Function at 0x411c96
Capabilities:
Check for debugger via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, ecx
mov dword [ebp - 8], edx
push edi
push eax
mov dword [ebp - 0xc], eax
call dword [0x41c190]
add eax, 0x40
push eax
push 0x40
call dword [0x41c048]
mov ebx, dword [sym.imp.USER32.dll_DestroyWindow]
push 0
mov dword [ebp - 4], eax
call ebx
mov esi, dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xa3e0dbe
push 0
call esi
push 0
push 0xcaf10a0b
push 0
call esi
push 0
push 0x345681ea
push 0
call esi
xor edi, edi
push edi
call ebx
push edi
call ebx
push edi
call ebx
push edi
call ebx
push edi
push 0xda53a5a1
push edi
call esi
push edi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
call edi
push 0
call ebx
push 0
push 0
call edi
push 0
push 0
call edi
push 0
push 0
call edi
mov edi, dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0xffffffffffffffed
push 0x702a8f5f
push 0xb7c8693
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 3
push 0x9f8e6dd8
push 0xb598e814
call edi
push 0
push 0xd12f2cde
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x56dde794
push 0
call esi
push 0
push 0x2cd1b4b6
push 0
call esi
push 0
push 0x8fb13f6b
push 0
call esi
push 0
call ebx
push 0
push 0x54e4799b
push 0
call esi
push 0
push 0xb9a7f827
push 0
call esi
push 0
push 0x60bfb404
push 0
call esi
push 0
push 0x90ea7d3f
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x6c2145b8
push 0
call esi
push 0
push 0xd8e92e8f
push 0
call esi
push 0
push 0x16
push 0x3a5f66fe
push 0xcd635e60
call edi
push 0
push 0x789d1b61
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x80620da4
push 0
call esi
push 0
push 0x47f6e21b
push 0
call esi
push 0
push 0x86e5a575
push 0
call esi
push 0
call ebx
push 0
push 0xd1955a8
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0x6ce96106
push 0
call esi
push 0
push 0x3631a146
push 0
call esi
push 0
push 0x8c377539
push 0
call esi
push 0
push 0x78bfb4f3
push 0
call esi
push 0
push 0xfffffffffffffff6
push 0x64d06f1c
push 0x52f3bb9a
call edi
push 0
push 9
push 0xd8e3c3a2
push 0x31cbc15e
call edi
push 0
push 0xdf02ffda
push 0
call esi
push 0
push 0x668abf55
push 0
call esi
push 0
push 0xd87084ce
push 0
call esi
push 0
push 0x84311a96
push 0
call esi
push 0
push 0x59c204cf
push 0
call esi
push 0
push 0x83ca0c2e
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xdb142028
push 0
call esi
push 0
call ebx
push 0
call ebx
push 0
push 0xb2876cdc
push 0
call esi
push 0
push 0xc6161259
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x22f2844c
push 0
call esi
push 0
push 0x7c33d5f8
push 0
call esi
push 0
push 0xd801ce24
push 0
call esi
push 0
push 0x40b3c4eb
push 0
call esi
push 0
push 0xf4193ee2
push 0
call esi
push 0
push 0xf950d8d3
push 0
call esi
push 0
push 0xbee7bc8d
push 0
call esi
push 0
call ebx
push 0
push 0xef1a6f92
push 0
call esi
push 0
push 0xffffffffffffffed
push 0xfad7c5cb
push 0xa4b3c303
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x565a8f9d
push 0
call esi
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
cmp ecx, eax
jge 0x411fcd
mov ebx, dword [ebp + 0xc]
mov eax, edx
mov esi, dword [ebp - 0xc]
sub eax, ecx
mov edi, eax
mov al, byte [ecx + esi]
mov byte [edi + ecx], al
inc ecx
cmp ecx, ebx
jl 0x411fad
mov esi, dword [sym.imp.GDI32.dll_GetObjectW]
mov edi, dword [sym.imp.ole32.dll_CoDecodeProxy]
mov ebx, dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp + 0xc]
push 0
mov byte [edx + eax + 1], 0
call ebx
push 0
push 0x33b767a4
push 0
call esi
push 0
push 0x32e4a792
push 0
call esi
push 0
push 0x8a5903bb
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xe98cbfce
push 0
call esi
push 0
push 0xbd39c806
push 0
call esi
push 0
push 0xfffffffffffffff6
push 0xd01a0fd0
push 0xc725d94
call edi
push 0
push 0xaf0fff42
push 0
call esi
push 0
call ebx
push 0
push 0x16
push 0xb30efb27
push 0x50607eb2
call edi
push 0
push 0xfffffffffffffffb
push 0xd4c12885
