Function at 0x409a70
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4387f2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5d4
push ebx
push ebp
push esi
push edi
mov esi, ecx
lea eax, [esp + 0x3a4]
lea ecx, [esp + 0x1a0]
push eax
lea edx, [esp + 0x2a8]
push ecx
mov ecx, dword [esp + 0x600]
lea eax, [esp + 0x7c]
push edx
mov ebp, 1
push eax
push ecx
mov dword [esp + 0x600], ebp
call fcn.00418b94
add esp, 0x14
lea edx, [esp + 0x5f8]
lea ecx, [esp + 0x4c]
push edx
call fcn.0042a42c
mov eax, dword [0x44927c]
mov dword [esp + 0x34], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
push 0x44b620
lea ecx, [esp + 0x38]
mov byte [esp + 0x5f0], 7
call fcn.0042a840
push 0x44b620
lea ecx, [esp + 0x30]
call fcn.0042a840
push 0x44b620
lea ecx, [esp + 0x34]
call fcn.0042a840
push 0x44b620
lea ecx, [esp + 0x44]
call fcn.0042a840
push 0x44b620
lea ecx, [esp + 0x48]
call fcn.0042a840
mov eax, dword [0x44927c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1a0]
mov bl, 0xb
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x5f0], bl
call fcn.0042a840
mov edx, dword [esp + 0x5f4]
lea ecx, [esp + 0x4a4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x5f4]
lea ecx, [esp + 0x34]
push eax
call fcn.0042a7f0
push 0x44b620
lea ecx, [esp + 0x30]
call fcn.0042a840
push 0x44b620
lea ecx, [esp + 0x34]
call fcn.0042a840
mov ecx, dword [esp + 0x34]
push ecx
push 0x3f4
mov ecx, esi
call fcn.0042e129
mov ecx, eax
call fcn.0042e219
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x78]
push edx
push eax
call fcn.00418729
add esp, 8
test eax, eax
jne 0x409c44
mov ecx, dword [esp + 0x8c]
mov eax, ecx
cdq
fild dword [esp + 0x8c]
and edx, 0x3ff
add eax, edx
sar eax, 0xa
cmp eax, 0x400
jge 0x409c25
fmul qword [0x43b5d8]
sub esp, 8
fstp qword [esp]
push ecx
lea ecx, [esp + 0x3c]
push str._d__.2fK_
push ecx
jmp 0x409c3c
fmul qword [0x43b5d0]
sub esp, 8
lea edx, [esp + 0x38]
fstp qword [esp]
push ecx
push str._d__.2fM_
push edx
call fcn.0042846c
add esp, 0x14
mov eax, dword [esp + 0x30]
mov ecx, esi
push eax
push 0x3f5
call fcn.0042e129
mov ecx, eax
call fcn.0042e219
call fcn.00434891
mov eax, dword [eax + 4]
push 0x64
push str.Zoom
push str.ZoomRatio
mov ecx, eax
call fcn.0043443c
mov dword [esp + 0x20], eax
mov eax, dword [0x44b81c]
sub eax, 0
je 0x409cc3
sub eax, 2
je 0x409cae
dec eax
jne 0x40a678
mov ecx, dword [esp + 0x5f8]
mov dword [esp + 0x20], 0xc8
push ecx
call fcn.00427f9c
add esp, 4
jmp 0x40a678
mov edx, dword [esp + 0x5f8]
push edx
call fcn.00427f9c
add esp, 4
jmp 0x40a678
mov eax, dword [0x4477cc]
test eax, eax
je 0x409cd4
mov dword [esp + 0x20], 0x64
push 0x5c
lea ecx, [esp + 0x5fc]
call fcn.00428117
mov edi, eax
lea eax, [esp + 0x50]
push edi
push eax
lea ecx, [esp + 0x600]
call fcn.0042809f
push 0x4474ac
lea ecx, [esp + 0x6c]
push eax
push ecx
mov byte [esp + 0x5f8], 0xc
call fcn.0042a94c
lea edx, [esp + 0x28]
mov byte [esp + 0x5ec], 0xd
push edx
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0042a8e6
push str.css
lea ecx, [esp + 0x3c]
push eax
push ecx
mov byte [esp + 0x5f8], 0xe
call fcn.0042a94c
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x5f0], 0xf
call fcn.0042a7f0
lea ecx, [esp + 0x38]
mov byte [esp + 0x5ec], 0xe
call fcn.0042a6b7
lea ecx, [esp + 0x1c]
mov byte [esp + 0x5ec], 0xd
call fcn.0042a6b7
lea ecx, [esp + 0x68]
mov byte [esp + 0x5ec], 0xc
call fcn.0042a6b7
lea ecx, [esp + 0x50]
mov byte [esp + 0x5ec], bl
call fcn.0042a6b7
lea edx, [esp + 0x6c]
push edi
push edx
lea ecx, [esp + 0x600]
call fcn.0042809f
push 0x4474ac
push eax
lea eax, [esp + 0x64]
mov byte [esp + 0x5f4], 0x10
push eax
call fcn.0042a94c
lea ecx, [esp + 0x28]
lea edx, [esp + 0x70]
push ecx
