Function at 0x200c7520
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x200d5608
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x64]
lea ecx, [esp + 0x20]
mov esi, dword [edi + 0x2c]
call fcn.200b51c0
mov dword [esp + 0x20], 0x200e0020
xor ebp, ebp
lea ecx, [esp + 0x30]
mov dword [esp + 0x58], ebp
call sub.MFC42.DLL_CDC::CDC
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], 0x200dafbc
push ebp
lea ecx, [esp + 0x2c]
mov byte [esp + 0x5c], 2
call sub.MFC42.DLL_CBrush::CBrush
add edi, 0x1c
mov byte [esp + 0x58], 3
mov eax, dword [edi]
mov ecx, dword [edi + 4]
inc ecx
mov edx, dword [edi + 8]
mov dword [esp + 0x44], ecx
mov edi, dword [edi + 0xc]
dec edi
inc eax
dec edx
cmp esi, 8
mov dword [esp + 0x4c], edi
mov dword [esp + 0x40], eax
mov dword [esp + 0x48], edx
jl 0x200c75ad
add esi, 8
cmp esi, ebp
jl 0x200c770f
je 0x200c770f
cmp esi, 1
jne 0x200c75ca
push 0xffffff
jmp 0x200c7710
cmp esi, 2
jl 0x200c75e8
cmp esi, 8
jge 0x200c75e8
mov esi, dword [esi*4 + 0x200ea2d4]
push ebp
push esi
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
jmp 0x200c7716
cmp esi, 0x10
jl 0x200c770f
cmp esi, 0x20
jge 0x200c770f
mov eax, dword [esp + 0x60]
cmp eax, ebp
jne 0x200c7606
xor eax, eax
jmp 0x200c7609
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CDC::Attach
mov eax, dword [esp + 0x34]
push 8
push 8
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CGdiObject::Attach
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x20]
neg eax
sbb eax, eax
and eax, edx
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
lea edx, [esp + 0x28]
lea ecx, [esp + 0x30]
push edx
mov dword [esp + 0x14], eax
call sub.MFC42.DLL_CDC::SelectObject_3
push 0xff0062
push 8
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x3c]
push 8
push ebp
push ebp
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
lea edi, [esi - 0x10]
shl edi, 4
add edi, 0x200ea2f4
xor ebx, ebx
mov dword [esp + 0x64], 1
mov bx, word [edi]
xor esi, esi
mov ecx, dword [esp + 0x64]
test ecx, ebx
je 0x200c76b1
mov edx, dword [esp + 0x34]
push 0xf00021
push 1
push 1
push ebp
push esi
push edx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edx, dword [esp + 0x64]
shl edx, 1
inc esi
mov dword [esp + 0x64], edx
cmp esi, 8
jl 0x200c7693
inc ebp
add edi, 2
cmp ebp, 8
jl 0x200c7684
mov edi, dword [esp + 0x24]
lea eax, [esp + 0x20]
neg eax
sbb eax, eax
and eax, edi
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push eax
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CGdiObject::Attach
mov eax, dword [esp + 0x10]
test eax, eax
je 0x200c76f4
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x38]
push eax
call sub.MFC42.DLL_CDC::SelectGdiObject
mov ecx, dword [esp + 0x14]
push ecx
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CDC::SelectObject_3
jmp 0x200c7720
push ebp
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CGdiObject::Attach
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x60]
lea eax, [esp + 0x18]
lea edx, [esp + 0x40]
neg eax
sbb eax, eax
and eax, ebx
push eax
mov eax, dword [esi + 4]
push edx
push eax
call dword [sym.imp.USER32.dll_FillRect]
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x28]
mov edx, dword [esi + 4]
lea ecx, [esp + 0x40]
neg eax
sbb eax, eax
and eax, ebx
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_FrameRect]
mov esi, 0x200da274
mov dword [esp + 0x28], esi
lea ecx, [esp + 0x28]
mov byte [esp + 0x58], 4
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov edi, 0x200d72cc
mov dword [esp + 0x18], esi
mov dword [esp + 0x28], edi
lea ecx, [esp + 0x18]
mov byte [esp + 0x58], 5
call sub.MFC42.DLL_CGdiObject::DeleteObject
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], edi
mov byte [esp + 0x58], 0
call fcn.200cdd66
mov dword [esp + 0x20], esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x58], 6
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4c
ret 8