Function at 0x40f842
Capabilities:
Check for debugger via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [sym.imp.GDI32.dll_GetObjectW]
push edi
push 0
push 0xa5971d9c
push 0
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
call esi
xor ebx, ebx
push ebx
push 0xe202a8a6
push ebx
call esi
push ebx
push 0x4998a34e
push ebx
call esi
push ebx
push 0xd47029a5
push ebx
call esi
push ebx
push 0xa08c5ed5
push ebx
call esi
push ebx
push 0x32e49758
push ebx
call esi
mov edi, dword [sym.imp.ole32.dll_CoDecodeProxy]
push ebx
push 0xfffffffffffffff7
push 0xc47fb74a
push 0xd38403d1
call edi
push ebx
push 0x8c962fda
push ebx
call esi
push ebx
mov ebx, dword [sym.imp.USER32.dll_DestroyWindow]
call ebx
push 0
push 0x33399b12
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xf84c5a29
push 0
call esi
push 0
push 0xfffffffffffffffc
push 0xe25b96f8
push 0xda0f8fa7
call edi
push 0
call ebx
push 0
call ebx
push 0
push 0xc9ff89aa
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x1465b2c2
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xc103fe27
push 0
call esi
push 0
call ebx
push 0
push 0xfffffffffffffffc
push 0x616462d9
push 0x3b0cc0b1
call edi
push 0
push 0x5c4d71cb
push 0
call esi
push 0
push 0xf18ad55c
push 0
call esi
push 0
call ebx
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x58f75ecb
push 0
call esi
push 0
push 0x14
push 0xeb90727f
push 0x5e166ae5
call edi
push 0
call ebx
push 0
push 0xa
push 0x2a9fb481
push 0x8b7112a7
call edi
push 0
push 0xfffffffffffffffa
push 0x11897aba
push 0x3ac11f12
call edi
push 0
push 0xeb507788
push 0
call esi
push 0
push 0x7ceeb282
push 0
call esi
push 0
push 0xd4135932
push 0
call esi
push 0
push 0x4de80cf5
push 0
call esi
mov eax, dword [0x41c1b0]
push 0
push 0xa
push 0x7178768a
push 0xf152e8ee
mov dword [ebp - 0x1c], eax
call edi
push 0
push 0x429639c3
push 0
call esi
push 0
push 0xa3fd28bd
push 0
call esi
push 0
push 0xfffffffffffffff8
push 0x46f76350
push 0x19a31674
call edi
push 0
call ebx
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0xb64b8dfc
push 0
call esi
push 0
call ebx
push 0
push 7
push 0x66be24
push 0x895306c
call edi
push 0
push 0xffffffffffffffef
push 0x30f899d6
push 0x25e52304
call edi
push 0
call ebx
push 0
push 5
push 0x992ee2c8
push 0xeb0c2336
call edi
push 0
push 0xf7dd3711
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
call ebx
push 0
push 0xe
push 0xf20d184a
push 0x61bd4926
call edi
push 0
push 0x7187f5a1
push 0
call esi
push 0
push 0xc9913186
push 0
call esi
push 0
push 0x7c498df8
push 0
call esi
push 0
push 0x6c543cf1
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xcd93e1e6
push 0
call esi
push 0
push 0xf1a15d25
push 0
call esi
push 0
push 0xbde1e509
push 0
call esi
push 0
push 0x99424318
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x74e8dd30
push 0
call esi
push 0
push 0xc4411dc7
push 0
call esi
push 0
push 0x319ca50b
push 0
call esi
push 0
push 0xd6b02b57
push 0
call esi
push dword [ebp - 0x18]
call dword [0x41c088]
lea eax, [eax*2 + 0x100]
push eax
push 0x40
call dword [0x41c048]
push 0
mov dword [ebp - 8], eax
call ebx
push 0
push 0x296eef2
push 0
call esi
push 0
push 0x79d1235
push 0
call esi
push 0
push 0xffffffffffffffe9
push 0x8445b054
push 0x44f3386f
call edi
push 0
push 7
