Function at 0x42a9a0
Capabilities:
Access peb ldr_data
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x45fef0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
push esi
lea ecx, [esp + 0x44]
call fcn.00452d1d
xor ebp, ebp
mov eax, vtable.CFont.0
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], eax
mov byte [esp + 0x5c], 2
call fcn.0044fd47
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov edx, dword [esi + 0x98]
mov eax, dword [esi + 0xa0]
mov ecx, dword [esi + 0xec]
sub eax, edx
xor edx, edx
div ecx
mov eax, dword [esi + 0xa0]
mov byte [esp + 0x5c], 3
sub eax, edx
mov dword [esi + 0xa0], eax
sub eax, dword [esi + 0x98]
mov dword [esi + 0x7c], eax
mov edi, dword [esi + 0x94]
mov edx, dword [esi + 0x9c]
sub edx, edi
mov dword [esi + 0x80], edx
xor edx, edx
div ecx
lea edi, [esi + 0xac]
cmp edi, ebp
mov dword [esi + 0xf4], eax
je 0x41c9fc
cmp dword [edi + 4], ebp
jne 0x41ca4e
mov eax, dword [esp + 0x44]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
mov ecx, edi
call fcn.00452c86
mov eax, dword [esi + 0x74]
mov ecx, dword [esi + 0x78]
push eax
push ecx
mov ecx, dword [esp + 0x4c]
push ecx
lea ebx, [esi + 0xdc]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov ecx, ebx
call fcn.00452f83
cmp ebx, ebp
jne 0x41ca38
xor ebx, ebx
jmp 0x41ca3b
mov ebx, dword [ebx + 4]
mov edx, dword [esi + 0xb0]
push ebx
push edx
call fcn.0045300c
mov dword [esi + 0xd4], eax
mov ecx, dword [esi + 0x50]
mov eax, dword [edi]
push ecx
mov ecx, edi
call dword [eax + 0x2c]
lea eax, [esi + 0xa4]
cmp eax, ebp
jne 0x41ca67
xor ecx, ecx
jmp 0x41ca6a
mov ecx, dword [eax + 4]
mov edx, dword [esi + 0xb0]
push ecx
lea eax, [esi + 0x84]
push eax
push edx
call dword [sym.imp.USER32.dll_FillRect]
lea eax, [esi + 0xcc]
push eax
mov ecx, edi
call fcn.0045305f
mov ecx, dword [esi + 0x98]
push ecx
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0x94]
push eax
lea ecx, [esp + 0x40]
push ecx
mov ecx, edi
call fcn.00452a1e
mov edx, dword [esi + 0xa0]
mov eax, dword [esi + 0x94]
push edx
push eax
mov ecx, edi
call fcn.00452684
mov ecx, dword [esi + 0xa0]
mov eax, dword [esi + 0x9c]
push ecx
push eax
mov ecx, edi
call fcn.00452684
mov ecx, dword [esi + 0x98]
mov edx, dword [esi + 0x9c]
push ecx
push edx
mov ecx, edi
call fcn.00452684
mov ecx, dword [esi + 0x98]
mov eax, dword [esi + 0x94]
push ecx
push eax
mov ecx, edi
call fcn.00452684
push 0x465488
push 0x20
push ebp
mov ebx, dword [sym.imp.GDI32.dll_CreateFontA]
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push 0x12c
push ebp
push ebp
push ebp
push 0xd
call ebx
push eax
lea ecx, [esp + 0x34]
call fcn.00452f83
push 0x465488
push 0x20
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push 0x12c
push ebp
push 0x384
push ebp
push 0xd
call ebx
push eax
lea ecx, [esp + 0x2c]
call fcn.00452f83
mov eax, dword [edi]
mov ecx, dword [esi + 0x54]
push ecx
mov ecx, edi
call dword [eax + 0x30]
mov edx, dword [edi]
lea eax, [esp + 0x30]
push eax
mov ecx, edi
call dword [edx + 0x28]
push 6
mov ecx, edi
mov dword [esp + 0x24], eax
call fcn.004526b9
mov ebp, dword [esi + 0x94]
mov eax, dword [esi + 0x9c]
mov ecx, dword [esi + 0xa0]
add eax, ebp
mov ebp, dword [edi]
cdq
sub eax, edx
mov edx, dword [esi + 0x6c]
mov ebx, dword [edx - 0xc]
push ebx
add ecx, 0xc
push edx
push ecx
sar eax, 1
push eax
mov ecx, edi
call dword [ebp + 0x5c]
mov ecx, dword [esi + 0x64]
mov eax, dword [esi + 0x7c]
xor edx, edx
div ecx
mov ebx, dword [esi + 0xa0]
mov dword [esp + 0x18], eax
xor eax, eax
cmp ecx, eax
mov dword [esp + 0x1c], eax
jbe 0x41cc43
jmp 0x41cbd0
mov eax, dword [esp + 0x14]
lea ebx, [ebx]
mov edx, dword [esi + 0x60]
