + 0x18]
mov dword [ebp + 0xc], 0
test esi, esi
je 0x40b985
mov eax, dword [esi]
jmp 0x40b987
xor eax, eax
movd xmm0, dword [ebp + 0x14]
lea ecx, [ebp + 0xc]
push ecx
push 2
cvtdq2ps xmm0, xmm0
push 0
push ecx
movss dword [esp], xmm0
push eax
call sub.gdiplus.dll_GdipCreateFont
mov dword [edi + 0xd8], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0xd4], eax
mov dword [ebp + 0xc], 0
test esi, esi
je 0x40b9c1
mov eax, dword [esi]
jmp 0x40b9c3
xor eax, eax
movd xmm0, dword [ebp + 0x14]
lea ecx, [ebp + 0xc]
cvtdq2pd xmm0, xmm0
push ecx
push 2
push 0
push ecx
mulsd xmm0, qword [0x52aaa8]
cvtpd2ps xmm0, xmm0
movss dword [esp], xmm0
push eax
call sub.gdiplus.dll_GdipCreateFont
mov dword [edi + 0xe0], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0xdc], eax
mov esi, dword [ebp + 0x1c]
mov dword [ebp + 0xc], 0
test esi, esi
je 0x40ba0d
mov eax, dword [esi]
jmp 0x40ba0f
xor eax, eax
movd xmm0, dword [ebp + 0x14]
lea ecx, [ebp + 0xc]
push ecx
push 2
cvtdq2ps xmm0, xmm0
push 1
push ecx
movss dword [esp], xmm0
push eax
call sub.gdiplus.dll_GdipCreateFont
mov dword [edi + 0xe8], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0xe4], eax
mov dword [ebp + 0xc], 0
test esi, esi
je 0x40ba49
mov eax, dword [esi]
jmp 0x40ba4b
xor eax, eax
movd xmm0, dword [ebp + 0x14]
lea ecx, [ebp + 0xc]
cvtdq2pd xmm0, xmm0
push ecx
push 2
push 1
push ecx
mulsd xmm0, qword [0x52aab0]
cvtpd2ps xmm0, xmm0
movss dword [esp], xmm0
push eax
call sub.gdiplus.dll_GdipCreateFont
mov dword [edi + 0xf0], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0xec], eax
mov dword [edi + 0x100], 0
mov dword [edi + 0x104], 0
push 8
mov byte [ebp - 4], 0x15
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
test esi, esi
je 0x40baca
xor eax, eax
lea ecx, [edi + 4]
mov dword [ebp + 0x14], eax
test ecx, ecx
je 0x40bac6
lea eax, [ebp + 0x14]
push eax
push dword [ecx + 4]
call sub.gdiplus.dll_GdipGetImageGraphicsContext
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [esi], eax
jmp 0x40bacc
xor esi, esi
push 4
mov dword [edi], esi
push dword [esi]
call sub.gdiplus.dll_GdipSetTextRenderingHint
test eax, eax
je 0x40bade
mov dword [esi + 4], eax
push 1
push dword [edi + 0xb4]
call sub.gdiplus.dll_GdipSetStringFormatAlign
test eax, eax
je 0x40baf5
mov dword [edi + 0xb8], eax
push 1
push dword [edi + 0xb4]
call sub.gdiplus.dll_GdipSetStringFormatLineAlign
test eax, eax
je 0x40bb0c
mov dword [edi + 0xb8], eax
push 1
push dword [edi + 0xbc]
call sub.gdiplus.dll_GdipSetStringFormatLineAlign
test eax, eax
je 0x40bb23
mov dword [edi + 0xc0], eax
push 2
push dword [edi + 0xc4]
call sub.gdiplus.dll_GdipSetStringFormatAlign
test eax, eax
je 0x40bb3a
mov dword [edi + 0xc8], eax
push 2
push dword [ebx]
call sub.gdiplus.dll_GdipSetStringFormatAlign
test eax, eax
je 0x40bb4a
mov dword [ebx + 4], eax
push 1
push dword [ebx]
call sub.gdiplus.dll_GdipSetStringFormatLineAlign
test eax, eax
je 0x40bb5a
mov dword [ebx + 4], eax
mov esi, dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f00
push 0
call esi
push 0x7f89
push 0
mov dword [edi + 0xf4], eax
call esi
movss xmm0, dword [ebp + 0x10]
push ecx
movss dword [esp], xmm0
push 0x98
mov dword [edi + 0xf8], eax
call fcn.00427630
push eax
mov dword [edi + 0xfc], eax
lea eax, [ebp - 0x14]
push eax
call fcn.00427510
add esp, 0x10
or ebx, 0xffffffff
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [eax], 0
mov dword [eax + 4], 0
mov esi, dword [edi + 0x104]
mov dword [edi + 0x100], ecx
mov dword [edi + 0x104], edx
test esi, esi
je 0x40bbf0
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x40bbf0
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, ebx
lock xadd dword [esi + 8], eax
jne 0x40bbf0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x40bc15
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x40bc15
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x40bc15
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18