push eax
push edx
mov byte [esp + 0x5f8], 0x11
call fcn.0042a8e6
push str.img
push eax
lea eax, [esp + 0x6c]
mov byte [esp + 0x5f4], 0x12
push eax
call fcn.0042a94c
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x5f0], 0x13
call fcn.0042a7f0
mov byte [esp + 0x5ec], 0x12
lea ecx, [esp + 0x64]
call fcn.0042a6b7
lea ecx, [esp + 0x70]
mov byte [esp + 0x5ec], 0x11
call fcn.0042a6b7
lea ecx, [esp + 0x5c]
mov byte [esp + 0x5ec], 0x10
call fcn.0042a6b7
lea ecx, [esp + 0x6c]
mov byte [esp + 0x5ec], bl
call fcn.0042a6b7
lea ecx, [esp + 0x54]
push edi
push ecx
lea ecx, [esp + 0x600]
call fcn.0042809f
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x5f0], 0x14
call fcn.0042a7f0
lea ecx, [esp + 0x54]
mov byte [esp + 0x5ec], bl
call fcn.0042a6b7
lea edx, [esp + 0x24]
push 0x4474ac
lea eax, [esp + 0x4c]
push edx
push eax
call fcn.0042a94c
lea ecx, [esp + 0x28]
lea edx, [esp + 0x60]
push ecx
push eax
push edx
mov byte [esp + 0x5f8], 0x15
call fcn.0042a8e6
push str..htm
push eax
lea eax, [esp + 0x60]
mov byte [esp + 0x5f4], 0x16
push eax
call fcn.0042a94c
push eax
lea ecx, [esp + 0x5fc]
mov byte [esp + 0x5f0], 0x17
call fcn.0042a7f0
lea ecx, [esp + 0x58]
mov byte [esp + 0x5ec], 0x16
call fcn.0042a6b7
lea ecx, [esp + 0x60]
mov byte [esp + 0x5ec], 0x15
call fcn.0042a6b7
lea ecx, [esp + 0x48]
mov byte [esp + 0x5ec], bl
call fcn.0042a6b7
push ecx
lea edx, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.0042a42c
call fcn.0040d4d0
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0042a42c
call fcn.0040d4d0
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.0042a42c
call fcn.0040d4d0
mov ecx, esp
mov dword [esp + 0x18], esp
push str.blank.gif
call fcn.0042a725
push 0x4482ec
push 0x89
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
mov byte [esp + 0x600], 0x18
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.clsfile0.gif
call fcn.0042a725
push 0x4482ec
push 0x8a
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x600], 0x19
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.clsfile1.gif
call fcn.0042a725
push 0x4482ec
push 0x8b
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x600], 0x1a
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.ffwd_0.gif
call fcn.0042a725
push 0x4482ec
push 0x8c
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x600], 0x1b
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.ffwd_1.gif
call fcn.0042a725
push 0x4482ec
push 0x8d
push ecx
mov byte [esp + 0x5fc], 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
lea eax, [esp + 0x28]
push eax
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.file0.gif
call fcn.0042a725
push 0x4482ec
push 0x90
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x600], 0x1d
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.file1.gif
call fcn.0042a725
push 0x4482ec
push 0x91
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x600], 0x1e
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.file_0.gif
call fcn.0042a725
push 0x4482ec
push 0x8e
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x600], 0x1f
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.file_1.gif
call fcn.0042a725
push 0x4482ec
push 0x8f
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x600], 0x20
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.hstbwd_0.gif
call fcn.0042a725
push 0x4482ec
push 0x92
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x600], 0x21
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.hstbwd_1.gif
call fcn.0042a725
push 0x4482ec
push 0x93
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x600], 0x22
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.hstfwd_0.gif
call fcn.0042a725
push 0x4482ec
push 0x94
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x600], 0x23
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.hstfwd_1.gif
call fcn.0042a725
push 0x4482ec
push 0x95
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x600], 0x24
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.lastnode.gif
call fcn.0042a725
push 0x4482ec
push 0x96
push ecx
mov byte [esp + 0x5fc], 0x25
mov ecx, esp
mov dword [esp + 0x24], esp
lea edx, [esp + 0x28]
push edx
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.next_0.gif
call fcn.0042a725
push 0x4482ec
push 0x97
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x600], 0x26
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.next_1.gif
call fcn.0042a725
push 0x4482ec
push 0x98
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x600], 0x27
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.node.gif
call fcn.0042a725
push 0x4482ec
push 0x99
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x600], 0x28
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.opnfile0.gif
call fcn.0042a725
push 0x4482ec
push 0x9a
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x600], 0x29
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.opnfile1.gif
call fcn.0042a725
push 0x4482ec
push 0x9b
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x600], 0x2a
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.prev_0.gif
call fcn.0042a725
push 0x4482ec
push 0xa1
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x600], 0x2b
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.prev_1.gif
call fcn.0042a725
push 0x4482ec
push 0x9d
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x600], 0x2c
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.rew_0.gif
call fcn.0042a725
push 0x4482ec
push 0x9e
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x600], 0x2d
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.rew_1.gif
call fcn.0042a725
push 0x4482ec
push 0x9f
push ecx
mov byte [esp + 0x5fc], 0x2e
mov ecx, esp
mov dword [esp + 0x24], esp
lea eax, [esp + 0x28]
push eax
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.sep.gif
call fcn.0042a725
push 0x4482ec
push 0xa0
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x600], 0x2f
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.vertline.gif
call fcn.0042a725
push 0x4482ec
push 0x9c
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x600], 0x30
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.bookmark.js
call fcn.0042a725
push 0x448198
push 0x88
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x600], 0x31
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.index.js
call fcn.0042a725
push 0x448198
push 0x87
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x600], 0x32
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.navbar.js
call fcn.0042a725
push 0x448198
push 0x86
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x600], 0x33
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040b4a0
mov dword [esp + 0x1c], 0x186a0
call fcn.00434891
mov eax, dword [eax + 4]
push 0
push str.Type
push str.PageRangeType
mov ecx, eax
call fcn.0043443c
mov edi, eax
cmp edi, 1
jne 0x40a6ff
call fcn.00434891
mov eax, dword [eax + 4]
push edi
push str.From
push str.PageRange
mov ecx, eax
call fcn.0043443c
mov ebp, eax
call fcn.00434891
mov eax, dword [eax + 4]
push 0x186a0
push 0x4477e0
push str.PageRange
mov ecx, eax
call fcn.0043443c
cmp ebp, eax
mov dword [esp + 0x1c], eax
jg 0x40a6ec
test ebp, ebp
jl 0x40a6ec
test eax, eax
jge 0x40a6ff
push 0
push 0
push str.Page_range_is_incorrect_Please_check_it_in_option_dialog_and_try_again.