push 0xb3276ee9
push 0x5f273d53
call edi
push 0
call ebx
push 0
push 0xffffffffffffffec
push 0xb0dfcbc3
push 0x31f968dd
call edi
push 0
push 0x5c95295b
push 0
call esi
push 0
call ebx
push 0
push 0xa94c387a
push 0
call esi
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x3cce5f63
push 0
call esi
push 0
push 5
push 0x3557e00c
push 0x17142685
call edi
push 0
push 0xf7ab8adf
push 0
call esi
push 0
push 0xfffffffffffffffc
push 0x9310538c
push 0x1e98ca22
call edi
push 0
push 0xd
push 0xeda7bf80
push 0x3e776db3
call edi
push 0
push 0xfffffffffffffff1
push 0xc9971b94
push 0xe3361c23
call edi
push 0
push 0x11
push 0x5c837478
push 0xfd3030bc
call edi
push 0
push 0x54b0b451
push 0
call esi
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 2
pop eax
push eax
push 0x2419a975
push 0x68e71ce8
call edi
push 0
push 0x8429f522
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x55839f45
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xdb6988d9
push 0
call esi
push 0
push 0xfd0e8259
push 0
call esi
push 0
push 0x32e7f7b0
push 0
call esi
push 0
push 0x16d3cc12
push 0
call esi
push 0
push 0xfecef470
push 0
call esi
push 0
push 0xb
push 0xb873cfce
push 0x3422b249
call edi
push 0
push 0x298593b0
push 0
call esi
push 0
call ebx
push 0
call ebx
mov ecx, dword [ebp - 0x18]
xor eax, eax
push 2
pop edx
push 0
cmp word [ecx], 0x5c
push 0
cmove eax, edx
add eax, ecx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x36a49241
push 0
call esi
push 0
push 0x34ea7e2d
push 0
call esi
push 0
push 0x12e4fa51
push 0
call esi
push 0
push 0xfffffffffffffffa
push 0x1c34c8aa
push 0xe34e72ca
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0xb4298b33
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x12
push 0x8b647f1c
push 0x9f7d03f5
call edi
push 0
push 0x5d850b64
push 0
call esi
push 0
push 0x703ff5d5
push 0
call esi
push 0
push 0x8b3794da
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x14
push 0x84d0ddf1
push 0xc4761a6f
call edi
push 0
push 0x7abcbf61
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0xffffffffffffffff
push 0x11f75a2f
push 0xebbddd9b
call edi
push 0
push 0x9367c470
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
call ebx
push 0
push 0x16
push 0xaf65b544
push 0x8ed7025e
call edi
push 0
push 0x3c56a3d9
push 0
call esi
push 0
push 0xe44bb209
push 0
call esi
push 0
call ebx
push 0
push 0xf0b05981
push 0
call esi
push 0
push 8
push 0x5af5e645
push 0xb9d61cba
call edi
push 0
call ebx
push 0
push 0x6e79f6e2
push 0
call esi
push 0
push 0xe2e3896a
push 0
call esi
push 0
push 0x65c481b2
push 0
call esi
push 0
push 0xadaf3623
push 0
call esi
push 0
push 7
push 0xf968f375
push 0xc40fc41e
call edi
push 0
call ebx
jmp 0x41115e
push 0
push 0xbf416d41
push 0
call esi
push 0
push 0x279f329d
push 0
call esi
push 0
push 0x979901c5
push 0
call esi
push 0
push 0x872f4d22
push 0
call esi
push 0
push 0x3c8e0d7
push 0
call esi
push 0
push 0x92fc0867
push 0
call esi
push 0
push 0x325fd80b
push 0
call esi
push 0
push 0
push 0x5ec3da6a
push 0x5f005b1f
call edi
push 0
push 0x6586df13
push 0
call esi
push 0
push 0xb5e23008
push 0
call esi
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xd42904b4
push 0
call esi
push 0
push 0x8f0be5f
push 0
call esi
push 0
push 0xffffffffffffffea
push 0xb1a55a33
push 0x8c6fd98b
call edi
push 0
push 0xb
push 0x3df177b6
push 0x43ab0706
call edi
push 0
call ebx
push 0
push 0xb
push 0x5a615f4
push 0xabcc3928
call edi
push 0
push 0x6cca42b7
push 0
call esi
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x87f48987
push 0
call esi
push 0
push 0x35b0fde6
push 0
call esi
push 0
push 0xcfb4a66b
push 0
call esi
push 0
push 0xca3e5c97
push 0
call esi
push 0
push 3
push 0xffe346af
push 0xfe495cf8
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xaa7ea37d
push 0
call esi
push 0
push 0xe
push 0x303c7764
push 0x9f322e38
call edi
push 0
push 0x6a4ed234
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x8c67d2f8
push 0
call esi
push 0
call ebx
push 0
push 0xe899c34
push 0
call esi
push 0
call ebx
push 0
push 2
pop eax
push eax
push 0xfd30f5f1
push 0x8b30ce97
call edi
push dword [ebp - 0x18]
call dword [0x41c088]
lea eax, [eax*2 + 0x100]
push eax
push 0x40
call dword [0x41c048]
push 0
push 0xbbd88c6a
push 0
mov dword [ebp - 0x10], eax
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xbf42d6ef
push 0
call esi
push 0
push 0xaa892a48
push 0
call esi
push 0
push 0x10
push 0xa6a3f3ab
push 0x9bd98e66
call edi
push 0
push 8
push 0xb9de8264
push 0xeed3a82d
call edi
push 0
push 0xf566dbfe
push 0
call esi
push 0
push 0x12
push 0x585ecef5
push 0xc50bf6ed
call edi
push 0
push 2
pop eax
push eax
push 0x78dcaa36
push 0x1db8cfd3
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 1
push 0x48ee547e
push 0xcaa9a055
call edi
push 0
push 6
push 0x640d3de8
push 0x9b2b42ed
call edi
push 0
push 0x13
push 0x377c6167
push 0xb105f1ec
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xffffffffffffffee
push 0xe96d19b7
push 0x574c2a7f
call edi
push 0
push 0xf4e3efb7
push 0
call esi
push 0
call ebx
push 0
push 0xd
push 0x81b1db8f
push 0x2c38e243
call edi
push 0
push 0x50cc4ec9
push 0
call esi
push 0
push 0xd641bae3
push 0
call esi
push 0
push 0xcf7fed47
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xe672b981
push 0
call esi
push 0
push 0x7ea444c6
push 0
call esi
push 0
call ebx
push 0
push 0x7a90b13d
push 0
call esi
push 0
push 3
push 0x40090fc
push 0x442e7a2e
call edi
push 0
push 0x96540b41
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x10
push 0xae1bb7c5
push 0x7243c275
call edi
push 0
push 0x85162f9e
push 0
call esi
push 0
push 0xb38bcda8
push 0
call esi
push 0
push 0xec334fed
push 0
call esi
push 0
call ebx
push 0
push 0xa
push 0x58b5b5ed
push 0xc475fff6
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x8ec2cc44
push 0
call esi
push 0
push 0x7fd790e5
push 0
call esi
push 0
push 0x557c7f66
push 0
call esi
push 0
push 0x19aadab6
push 0
call esi
push 0
push 0xabb146af
push 0
call esi
push 0
push 0x5bcffb62
push 0
call esi
push 0
push 0xacca8e48
push 0
call esi
push 0
push 0xdab478cc
push 0
call esi
push 0
push 0x5a5a60d4
push 0
call esi
push 0
push 0x8491de10
push 0
call esi
push 0
push 0x8f6c740f
push 0
call esi
push 0
push 0x13
push 0x6e4e2545
push 0x7073017b
call edi
push 0
push 0xc14ed91c
push 0
call esi
push 0
call ebx
push 0
push 0x9411fdd4
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x314f447b
push 0
call esi
push 0
push 0xf
push 0xf2ea95ad
push 0x89e02027
call edi
push 0
push 0x6ff95572
push 0
call esi
push 0
call ebx
push 0
push 0xa0094366
push 0
call esi
push 0
push 0x85abb6ea
push 0
call esi
push 0
push 0x12
push 0x43fec46c
push 0x9a2b64a5
call edi
push 0
push 0x202a4f13
push 0
call esi
push 0
push 0xa632434
push 0
call esi
push 0
push 0xe1e65463
push 0
call esi
push 0
push 0x1ad832b4
push 0
call esi
push 0
push 0xcf711a27
push 0
call esi
push 0
push 0x1cd2c312
push 0
call esi
push 0
push 0x2ea9595f
push 0
call esi
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xe23dce87
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push dword [0x41c290]
push dword [ebp - 4]
call dword [0x41c184]
push 0
push 0
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x76c045ef
push 0
call esi
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x3ba1afc2
push 0
call esi
push 0
push 0x35659c16
push 0
call esi
push 0
call ebx
push 0
push 0xfffffffffffffff9
push 0x33ee89c8
push 0x56b9f0bc
call edi
push 0
push 0xb
push 0x7bf88e7
push 0x5768a712
call edi
push 0
push 0xb8a8da77
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x75e75ccd
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x920a4dfa
push 0
call esi
push 0
push 0xaddfd4a7
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x69e3bc2e
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x26fe89bc
push 0
call esi
push 0
push 0xf6c6d8b7
push 0
call esi
push 0
push 0x5e159236
push 0
call esi
push 0
push 0xfb6c2aa1
push 0
call esi
push 0
call ebx
push 0
push 0xbbe10f48
push 0
call esi
push 0
push 0x1e81e158
push 0
call esi
push 0
push 0x50f519ad
push 0
call esi
push 0
push 0x6191974
push 0
call esi
push 0
push 0xffffffffffffffeb
push 0xde0c4f2d
push 0x8210ff9a
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 5
push 0x4e9540e8
push 0xd5fb4efa
call edi
push 0
push 0x5285f28f
push 0
call esi
push 0
call ebx
push 0
push 0x237c2a12
push 0
call esi
push 0
call ebx
cmp dword [ebp - 0xc], 0
je 0x4109a0
push 0
call ebx
push 0
push 0x65dc2d59
push 0
call esi
push 0
push 0x6eab154a
push 0
call esi
push 0
call ebx
push 0
push 0x17
push 0x1c07f148
push 0xd0460ae2
call edi
push 0
push 0xe090b67d
push 0
call esi
push 0
call ebx
push 0
push 0x5ceaefc1
push 0
call esi
push 0
push 0xfffffffffffffffb
push 0x17687199
push 0x3013e3f6
call edi
push 0
push 0xf7a6aceb
push 0
call esi
push 0
push 0x81ebbe28
push 0
call esi
push 0
call ebx
push 0
push 0xcc8a25c8
push 0
call esi
push 0
push 0xc51206eb
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x13201153
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x13
push 0xb6f59c06
push 0x4bf1df85
call edi
push 0
push 0xc9b0f034
push 0
call esi
push 0
push 0x95b3473f
push 0
call esi
push 0
call ebx
push 0
push 0xbd1c44
push 0
call esi
push 0
push 0xd136ecb0
push 0
call esi
push 0
push 0x1ea3e0d1
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x88975f11
push 0
call esi
push 0
push 0x16
push 0x54e9d359
push 0xc0b367e2
call edi
push 0
push 0x3343d2af
push 0
call esi
push 0
push 0x10
push 0x22f037b6
push 0x4a331a17
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x91e2c6bb
push 0
call esi
push 0
push 0xfffffffffffffff7
push 0x7f81c482
push 0xf28da1e4
call edi
push 0
push 0x7a732082
push 0
call esi
push 0
push 0xd93d9cd9
push 0
call esi
push 0
push 0x5f3ced79
push 0
call esi
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 4]
