Function at 0x4114a0
Capabilities:
Check for debugger via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
call edi
push ebx
push ebx
call edi
mov esi, dword [sym.imp.GDI32.dll_GetObjectW]
push ebx
push 0xcbc0de64
push ebx
call esi
push ebx
push 0xcd4da172
push ebx
call esi
push ebx
mov ebx, dword [sym.imp.USER32.dll_DestroyWindow]
call ebx
push 0
push 0x2bc8a08e
push 0
call esi
push 0
push 0
call edi
xor edi, edi
push edi
call ebx
push edi
call ebx
push edi
mov edi, dword [sym.imp.ole32.dll_CoDecodeProxy]
push 1
push 0x8849532f
push 0x93c12fa
call edi
push 0
call ebx
push 0
push 0x68063be0
push 0
call esi
push 0
push 0xb836a32b
push 0
call esi
push 0
push 0xfffffffffffffff5
push 0x44cae146
push 0xf67229ee
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xffffffffffffffee
push 0xe38249b5
push 0xe053a5de
call edi
push 0
push 0xdc6e3da
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0xdfc23025
push 0
call esi
push 0
push 0x37d5d4d3
push 0
call esi
push 0
push 0xc32e172d
push 0
call esi
push 0
push 0x8ecf45f4
push 0
call esi
push 0
push 0x9e5fc3d1
push 0
call esi
push 0
push 0xaa69b08f
push 0
call esi
push 0
push 9
push 0x4bd52ec4
push 0xb4dc9958
call edi
push 0
push 0x73febd17
push 0
call esi
push 0
push 0xf8c39608
push 0
call esi
push 0
push 0xe
push 0xe6da9338
push 0xf2725540
call edi
push 0
push 0x40ce92b
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0x5ca43697
push 0
call esi
push 0
call ebx
push 0
push 0xeed57b30
push 0
call esi
push dword [ebp - 8]
call dword [0x41c088]
lea eax, [eax*2 + 0x80]
push eax
push 0x40
call dword [0x41c048]
push 0
push 0
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x563b6400
push 0
call esi
push 0
push 0xab7fb66c
push 0
call esi
push 0
push 0x76204067
push 0
call esi
push 0
push 0x110efd15
push 0
call esi
push 0
push 0x641421c1
push 0
call esi
push 0
call ebx
push 0
push 0x14874c92
push 0
call esi
push 0
push 0x4c029a76
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x41c5dbef
push 0
call esi
push 0
push 0x231c0c36
push 0
call esi
push 0
push 0x21594005
push 0
call esi
push 0
push 0x90457246
push 0
call esi
push 0
push 0x13
push 0xe70bad98
push 0x50cf4ab7
call edi
push 0
push 8
push 0x28432823
push 0x282f1411
call edi
push 0
push 0xd7ddbafe
push 0
call esi
push 0
push 0x4ef8336b
push 0
call esi
push 0
push 0x291415c4
push 0
call esi
push 0
push 0xbf3be59f
push 0
call esi
push 0
push 0xb
push 0x638975ad
push 0x18076b4
call edi
push 0
push 0x925a2559
push 0
call esi
push 0
push 0x699225ea
push 0
call esi
push 0
push 0xb
push 0x49b6250a
push 0x905bf38
call edi
push 0
push 0x8715459
push 0
call esi
push 0
push 0xc1aa9fd6
push 0
call esi
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xf2eabf7d
push 0
call esi
push 0
push 0x698a9022
push 0
call esi
push 0
push 1
push 0x904d2408
push 0xe1a22498
call edi
push 0
call ebx
push 0
push 0x11
push 0xe80cceda
push 0x31d971f0
call edi
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp + 0xc]
jge 0x4117f1
mov edx, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp - 8]
mov ax, word [ebx + ecx*2]
inc ecx
mov word [edx], ax
lea edx, [edx + 2]
cmp ecx, edi
jl 0x4117d6
mov edi, dword [sym.imp.ole32.dll_CoDecodeProxy]
mov ebx, dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0x70c17bbb
push 0
call esi
push 0
push 0x92a8f013
push 0
call esi
push 0
push 0xd5078eca
push 0
call esi
push 0
push 0x809348c6
push 0
call esi
push 0
push 0x4c563c6b
push 0
call esi
push 0
push 0x2821da41
push 0
call esi
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x69640bd6
push 0
call esi
push 0
push 0xff8c0f95
push 0
call esi
push 0
push 0xdab8842e
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xcd3df6e6
push 0
call esi
push 0
call ebx
push 0
push 0x85256ebc
push 0
call esi
push 0
push 7
push 0xbf8380fa
