Function at 0x41673a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
push ebp
push 0x4169ce
push dword fs:[0]
mov dword fs:[0], esp
lea ebx, [0]
add ebx, dword [ebp + 8]
add ebx, dword [ebx + 0x3c]
and eax, 0
push eax
push 0x37dc25dd
rol dword [esp], 0x16
call sub.gdi32.dll_GetStockObject
pop eax
push eax
push dword [ebx + 0x50]
push eax
push 0x8000040
push eax
push 0x99e45875
xor dword [esp], 0x661ba78a
mov eax, dword [0x418010]
call eax
test eax, eax
je 0x416a31
mov dword [ebp - 4], 0
xor dword [ebp - 4], eax
and eax, 0
push eax
push 0x2db1ab1b
xor dword [esp], 0x2d85da0a
push 0x38700000
rol dword [esp], 0xe
call sub.gdi32.dll_GetNearestColor
pop eax
push eax
push eax
push eax
push 0xf001f
push dword [ebp - 4]
imul eax, eax, 0
or eax, dword [0x418014]
call eax
cmp eax, 0
je 0x416a0b
mov dword [ebp - 8], 0
xor dword [ebp - 8], eax
cld
push 0
pop esi
xor esi, dword [ebp + 8]
push 0
pop edi
add edi, dword [ebp - 8]
shr ecx, 0x1f
shr ecx, 1
or ecx, dword [ebx + 0x54]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
movzx edx, word [ebx + 6]
mov eax, ebx
add eax, 0xf8
push dword [eax + 0x10]
pop ecx
mov esi, dword [eax + 0x14]
push dword [eax + 0xc]
pop edi
add esi, dword [ebp + 8]
add edi, dword [ebp - 8]
rep movsb byte es:[edi], byte [esi]
add eax, 0x28
dec edx
jne 0x416818
cmp dword [ebx + 0xa0], 0
je 0x41689d
imul eax, eax, 0
xor eax, dword [ebx + 0xa0]
add eax, dword [ebp - 8]
sub ecx, ecx
add ecx, dword [ebx + 0xa4]
cmp ecx, 0
je 0x41689d
sub ecx, dword [eax + 4]
push ecx
push dword [ebp + 0xc]
pop edx
sub edx, dword [ebx + 0x34]
push edx
push eax
pop edx
add edx, 8
push edx
lea edx, [0]
xor edx, dword [eax + 4]
sub edx, 8
shr edx, 1
push edx
xor edx, edx
xor edx, dword [eax]
add edx, dword [ebp - 8]
push edx
push eax
push 0x32f200
ror dword [esp], 8
call sub.gdi32.dll_GetBkMode
pop eax
shr eax, 0x1f
shr eax, 1
add eax, dword [0x418028]
call eax
pop ecx
test eax, eax
jne 0x41684e
cmp dword [ebx + 0x80], 0
je 0x416968
mov edi, dword [ebx + 0x80]
add edi, dword [ebp - 8]
cmp dword [edi + 0x10], 0
je 0x416968
and eax, 0
add eax, dword [edi + 0xc]
add eax, dword [ebp - 8]
push eax
push 0xc987f5ef
sub dword [esp], 0xc9877aa4
call sub.gdi32.dll_PathToRegion
pop eax
push eax
push 0
pop eax
xor eax, dword [0x418018]
call eax
or eax, eax
je 0x4169d6
mov dword [ebp - 0x4c], eax
push edi
push 0
pop eax
add eax, dword [edi]
test eax, eax
je 0x41690b
shr esi, 0x1f
shr esi, 1
add esi, dword [edi]
jo 0x416910
jmp 0x416910
xor esi, esi
add esi, dword [edi + 0x10]
add esi, dword [ebp - 8]
mov edi, dword [edi + 0x10]
add edi, dword [ebp - 8]
cmp dword [edi], 0
je 0x41695f
lodsd eax, dword [esi]
test eax, 0x80000000
jne 0x416933
add eax, dword [ebp - 8]
add eax, 1
add eax, 1
je 0x416938
jmp 0x416938
and eax, 0x7fffffff
push eax
push 0x91794697
rol dword [esp], 0x1a
push 0xd7400004
ror dword [esp], 0x14
call sub.gdi32.dll_SetStretchBltMode
pop eax
push eax
push dword [ebp - 0x4c]
mov eax, dword [0x41801c]
call eax
stosd dword es:[edi], eax
jmp 0x416919
pop edi
add edi, 0x14
jmp 0x4168b3
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov edi, dword [edi + 0x14]
mov esi, dword [ebp + 0xc]
mov eax, dword [edi + 0x10]
or eax, eax
je 0x4169b5
cmp esi, eax
je 0x416987
mov edi, dword [edi]
jmp 0x416978
push dword [ebx + 0x28]
pop eax
test eax, eax
je 0x416992
add eax, dword [ebp + 0xc]
push eax
pop dword [edi + 0x14]
mov eax, dword [ebx + 0x50]
mov dword [edi + 0x18], eax
push dword [ebp - 8]
pop ebx
add ebx, dword [ebx + 0x3c]
shr eax, 0x1f
shr eax, 1
xor eax, dword [ebp + 0xc]
mov dword [ebx + 0x34], 0
add dword [ebx + 0x34], eax
push eax
call sub.gdi32.dll_GdiGetBatchLimit
pop eax
push dword [ebp - 8]
and eax, 0
xor eax, dword [0x418020]
call eax
jg 0x416a31
jle 0x416a31
mov esp, dword [esp + 8]
mov ebp, dword [esp + 8]
push eax
push 0xfd4122c6
rol dword [esp], 0xa
push 0x4d377335
xor dword [esp], 0x16bf475d
push 0x80001ca7
rol dword [esp], 2
call sub.gdi32.dll_OffsetRgn
pop eax
push dword [ebp - 8]
shl eax, 0x1f
shl eax, 1
add eax, dword [0x418020]
call eax
push eax
push 0xc0000191
ror dword [esp], 0x1a
call sub.gdi32.dll_SaveDC
pop eax
push dword [ebp - 4]
shl eax, 0x1f
shl eax, 1
add eax, dword [0x418024]
call eax
and eax, 0
mov dword [ebp - 4], eax
push eax
push 0
push 0xa57a9d1
sub dword [esp], 0xd37dc7b6
push 0x5173fd9a
xor dword [esp], 0x577dab6f
push 0x4849ef4
xor dword [esp], 0x6929ee96
push 0xeafb4eb
sub dword [esp], 0x5e24278
push 0x1b39800
ror dword [esp], 0xa
push 0xedffbdd5
sub dword [esp], 0x903a6e72
push 0x2976efcb
rol dword [esp], 8
push 0x3c9b96f0
sub dword [esp], 0xd05872c0
push 0x411ad716
ror dword [esp], 0xc
push 0xc3800007
rol dword [esp], 0xc
call sub.msimg32.dll_AlphaBlend
pop eax
push 0x8000
push 0
push dword [ebp + 8]
push 0
pop eax
add eax, dword [0x41800c]
call eax
pop dword fs:[0]
add esp, 8
lea eax, [0]
or eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8