push 0
push 0x464f5a44
sar eax, 1
push 0
mov dword [ebp - 0xc], eax
call esi
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xbf7da7e6
push 0
call esi
push 0
push 0x649740df
push 0
call esi
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x1e3bedb2
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x21a198bb
push 0
call esi
push 0
push 0x2ebc796d
push 0
call esi
push 0
push 0xf0b34125
push 0
call esi
push 0
call ebx
push 0
push 0xd
push 0x4d5d3bbf
push 0xf3b20516
call edi
push 0
push 0xea1765d6
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xaded57a4
push 0
call esi
push 0
push 0xaeca26ba
push 0
call esi
push 0
push 0x701c5d3e
push 0
call esi
push 0
push 0x10
push 0x2e42c82b
push 0x84f623e
call edi
push 0
push 0xcad5091d
push 0
call esi
push 0
push 0x4b459844
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0xae3f1a1
push 0
call esi
push 0
push 0x752f30e4
push 0
call esi
push 0
push 0x412b0746
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x87fb6807
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x586cae4d
push 0
call esi
push 0
push 0xfffffffffffffff3
push 0x7b1ed369
push 0x3c6490c7
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x9e243c5c
push 0
call esi
push dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x10]
push 0
call fcn.004114a0
pop ecx
pop ecx
test eax, eax
je 0x41098c
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
call fcn.00412dc2
mov edx, dword [ebp - 0x10]
mov ecx, eax
call fcn.00412dc2
push 0
mov dword [ebp - 8], eax
call ebx
push 0
push 0x2c374f5b
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xfabf1ebe
push 0
call esi
push 0
push 0x7c74cf98
push 0
call esi
push 0
push 0xe1b49c4f
push 0
call esi
push 0
push 0x39b94bef
push 0
call esi
push 0
push 0xf89a2491
push 0
call esi
push 0
push 0x11
push 0xba37401
push 0xc8b29071
call edi
push 0
push 0xe5e2b603
push 0
call esi
push 0
push 0x135b506f
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x640f6c7e
push 0
call esi
push 0
push 0xeb9bef46
push 0
call esi
push 0
push 0xef3781bb
push 0
call esi
push 0
push 0x97dc5765
push 0
call esi
push 0
push 0x3f91bd8a
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xb07b4c97
push 0
call esi
push 0
push 0x944363de
push 0
call esi
push 0
push 0x43e20219
push 0
call esi
push 0
push 0xf486c5b2
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xb6e2a9ff
push 0
call esi
push 0
push 0xa59264ff
push 0
call esi
push 0
push 0xfffffffffffffff0
push 0xc18c23d7
push 0xe654323c
call edi
push 0
push 0x440801fd
push 0
call esi
push 0
push 0x10bccfde
push 0
call esi
push 0
push 0xffffffffffffffec
push 0x14e3a9e1
push 0xae64ee
call edi
push 0
push 0xb95aa835
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x81971b11
push 0
call esi
push 0
push 0xce6692fc
push 0
call esi
push 0
call ebx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
lea eax, [eax + ecx*2]
add eax, 2
mov dword [ebp - 4], eax
jmp 0x410e49
cmp dword [ebp + 8], 0
je 0x410b22
push 0
push 0xbe974c8d
push 0
call esi
push 0
call ebx
push 0
push 0x97b346c7
push 0
call esi
push 0
push 0x7c9aae45
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0xe6a31103
push 0
call esi
push 0
push 0x537e1d5f
push 0
call esi
push 0
push 0xfef574c0
push 0
call esi
push 0
