Function at 0x414e17
Capabilities:
Check for debugger via api

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.GDI32.dll_GetObjectW]
xor esi, esi
push esi
push 0x6f0ffd5e
push esi
mov ebx, edx
call edi
push esi
push 0x3894b7ff
push esi
call edi
push esi
push 0xf4f0b08a
push esi
call edi
push esi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
call esi
push 0
push 0
call esi
push 0
push 0
call esi
xor esi, esi
push esi
push 0x5e831614
push esi
call edi
mov edi, dword [sym.imp.ole32.dll_CoDecodeProxy]
push esi
push 1
push 0xbd01abd1
push 0x284f23d7
call edi
push esi
mov esi, dword [sym.imp.USER32.dll_DestroyWindow]
call esi
push 0
push 0x930105ae
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x12
push 0x283212d
push 0x6ca97f31
call edi
push 0
push 0xfffffffffffffff8
push 0x29b0cf17
push 0x277f79d0
call edi
push 0
push 0x414fd20c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xf1c4400
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x15323a43
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 1
push 0x119b1595
push 0x9bd16cdd
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 1
push 0x50ebc262
push 0x1dbc6aed
call edi
push 0
push 0x17
push 0x6a60a82
push 0xc8676fb0
call edi
push 0
push 0xe
push 0xba939cbd
push 0x1401a63d
call edi
push 0
push 0x2d05e0b3
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x1e0c7e6d
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xe716c17d
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xb0b6a5c0
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call esi
push 0
push 6
push 0x30f40cfc
push 0x3ced115e
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xd
push 0x4c41401a
push 0x702a603f
call edi
push 0
push 5
push 0xc95e2c6f
push 0x84b67139
call edi
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call esi
push 0
push 0x9998b92c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xf9a79385
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0x208
push 0x40
call dword [0x41c048]
push 0
push 0
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xf0a0241f
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x9f8d051a
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call esi
push 0
push 0x1d37c3fc
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 8
push 0x7af618b8
push 0xde32898c
call edi
push 0
call esi
push 0
call esi
push 0
push 0xff48749f
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xdddd332e
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x865442de
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xf3a25e8
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x13829761
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call esi
push 0
call esi
push 0
push 0xfafa703f
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x12
push 0xa6700257
push 0xd8532d85
call edi
push 0
push 5
push 0x970511a0
push 0xb2a3bb12
call edi
push 0
push 0xd4691cec
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call esi
push 0
push 0xf019fe5d
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x78758127
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x43e61cb9
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x8887ac4c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x2981acf3
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x221f4b3f
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xfc637374
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
push 0x1d190694
push 0x47c6e996
call edi
push 0
push 0xb592f167
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x287cac43
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x90c38614
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xae600de1
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xf
push 0x5c3419e0
push 0x44ea5d1b
call edi
push 0
push 0xad175e92
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x6770284
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x2775db6b
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x4f4a72ff
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call esi
push 0
push 0x229734af
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call esi
push 0
push 0x631677b0
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x9d4f1cad
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xcedfffbe
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call esi
push 0
push 0xffffffffffffffef
push 0xdab1900a
push 0x7e5ceb49
call edi
push 0
push 0x5b7e1946
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x6fba30df
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call esi
push 0
call esi
push 0
push 0xa09fd635
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call esi
push 0
push 0x1865bd99
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xffffffffffffffec
push 0xdb04bcc9
push 0x2dcc1fd8
call edi
push 0
push 6
push 0x163e9edd
push 0xd1a5ec63
call edi
mov edi, dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call edi
push 0
call esi
push 0
push 0
call edi
push 0
push 0
call edi
push 0
push 0x70e2f4f9
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call esi
push 0
push 0
call edi
mov edi, dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x682b69c1
push 0
call edi
push 0
push 0x32f9c5fc
push 0
call edi
push 0
push 0x1283e20
push 0
call edi
lea ecx, [ebp - 4]
call fcn.0040ed61
push 0
mov edi, eax
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xcdd9a0d0
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xffffffffffffffee
push 0xe6339836
push 0xb40d2b34
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0x29510e75
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 4
push 0xa88faaa2
push 0x7e7c53f8
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0x82fd121d
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xd637fcbd
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x204cdbfb
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x6698cb5e
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x3d251b6c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x25642b02
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xf8915836
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x575f48e6
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xa21e4ec1
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call esi
push 0
push 0xe
push 0xc60ae51e
push 0xe69f926a
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x5b47d40c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x3d11fe2d
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call esi
xor esi, esi
push esi
push 0xdd0f55ca
push esi
call dword [sym.imp.GDI32.dll_GetObjectW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push esi
mov esi, dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0xa
push 0x60b4e115
push 0x56a0c5e3
call esi
push 0
push 0xfffffffffffffff4
push 0x4c487d13
push 0xc6cbd6de
call esi
mov esi, dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xeeb7885b
push 0
call esi
push 0
push 0x3ec596c5
push 0
call esi
push 0
push 0x67e19cdd
push 0
call esi
push 0
push 0x5681358e
push 0
call esi
push 0
push 0xeff7869f
push 0
call esi
push 0x208
push 0x40
call dword [0x41c048]
push 0
push 0xceb839dd
push 0
mov esi, eax
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xdba442c4
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x50b13826
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x4acd0160
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xfffffffffffffff2
push 0xbe04e705
push 0xc510cbd2
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0xd8da18f3
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
push 0x6858eb0b
push 0xd590a0df
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0x27665fa0
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xc0180505
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 4
push 0xa250bfee
push 0x11d7d785
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x9a5c4c50
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x7f80f22d
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x5846d31e
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xf9f54a29
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xd869dd35
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 2
push 0x85a816e4
push 0x19a981cd
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0x39588ccf
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xf2c3fa2a
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x30747fa8
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xe
push 0x40cefe36
push 0x537b907f
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0xcd9adca6
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x5ce5844
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xa48591b8
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xfffffffffffffff1
push 0x5dbf0be6
push 0xb92e5aa5
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0xb012a5fe
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x8fa9ddac
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x3ee9bfe3
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x14
push 0xfae3ede
push 0xede91a8e
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0xc
pop edx
mov ecx, esi
call fcn.0040ce41
push 0
push 0
push 0xd45c16a6
push 0x50cae9d1
mov esi, eax
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0x66e3b01e
