Function at 0x4cd620
Capabilities:
Check os version
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f26aa
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x58bd90]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, vtable.CGdiObject.0
xor edi, edi
mov dword [ebp - 0x12c], 0x596870
mov dword [ebp - 0x128], 0x596900
mov dword [0x596900], eax
mov dword [0x596904], edi
mov dword [ebp - 4], edi
mov ecx, vtable.CBrush.0
mov dword [0x596900], ecx
mov esi, 1
mov dword [ebp - 4], esi
mov dword [ebp - 0x128], 0x596908
mov dword [0x596908], eax
mov dword [0x59690c], edi
mov byte [ebp - 4], 2
mov dword [0x596908], ecx
mov byte [ebp - 4], 3
mov dword [ebp - 0x128], 0x596910
mov dword [0x596910], eax
mov dword [0x596914], edi
mov byte [ebp - 4], 4
mov dword [0x596910], ecx
mov byte [ebp - 4], 5
mov dword [ebp - 0x128], 0x596918
mov dword [0x596918], eax
mov dword [0x59691c], edi
mov byte [ebp - 4], 6
mov dword [0x596918], ecx
mov byte [ebp - 4], 7
mov dword [ebp - 0x128], 0x596920
mov dword [0x596920], eax
mov dword [0x596924], edi
mov byte [ebp - 4], 8
mov dword [0x596920], ecx
mov byte [ebp - 4], 9
mov dword [ebp - 0x128], 0x596928
mov dword [0x596928], eax
mov dword [0x59692c], edi
mov byte [ebp - 4], 0xa
mov dword [0x596928], ecx
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x128], 0x596930
mov dword [0x596930], eax
mov dword [0x596934], edi
mov byte [ebp - 4], 0xc
mov dword [0x596930], ecx
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x128], 0x596938
mov dword [0x596938], eax
mov dword [0x59693c], edi
mov byte [ebp - 4], 0xe
mov dword [0x596938], ecx
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x128], 0x596940
mov dword [0x596940], eax
mov dword [0x596944], edi
mov byte [ebp - 4], 0x10
mov ecx, vtable.CPen.0
mov dword [0x596940], ecx
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x128], 0x596948
mov dword [0x596948], eax
mov dword [0x59694c], edi
mov byte [ebp - 4], 0x12
mov dword [0x596948], ecx
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x128], 0x596950
mov dword [0x596950], eax
mov dword [0x596954], edi
mov byte [ebp - 4], 0x14
mov dword [0x596950], ecx
mov byte [ebp - 4], 0x15
mov dword [0x59697c], edi
mov dword [0x596980], edi
mov dword [ebp - 0x128], 0x596984
mov dword [0x596984], eax
mov dword [0x596988], edi
mov byte [ebp - 4], 0x16
mov ecx, vtable.CFont.0
mov dword [0x596984], ecx
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x128], 0x59698c
mov dword [0x59698c], eax
mov dword [0x596990], edi
mov byte [ebp - 4], 0x18
mov dword [0x59698c], ecx
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x128], 0x596994
mov dword [0x596994], eax
mov dword [0x596998], edi
mov byte [ebp - 4], 0x1a
mov dword [0x596994], ecx
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x128], 0x59699c
mov dword [0x59699c], eax
mov dword [0x5969a0], edi
mov byte [ebp - 4], 0x1c
mov dword [0x59699c], ecx
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x128], 0x5969a4
mov dword [0x5969a4], eax
mov dword [0x5969a8], edi
mov byte [ebp - 4], 0x1e
mov dword [0x5969a4], ecx
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x128], 0x5969ac
mov dword [0x5969ac], eax
mov dword [0x5969b0], edi
mov byte [ebp - 4], 0x20
mov dword [0x5969ac], ecx
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x128], 0x5969b4
mov dword [0x5969b4], eax
mov dword [0x5969b8], edi
mov byte [ebp - 4], 0x22
mov dword [0x5969b4], ecx
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x128], 0x5969bc
mov dword [0x5969bc], eax
mov dword [0x5969c0], edi
mov byte [ebp - 4], 0x24
mov dword [0x5969bc], ecx
mov byte [ebp - 4], 0x25
mov dword [ebp - 0x128], 0x5969c4
mov dword [0x5969c4], eax
mov dword [0x5969c8], edi
mov byte [ebp - 4], 0x26
mov dword [0x5969c4], ecx
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x128], 0x5969cc
mov dword [0x5969cc], eax
mov dword [0x5969d0], edi
mov byte [ebp - 4], 0x28
mov dword [0x5969cc], ecx
mov byte [ebp - 4], 0x29
lea eax, [ebp - 0x124]
push eax
mov dword [0x5969d4], edi
mov dword [0x5969d8], edi
mov dword [0x5969dc], edi
mov dword [0x5969e0], edi
mov dword [ebp - 0x124], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x5969f0], eax
mov eax, dword [ebp - 0x120]
cmp eax, 6
sbb ecx, ecx
inc ecx
mov dword [0x5969e4], ecx
cmp eax, 6
jne 0x4cda74
cmp dword [ebp - 0x11c], esi
jb 0x4cda7a
mov eax, esi
mov dword [0x5969e8], eax
mov dword [0x5969ec], edi
mov dword [0x596a54], esi
mov dword [0x59687c], edi
mov dword [0x596878], edi
mov dword [0x596880], edi
call fcn.004ccbb0
push str.UxTheme.dll
call fcn.00402740
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 4
mov dword [0x596a5c], eax
cmp eax, edi
je 0x4cda81
push 0x54c20c
push eax
call ebx
mov edx, dword [0x596a5c]
push 0x54c228
push edx
mov dword [0x596a64], eax
call ebx
mov dword [0x596a68], eax
mov eax, dword [0x596a5c]
push str.BufferedPaintInit
push eax
call ebx
mov ecx, dword [0x596a5c]
push str.BufferedPaintUnInit
push ecx
mov dword [0x596a6c], eax
call ebx
mov edx, dword [0x596a5c]
push 0x54c260
push edx
mov dword [0x596a70], eax
call ebx
mov dword [0x596a74], eax
mov eax, dword [0x596a5c]
push 0x54c274
push eax
call ebx
mov dword [0x596a78], eax
jmp 0x4cdaa5
ja 0x4cd9c2
xor eax, eax
jmp 0x4cd9c4
mov dword [0x596a64], edi
mov dword [0x596a68], edi
mov dword [0x596a6c], edi
mov dword [0x596a70], edi
mov dword [0x596a74], edi
mov dword [0x596a78], edi
mov esi, 0x54c288
call fcn.00401a30
mov dword [0x596a60], eax
cmp eax, edi
je 0x4cdaed
push 0x54c2a0
push eax
call ebx
mov ecx, dword [0x596a60]
push 0x54c2c0
push ecx
mov dword [0x596a7c], eax
call ebx
mov edx, dword [0x596a60]
push 0x54c2d4
push edx
mov dword [0x596a80], eax
call ebx
mov dword [0x596a84], eax
jmp 0x4cdaff
mov dword [0x596a7c], edi
mov dword [0x596a80], edi
mov dword [0x596a84], edi
mov dword [0x596958], edi
mov dword [0x59695c], edi
mov dword [0x596960], edi
mov dword [0x596964], edi
mov dword [0x596970], edi
mov dword [0x596974], edi
mov dword [0x596978], edi
mov dword [0x596968], edi
mov dword [0x59696c], edi
mov dword [0x596870], edi
mov dword [0x596874], edi
call fcn.004cd0b0
call fcn.004cc700
mov eax, 4
mov dword [0x596a20], eax
mov dword [0x596a2c], eax
mov ecx, 1
or eax, 0xffffffff
mov dword [0x596a08], edi
mov dword [0x596a58], edi
mov dword [0x596a24], 3
mov dword [0x596a28], 0xe
mov dword [0x596a30], 0x32
mov dword [0x596a34], eax
mov dword [0x5969f4], edi
mov dword [0x5969f8], edi
mov dword [0x5969fc], ecx
mov dword [0x596a88], edi
mov dword [0x596a90], edi
mov dword [0x596a94], edi
mov dword [0x596a8c], ecx
mov dword [0x596a0c], ecx
mov dword [ebp - 4], eax
mov eax, 0x596870
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045463b
mov esp, ebp
pop ebp
ret