call ebx
push 0
push 0
push 0x35212d00
push 0xf9394411
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x884c3321
push 0
call esi
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0xffffffffffffffec
push 0x478dbe52
push 0x2af54eb8
call edi
push 0
push 0x9a161938
push 0
call esi
push 0
push 0xffffffffffffffec
push 0x76b43426
push 0x92776b45
call edi
push 0
push 0xd09544b7
push 0
call esi
push 0
call ebx
push 0
push 0x13
push 0x1f66d1e0
push 0xb4ad57f6
call edi
push 0
push 0x7007ffb6
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 2
pop eax
push eax
push 0x9ff18ba1
push 0xf9b30378
call edi
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
push 0xd78230d6
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0xce4d4ba0
push 0
call esi
push 0
push 0xdde79981
push 0
call esi
push 0
push 0xcda92ebe
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x4139ef74
push 0
call esi
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
call fcn.00412dc2
mov edx, dword [ebp + 8]
mov ecx, eax
call fcn.00412dc2
mov dword [ebp - 8], eax
jmp 0x410e34
push dword [ebp - 4]
call dword [0x41c088]
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x10]
push eax
push 0
call fcn.004114a0
pop ecx
pop ecx
test eax, eax
je 0x410e31
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x20b59ad9
push 0
call esi
push 0
push 4
push 0x6d392a0c
push 0x6f9b59f1
call edi
push 0
push 0x88033d
push 0
call esi
push 0
push 0xfffffffffffffffc
push 0xd422dc23
push 0x266f3cba
call edi
push 0
call ebx
push 0
call ebx
push 0
push 0xffffffffffffffed
push 0x98c54c7a
push 0x4ccbcf6
call edi
push 0
push 0xf0394988
push 0
call esi
push 0
push 0x6892a68c
push 0
call esi
push 0
push 0xfffffffffffffff0
push 0x9ae2720d
push 0x860ea381
call edi
push 0
push 0xfffffffffffffff1
push 0x50403f03
push 0x21f3acf7
call edi
push 0
call ebx
push 0
push 4
push 0xeff43044
push 0x385b8db5
call edi
push 0
call ebx
push 0
push 0x360f52ca
push 0
call esi
push 0
push 0x1aa52160
push 0
call esi
push 0
push 0x155b833c
push 0
call esi
push 0
call ebx
push 0
call ebx
push 0
push 0x26224597
push 0
call esi
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
push 0x65c70134
push 0
call esi
push 0
push 0x3a193710
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
call ebx
push 0
push 0xe
push 0x66551854
push 0x6e6ee771
call edi
push 0
push 5
push 0x8e5243c6
push 0x894356a9
call edi
push 0
push 0xeacf085f
push 0
call esi
push 0
push 0xa
push 0x56e6ec21
push 0xd9ff734f
call edi
push 0
push 0xf9282713
push 0
call esi
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
call fcn.00412dc2
mov edx, dword [ebp - 0x10]
mov ecx, eax
call fcn.00412dc2
push 0
push 0xf8d80127
push 0
mov dword [ebp - 8], eax
call esi
push 0
push 0x25e5b4e7
push 0
call esi
push 0
call ebx
push 0
push 0xf
push 0xb23fefab
push 0xac3891bd
call edi
push 0
push 0x160a3e91
push 0
call esi
push 0
push 0x90353489
push 0
call esi
push 0
push 0xa6057876
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xd07edf19
push 0
call esi
push 0
push 0xe1f699c7
push 0
call esi
push 0
push 0x5a0cb4de
push 0
call esi
push 0
call ebx
push 0
call ebx
push 0
push 0x8014804f
push 0
call esi
push 0
call ebx
push 0
push 0xbaad017c
push 0
call esi
push 0
push 0x5ee1ad3e
push 0
call esi
push 0