mov ebp, dword [esp + 0x18]
add eax, edx
push eax
lea ecx, [esp + 0x14]
push 0x464628
push ecx
sub ebx, ebp
mov dword [esp + 0x20], eax
call fcn.004026d0
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx - 0xc]
mov eax, dword [esi + 0x94]
mov ebp, dword [edi]
add esp, 0xc
push edx
push ecx
lea edx, [ebx - 5]
sub eax, 0xa
push edx
push eax
mov ecx, edi
call dword [ebp + 0x5c]
xor ebp, ebp
mov ecx, dword [esi + 0x54]
mov eax, dword [esi + 0x94]
push ecx
add eax, ebp
push ebx
push eax
mov eax, dword [esi + 0xb0]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
inc ebp
cmp ebp, 5
jb 0x41cc12
mov eax, dword [esp + 0x1c]
mov ecx, dword [esi + 0x64]
inc eax
cmp eax, ecx
mov dword [esp + 0x1c], eax
jb 0x41cbc6
mov eax, dword [esi + 0x80]
xor edx, edx
div dword [esi + 0x5c]
mov ebx, dword [esi + 0x9c]
xor ebp, ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], eax
jmp 0x41cc64
mov ebp, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x14]
push 0x464628
push ecx
call fcn.004026d0
mov edx, dword [esp + 0x1c]
mov ecx, dword [edx - 0xc]
mov eax, dword [esi + 0xa0]
mov edx, dword [edi]
add esp, 0xc
push ecx
mov ecx, dword [esp + 0x14]
push ecx
add eax, 2
push eax
push ebx
mov ecx, edi
call dword [edx + 0x5c]
mov eax, dword [esi + 0x58]
mov ecx, dword [esp + 0x18]
add ebp, eax
sub ebx, ecx
mov dword [esp + 0x14], ebp
xor ebp, ebp
jmp 0x41ccb0
mov ecx, dword [esi + 0x54]
mov eax, dword [esi + 0xa0]
mov edx, dword [esi + 0xb0]
push ecx
sub eax, ebp
push eax
push ebx
push edx
call dword [sym.imp.GDI32.dll_SetPixel]
inc ebp
cmp ebp, 5
jb 0x41ccb0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esi + 0x5c]
inc eax
cmp eax, ecx
mov dword [esp + 0x1c], eax
jbe 0x41cc60
mov ebx, dword [esi + 0xfc]
mov al, byte [esi + 0xf8]
test al, al
mov ecx, dword [esi + 0x7c]
lea ebp, [esi + 0xf8]
mov dword [esp + 0x14], ebx
mov dword [ebp + 4], ecx
jne 0x41cd46
mov eax, ecx
shr eax, 2
lea edx, [eax + eax]
lea ebx, [eax + edx]
mov dword [esp + 0x1c], ebx
mov dword [ebp + 0x18], ebx
mov ebx, eax
mov dword [ebp + 8], eax
mov dword [ebp + 0x20], ecx
mov dword [ebp + 0x10], edx
sub ebx, dword [0x47d6d0]
mov dword [ebp + 0xc], ebx
mov ebx, edx
sub ebx, eax
mov eax, dword [esp + 0x1c]
mov dword [ebp + 0x14], ebx
mov ebx, eax
sub ebx, edx
sub ecx, eax
mov dword [ebp + 0x1c], ebx
mov ebx, dword [esp + 0x14]
mov dword [ebp + 0x24], ecx
mov eax, dword [esi + 0x98]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x7c]
test eax, eax
jbe 0x41cd88
lea ebx, [eax - 1]
push ebx
mov ecx, ebp
call fcn.0041c250
mov ecx, dword [esp + 0x18]
push eax
push 1
push 0xa
push ecx
push 0x1e
mov ecx, edi
call fcn.00458d7c
mov edx, dword [esp + 0x18]
inc edx
mov eax, ebx
test eax, eax
mov dword [esp + 0x18], edx
ja 0x41cd57
mov ebx, dword [esp + 0x14]
mov edx, dword [esi + 0x50]
mov eax, dword [esp + 0x18]
push edx
push 1
push 0xa
push eax
push 0x1e
mov ecx, edi
call fcn.00458d7c
cmp byte [ebp], 0
mov dword [ebp + 4], ebx
jne 0x41cde4
mov eax, ebx
shr eax, 2
lea ecx, [eax + eax]
lea edx, [eax + ecx]
mov dword [esp + 0x1c], edx
mov dword [ebp + 0x18], edx
mov edx, eax
mov dword [ebp + 8], eax
mov dword [ebp + 0x20], ebx
mov dword [ebp + 0x10], ecx
sub edx, dword [0x47d6d0]
mov dword [ebp + 0xc], edx
mov edx, ecx
sub edx, eax
mov eax, dword [esp + 0x1c]
mov dword [ebp + 0x14], edx
mov edx, eax
sub edx, ecx
sub ebx, eax
mov dword [ebp + 0x1c], edx
mov dword [ebp + 0x24], ebx
mov ecx, dword [esp + 0x14]
xor edx, edx
mov eax, ecx
div dword [esi + 0x68]
xor edx, edx
mov ebx, dword [esi + 0xa0]
sub ebx, 0xc
mov ebp, eax
mov eax, dword [esi + 0x7c]
div ebp
xor ebp, ebp
test ecx, ecx
mov dword [esp + 0x1c], eax
jbe 0x41ce4b