push 0x575dc71a
call edi
push 0
push 0x68ef0cc1
push 0
call esi
push 0
push 0x33e3d599
push 0
call esi
push 0
push 0x9b3d92cb
push 0
call esi
push 0
push 0x4512d663
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x768dde5d
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xe0b185a3
push 0
call esi
push 0
push 0xb6974caa
push 0
call esi
push 0
push 0
push 0xc9941a28
push 0x6a81a950
call edi
push 0
call ebx
push 0
push 0x3c07f795
push 0
call esi
push 0
call ebx
push 0
call ebx
push 0
push 3
push 0x9eaa86ad
push 0x49513f2b
call edi
push 0
push 0x380b59be
push 0
call esi
push 0
push 0xec199ed6
push 0
call esi
push 0
push 0xc75f7b6e
push 0
call esi
push 0
push 0x28262e26
push 0
call esi
push 0
push 0x8bbfefdd
push 0
call esi
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, dword [ebp + 0xc]
push eax
mov word [eax + ecx*2 + 2], dx
mov eax, dword [ebp - 0xc]
push dword [eax]
call dword [0x41c138]
mov ecx, dword [ebp - 0xc]
push 0
push 0xffffffffffffffef
push 0xd0206ac0
push 0x61208e3c
mov dword [ecx], eax
call edi
push 0
push 0xb9f24740
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x29a1f532
push 0
call esi
push 0
call ebx
push 0
push 0x97ca1a8a
push 0
call esi
push 0
push 0xc93913c5
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x3b1dee49
push 0
call esi
push 0
call ebx
push 0
call ebx
push 0
push 0xfffffffffffffff4
push 0xab850a3
push 0xba3cdc44
call edi
push 0
push 1
push 0x1fe56918
push 0x7c930e7b
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x5b4bee0
push 0
call esi
push 0
push 0x64898459
push 0
call esi
push 0
push 0x54b5e65a
push 0
call esi
push 0
push 0x5cf9b651
push 0
call esi
push 0
push 9
push 0x795d95ce
push 0x5cb79a17
call edi
push 0
push 0x40fe30c5
push 0
call esi
push 0
push 0x16
push 0x6b7177c1
push 0xa01db08f
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x8346590d
push 0
call esi
push 0
call ebx
push 0
push 0xa774bf21
push 0
call esi
push 0
push 0xdfb899cb
push 0
call esi
push 0
push 5
push 0x458886e1
push 0x565706bb
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xe
push 0x49cfabbf
push 0x266c616f
call edi
push 0
push 8
push 0xacb19fa2
push 0x7d2457db
call edi
push 0
call ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x411b18
push eax
call dword [0x41c0c4]
push 0
call ebx
push 0
push 0x92c9045b
push 0
call esi
push 0
push 0xfffffffffffffff1
push 0x36298d4a
push 0x7c0c31e8
call edi
push 0
push 0x5869ce14
push 0
call esi
push 0
call ebx
push 0
push 0x9cb6eadb
push 0
call esi
push 0
push 0x973d7f82
push 0
call esi
push 0
push 5
push 0x9eb80ac7
push 0x722bf517
call edi
push 0
push 1
push 0xe0572112
push 0x51a677dc
call edi
push 0
push 0xf
push 0x7c63f127
push 0xd5c8fc6
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xa64f4757
push 0
call esi
push 0
push 0xc
push 0x7e52537e
push 0x5f0f924c
call edi
push 0
call ebx
push 0
push 0x66bb45d2
push 0
call esi
push 0
call ebx
push 0
push 0xffffffffffffffee
push 0x6bf18434
push 0xc353bd4e
call edi
push 0
call ebx
push 0
push 0xf125218
push 0
call esi
push 0
push 0x604479c1
push 0
call esi
push 0
push 0x3e741cf
push 0
call esi
push 0
push 0xc05db3f5
push 0
call esi
push 0
push 0x6d86e451
push 0
call esi
push 0
call ebx
xor ebx, ebx
push ebx
push 0x80475e61
push ebx
call esi
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
call ebx
push 0
push 0x6c0e9f81
push 0
call esi
push 0
push 0x62881115
push 0
call esi
push 0
push 0xd4b2b0c5
push 0
call esi
push 0
push 0x6a897ef0
push 0
call esi
push 0
push 0xf
push 0x642f96f3
push 0x2e4fa0d
call edi
xor edi, edi
push edi
push 0xca3f01d
push edi
call esi
push edi
push edi
call ebx
push edi
push 0x2a0f9905
push edi
call esi
push edi
push 0x31fc7811
push edi
call esi
push edi
push 0xb19a62b4
push edi
call esi
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret