Function at 0x402830
Capabilities:
Access peb ldr_data
Get graphical window text
Get kernel32 base address
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ecx, 0xc
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x48c]
lea edx, [ebp - 0x49e]
push ebx
xor ebx, ebx
mov eax, ebx
sub esp, 0x55c
mov dword [ebp - 0x48e], 0
mov dword [ebp - 0x460], 0
rep stosd dword es:[edi], eax
mov dword [esp], edx
mov dword [ebp - 0x49e], 0x42
mov dword [ebp - 0x48a], 0x104
mov eax, dword [0x40a404]
mov dword [ebp - 0x482], 0xffff0001
mov dword [ebp - 0x49a], eax
mov eax, dword [0x40b5d4]
mov dword [ebp - 0x496], eax
mov eax, dword [0x40b5d8]
mov dword [ebp - 0x492], eax
mov eax, dword [0x40a400]
mov dword [ebp - 0x47c], eax
call sym.unk_153
sub esp, 4
test eax, eax
jne 0x4028d0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x496]
mov dword [esp + 4], 1
mov dword [0x40b5d4], eax
mov eax, dword [ebp - 0x492]
mov dword [0x40b5d8], eax
mov eax, dword [ebp - 0x48e]
mov dword [esp], eax
call sym.unk_159
mov dword [ebp - 0x4f0], 0x14
mov dword [ebp - 0x4ec], 0x40aa8c
sub esp, 8
mov dword [ebp - 0x4e8], 0
mov dword [ebp - 0x4e4], 0
mov dword [ebp - 0x4e0], 0
test byte [ebp - 0x48a], 0x20
je 0x4029aa
mov eax, ebx
mov ecx, 0x14
lea edi, [ebp - 0x3f8]
mov esi, dword [ebp - 0x49a]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x400]
mov dword [ebp - 0x400], 0x58
mov dword [esp], edx
mov dword [ebp - 0x3cc], 0x806
mov dword [ebp - 0x3fc], esi
mov dword [ebp - 0x3e4], str.output.prn
mov dword [ebp - 0x3e0], 0x104
mov dword [ebp - 0x3c4], 0x409104
call sym.unk_111
sub esp, 4
test eax, eax
je 0x4028c0
mov dword [ebp - 0x4e8], str.output.prn
mov eax, dword [0x40a40c]
mov dword [esp], eax
call sym.unk_136
lea ebx, [eax + 1]
sub esp, 4
lea edx, [ebx + ebx]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sym.unk_180
sub esp, 0xc
mov dword [ebp - 0x540], eax
test eax, eax
je 0x403447
mov eax, dword [ebp - 0x540]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [0x40a40c]
mov dword [esp], eax
call sym.unk_160
sub esp, 0xc
mov ebx, eax
lea eax, [ebp - 0x4f0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x48e]
mov dword [esp], eax
call sym.unk_195
sub esp, 8
test eax, eax
jg 0x402a72
mov eax, dword [ebp - 0x48e]
mov dword [esp], eax
call sym.unk_193
mov esi, dword [ebp - 0x540]
sub esp, 4
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sym.unk_198
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x48e]
mov dword [esp + 4], 0x5a
lea edi, [ebp - 0x45c]
mov dword [esp], eax
call sym.unk_120
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [0x40b164]
mov dword [esp + 8], 0x9ec
mov dword [esp], eax
call sym.unk_218
mov esi, eax
mov eax, dword [ebp - 0x48e]
sub esp, 0xc
mov dword [esp + 4], 0x71
mov dword [esp], eax
call sym.unk_120
sub esi, eax
mov eax, dword [ebp - 0x48e]
sub esp, 8
mov dword [esp + 4], 0x6f
mov dword [esp], eax
mov dword [ebp - 0x4fc], esi
call sym.unk_120
mov esi, eax
mov eax, dword [ebp - 0x48e]
sub esp, 8
mov dword [esp + 4], 0x5a
mov dword [esp], eax
call sym.unk_120
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [0x40b168]
mov dword [esp + 8], 0x9ec
mov dword [esp], eax
call sym.unk_218
sub esi, eax
mov eax, dword [ebp - 0x48e]
sub esp, 0xc
mov dword [esp + 4], 0x58
mov dword [esp], eax
mov dword [ebp - 0x4f4], esi
call sym.unk_120
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [0x40b16c]
mov dword [esp + 8], 0x9ec
mov dword [esp], eax
call sym.unk_218
mov esi, eax
mov eax, dword [ebp - 0x48e]
sub esp, 0xc
mov dword [esp + 4], 0x70
mov dword [esp], eax
call sym.unk_120
sub esi, eax
mov eax, dword [ebp - 0x48e]
sub esp, 8
mov dword [esp + 4], 0x6e
mov dword [esp], eax
mov dword [ebp - 0x500], esi
call sym.unk_120
mov esi, eax
mov eax, dword [ebp - 0x48e]
sub esp, 8
mov dword [esp + 4], 0x58
mov dword [esp], eax
call sym.unk_120
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [0x40b170]
mov dword [esp + 8], 0x9ec
mov dword [esp], eax
call sym.unk_218
mov ecx, 0x17
sub esp, 0xc
sub esi, eax
mov dword [ebp - 0x4f8], esi
mov esi, 0x40a414
rep movsd dword es:[edi], dword [esi]
call dbg.get_dpi
mov dword [esp + 4], 0x5a
mov esi, eax
mov eax, dword [ebp - 0x48e]
mov dword [esp], eax
call sym.unk_120
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x45c]
mov dword [esp + 8], esi
mov dword [esp], eax
call sym.unk_218
sub esp, 0xc
mov dword [ebp - 0x45c], eax
lea eax, [ebp - 0x45c]
mov dword [esp], eax
sub dword [ebp - 0x44c], 0x64
call sym.unk_143
sub esp, 4
mov dword [ebp - 0x544], eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x48e]
mov dword [esp], eax
call sym.unk_175
sub esp, 8
cmp word [ebp - 0x47e], 0
mov dword [ebp - 0x548], eax
je 0x403240
mov eax, dword [ebp - 0x540]
xor edx, edx
mov dword [ebp - 0x53c], 1
lea eax, [eax + ebx*2]
mov dword [ebp - 0x520], eax
mov edi, dword [ebp - 0x540]
xor esi, esi
mov dword [ebp - 0x534], 1
mov dword [ebp - 0x51c], edi
mov edi, esi
nop
test byte [ebp - 0x48a], 2
je 0x403300
movzx eax, word [ebp - 0x484]
mov esi, dword [ebp - 0x534]
cmp eax, esi
jl 0x4033c0
movzx eax, word [ebp - 0x486]
cmp eax, esi
setle al
movzx eax, al
mov dword [ebp - 0x528], eax
mov eax, dword [ebp - 0x48e]
movzx edx, word [0x40b37c]
mov dword [ebp - 0x524], eax
test dx, dx
je 0x403341
mov ebx, 0x40b37e
xor eax, eax
xor ecx, ecx
jmp 0x402d24
cmp dx, 0x26
je 0x402de4
mov esi, eax
xor ecx, ecx
add eax, 0xb
cmp dx, 0x70
cmovne eax, esi
add ebx, 2
movzx edx, word [ebx - 2]
test dx, dx
je 0x402d41
test ecx, ecx
jne 0x402d00
cmp dx, 0x26
je 0x402df0
add ebx, 2
movzx edx, word [ebx - 2]
add eax, 1
test dx, dx
jne 0x402d24
lea edx, [eax + eax + 2]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sym.unk_180
sub esp, 0xc
mov edx, eax
mov dword [ebp - 0x52c], eax
test eax, eax
je 0x403240
movzx eax, word [0x40b37c]
test ax, ax
je 0x403350
mov dword [ebp - 0x538], edi
xor ebx, ebx
xor esi, esi
mov edi, edx
mov dword [ebp - 0x530], 0x40b37e
jmp 0x402dc8
cmp ax, 0x26
je 0x402e00
xor esi, esi
cmp ax, 0x70
je 0x4032d0
add dword [ebp - 0x530], 2
mov eax, dword [ebp - 0x530]
movzx eax, word [eax - 2]
test ax, ax
je 0x402e20
lea ecx, [ebx + ebx]
lea edx, [edi + ecx]
test esi, esi
jne 0x402da0
cmp ax, 0x26
je 0x402e13
mov word [edx], ax
add ebx, 1
lea edx, [edi + ecx + 2]
jmp 0x402db2
add eax, 1
xor ecx, ecx
jmp 0x402d18
mov ecx, 1
jmp 0x402d18
mov esi, 0x26
add ebx, 1
mov word [edx], si
lea edx, [edi + ecx + 2]
xor esi, esi
jmp 0x402db2