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xabd628f7
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xc71871e1
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xa1414176
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x2b2240
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xe
push 0x3ef2d22f
push 0x6a3faa5b
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xc
push 0x91d38a57
push 0x707b615d
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x9a65fde9
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x78db835b
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x382cfa14
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xa291d780
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xab65d0ff
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x94313599
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xa71ebb6c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x7b676839
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xdc7a4a4e
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x77c51518
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x8c501cac
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x29d88b19
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xf4c7c20a
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x7aafbd4e
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x7bcc3d06
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xf1266b69
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xd374e6d1
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x4b393153
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x94aa6e98
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
mov edx, dword [0x41c290]
mov ecx, dword [ebp - 4]
call fcn.00412dc2
push 0
push 0
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x355aa92
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xfffffffffffffff5
push 0x199376e0
push 0x9c220911
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0x2a1e61c4
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xffffffffffffffeb
push 0xb3d541aa
push 0xf951e04f
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0xddad787e
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x383e092f
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x4376d38d
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x8da6e029
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xc1b95aeb
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xef0fbb92
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x57eca1e4
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x6a5e3722
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xbd50fb6b
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xeef83ec9
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x50d09153
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xd1347185
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x434e5f4b
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x3b88a43d
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x106c1aa5
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xd
push 0x6eae0306
push 0x606eb3e5
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0xf21f0530
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xc3d4bb38
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x44901858
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xda8ee12a
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x9048649c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x103e4688
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [ebp - 4]
mov edx, esi
call fcn.00412dc2
push 0
mov dword [ebp - 4], eax
push 0x86f456d4
mov esi, dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call esi
push 0
push 0xa8646557
push 0
call esi
push 0
push 0x7da4dce5
push 0
call esi
push 0
push 0x15b1b462
push 0
call esi
mov esi, dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call esi
push 0
push 0xa
push 0x9fe3754a
push 0x268d7e91
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0x40c72e6e
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xab20566a
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xabeff4d1
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x2f753f6
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x6c9b0e7f
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xe8927ce2
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xb592ffb7
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xe88cb999
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call esi
push 0
push 0x882c19d8
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xffffffffffffffff
push 0x6f1ea783
push 0x967ad48c
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0xb
push 0x2222546c
push 0x3963b28
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0xfffffffffffffff4
push 0xe0a3abdd
push 0xa690d389
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0xa0900d28
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x4cbbe7f6
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x77b206b6
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call esi
push 0
push 0x1ede1bdd
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call esi
push 0
push 0x11
push 0x439d33e6
push 0xf429d3f0
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0x34b7f53
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xb8c847b0
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x8133363c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call esi
push 0
push 0xd688fd01
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push dword [ebp - 4]
push dword [ebx]
call dword [0x41c138]
push 0
push 2
push 0xfc88adb3
mov dword [ebx], eax
mov ebx, dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0x5dc00bfe
call ebx
push 0
push 0xd376fae3
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xc9d9026c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xf85cea4b
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x650eaa41
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x135d6de9
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x351a0083
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x1f32bce3
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call esi
push 0
call esi
push 0
push 0x35a4a6c9
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xfffffffffffffff1
push 0xd3746f6e
push 0xc020c723
call ebx
push 0
push 0xd2b49fb7
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xf161dbee
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x5f3551a
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xddddcb82
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 9
push 0x6b7df33
push 0xfd15e67a
call ebx
push 0
call esi
push 0
call esi
push 0
push 0x5b289310
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xa9fd17b9
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xd1e0c9f0
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xbeaa3200
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xd12d5abc
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call esi
push 0
call esi
push 0
call esi
push 0
push 0
push 0x5ba757f1
push 0x7525e06f
call ebx
push 0
push 0x89960a66
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x5d2973b0
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x5b0b7fa1
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push dword [ebp - 4]
call dword [0x41c0c4]
push 0
call esi
push 0
push 0x1587db1b
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x890edd10
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xfffffffffffffffe
push 0xf59eac57
push 0xdc11338b
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 5
push 0x9be13e50
push 0x96291fe1
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x36cb87eb
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x764884dd
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 5
push 0x752dbb3f
push 0xca8854dd
call ebx
push 0
push 0x859d0d10
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xb593c8ba
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x79487ede
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call esi
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xbf2f41b0
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call esi
xor esi, esi
push esi
push 0x15
push 0xbdbe5608
push 0x7aac48f
call ebx
push esi
push 0x2b9d2e6a
push esi
call dword [sym.imp.GDI32.dll_GetObjectW]
push esi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
call esi
push 0
push 0x15
push 0xa38d27fa
push 0x18c55e65
call ebx
push 0
push 0xe1219239
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x43a05854
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x27338a2c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xfffffffffffffff1
push 0x6a63510c
push 0x5cb0d98
call ebx
push 0
push 0xe037f2bb
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x67149c6c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x2617f907
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x276c3560
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xf921b00c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call esi
push 0
push 0xc15017de
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call esi
push 0
push 0xd
push 0x5061d06b
push 0xd1a31b2b
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret