Function at 0x430e70
Capabilities:
Extract resource via kernel32 functions
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
push ebx
push esi
push edi
mov dword [ebp - 0x108], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x430e96
mov eax, dword [eax]
cmp eax, 0x708
je 0x430e9d
xor eax, eax
jmp 0x431cbe
mov edx, dword [ebp + 8]
mov ecx, 0x708
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov edx, dword [ebp + 8]
mov dword [edx], 0x708
mov eax, dword [0x6a8c84]
test eax, eax
jne 0x43173b
mov edx, dword [ebp + 8]
mov dword [edx + 4], 1
push 5
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [ebp + 8]
mov dword [edx + 0x33c], eax
push 5
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [ebp + 8]
mov dword [edx + 0x340], eax
mov edx, dword [ebp + 8]
mov dword [edx + 0x344], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x354], 0xc
mov dword [eax + 0x350], 0xc
mov dword [eax + 0x34c], 0xc
mov dword [eax + 0x348], 0xc
mov edx, dword [ebp + 8]
mov dword [edx + 0x36c], 6
mov edx, dword [ebp + 8]
mov dword [edx + 0x370], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x374], 4
mov edx, dword [ebp + 8]
mov dword [edx + 0x378], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x37c], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x380], 4
mov edx, dword [ebp + 8]
mov dword [edx + 0x384], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x388], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x38c], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x390], 4
mov edx, dword [ebp + 8]
mov dword [edx + 0x394], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x398], 0
push 0x12
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [ebp + 8]
mov dword [edx + 0x39c], eax
push 0x1a
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [ebp + 8]
mov dword [edx + 0x3a0], eax
mov eax, dword [ebp + 8]
lea edi, [eax + 0x3a4]
lea esi, [eax + 0x36c]
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
lea edx, [ebp - 0x158]
push edx
push eax
call fcn.004360f0
test eax, eax
je 0x431044
mov eax, dword [ebp + 8]
lea ecx, [eax + 0x3dc]
lea edx, [ebp - 0x13c]
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x431028
pop eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x158]
mov dword [edx + 0x4e0], eax
jmp 0x43106d
mov eax, dword [ebp + 8]
lea ecx, [eax + 0x3dc]
mov edx, str.Arial
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x431055
pop eax
mov edx, dword [ebp + 8]
mov dword [edx + 0x4e0], 0xfffffff3
mov edx, dword [ebp + 8]
mov dword [edx + 0x4e4], 0xf
push 0x12
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [ebp + 8]
mov dword [edx + 0x4f4], eax
push 0x12
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [ebp + 8]
mov dword [edx + 0x4f8], eax
mov edx, dword [ebp + 8]
mov dword [edx + 0x4fc], 0x21
mov edx, dword [ebp + 8]
mov dword [edx + 0x500], 0x2bc
mov edx, dword [ebp + 8]
mov dword [edx + 0x504], 0xa
mov edx, dword [ebp + 8]
mov dword [edx + 0x508], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x50c], 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x510], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x514], 2
mov edx, dword [ebp + 8]
mov dword [edx + 0x518], 2
mov edx, dword [ebp + 8]
mov dword [edx + 0x51c], 2
mov edx, dword [ebp + 8]
mov dword [edx + 0x520], 0
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [ebp + 8]
mov dword [edx + 0x524], eax
mov edx, dword [ebp + 8]
mov dword [edx + 0x4ec], 0xba
mov edx, dword [ebp + 8]
mov dword [edx + 0x4f0], 0x15
push 0x12
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [ebp + 8]
lea ecx, [edx + 0x52c]
push ecx
add edx, 0x528
push edx
push 0xff
push eax
push 0xf0e0d
push 0x6b
mov eax, dword [0x6a8c88]
push eax
call fcn.00435a50
add esp, 0x1c
mov edx, dword [ebp + 8]
mov dword [edx + 0x530], eax
push 0x1a
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
push 0
push 0xff
push eax
push 0xf0e0d
push 0x6c
mov eax, dword [0x6a8c88]
push eax
call fcn.00435a50
add esp, 0x1c
mov edx, dword [ebp + 8]
mov dword [edx + 0x534], eax
push 0x1a
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
push 0
push 0xff
push eax
push 0xf0e0d
push 0x6d
mov eax, dword [0x6a8c88]
push eax
call fcn.00435a50
add esp, 0x1c
mov edx, dword [ebp + 8]
mov dword [edx + 0x538], eax
push 0x12
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
push 0
push 0xff
push eax
push 0xf0e0d
push 0x6e
mov eax, dword [0x6a8c88]
push eax
call fcn.00435a50
add esp, 0x1c
mov edx, dword [ebp + 8]
mov dword [edx + 0x53c], eax
push 0x1a
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
push 0
push 0xff
push eax
push 0xf0e0d
push 0x6f
mov eax, dword [0x6a8c88]
push eax
call fcn.00435a50
add esp, 0x1c
mov edx, dword [ebp + 8]
mov dword [edx + 0x540], eax
push 0x1a
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
push 0
push 0xff
push eax
push 0xf0e0d
push 0x70
mov eax, dword [0x6a8c88]
push eax
call fcn.00435a50
add esp, 0x1c
mov edx, dword [ebp + 8]
mov dword [edx + 0x544], eax
push 5
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [ebp + 8]
mov dword [edx + 0x548], eax
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [ebp + 8]
mov dword [edx + 0x55c], eax
mov edx, dword [ebp + 8]
mov dword [edx + 0x54c], 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x554], 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x550], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x558], 1
mov eax, dword [ebp + 8]
mov dword [eax + 0x568], 0xc
mov dword [eax + 0x560], 0xc
mov eax, dword [ebp + 8]
mov dword [eax + 0x56c], 0xa
mov dword [eax + 0x564], 0xa
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
lea edx, [ebp - 0x158]
push edx
push eax
call fcn.004360f0
test eax, eax
je 0x431341
mov eax, dword [ebp + 8]
lea ecx, [eax + 0x570]
lea edx, [ebp - 0x13c]
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x431325
pop eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x158]
mov dword [edx + 0x674], eax
jmp 0x43136a
mov eax, dword [ebp + 8]
lea ecx, [eax + 0x570]
mov edx, str.Arial
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x431352
pop eax
mov edx, dword [ebp + 8]
mov dword [edx + 0x674], 0xfffffff3
mov edx, dword [ebp + 8]
mov dword [edx + 0x678], 0xf
push 0xe
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [ebp + 8]
mov dword [edx + 0x688], eax
push 0xe
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [ebp + 8]
mov dword [edx + 0x68c], eax
mov edx, dword [ebp + 8]
mov dword [edx + 0x690], 0x21
mov edx, dword [ebp + 8]
mov dword [edx + 0x694], 0x2bc
mov edx, dword [ebp + 8]
mov dword [edx + 0x698], 0xa
mov edx, dword [ebp + 8]
mov dword [edx + 0x69c], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x6a0], 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x6a4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x6a8], 2
mov edx, dword [ebp + 8]
mov dword [edx + 0x6ac], 2
mov edx, dword [ebp + 8]
mov dword [edx + 0x6b0], 2
mov edx, dword [ebp + 8]
mov dword [edx + 0x6b4], 0
push 0xd
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [ebp + 8]
mov dword [edx + 0x6b8], eax
mov edx, dword [ebp + 8]
mov dword [edx + 0x680], 0xba
mov edx, dword [ebp + 8]
mov dword [edx + 0x684], 0x15
push 0xe
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [ebp + 8]
lea ecx, [edx + 0x6c0]
push ecx
add edx, 0x6bc
push edx
push 0xff
push eax
push 0xf0e0d
push 0x6b
mov eax, dword [0x6a8c88]
push eax
call fcn.00435a50
add esp, 0x1c
mov edx, dword [ebp + 8]
mov dword [edx + 0x6c4], eax
push 0xe
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
push 0
push 0xff
push eax
push 0xf0e0d
push 0x6c
mov eax, dword [0x6a8c88]
push eax
call fcn.00435a50
add esp, 0x1c
mov edx, dword [ebp + 8]
mov dword [edx + 0x6c8], eax
push 0xe
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
push 0
push 0xff
push eax
push 0xf0e0d
push 0x6d
mov eax, dword [0x6a8c88]
push eax
call fcn.00435a50
add esp, 0x1c
mov edx, dword [ebp + 8]
mov dword [edx + 0x6cc], eax
push 0xe
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
push 0
push 0xff
push eax
push 0xf0e0d
push 0x6e
mov eax, dword [0x6a8c88]
push eax
call fcn.00435a50
add esp, 0x1c
mov edx, dword [ebp + 8]
mov dword [edx + 0x6d0], eax
push 0xe
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
push 0
push 0xff
push eax
push 0xf0e0d
push 0x6f
mov eax, dword [0x6a8c88]
push eax
call fcn.00435a50
add esp, 0x1c
mov edx, dword [ebp + 8]
mov dword [edx + 0x6d4], eax
push 0xe
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
push 0
push 0xff
push eax
push 0xf0e0d
push 0x70
mov eax, dword [0x6a8c88]
push eax
call fcn.00435a50
add esp, 0x1c
mov edx, dword [ebp + 8]
mov dword [edx + 0x6d8], eax
push 5
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [ebp + 8]
mov dword [edx + 0x6dc], eax
push 0xd
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [ebp + 8]
mov dword [edx + 0x6f4], eax
mov edx, dword [ebp + 8]
mov dword [edx + 0x6e0], 0x44
mov edx, dword [ebp + 8]
mov dword [edx + 0x6e4], 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x6ec], 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x6e8], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x6f0], 1
mov eax, dword [ebp + 8]
mov dword [eax + 0x700], 0xc
mov dword [eax + 0x6f8], 0xc
mov eax, dword [ebp + 8]
mov dword [eax + 0x704], 0xa
mov dword [eax + 0x6fc], 0xa
push 0x12
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [ebp + 8]
lea ecx, [edx + 0x320]
push ecx
add edx, 0x31c
push edx
push 0xff
push eax
push 0xf0e0d
push 0x74
mov eax, dword [0x6a8c88]
push eax
call fcn.00435a50
add esp, 0x1c
mov edx, dword [ebp + 8]
mov dword [edx + 0x324], eax
push 0x1a
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
push 0
push 0xff
push eax
push 0xf0e0d
push 0x75
mov eax, dword [0x6a8c88]
push eax
call fcn.00435a50
add esp, 0x1c
mov edx, dword [ebp + 8]
mov dword [edx + 0x328], eax
push 0x1a
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
push 0
push 0xff
push eax
push 0xf0e0d
push 0x76
mov eax, dword [0x6a8c88]
push eax
call fcn.00435a50
add esp, 0x1c
mov edx, dword [ebp + 8]
mov dword [edx + 0x32c], eax
push 0x12
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
push 0
push 0xff
push eax
push 0xf0e0d
push 0x71
mov eax, dword [0x6a8c88]
push eax
call fcn.00435a50
add esp, 0x1c
mov edx, dword [ebp + 8]
mov dword [edx + 0x330], eax
push 0x1a
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
push 0
push 0xff
push eax
push 0xf0e0d
push 0x72
mov eax, dword [0x6a8c88]
push eax
call fcn.00435a50
add esp, 0x1c
mov edx, dword [ebp + 8]
mov dword [edx + 0x334], eax
push 0x1a
call dword [sym.imp.USER32.dll_GetSysColor]
push 0
push 0
push 0xff
push eax
push 0xf0e0d
push 0x73
mov eax, dword [0x6a8c88]
push eax
call fcn.00435a50
add esp, 0x1c
mov edx, dword [ebp + 8]
mov dword [edx + 0x338], eax
mov eax, 1
jmp 0x431cbe
lea eax, [ebp - 0x108]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionThemeManager
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x431760
mov eax, dword [ebp - 0x108]
test eax, eax
jne 0x431765
jmp 0x430ec5
mov dword [ebp - 0x10c], 0x104
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push str.ThemeActive
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4317a9
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x430ec5
push 0xa
push 0
lea eax, [ebp - 0x104]
push eax
call fcn.0052fb80
add esp, 0xc
test eax, eax
jne 0x4317d2
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x430ec5
mov dword [ebp - 0x10c], 0x104
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push str.DllName
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x431816
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x430ec5
push 0x103
mov eax, dword [ebp + 8]
add eax, 0x10
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea ecx, [ebp - 0x104]
mov eax, dword [ebp + 8]
lea edx, [eax + 0x10]
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x43183e
pop eax
lea eax, [ebp - 0x104]
push eax
call fcn.0052ff00
pop ecx
push str..msstyles
lea eax, [ebp - 0x104]
push eax
call fcn.0052ff40
add esp, 8
test eax, eax
jne 0x431895
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
lea edx, [eax + 0x10]
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
jmp 0x430ec5
mov dword [ebp - 0x10c], 0x104
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebp + 8]
add eax, 0x114
push eax
push 0
push 0
push str.ColorName
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x431908
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
lea edx, [eax + 0x10]
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov eax, dword [ebp + 8]
lea edx, [eax + 0x114]
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
jmp 0x430ec5
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x104]
mov eax, dword [ebp + 8]
lea edx, [eax + 0x10]
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x431924
pop eax
push 0x5c
lea eax, [ebp - 0x104]
push eax
call fcn.0052ffa0
add esp, 8
mov dword [ebp - 0x110], eax
test eax, eax
je 0x4318d6
mov edx, dword [ebp - 0x110]
mov byte [edx], 0
push str._shell_
lea eax, [ebp - 0x104]
push eax
call fcn.0052f8f0
add esp, 8
mov eax, dword [ebp + 8]
add eax, 0x114
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.0052f8f0
add esp, 8
push str._shellstyle.dll
lea eax, [ebp - 0x104]
push eax
call fcn.0052f8f0
add esp, 8
mov eax, dword [ebp + 8]
lea ecx, [eax + 0x218]
lea edx, [ebp - 0x104]
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x4319a9
pop eax
cmp dword [ebp + 0xc], 0
jne 0x4319d3
push 2
push 0
mov eax, dword [ebp + 8]
add eax, 0x218
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov ebx, eax
test eax, eax
jne 0x4319d8
jmp 0x430ec5
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 1
push str.UIFILE
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x11c], eax
test eax, eax
jne 0x431a06
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x430ec5
mov eax, dword [ebp - 0x11c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x114], eax
test eax, eax
jne 0x431a2a
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x430ec5
mov eax, dword [ebp - 0x11c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x160], 0
je 0x431a64
mov eax, dword [ebp - 0x15c]
test eax, eax
jne 0x431a87
mov eax, dword [ebp - 0x15c]
test eax, eax
je 0x431a6e
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x430ec5
mov eax, dword [ebp - 0x160]
push eax
mov eax, dword [ebp - 0x15c]
push eax
call fcn.00431cd0
add esp, 8
mov dword [ebp - 0x118], eax
test eax, eax
jne 0x431ac0
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x430ec5
push ebx
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x118]
push eax
call fcn.004323a0
add esp, 0xc
test eax, eax
jne 0x431c98
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4e8]
test eax, eax
je 0x431af9
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4e8]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x530]
test eax, eax
je 0x431b16
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x530]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x534]
test eax, eax
je 0x431b33
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x534]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x538]
test eax, eax
je 0x431b50
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x538]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x53c]
test eax, eax
je 0x431b6d
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x53c]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x540]
test eax, eax
je 0x431b8a
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x540]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x544]
test eax, eax
je 0x431ba7
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x544]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x67c]
test eax, eax
je 0x431bc4
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x67c]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x6c4]
test eax, eax
je 0x431be1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x6c4]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x6c8]
test eax, eax
je 0x431bfe
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x6c8]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x6cc]
test eax, eax
je 0x431c1b
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x6cc]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x6d0]
test eax, eax
je 0x431c38
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x6d0]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x6d4]
test eax, eax
je 0x431c55
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x6d4]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x6d8]
test eax, eax
je 0x431c72
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x6d8]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x118]
push eax
call fcn.00434030
pop ecx
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x430ec5
mov eax, dword [ebp - 0x118]
push eax
call fcn.00434030
pop ecx
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8