mov esi, 1
jmp 0x402db2
mov edi, dword [ebp - 0x538]
xor eax, eax
mov word [edx], ax
mov edx, dword [ebp - 0x528]
test edx, edx
je 0x402e4e
mov eax, dword [ebp - 0x524]
mov dword [esp], eax
call sym.unk_124
sub esp, 4
test eax, eax
jle 0x403360
lea eax, [ebp - 0x4dc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x524]
mov dword [esp], eax
call sym.unk_102
xor eax, eax
mov ebx, dword [ebp - 0x4fc]
sub esp, 8
cmp word [0x40a884], 0
je 0x402ea1
mov dword [esp + 4], 0x40a884
mov ecx, dword [ebp - 0x528]
lea edx, [ebp - 0x500]
mov dword [esp], 1
mov eax, dword [ebp - 0x524]
call sym._notepad_print_header.isra.1.part.2
imul eax, dword [ebp - 0x4dc]
add ebx, eax
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x530], eax
mov eax, dword [ebp - 0x52c]
cmp word [eax], 0
je 0x402eef
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x524]
xor ecx, ecx
lea edx, [ebp - 0x500]
mov dword [esp], 0
call sym._notepad_print_header.isra.1.part.2
imul eax, dword [ebp - 0x4dc]
add eax, eax
sub dword [ebp - 0x530], eax
lea esi, [ebp - 0x400]
mov edx, dword [0x40a470]
test edi, edi
je 0x402fa3
mov eax, edi
test edx, edx
jne 0x403026
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 0x528]
test eax, eax
jne 0x403120
mov eax, dword [ebp - 0x51c]
cmp dword [ebp - 0x520], eax
jbe 0x403190
cmp ebx, dword [ebp - 0x530]
jge 0x403190
movzx eax, word [eax]
cmp ax, 0xa
je 0x402f4e
cmp ax, 0xd
jne 0x402f9d
mov edx, dword [ebp - 0x51c]
mov ecx, dword [ebp - 0x4dc]
add ecx, dword [ebp - 0x4cc]
add edx, 2
lea edi, [ebx + ecx]
cmp ax, 0xa
mov dword [ebp - 0x51c], edx
cmove ebx, edi
cmp dword [ebp - 0x520], edx
jbe 0x403190
cmp ebx, dword [ebp - 0x530]
jge 0x403190
movzx eax, word [edx]
add edx, 2
cmp ax, 0xa
je 0x402f63
cmp ax, 0xd
je 0x402f63
mov edx, dword [0x40a470]
mov ecx, dword [ebp - 0x51c]
cmp dword [ebp - 0x520], ecx
jbe 0x403330
movzx eax, word [ecx]
cmp ax, 0xd
je 0x403330
cmp ax, 0xa
je 0x403330
xor edi, edi
jmp 0x403009
mov word [ebp + edi*2 - 0x400], ax
add edi, 1
cmp edi, 0x1f3
ja 0x40301b
add ecx, 2
cmp dword [ebp - 0x520], ecx
jbe 0x403180
movzx eax, word [ecx]
cmp ax, 0xd
je 0x403180
cmp ax, 0xa
je 0x403180
cmp ax, 9
je 0x4030e1
cmp edi, 0x1f3
jbe 0x402fd0
test edx, edx
je 0x402fe3
nop
mov dword [ebp - 0x51c], ecx
lea eax, [ebp - 0x508]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x50c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x4f8]
sub eax, dword [ebp - 0x500]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x524]
mov dword [esp + 4], esi
mov dword [esp], eax
call sym.unk_133
mov eax, dword [ebp - 0x50c]
sub esp, 0x1c
mov edx, eax
cmp eax, edi
jae 0x403084
lea ecx, [esi + eax*2]
cmp word [ecx], 0x20
jne 0x403290
mov ecx, dword [ebp - 0x528]
test ecx, ecx
jne 0x403282
sub edi, edx
je 0x402f21
lea ecx, [esi + edx*2]
lea eax, [edi + edi]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp], esi
call sym._memcpy
mov eax, dword [ebp - 0x4cc]
add eax, dword [ebp - 0x4dc]
add ebx, eax
cmp ebx, dword [ebp - 0x530]
jge 0x403192
mov ecx, dword [ebp - 0x51c]
cmp dword [ebp - 0x520], ecx
ja 0x402ef5
jmp 0x403192
mov eax, 8
jmp 0x403106
mov word [ebp + edi*2 - 0x400], 0x20
add edi, 1
sub eax, 1
je 0x402fdb
cmp edi, 0x1f3
jbe 0x4030f0
test edx, edx
je 0x4030fd
jmp 0x403020
mov ecx, edi
lea eax, [ebp - 0x500]
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x500]
mov dword [esp + 0x1c], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x524]
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], 4
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [ebp - 0x538], ecx
call sym.unk_97
mov ecx, dword [ebp - 0x538]
mov edx, dword [ebp - 0x50c]
sub esp, 0x20
mov edi, ecx
jmp 0x403092
mov dword [ebp - 0x51c], ecx
jmp 0x402f03
xor edi, edi
mov eax, dword [ebp - 0x52c]
cmp word [eax], 0
je 0x4031c0
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x528]
lea edx, [ebp - 0x500]
mov dword [esp], 0
mov eax, dword [ebp - 0x524]
call sym._notepad_print_header.isra.1.part.2
mov edx, dword [ebp - 0x528]
test edx, edx
jne 0x403310
mov esi, dword [ebp - 0x52c]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], esi
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sym.unk_198
mov edx, 1
add dword [ebp - 0x534], 1
mov esi, dword [ebp - 0x51c]
sub esp, 0xc
cmp dword [ebp - 0x520], esi
ja 0x402ca0
add dword [ebp - 0x53c], 1
mov esi, dword [ebp - 0x53c]
mov edx, 1
movzx eax, word [ebp - 0x47e]
cmp eax, esi
jge 0x402c85
lea esi, [esi]
lea esi, [esi]
mov eax, dword [ebp - 0x48e]
mov dword [esp], eax
call sym.unk_114
mov eax, dword [ebp - 0x548]
sub esp, 4
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x48e]
mov dword [esp], eax
call sym.unk_175
mov eax, dword [ebp - 0x544]
sub esp, 8
mov dword [esp], eax
call sym.unk_190
sub esp, 4
jmp 0x402a30
mov ecx, edi
mov edi, edx
jmp 0x403122
test eax, eax
jne 0x4032a2
jmp 0x403430
mov eax, ecx
mov ecx, eax
sub ecx, 1
je 0x403084
cmp word [esi + ecx*2], 0x20
jne 0x4032a0
test ecx, ecx
jle 0x403084
mov dword [ebp - 0x50c], eax
mov edx, eax
jmp 0x403084
mov eax, dword [ebp - 0x534]
mov dword [esp], edx
mov dword [esp + 8], 0x4090c0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xb
call sym.unk_177
add ebx, eax
lea edx, [edi + ebx*2]
jmp 0x402db2
mov dword [ebp - 0x528], 1
jmp 0x402cd7
mov eax, dword [ebp - 0x524]
mov dword [esp], eax
call sym.unk_165
sub esp, 4
jmp 0x4031ce
test edx, edx
jne 0x4033d0
xor eax, eax
xor edi, edi
jmp 0x402f0d
mov edx, 2
jmp 0x402d45
mov edx, dword [ebp - 0x52c]
jmp 0x402e26
mov eax, dword [0x40a404]
mov dword [esp + 0xc], 0x30
mov dword [esp + 8], str.Print_Error
mov dword [esp + 4], str.StartPage_failed
mov dword [esp], eax
call sym.unk_99
mov esi, dword [ebp - 0x52c]
sub esp, 0x10
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sym.unk_198
sub esp, 0xc
jmp 0x403240
test edx, edx
jne 0x403215
jmp 0x403240
lea eax, [ebp - 0x508]
mov dword [esp + 0x14], 0
xor edi, edi
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x50c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x4f8]
sub eax, dword [ebp - 0x500]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x524]
mov dword [esp + 4], esi
mov dword [esp], eax
call sym.unk_133
mov edx, dword [ebp - 0x50c]
sub esp, 0x1c
jmp 0x403084
mov eax, dword [ebp - 0x528]
test eax, eax
je 0x40309d
mov ecx, edi
xor edi, edi
jmp 0x403122
mov eax, dword [ebp - 0x48e]
mov dword [esp], eax
call sym.unk_193
sub esp, 4
call dbg.ShowLastError
jmp 0x4028c0