call fcn.0043221d
jmp 0x40ab43
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x5f4]
push eax
push 0
push 0
push ecx
call sub.kernel.dll_FATALEXIT
test eax, eax
mov dword [esp + 0x20], eax
je 0x40ab36
push eax
call sub.kernel.dll_GETVERSION
cmp edi, 1
jne 0x40a73a
cmp ebp, edi
jge 0x40a732
mov ebp, edi
cmp eax, dword [esp + 0x1c]
jge 0x40a743
jmp 0x40a73f
mov ebp, 1
mov dword [esp + 0x1c], eax
mov eax, dword [0x44b754]
test eax, eax
mov eax, dword [0x44b81c]
je 0x40a777
cmp eax, 3
ja case.default.0x40a756
jmp dword [eax*4 + 0x40ac34]
mov ecx, dword [0x44795c]
jmp 0x40a773
mov ecx, dword [0x44b828]
jmp 0x40a773
mov ecx, dword [0x44b820]
test ecx, ecx
jne case.default.0x40a756
mov edx, dword [esp + 0x1c]
mov ecx, 0x1f4
cmp edx, ecx
jl case.default.0x40a756
jmp 0x40a79d
mov ecx, dword [0x44b824]
test ecx, ecx
jne case.default.0x40a756
mov edx, dword [esp + 0x1c]
mov ecx, 0x1f4
cmp edx, ecx
jl case.default.0x40a756
mov dword [esp + 0x1c], ecx
test eax, eax
jne 0x40a897
push ebp
push ecx
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.0042a42c
push ecx
lea eax, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
mov byte [esp + 0x5fc], 0x34
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5f8], bl
call fcn.0040b780
mov edi, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push edi
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.0042a42c
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x600], 0x35
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040bba0
push edi
push ebp
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.0042a42c
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x600], 0x36
call fcn.0042a42c
mov ecx, esi
mov byte [esp + 0x5fc], bl
call fcn.0040c580
push ecx
lea edx, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.0042a42c
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
mov byte [esp + 0x5f8], 0x37
call fcn.0042a42c
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x5f4], bl
push ecx
mov ecx, esi
call fcn.0040be90
lea eax, [ebp + ebp*4]
mov dword [esi + 0x5c], 0
mov ebx, ebp
lea eax, [eax + eax*4]
shl eax, 2
mov dword [esp + 0x48], eax
mov dword [esp + 0x38], eax
mov eax, dword [0x44b818]
test eax, eax
je 0x40ab2c
cmp ebx, dword [esp + 0x1c]
jg 0x40ab2c
mov edi, dword [esi + 0x108]
lea edx, [esp + 0x44]
push edi
push str._d_files
push edx
call fcn.0042846c
mov eax, dword [esp + 0x50]
add esp, 0xc
mov ecx, esi
push eax
push 0x3f8
call fcn.0042e129
mov ecx, eax
call fcn.0042e219
mov eax, 0x63
lea ecx, [esi + 0x218]
cdq
idiv edi
push eax
call fcn.00401810
mov ecx, dword [esp + 0x1c]
mov edx, ebx
sub ecx, ebp
sub edx, ebp
inc edx
lea eax, [esp + 0x40]
lea edi, [ecx + 1]
push edi
push edx
push str.page__d_of__d
push eax
call fcn.0042846c
mov ecx, dword [esp + 0x50]
add esp, 0x10
push ecx
push 0x3f9
mov ecx, esi
call fcn.0042e129
mov ecx, eax
call fcn.0042e219
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x48]
sub eax, ecx
lea ecx, [esi + 0x1b8]
add eax, 0x63
cdq
idiv edi
push eax
call fcn.00401810
mov eax, dword [0x44b81c]
cmp eax, 3
ja case.default.0x40a972
jmp dword [eax*4 + 0x40ac44]
mov edx, dword [esp + 0x5f8]
push ebx
push edx
lea eax, [esp + 0xa4]
push str._s._03d.bmp
push eax
call fcn.00418046
mov ecx, dword [esp + 0x30]
add esp, 0x10
push ebx
push ecx
call sub.kernel.dll_LOCALREALLOC
mov edi, eax
mov eax, dword [esi + 0x5c]
test eax, eax
jne 0x40a9ca
mov eax, dword [0x44b818]
test eax, eax
je 0x40a9ca
test edi, edi
je case.default.0x40a972
lea edx, [esp + 0x9c]
push edx
push edi
call sub.kernel.dll_LOCALNOTIFY
test edi, edi
je case.default.0x40a972
push edi
call sub.kernel.dll_LOCALFREE
jmp case.default.0x40a972
mov eax, dword [esp + 0x20]
push ebx
push eax
call sub.kernel.dll_LOCALINIT
mov edi, eax
test edi, edi
je 0x40aa21
fld dword [edi + 0x14]
sub esp, 8
lea ecx, [esp + 0x34]
fstp qword [esp]
push str.__PDF__.1f
push ecx
call fcn.0042846c
mov edx, dword [esp + 0x3c]
add esp, 0x10
mov ecx, esi
push edx
push 0x3f6
call fcn.0042e129
mov ecx, eax
call fcn.0042e219
mov eax, dword [esi + 0x5c]
test eax, eax
jne 0x40aa5b
mov eax, dword [0x44b818]
test eax, eax
je 0x40aa5b
test edi, edi
je case.default.0x40a972
push ecx
lea eax, [esp + 0x5fc]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.0042a42c
mov ecx, dword [esp + 0x24]
push edi
push ebx
push ecx
mov ecx, esi
call fcn.0040ac60
test edi, edi
je case.default.0x40a972
push edi
call sub.kernel.dll_LOCALALLOC
jmp case.default.0x40a972
mov edx, dword [esp + 0x20]
push ebx
push edx
call sub.kernel.dll_LOCALINIT
mov edi, eax
test edi, edi
je 0x40aab2
fld dword [edi + 0x14]
sub esp, 8
lea eax, [esp + 0x34]
fstp qword [esp]
push str.__PDF__.1f
push eax
call fcn.0042846c
mov ecx, dword [esp + 0x3c]
add esp, 0x10
push ecx
push 0x3f6
mov ecx, esi
call fcn.0042e129
mov ecx, eax
call fcn.0042e219
mov eax, dword [esi + 0x5c]
test eax, eax
jne 0x40aae8
mov eax, dword [0x44b818]
test eax, eax
je 0x40aae8
test edi, edi
je case.default.0x40a972
push ecx
lea edx, [esp + 0x5fc]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.0042a42c
mov eax, dword [esp + 0x24]
push edi
push ebx
push eax
mov ecx, esi
call fcn.0040b2b0
test edi, edi
je case.default.0x40a972
push edi
call sub.kernel.dll_LOCALALLOC
jmp case.default.0x40a972
push ecx
lea edx, [esp + 0x5fc]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.0042a42c
mov eax, dword [esp + 0x24]
push ebx
push eax
mov ecx, esi
call fcn.0040b100
mov ecx, dword [esp + 0x38]
mov eax, dword [esi + 0x5c]
inc ebx
add ecx, 0x64
test eax, eax
mov dword [esp + 0x38], ecx
je 0x40a8b2
mov ecx, dword [esp + 0x20]
push ecx
call sub.kernel.dll_EXITKERNEL
push 0
lea ecx, [esi + 0x1b8]
call fcn.00401810
lea ecx, [esp + 0x3c]
mov byte [esp + 0x5ec], 0xa
call fcn.0042a6b7
lea ecx, [esp + 0x28]
mov byte [esp + 0x5ec], 9
call fcn.0042a6b7
lea ecx, [esp + 0x24]
mov byte [esp + 0x5ec], 8
call fcn.0042a6b7
lea ecx, [esp + 0x18]
mov byte [esp + 0x5ec], 7
call fcn.0042a6b7
lea ecx, [esp + 0x44]
mov byte [esp + 0x5ec], 6
call fcn.0042a6b7
lea ecx, [esp + 0x40]
mov byte [esp + 0x5ec], 5
call fcn.0042a6b7
lea ecx, [esp + 0x30]
mov byte [esp + 0x5ec], 4
call fcn.0042a6b7
lea ecx, [esp + 0x2c]
mov byte [esp + 0x5ec], 3
call fcn.0042a6b7
lea ecx, [esp + 0x34]
mov byte [esp + 0x5ec], 2
call fcn.0042a6b7
lea ecx, [esp + 0x4c]
mov byte [esp + 0x5ec], 1
call fcn.0042a6b7
lea ecx, [esp + 0x5f4]
mov byte [esp + 0x5ec], 0
call fcn.0042a6b7
lea ecx, [esp + 0x5f8]
mov dword [esp + 0x5ec], 0xffffffff
call fcn.0042a6b7
mov ecx, dword [esp + 0x5e4]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x5e0
ret 8