call ebx
push 0
push 0xe10b719d
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xc60e17d2
push 0
call esi
push 0
push 0xa
push 0x191a41f3
push 0xeeb1f2b1
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xfffffffffffffff9
push 0x1ea1c0d6
push 0xa8e841a0
call edi
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0xd93d1b38
push 0
call esi
push 0
push 4
push 0x4aff7629
push 0x3b4ceef2
call edi
push 0
push 0xa42df84a
push 0
call esi
push 0
push 0xfffffffffffffffd
push 0xf292e00b
push 0x455d8d72
call edi
push 0
push 0x55ffab61
push 0
call esi
push 0
push 0x25ffa151
push 0
call esi
push 0
push 0xfffffffffffffff6
push 0x56620531
push 0xadec8536
call edi
push 0
push 0x740f4665
push 0
call esi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
push dword [eax]
call dword [0x41c138]
mov ecx, dword [ebp - 0x14]
and dword [ebp - 4], 0
mov dword [ecx], eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0x84e2f1f6
push 0
call esi
push 0
push 0x16
push 0xbdd43724
push 0x3cc36ef8
call edi
push 0
push 0x24fd1925
push 0
call esi
push 0
push 0x8712fae1
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0xbbebb244
push 0
call esi
push 0
push 0xb9f6dfbc
push 0
call esi
push 0
call ebx
push 0
push 0xfa7e4e9d
push 0
call esi
push 0
push 0x9c38a6af
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x9b84e6b1
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xac78f3a0
push 0
call esi
push 0
push 0xae88ba38
push 0
call esi
push 0
push 0x18728fc0
push 0
call esi
push 0
push 0xc5a5b858
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x9894b897
push 0
call esi
push 0
push 0xc8f5df5e
push 0
call esi
push 0
push 0x55c040bc
push 0
call esi
push 0
push 0xb
push 0x34f71210
push 0xf3b4a6a4
call edi
push 0
push 0x868f816
push 0
call esi
push 0
push 0xf4374cab
push 0
call esi
push 0
push 0xee3dbedd
push 0
call esi
push 0
push 0x564f41ba
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xfffffffffffffff3
push 0x1e987af6
push 0xcc486a56
call edi
push 0
push 0x17
push 0xa43652b
push 0x74926543
call edi
push dword [ebp - 0x10]
call dword [0x41c0c4]
push 0
push 0xf5e044f1
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xa573bf21
push 0
call esi
push 0
push 0xb
push 0x2c919719
push 0x506329d6
call edi
push 0
push 0x4a95dbd0
push 0
call esi
push 0
push 0x233e7759
push 0
call esi
push 0
push 0x85b332e5
push 0
call esi
push 0
push 0xf229fb78
push 0
call esi
push 0
push 7
push 0xc62d169c
push 0xe39cb5df
call edi
push 0
push 0x63a5d97b
push 0
call esi
push 0
push 0
push 0x4d82542d
push 0xfd31a195
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x38e71aac
push 0
call esi
push 0
push 0x1f3ca184
push 0
call esi
push 0
call ebx
push 0
push 0x5a6253fe
push 0
call esi
push 0
push 0x117f1541
push 0
call esi
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xfb9216c0
push 0
call esi
push 0
push 0x6d629166
push 0
call esi
push 0
push 0x4cf411b3
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xdbceb613
push 0
call esi
push 0
push 0x7cd1b8e9
push 0
call esi
push 0
push 0xffffffffffffffea
push 0x74e0d8b6
push 0x7f93dda5
call edi
push 0
push 0xd40b5637
push 0
call esi
push 0
push 3
push 0x52e007e9
push 0x85c244d9
call edi
push 0
push 0x9525fcbf
push 0
call esi
push 0
push 0x84aacdcc
push 0
call esi
