Function at 0x40ed61
Capabilities:
Check for debugger via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [sym.imp.GDI32.dll_GetObjectW]
xor esi, esi
push esi
push 0xb6d0495b
push esi
mov dword [ebp - 8], ecx
call edi
push esi
push 0x2b0d0ccc
push esi
call edi
push esi
push 0x4b8c3967
push esi
call edi
push esi
push 0xae86a371
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_DestroyWindow]
push esi
call ebx
push esi
push 0x77fff5ab
push esi
call edi
push esi
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push esi
push esi
call ebx
push esi
mov esi, dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0xfffffffffffffff8
push 0x8d6d12fe
push 0xdd65ce4d
call esi
push 0
push 0
call ebx
push 0
push 0x91b692
push 0
call edi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xfffffffffffffffe
push 0x875589ef
push 0x9c5e4676
call esi
push 0
push 0
call ebx
push 0
push 0
call ebx
push 0
push 0x9ff38b5d
push 0
call edi
push 0
push 0xa5a9cb79
push 0
call edi
push 0
push 0xf
push 0x72ae55a3
push 0x23024199
call esi
push 0
push 0xffffffffffffffeb
push 0x6c996562
push 0x31f3e61b
call esi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x3b6238a2
push 0
call edi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x13c94dd5
push 0
call edi
push 0
push 0xd
push 0x7b85aea4
push 0xb426eafd
call esi
push 0
push 0xfffffffffffffff5
push 0xca10a1a
push 0x27ec6ead
call esi
push 0
push 0
call ebx
push 0
push 0xa
push 0x45daabb5
push 0x742dea08
call esi
push 0
push 0x4cdb4eec
push 0
call edi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xffffffffffffffee
push 0x9f24a083
push 0xe2f94b94
call esi
push 0
push 0
call ebx
push 0
push 0xfdae8269
push 0
call edi
push 0
push 0xd7ac3055
push 0
call edi
push 0
push 8
push 0x73347bc3
push 0x26b16976
call esi
push 0
push 2
push 0x3ebf2914
push 0x29ec0b3f
call esi
push 0x20a
push 0x40
call dword [0x41c048]
push 0
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call ebx
push 0
push 0x3fa98b20
push 0
call edi
push 0
push 0
call ebx
push 0
push 0x863ba7bc
push 0
call edi
push 0
push 0xd84106ab
push 0
call edi
push 0
push 0xf83230c0
push 0
call edi
push 0
push 0xb869d9b3
push 0
call edi
push 0
push 0xc7d4a2f0
push 0
call edi
push 0
push 0
call ebx
push 0
push 0
call ebx
push 0
push 0x6a00a881
push 0
call edi
push 0
push 0xbe13b17e
push 0
call edi
push 0
push 0x446aa7b2
push 0
call edi
push 0
push 0
call ebx
push 0
push 0
call ebx
push 0
push 0
call ebx
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xfffffffffffffff0
push 0xf409d8f0
push 0x9cf67586
call esi
push 0
push 0x3184900b
push 0
call edi
push 0
push 0x26c0439
push 0
call edi
push 0
push 0xac85b40d
push 0
call edi
push 0
push 0xa3831bc8
push 0
call edi
push 0
push 0x2caa1d21
push 0
call edi
push 0
push 0xa04c69cf
push 0
call edi
push 0
push 0
call ebx
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x6401abe0
push 0
call edi
push 0
push 0x282eed37
push 0
call edi
push 0
push 0
call ebx
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x2e2be840
push 0
call edi
push 0
push 0x9d9d139c
push 0
call edi
push 0
push 0xf
push 0xf4d696fb
push 0xeef64c6c
call esi
push 0
push 0x43cfb9f1
push 0
call edi
push 0
push 0xfffffffffffffff0
push 0x487b7f2d
push 0xae798453
call esi
push dword [ebp - 4]
xor eax, eax
push eax
push eax
push 0x1c
push eax
call dword [0x41c18c]
push 0
test eax, eax
js 0x40f54c
push 0x468f1f47
push 0
call edi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x7d10f12b
push 0
call edi
push 0
push 7
push 0xf675b070
push 0x95fd2837
call esi
push 0
push 7
push 0xec2740fa
push 0xf62cbe19
call esi
push 0
push 0xfffffffffffffffd
push 0xa49dcd6d
push 0x44545001
call esi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x11
push 0xf667e374
push 0x3aab7fcf
call esi
push 0
push 0xf1086c62
push 0
call edi
push 0
push 0x179128fd
push 0
call edi
push 0
push 0x3d8aa16e
push 0
call edi
push 0
push 0
call ebx
push 0
push 0xb484ed4e
push 0
call edi
push 0
push 0
call ebx
push 0
push 0x162324fa
push 0
call edi
push 0
push 0x14
push 0x2f4b1525
push 0x34cd10bf
call esi
push 0
push 0x16
push 0x10173b43
push 0x52e99aa2
call esi
push 0
push 0x9f65f1b
push 0
call edi
push 0
push 0x5410d25
push 0
call edi
push 0
push 0x3f1693b4
push 0
call edi
push 0
push 0xfdc6e543
push 0
call edi
push 0
push 0x4d77aa51
push 0
call edi
push 0
push 0
call ebx
push 0
push 0xcbcb0c9f
push 0
call edi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x70d9b2bc
push 0
call edi
push 0
push 0xc276487d
push 0
call edi
push 0
push 0xf5c25765
push 0
call edi
push 0
push 0xdff6c8e8
push 0
call edi
push 0
push 0x9b7981f8
push 0
call edi
push 0
push 0
call ebx
push 0
push 0x2c4f7773
push 0
call edi
push 0
push 0
call ebx
push 0
push 0xf054c080
push 0
call edi
push 0
push 0xfffffffffffffff2
push 0x1718ce55
push 0xbf44e9d8
call esi
mov edx, dword [0x41c484]
mov ecx, dword [ebp - 4]
call fcn.00412dc2
push 0
mov esi, eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call ebx
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x1c1be3c1
push 0
call edi
push 0
push 0
push 0x7be18a43
push 0xa5096cbf
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0xc0d29184
push 0
call edi
push 0
push 0
call ebx
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call ebx
push 0
push 0xd3e26c8a
push 0
call edi
push 0
push 0x838d399
push 0
call edi
push 0
push 0x721b833b
push 0
call edi
push 0
push 0xf1f938a5
push 0
call edi
push 0
push 0x44e08ddc
push 0
call edi
push 0
push 0
call ebx
push 0
push 0
call ebx
push 0
push 0xa31e2c9a
push 0
call edi
push 0
push 0x3a719e5b
push 0
call edi
push 0
push 0x13
push 0xafa2a4f2
push 0xb8b17e3d
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0x9b1b5d57
push 0
call edi
push 0
push 0x215442c9
push 0
call edi
push 0
push 0x26f51cf9
push 0
call edi
push 0
push 0
call ebx
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call ebx
push 0
push 0xa
push 0x2f151d37
push 0x95abe554
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0x685dde60
push 0
call edi
push 0
push 0x6828e38
push 0
call edi
push 0
push 0xfd55a588
push 0
call edi
push 0
push 0x79eacf14
push 0
call edi
push 0
push 0xffffffffffffffee
push 0x6c86b375
push 0x8046744e
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0xfffffffffffffff2
push 0x12607151
push 0xf547ad14
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0
call ebx
push 0
push 0xb49e62a
push 0
call edi
push 0
push 0xc10bebf7
push 0
call edi
push 0
push 0x250a700
push 0
call edi
mov eax, dword [ebp - 8]
push esi
push dword [eax]
call dword [0x41c138]
mov ecx, dword [ebp - 8]
push 0
mov dword [ecx], eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xfffffffffffffffb
push 0xaadb1203
push 0xdcc6f417
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xab20dedc
push 0
call edi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xb
push 0x976206a4
push 0xbbc9330b
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0
call ebx
push 0
push 0
call ebx
push 0
push 0x47b65eec
push 0
call edi
push 0
push 0x25a4ccc3
push 0
call edi
push 0
push 0x89b3951d
push 0
call edi
push 0
push 0
call ebx
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x58f18735
push 0
call edi
push 0
push 0
call ebx
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xe14f916e
push 0
call edi
push 0
push 0xfa700ab9
push 0
call edi
push 0
push 0xfffffffffffffff2
push 0xa852069a
push 0x29623275
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0
call ebx
push 0
push 0
call ebx
push 0
push 0x12
push 0x7e56c2fd
push 0x91df5827
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x70923802
push 0
call edi
push 0
push 0xabdcefd5
push 0
call edi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xffffffffffffffea
push 0x25f60829
push 0x2c5df74e
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0x2021bc61
push 0
call edi
push 0
push 0
call ebx
mov ebx, dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0xa
push 0x780deca3
push 0x619c1b93
call ebx
push 0
push 0xd0d119b7
push 0
call edi
push 0
push 0x5ec228ab
push 0
call edi
push 0
push 3
push 0xb507f2b2
push 0x3280007
call ebx
push esi
call dword [0x41c0c4]
xor eax, eax
inc eax
jmp 0x40f83d
push 0x84e41e86
push 0
call edi
push 0
push 0x12094929
push 0
call edi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x13
push 0xe959c6dc
push 0x4b966ae2
call esi
push 0
push 0
call ebx
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xf8c86470
push 0
call edi
push 0
push 0xfffffffffffffff5
push 0x762be83c
push 0x53beb40a
call esi
push 0
push 0x8413096c
push 0
call edi
push 0
push 0x14
push 0xff2e7fa
push 0x2339a8f8
call esi
push 0
push 0xb221a8b8
push 0
call edi
push 0
push 0
call ebx
push 0
push 0x66a9077f
push 0
call edi
push 0
push 0xc7995ea1
push 0
call edi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xfffffffffffffff8
push 0x672796e1
push 0x5995241c
call esi
push 0
push 0xb02913f0
push 0
call edi
push 0
push 0x2548d9ae
push 0
call edi
push 0
push 4
push 0x3d32dcec
push 0x9956275d
call esi
push 0
push 0x52f686f1
push 0
call edi
push 0
push 0x794391be
push 0
call edi
push 0
push 0
call ebx
push 0
push 0
call ebx
push 0
push 0x200efb78
push 0
call edi
push 0
push 0xe45e6e91
push 0
call edi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call ebx
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call ebx
push 0
push 0x2d53428c
push 0
call edi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x15
push 0xaf5b2f2
push 0x9028e2bd
call esi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x5001ca7
push 0
call edi
push 0
push 0xdb104cfd
push 0
call edi
mov eax, dword [ebp - 4]
test eax, eax
je 0x40f6cc
push eax
call dword [0x41c0c4]
push 0
push 8
push 0x8e8b5fb1
push 0x8a01719c
call esi
push 0
push 0
call ebx
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call ebx
push 0
push 0xfffffffffffffff6
push 0x982b46af
push 0xf126ce85
call esi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x3232967
push 0
call edi
push 0
push 0
call ebx
push 0
push 0
call ebx
push 0
push 0x1d0d50b1
push 0
call edi
push 0
push 0xa6f750d4
push 0
call edi
push 0
push 0
call ebx
push 0
push 0xd72342df
push 0
call edi
push 0
push 0xb0047b61
push 0
call edi
push 0
push 0xc
push 0x251a9c27
push 0x6b22f0fe
call esi
push 0
push 0
call ebx
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x84d82913
push 0
call edi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
push 0xd25c752f
push 0x409c5165
call esi
push 0
push 5
push 0xc392af82
push 0xad6874e
call esi
push 0
push 0x1d2f1696
push 0
call edi
push 0
push 0x311377b7
push 0
call edi
push 0
push 0x8da72b3e
push 0
call edi
push 0
push 0x9294771b
push 0
call edi
push 0
push 0xfffffffffffffff6
push 0xee538a20
push 0xf3294ee4
call esi
push 0
push 0x55c9c1c5
push 0
call edi
push 0
push 0xb7a51918
push 0
call edi
push 0
push 0xc45f041d
push 0
call edi
push 0
push 0x16
push 0x200c2077
push 0x6ce88581
call esi
xor esi, esi
push esi
push esi
call ebx
push esi
push esi
call ebx
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
push esi
push 0xa64b7b7d
push esi
call edi
push esi
push 0x265b6580
push esi
call edi
push esi
push 0x27979690
push esi
call edi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret