Function at 0x412dc2
Capabilities:
Check for debugger via api

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ole32.dll_CoDecodeProxy]
mov ebx, ecx
push edi
push 0
push 0xffffffffffffffff
push 0xb0bf3328
push 0xa8fcf651
mov edi, edx
mov dword [ebp - 4], ebx
call esi
push 0
push 0x1d91d145
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x5e5e91f7
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x6566ab34
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x12
push 0x87d017d5
push 0xd29e2ce9
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x8c1bad20
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xe6dd91d9
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xb7ea02d8
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xffffffffffffffe9
push 0x7385dc05
push 0xfc91a1d7
call esi
push 0
push 0x2722c0b8
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x69aac1df
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x69d8b887
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xb
push 0x41c44037
push 0xf49df40c
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xf85bec4c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x7ea6dbc
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x3ee21247
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xfd3b9385
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x14
push 0x4101f1fe
push 0x6f1c304c
call esi
mov esi, dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x648e8181
push 0
call esi
push 0
push 0xc0b862f7
push 0
call esi
push ebx
call dword [0x41c088]
push edi
mov esi, eax
call dword [0x41c088]
mov ebx, dword [sym.imp.USER32.dll_DestroyWindow]
sub eax, 0xffffff80
push 0
add esi, eax
call ebx
push 0
push 0xd083ae21
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xfd68a78e
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0x172c52bd
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x10fe4b8
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x1815e74f
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call ebx
push 0
push 0x1cf80449
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x1c203f3d
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call ebx
mov ebx, dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0xb
push 0x3e4c1a6
push 0xfd177180
call ebx
push 0
push 0xad008b2d
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x7d4bd4d2
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xffffffffffffffee
push 0x87dfefe7
push 0xea1f0151
call ebx
push 0
push 0x3a959140
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x9896d9b
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xf
push 0x3e93513c
push 0xa12a5bd9
call ebx
mov ebx, dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xb10c61cb
push 0
call ebx
push 0
push 0x61ee41e5
push 0
call ebx
mov ebx, dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call ebx
push 0
push 0x781f592b
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
mov ebx, dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xb9296802
push 0
call ebx
push 0
push 0x9a2fc0f9
push 0
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call ebx
push 0
push 0xd15c5a46
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call ebx
mov ebx, dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x7f0acb31
push 0
call ebx
push 0
push 0x8e7ce17a
push 0
call ebx
lea eax, [esi + esi]
push eax
push 0x40
call dword [0x41c048]
push dword [ebp - 4]
mov ebx, eax
mov edx, esi
mov ecx, ebx
call fcn.00401c61
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x6cec2f7c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xa3f68cac
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x9ce40156
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xbdc16090
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x12
push 0x95c8a975
push 0x576dd1fe
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 1
push 0xd1c403d7
push 0x84be342
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0xfffffffffffffff3
push 0xf58f7929
push 0x789eac41
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xbb0964be
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x80ba6359
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xfffffffffffffffb
push 0x2c74177d
push 0xcc495310
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0xfffffffffffffff0
push 0xc465b19e
push 0x7ca9a1f7
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0x1d4b6d5d
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xfffffffffffffff8
push 0x6f20dad9
push 0x6fc2b16a
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0x4431dd4d
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x36e808c0
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0xef9ed42
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x1534f4e4
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xd
push 0x4cbb68b4
push 0x160fbcd5
call dword [sym.imp.ole32.dll_CoDecodeProxy]
push 0
push 0x415f776c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push edi
mov edx, esi
mov ecx, ebx
call fcn.00401c8e
mov esi, dword [sym.imp.GDI32.dll_GetObjectW]
xor edi, edi
push edi
push 0x6c3a613c
push edi
call esi
push edi
push 0x22711e07
push edi
call esi
push edi
push 0x7ee10164
push edi
call esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov esi, dword [sym.imp.ole32.dll_CoDecodeProxy]
push edi
push 0xffffffffffffffee
push 0x5a91cbb2
push 0xb83e6225
call esi
push edi
push 7
push 0x5459679c
push 0xb253e43
call esi
push edi
mov edi, dword [sym.imp.USER32.dll_DestroyWindow]
call edi
push 0
push 0xffffffffffffffef
push 0x314d2763
push 0x6c62e870
call esi
push 0
call edi
push 0
push 0x9a7bea0c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call edi
push 0
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xe2732f25
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xedee05d6
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call edi
push 0
push 0xdafe6b01
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x886e67d5
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x9ea83d5d
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x5d018ad4
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x7e57dcef
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x6267dcc1
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xd1aaba7b
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 1
push 0x420d42d0
push 0x5c9bf4c6
call esi
push 0
push 0x584f0e76
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x2b4cf15d
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x34dbbfde
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x36468ac9
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 8
push 0x4326486f
push 0x93efa8aa
call esi
push 0
push 0xffffffffffffffff
push 0x395afa69
push 0xdb760db6
call esi
push 0
push 1
push 0x89d59230
push 0x46857389
call esi
push 0
call edi
push 0
push 0x818f23b6
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xa7ceec01
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push dword [ebp - 4]
call dword [0x41c0d8]
push 0
push 5
push 0xb2c74937
push 0xc6437977
call esi
push 0
push 0x2787228c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xd0369309
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x7e65081a
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x6fd0466
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xffffffffffffffee
push 0x38c03405
push 0x241972ee
call esi
push 0
push 0x33362474
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x2051f354
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x330ad94c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xa00945c0
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x4954e5a1
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xbcd36d7c
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0x9f3bb2fa
push 0
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0
call edi
push 0
push 0xb
push 0x160ab25a
push 0x3133c4a2
call esi
xor esi, esi
push esi
push 0x2dbf5a5f
push esi
call dword [sym.imp.GDI32.dll_GetObjectW]
push esi
call edi
push esi
call edi
push esi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
call esi
mov edi, dword [sym.imp.GDI32.dll_GetObjectW]
push 0
push 0xefb98e5d
push 0
call edi
push 0
push 0xbe4d0310
push 0
call edi
push 0
push 0x4b0c328b
push 0
call edi
push 0
push 0
call esi
push 0
push 0x1bb14518
push 0
call edi
push 0
push 0xa077637a
push 0
call edi
push 0
push 0
call esi
push 0
push 0x2f429ac1
push 0
call edi
push 0
push 0x12417a8
push 0
call edi
push 0
push 0
call esi
push 0
push 0x6d49b0f
push 0
call edi
push 0
push 0xc31ac4b9
push 0
call edi
push 0
push 0
call esi
push 0
push 0xab40ae7f
push 0
call edi
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret