Function at 0x416ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x3c]
push ebx
sub esp, 0x68
mov dword [ebp - 0x3c], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0x461818
mov dword [esp], 1
call sub.dwrite.dll_DWriteCreateFactory
mov ebx, dword [ebp - 0x3c]
sub esp, 0xc
test ebx, ebx
je 0x417350
mov eax, dword [ebx]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [eax + 0xb8]
sub esp, 0xc
mov edi, eax
call fcn.00454c90
mov dword [eax], 0x462615
mov dword [eax + 4], 0x256d
xor eax, eax
test edi, edi
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_container_type__u._n
call fcn.0040ad90
mov eax, dword [ebx]
mov dword [esp + 8], 0
mov dword [esp + 4], 0xdeadbeef
mov dword [esp], ebx
call dword [eax + 0xb8]
sub esp, 0xc
mov edi, eax
call fcn.00454c90
mov dword [eax], 0x462615
mov dword [eax + 4], 0x2570
xor eax, eax
test edi, edi
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_container_type__u._n
call fcn.0040ad90
mov dword [ebp - 0x64], 0xffffffff
lea edx, [ebp - 0x68]
mov dword [ebp - 0x5c], 0xffffffff
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x68], 0x46464f77
mov dword [ebp - 0x60], 0
mov eax, dword [ebx]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x2c
mov dword [esp], ebx
call dword [eax + 0xb8]
sub esp, 0xc
mov edi, eax
call fcn.00454c90
mov dword [eax], 0x462615
mov dword [eax + 4], 0x2576
xor eax, eax
cmp edi, 1
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_container_type__u._n
call fcn.0040ad90
mov dword [ebp - 0x64], 0xffffffff
lea edx, [ebp - 0x68]
mov dword [ebp - 0x60], 0xffffffff
mov dword [ebp - 0x5c], 0xffffffff
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x68], 0x46464f77
mov eax, dword [ebx]
mov dword [esp + 4], edx
mov dword [esp + 8], 4
mov dword [esp], ebx
call dword [eax + 0xb8]
sub esp, 0xc
mov edi, eax
call fcn.00454c90
mov dword [eax], 0x462615
mov dword [eax + 4], 0x257b
xor eax, eax
cmp edi, 1
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_container_type__u._n
call fcn.0040ad90
mov dword [ebp - 0x64], 0xffffffff
lea edx, [ebp - 0x68]
mov dword [ebp - 0x60], 0xffffffff
mov dword [ebp - 0x5c], 0xffffffff
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x68], 0x46464f77
mov eax, dword [ebx]
mov dword [esp + 4], edx
mov dword [esp + 8], 3
mov dword [esp], ebx
call dword [eax + 0xb8]
sub esp, 0xc
mov edi, eax
call fcn.00454c90
mov dword [eax], 0x462615
mov dword [eax + 4], 0x2580
xor eax, eax
test edi, edi
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_container_type__u._n
call fcn.0040ad90
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x3c], 0x32464f77
mov eax, dword [ebx]
mov dword [esp + 4], esi
mov dword [esp + 8], 0x30
mov dword [esp], ebx
call dword [eax + 0xb8]
sub esp, 0xc
mov edi, eax
call fcn.00454c90
mov dword [eax], 0x462615
mov dword [eax + 4], 0x2585
xor eax, eax
cmp edi, 2
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_container_type__u._n
call fcn.0040ad90
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x3c], 0x32464f77
mov eax, dword [ebx]
mov dword [esp + 4], esi
mov dword [esp + 8], 4
mov dword [esp], ebx
call dword [eax + 0xb8]
sub esp, 0xc
mov edi, eax
call fcn.00454c90
mov dword [eax], 0x462615
mov dword [eax + 4], 0x258a
xor eax, eax
cmp edi, 2
sete al
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_container_type__u._n
call fcn.0040ad90
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x3c], 0x32464f77
mov eax, dword [ebx]
mov dword [esp + 4], esi
mov dword [esp + 8], 3
mov dword [esp], ebx
call dword [eax + 0xb8]
sub esp, 0xc
mov esi, eax
call fcn.00454c90
mov dword [eax], 0x462615
mov dword [eax + 4], 0x258f
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.Unexpected_container_type__u._n
call fcn.0040ad90
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 8]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x2568
call fcn.0040a1d0
mov dword [esp], str.AnalyzeContainerType___is_not_supported._n
call fcn.0040ad60
jmp 0x417344