jmp 0x41ce10
push ebp
lea eax, [esp + 0x14]
push 0x464628
push eax
call fcn.004026d0
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx - 0xc]
mov edx, dword [edi]
add esp, 0xc
push eax
push ecx
push ebx
push 0xf
mov ecx, edi
call dword [edx + 0x5c]
mov ecx, dword [esi + 0x68]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
add ebp, ecx
sub ebx, edx
cmp ebp, eax
jb 0x41ce10
mov ecx, eax
mov eax, dword [esi + 0x68]
sub ebp, ecx
shr eax, 1
cmp ebp, eax
jae 0x41ce84
push ecx
lea ecx, [esp + 0x14]
push 0x464628
push ecx
call fcn.004026d0
mov ebp, dword [esp + 0x1c]
mov ecx, dword [ebp - 0xc]
mov eax, dword [esi + 0x98]
mov edx, dword [edi]
add esp, 0xc
push ecx
push ebp
push eax
push 0xf
mov ecx, edi
call dword [edx + 0x5c]
jmp 0x41ce88
mov ebp, dword [esp + 0x10]
mov eax, dword [edi]
lea ecx, [esp + 0x28]
push ecx
mov ecx, edi
call dword [eax + 0x28]
push 0x1e
mov ecx, edi
call fcn.004526b9
mov ecx, dword [esi + 0x98]
mov eax, dword [esi + 0xa0]
add eax, ecx
mov ecx, dword [esi + 0x94]
cdq
sub eax, edx
mov edx, dword [esi + 0x70]
mov ebx, dword [edx - 0xc]
mov dword [esp + 0x1c], ebx
push dword [esp + 0x1c]
mov ebx, dword [edi]
push edx
sar eax, 1
sub ecx, 0x19
push eax
push ecx
mov ecx, edi
call dword [ebx + 0x5c]
mov eax, dword [esp + 0x20]
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 0x28]
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, edi
call fcn.0045305f
lea edi, [esi + 0xbc]
test edi, edi
je 0x41cefa
mov eax, dword [edi + 4]
test eax, eax
jne 0x41cf48
mov edx, dword [esp + 0x44]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
mov ecx, edi
call fcn.00452c86
mov eax, dword [esi + 0x74]
mov ecx, dword [esi + 0x78]
push eax
mov eax, dword [esp + 0x48]
push ecx
push eax
lea ebx, [esi + 0xe4]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov ecx, ebx
call fcn.00452f83
test ebx, ebx
je 0x41cf35
mov ebx, dword [ebx + 4]
mov ecx, dword [esi + 0xc0]
push ebx
push ecx
call fcn.0045300c
mov dword [esi + 0xd8], eax
mov eax, dword [esi + 0x50]
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 0x2c]
lea eax, [esi + 0xa4]
test eax, eax
je 0x41cf60
mov eax, dword [eax + 4]
mov ecx, dword [esi + 0xc0]
push eax
lea edi, [esi + 0x84]
push edi
push ecx
call dword [sym.imp.USER32.dll_FillRect]
mov edx, dword [esi + 0x1c]
push 1
push edi
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea eax, [ebp - 0x10]
mov byte [esp + 0x5c], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41cfa1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov esi, vtable.CGdiObject.0
lea ecx, [esp + 0x28]
mov byte [esp + 0x5c], 1
mov dword [esp + 0x28], esi
call fcn.00452fda
lea ecx, [esp + 0x30]
mov byte [esp + 0x5c], 0
mov dword [esp + 0x30], esi
call fcn.00452fda
lea ecx, [esp + 0x40]
mov dword [esp + 0x5c], 0xffffffff
call fcn.00452d78
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret
jmp 0x41c940
push esi
push 0
push 0
mov esi, ecx
mov eax, dword [esi + 0x378]
push 0x147
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
mov dword [esi + 0x34c], eax
jl 0x42aa2a
cmp eax, dword [esi + 0x340]
jge 0x42aa2a
mov edx, dword [esi + 0x33c]
push edi
lea ecx, [eax + eax*2]
mov eax, dword [edx + ecx*8 + 8]
lea edi, [edx + ecx*8]
mov ecx, dword [edi + 4]
push 0
push eax
add esi, 0x204
push ecx
mov ecx, esi
call fcn.0041c330
push 0xd
push 0xa
mov ecx, esi
call fcn.0041c370
push 4
mov ecx, esi
call fcn.0041c360
mov edx, dword [edi + 0x14]
mov eax, dword [edi + 0x10]
push edx
push eax
mov ecx, esi
call fcn.0041c390
mov ecx, dword [edi + 8]
shr ecx, 3
push ecx
mov ecx, esi
call fcn.0041c3b0
pop edi
mov ecx, esi
pop esi
jmp 0x41cff0
jmp fcn.004483e3