push 0x7076ab20
call edi
push 0
push 0xf8905a4
push 0
call esi
push 0
call ebx
push 0
push 0xa
push 0xb2781f33
push 0xe1b1444e
call edi
push 0
push 0xe072d5e3
push 0
call esi
push 0
push 0xb98951f6
push 0
call esi
push 0
push 0xa6bab9bc
push 0
call esi
push 0
push 0x41fdda1c
push 0
call esi
push 0
push 0x4ca5f75d
push 0
call esi
push 0
push 0x70152fe4
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x492e6fe2
push 0
call esi
push 0
push 0x932e93c0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
call ebx
push 0
push 0xa5e5b8fe
push 0
call esi
push 0
push 0x751e1ac8
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x13
push 0x4450e73c
push 0x89abb624
call edi
push 0
call ebx
push 0
push 0xa51d1e79
push 0
call esi
push 0
push 0x8cabb9de
push 0
call esi
push 0
call ebx
push 0
call ebx
mov eax, dword [ebp - 8]
push dword [ebp - 4]
push dword [eax]
call dword [0x41c050]
mov ecx, dword [ebp - 8]
push 0
mov dword [ecx], eax
call ebx
push 0
call ebx
push 0
push 0xb6b18872
push 0
call esi
push 0
push 0xb5073c54
push 0
call esi
push 0
push 0x8afc113a
push 0
call esi
push 0
call ebx
push 0
push 0xffffffffffffffee
push 0xc7d1fa22
push 0x2179cf38
call edi
push 0
push 0xab3b064d
push 0
call esi
push 0
push 0
push 0xf0573d60
push 0x77ed43c6
call edi
push 0
push 0x773bffe0
push 0
call esi
push 0
push 0x72185988
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x11
push 0x71b90bfd
push 0x950b7c9c
call edi
push 0
push 0x11
push 0x5cb8da14
push 0x12956527
call edi
push 0
push 0xbec7f98
push 0
call esi
push 0
push 0xfffffffffffffff1
push 0x8066e98e
push 0x134da20f
call edi
push 0
call ebx
push 0
push 0xe6af0fdd
push 0
call esi
push 0
call ebx
push 0
push 0x957e53d
push 0
call esi
push 0
call ebx
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x143de072
push 0
call esi
push 0
push 0x516ac206
push 0
call esi
push 0
push 0xf4c49c8c
push 0
call esi
push 0
push 0x62131708
push 0
call esi
push 0
push 0x301d59fb
push 0
call esi
push 0
push 9
push 0x62db3958
push 0x964268c3
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xfcdf9c5f
push 0
call esi
push 0
push 0xd8aedd3
push 0
call esi
push 0
push 0x3cfc9f70
push 0
call esi
push 0
push 0x3df5dbc9
push 0
call esi
push 0
call ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x4122ca
push eax
call dword [0x41c0c4]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xddd5e83f
push 0
call esi
push 0
push 0x831474de
push 0
call esi
push 0
call ebx
push 0
push 2
push 0xb159c326
push 0x25696224
call edi
push 0
push 0x7a660652
push 0
call esi
push 0
push 0xa
push 0x80fbc887
push 0x161bbcb7
call edi
push 0
push 0xfffffffffffffff8
push 0xb0d3089e
push 0x2795f0fd
call edi
push 0
push 0x2767b833
push 0
call esi
push 0
push 0x8013aa9f
push 0
call esi
push 0
push 0xce7c7a08
push 0
call esi
push 0
push 0x26ea1a97
push 0
call esi
push 0
push 0xffffffffffffffff
push 0x78c34876
push 0x849a32ed
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xe
push 0x979b47f3
push 0x5547ff0d
call edi
push 0
push 0x39e72b1
push 0
call esi
push 0
push 0x3692ea5d
push 0
call esi
push 0
push 0x633e563
push 0
call esi
push 0
push 0xe2057345
push 0
call esi
push 0
push 0x625cc71a
push 0
call esi
push 0
call ebx
push 0
push 0x8d4e7091
push 0
call esi
push 0
push 0xe37da4c0
push 0
call esi
push 0
push 0xfef40268
push 0
call esi
push 0
push 9
push 0xc92281ad
push 0x6031bed7
call edi
push 0
push 0x60512bf3
push 0
call esi
push 0
push 0x85a6c87c
push 0
call esi
push 0
call ebx
push 0
push 0xd674fdb1
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xffffffffffffffec
push 0xd4c9cc22
push 0x461ca73c
call edi
push 0
push 0x32b15943
push 0
call esi
push 0
push 0x82f4c55
push 0
call esi
xor esi, esi
push esi
call ebx
push esi
push 0xd
push 0xf761c679
push 0x97ca958c
call edi
push esi
push 0xffffffffffffffeb
push 0xe8d26cd
push 0x5de7684f
call edi
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret