Function at 0x4179d9
Capabilities:
Check for debugger via api

Disassembly:
push ebx
mov ebx, dword [sym.imp.GDI32.dll_GetObjectW]
push esi
push edi
push 0
push 0x5cb8e6d8
push 0
mov edi, edx
mov esi, ecx
call ebx
push 0
push 0xf0e258fe
push 0
call ebx
push 0
push 0x1ae7ce77
push 0
call ebx
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x8e4781f2
push 0
call ebx
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ebx, dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 8
push 0x752b45e1
push 0x99b40d6b
call ebx
push 0
push 0x13
push 0x3af87d90
push 0x8cb9c853
call ebx
push 0
push 0xc76929fe
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xffffffffffffffe9
push 0xe1bbef84
push 0x72a219
call ebx
xor ebx, ebx
push ebx
push 0x1cc2a167
push ebx
call dword [sym.imp.GDI32.dll_GetObjectW]
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
call ebx
push 0
push 6
push 0xca174ea5
push 0x6ce4bb79
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0xffffffffffffffec
push 0xd903ff8c
push 0xc9920602
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0x4344dfdc
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x17e6bc5a
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x3e015adc
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xaf974ae7
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x662c026e
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x7cdeb83a
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x7cf9a48f
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x442b1624
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xb
push 0x51d375a2
push 0xb010a3ce
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call ebx
push 0
push 0xadf12a80
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call ebx
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call ebx
push 0
push 0xfffffffffffffff2
push 0x925ba3fc
push 0x28d7b2a4
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0
call ebx
push 0
push 0x581edad1
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 4
push 0xc110595f
push 0x1d0f3223
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0xa
push 0xe3b6980f
push 0xf947c9b9
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0x528233e0
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xa
push 0xba7ff777
push 0x7f1dfd1
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0x5c
push 0
push esi
call dword [0x41c0dc]
push 0
push 0xffffffffffffffea
push 0x5e6e98d0
push 0xcbec0f2c
lea esi, [eax + 2]
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x9d8a602d
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 5
push 0x1060ea88
push 0x543682df
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0xc351156a
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call ebx
push 0
push 0
call ebx
push 0
push 0x8c80731
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xffffffffffffffed
push 0x18a4ccbd
push 0x4dde8eb3
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0x1ccfec41
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x8c572bdf
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call ebx
push 0
push 0x32e0430d
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x8c5aed74
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xff6fd2ee
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 4
push 0xfc7b211d
push 0xb19d935a
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xad33cecc
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xcc7a1cd1
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call ebx
push 0
push 0
call ebx
push 0
push 0xffffffffffffffee
push 0x1ff396ff
push 0x71538d15
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0x9d29acb9
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xfffffffffffffffc
push 0x109f25d8
push 0x936063e8
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0x3e120aff
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xfb08d11c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x369413f9
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x9aa1bae1
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x1408908
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xb8971fda
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call ebx
push esi
push dword [edi]
call dword [0x41c138]
mov esi, dword [sym.imp.ole32.dll_CoDecodeProxy]
xor edi, edi
push edi
push 0xa
push 0x46d1e9bf
push 0x1a8b17a2
call esi
push edi
push edi
call ebx
push edi
push edi
call ebx
push edi
push 0x95362939
push edi
mov edi, dword [sym.imp.GDI32.dll_GetObjectW]
call edi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call ebx
push 0
push 0x2175e7f
push 0
call edi
push 0
push 0
call ebx
push 0
push 0
call ebx
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x6ef8c0b7
push 0
call edi
push 0
push 5
push 0x4eace92c
push 0x473cb61
call esi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x293c0cd4
push 0
call edi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x59a3a54b
push 0
call edi
push 0
push 0x55110733
push 0
call edi
push 0
push 0
call ebx
push 0
push 0xb5b147cf
push 0
call edi
push 0
push 0x75a66ac9
push 0
call edi
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x365706cc
push 0
call edi
push 0
push 0xfffffffffffffff9
push 0x134bba47
push 0xd2a92653
call esi
push 0
push 0
call ebx
push 0
push 0xe96f73b8
push 0
call edi
push 0
push 0x9e075576
push 0
call edi
push 0
push 0
call ebx
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x4a0c01be
push 0
call edi
push 0
push 0
call ebx
xor ebx, ebx
push ebx
push 0xa39079fa
push ebx
call edi
push ebx
push 0x13
push 0xbe2b620e
push 0xa528b54c
call esi
push ebx
push 0xfffffffffffffff9
push 0x6fa90852
push 0xcf729d13
call esi
push ebx
mov ebx, dword [sym.imp.USER32.dll_DestroyWindow]
call ebx
push 0
call ebx
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
ret