Function at 0x70cd14
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x70cd1c
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add edi, 0xfffffff8
xor eax, eax
push ebp
push 0x70d0e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi]
mov eax, dword [eax + 0xc]
mov edx, 0x70d100
call fcn.0042ea8c
mov eax, dword [edi]
mov eax, dword [eax + 0xc]
mov edx, 9
call fcn.0042eb04
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
fld qword [eax + 0x30]
call fcn.00402cd4
mov edx, eax
mov eax, dword [edi]
mov eax, dword [eax + 0xc]
call fcn.0070cb38
mov ebx, eax
push ebx
mov eax, dword [edi]
call fcn.0042fce8
push eax
call sub.gdi32.dll_SelectObject
mov esi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x38]
mov eax, dword [edi]
mov eax, dword [eax + 0x14]
call fcn.0042f058
push 1
mov eax, dword [edi]
call fcn.0042fce8
push eax
call sub.gdi32.dll_SetBkMode
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov al, byte [eax + 0x60]
sub al, 0xd
je 0x70cdd2
dec al
je 0x70ce4d
dec al
je 0x70cf0f
dec eax
sub al, 2
jb 0x70d000
jmp 0x70d07c
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x58]
mov ecx, 4
mov edx, 1
call fcn.004054a4
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x1e
mov edx, 3
mov eax, 3
call fcn.0070cb74
pop ecx
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x58]
mov ecx, 4
mov edx, 5
call fcn.004054a4
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
sub ecx, 4
mov edx, 0x23
mov eax, 0x23
call fcn.0070cb74
pop ecx
jmp 0x70d0b9
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x58]
cmp byte [eax], 0x30
je 0x70ce94
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x58]
mov ecx, 1
mov edx, 1
call fcn.004054a4
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 0xfffffffe
mov edx, 0xfffffff8
mov eax, 0xfffffff8
call fcn.0070cb74
pop ecx
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x58]
mov ecx, 6
mov edx, 2
call fcn.004054a4
mov eax, dword [ebp - 0x10]
push eax
mov ecx, 0x2c
mov edx, 3
mov eax, 3
call fcn.0070cb74
pop ecx
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x58]
mov ecx, 6
mov edx, 8
call fcn.004054a4
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
sub ecx, 4
mov edx, 0x31
mov eax, 0x31
call fcn.0070cb74
pop ecx
jmp 0x70d0b9
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x58]
mov ecx, 1
mov edx, 1
call fcn.004054a4
mov eax, dword [ebp - 0x18]
push eax
mov ecx, 0xfffffffe
mov edx, 0xfffffff8
mov eax, 0xfffffff8
call fcn.0070cb74
pop ecx
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x58]
mov ecx, 5
mov edx, 2
call fcn.004054a4
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, 0x2c
mov edx, 0xa
mov eax, 0xa
call fcn.0070cb74
pop ecx
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x58]
mov ecx, 5
mov edx, 7
call fcn.004054a4
mov eax, dword [ebp - 0x20]
push eax
mov ecx, 0x53
mov edx, 0x31
mov eax, 0x31
call fcn.0070cb74
pop ecx
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x58]
mov ecx, 1
mov edx, 0xc
call fcn.004054a4
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
add ecx, 8
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x14]
inc edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
inc eax
call fcn.0070cb74
pop ecx
jmp 0x70d0b9
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x58]
mov ecx, 6
mov edx, 1
call fcn.004054a4
mov eax, dword [ebp - 0x28]
push eax
mov ecx, 0x2c
mov edx, 3
mov eax, 3
call fcn.0070cb74
pop ecx
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x58]
mov ecx, 1
mov edx, 7
call fcn.004054a4
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
add ecx, 8
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x14]
inc edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
inc eax
call fcn.0070cb74
pop ecx
jmp 0x70d0b9
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x58]
mov eax, dword [edi]
call fcn.0042fb24
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x58]
push edx
mov edx, dword [ebp + 8]
mov ecx, dword [edx - 0x14]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 0x14]
sub edx, eax
sar edx, 1
jns 0x70d0af
adc edx, 0
mov eax, edx
xor edx, edx
call fcn.0070cb74
pop ecx
push esi
mov eax, dword [edi]
call fcn.0042fce8
push eax
call sub.gdi32.dll_SelectObject
push ebx
call sub.gdi32.dll_DeleteObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x70d0ef
lea eax, [ebp - 0x2c]
mov edx, 0xb
call fcn.00404f98
ret