push 0
push 0x7434517
push 0
call esi
push 0
push 0x100fd876
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x17f5d09e
push 0
call esi
push 0
push 0x5e5a8078
push 0
call esi
cmp dword [ebp - 4], 0
jne 0x40fe78
mov eax, dword [ebp - 0x14]
push dword [ebp - 8]
push dword [eax]
call dword [0x41c138]
mov ecx, dword [ebp - 0x14]
push 0
push 0x4ee944b5
push 0
mov dword [ecx], eax
call esi
push 0
push 0x62c5d2cf
push 0
call esi
push 0
push 0x4226e684
push 0
call esi
push 0
push 0x1a60aad9
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xa
push 0xee21213c
push 0x853cb4b6
call edi
push 0
push 0xacb230fe
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x1ba95cfd
push 0
call esi
push 0
push 5
push 0xa5e66c52
push 0x8cec8e7c
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x2eb104c3
push 0
call esi
push 0
push 0x17c4c1e4
push 0
call esi
push 0
push 0x16b9067f
push 0
call esi
push 0
call ebx
push 0
push 5
push 0xf2003be7
push 0x1066cddd
call edi
push 0
push 0x9df51af0
push 0
call esi
push 0
call ebx
push 0
push 0x5644eb1d
push 0
call esi
push 0
push 0x5eb0fe21
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x601f124b
push 0
call esi
push 0
push 0xffffffffffffffed
push 0x9ad20a5a
push 0x8e8f0a35
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x6d430e14
push 0
call esi
push 0
push 0xa
push 0xf25afc15
push 0x628c2395
call edi
push 0
push 0xe6fbf03d
push 0
call esi
push 0
push 0xd
push 0x9720a11e
push 0x38b8555c
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x42d845c3
push 0
call esi
push 0
push 7
push 0xc3d19e49
push 0x44758180
call edi
push 0
push 0xcff75d83
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xed413dbd
push 0
call esi
push 0
push 0x607c8348
push 0
call esi
push dword [ebp - 8]
call dword [0x41c0c4]
push 0
call ebx
push 0
call ebx
push 0
push 0xcf7ffc31
push 0
call esi
push 0
push 0x2b7495a9
push 0
call esi
push 0
call ebx
push 0
call ebx
push 0
push 4
push 0xde4c474d
push 0x88f72cdc
call edi
push 0
push 0xfffffffffffffffd
push 0xc5679726
push 0x31eac81f
call edi
push 0
call ebx
push 0
push 0x5494a121
push 0
call esi
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x4a3d90c0
push 0
call esi
push 0
push 0xd76b0e9f
push 0
call esi
push 0
call ebx
push 0
push 0x26349c03
push 0
call esi
push 0
push 8
push 0x15c31034
push 0x33c79f03
call edi
push 0
push 0x1286edd0
push 0
call esi
push 0
push 0x17
push 0x253aa744
push 0x7851a0cf
call edi
push 0
push 0xfffffffffffffff3
push 0x3cb8932e
push 0x82d8d21f
call edi
push 0
call ebx
push 0
push 0x94bf145c
push 0
call esi
push 0
push 0x3b70e14c
push 0
call esi
push 0
push 0xfffffffffffffff7
push 0xf7adfcb6
push 0xd062cdbf
call edi
push 0
push 0xffffffffffffffff
push 0xc931df1
push 0x3959db7
call edi
push 0
push 0x7de46071
push 0
call esi
push 0
push 0x3117883b
push 0
call esi
push 0
push 0x1ad40179
push 0
call esi
push 0
push 0x882ff30f
push 0
call esi
push 0
push 0xe62e9051
push 0
call esi
push 0
push 0xdf094705
push 0
call esi
push 0
push 0xd78faf58
push 0
call esi
push 0
push 0xfffffffffffffff2
push 0xa22636b9
push 0x8566060
call edi
push 0
push 0x5ef1ae1a
push 0
call esi
push 0
push 0x69fab56
push 0
call esi
push 0
push 0x8f68be75
push 0
call esi
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret