Function at 0x402550
Capabilities:
Access peb ldr_data
Get graphical window text
Get kernel32 base address
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ecx, 0xc
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x480]
lea edx, [ebp - 0x492]
push ebx
xor ebx, ebx
mov eax, ebx
sub esp, 0x54c
mov dword [ebp - 0x482], 0
mov dword [ebp - 0x454], 0
rep stosd dword es:[edi], eax
mov dword [esp], edx
mov dword [ebp - 0x492], 0x42
mov dword [ebp - 0x47e], 0x104
mov eax, dword [0x40c024]
mov dword [ebp - 0x476], 0xffff0001
mov dword [ebp - 0x48e], eax
mov eax, dword [0x40d20c]
mov dword [ebp - 0x48a], eax
mov eax, dword [0x40d210]
mov dword [ebp - 0x486], eax
mov eax, dword [0x40c020]
mov dword [ebp - 0x470], eax
call dword [sym.imp.comdlg32.dll_PrintDlgW]
sub esp, 4
test eax, eax
jne 0x4025e9
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x48a]
mov dword [esp + 4], 1
mov dword [0x40d20c], eax
mov eax, dword [ebp - 0x486]
mov dword [0x40d210], eax
mov eax, dword [ebp - 0x482]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_SetMapMode]
mov dword [ebp - 0x4e4], 0x14
mov dword [ebp - 0x4e0], 0x40c6b8
sub esp, 8
mov dword [ebp - 0x4dc], 0
mov dword [ebp - 0x4d8], 0
mov dword [ebp - 0x4d4], 0
test byte [ebp - 0x47e], 0x20
je 0x4026c5
mov eax, ebx
mov ecx, 0x14
lea edi, [ebp - 0x3ec]
mov esi, dword [ebp - 0x48e]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x3f4]
mov dword [ebp - 0x3f4], 0x58
mov dword [ebp - 0x3c0], 0x806
mov dword [ebp - 0x3f0], esi
mov dword [ebp - 0x3d8], str.output.prn
mov dword [ebp - 0x3d4], 0x104
mov dword [ebp - 0x3b8], 0x40a124
mov dword [esp], edx
call dword [sym.imp.comdlg32.dll_GetSaveFileNameW]
sub esp, 4
test eax, eax
je 0x4025e1
mov dword [ebp - 0x4dc], str.output.prn
mov eax, dword [0x40c02c]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowTextLengthW]
lea ebx, [eax + 1]
sub esp, 4
lea edx, [ebx + ebx]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x524], eax
call eax
mov dword [ebp - 0x52c], eax
sub esp, 0xc
test eax, eax
je 0x4031df
mov ecx, dword [ebp - 0x52c]
mov eax, dword [0x40c02c]
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowTextW]
sub esp, 0xc
mov dword [ebp - 0x504], eax
lea eax, [ebp - 0x4e4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x482]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_StartDocW]
sub esp, 8
test eax, eax
jg 0x40279e
mov eax, dword [ebp - 0x482]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_DeleteDC]
mov ecx, dword [ebp - 0x52c]
sub esp, 4
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x482]
mov ebx, dword [sym.imp.gdi32.dll_GetDeviceCaps]
mov dword [esp + 4], 0x5a
mov dword [esp], eax
call ebx
mov edi, dword [sym.imp.kernel32.dll_MulDiv]
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [0x40cd90]
mov dword [esp + 8], 0x9ec
mov dword [esp], eax
call edi
mov esi, eax
mov eax, dword [ebp - 0x482]
sub esp, 0xc
mov dword [esp + 4], 0x71
mov dword [esp], eax
call ebx
sub esi, eax
mov eax, dword [ebp - 0x482]
sub esp, 8
mov dword [ebp - 0x4f0], esi
mov dword [esp + 4], 0x6f
mov dword [esp], eax
call ebx
mov esi, eax
mov eax, dword [ebp - 0x482]
sub esp, 8
mov dword [esp + 4], 0x5a
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [0x40cd94]
mov dword [esp + 8], 0x9ec
mov dword [esp], eax
call edi
sub esi, eax
mov eax, dword [ebp - 0x482]
sub esp, 0xc
mov dword [ebp - 0x4e8], esi
mov dword [esp + 4], 0x58
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [0x40cd98]
mov dword [esp + 8], 0x9ec
mov dword [esp], eax
call edi
mov esi, eax
mov eax, dword [ebp - 0x482]
sub esp, 0xc
mov dword [esp + 4], 0x70
mov dword [esp], eax
call ebx
sub esi, eax
mov eax, dword [ebp - 0x482]
sub esp, 8
mov dword [ebp - 0x4f4], esi
mov dword [esp + 4], 0x6e
mov dword [esp], eax
call ebx
mov esi, eax
mov eax, dword [ebp - 0x482]
sub esp, 8
mov dword [esp + 4], 0x58
mov dword [esp], eax
call ebx
mov dword [ebp - 0x508], edi
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [0x40cd9c]
mov dword [esp + 8], 0x9ec
mov dword [esp], eax
call edi
lea edi, [ebp - 0x450]
mov ecx, 0x17
sub esi, eax
mov eax, dword [0x40c024]
sub esp, 0xc
mov dword [ebp - 0x4ec], esi
mov esi, 0x40c040
rep movsd dword es:[edi], dword [esi]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetDpiForWindow]
mov esi, eax
mov eax, dword [ebp - 0x482]
sub esp, 4
mov dword [esp + 4], 0x5a
mov dword [esp], eax
call ebx
mov edi, dword [ebp - 0x508]
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x450]
mov dword [esp + 8], esi
mov dword [esp], eax
call edi
sub dword [ebp - 0x440], 0x64
sub esp, 0xc
mov dword [ebp - 0x450], eax
lea eax, [ebp - 0x450]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_CreateFontIndirectW]
mov ebx, dword [sym.imp.gdi32.dll_SelectObject]
sub esp, 4
mov dword [ebp - 0x530], eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x482]
mov dword [ebp - 0x538], ebx
mov dword [esp], eax
call ebx
sub esp, 8
cmp word [ebp - 0x472], 0
mov dword [ebp - 0x534], eax
je 0x402fa1
mov eax, dword [ebp - 0x504]
mov ecx, dword [ebp - 0x52c]
xor edx, edx
mov dword [ebp - 0x528], 1
lea eax, [ecx + eax*2]
mov dword [ebp - 0x504], eax
mov dword [ebp - 0x520], 1
mov edi, dword [ebp - 0x52c]
xor esi, esi
lea esi, [esi]
test byte [ebp - 0x47e], 2
je 0x403090
movzx eax, word [ebp - 0x478]
mov ecx, dword [ebp - 0x520]
cmp eax, ecx
jl 0x40315c
movzx eax, word [ebp - 0x47a]
cmp eax, ecx
setle al
movzx eax, al
mov dword [ebp - 0x508], eax
mov eax, dword [ebp - 0x482]
mov dword [ebp - 0x510], eax
movzx eax, word [0x40cfa8]
test ax, ax
je 0x4030fa
mov dword [ebp - 0x50c], edi
mov edx, 0x40cfaa
xor ecx, ecx
xor ebx, ebx
jmp 0x402a5b
cmp ax, 0x26
je 0x402db8
mov edi, ecx
xor ebx, ebx
add ecx, 0xb
cmp ax, 0x70
cmovne ecx, edi
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x402a77
test ebx, ebx
jne 0x402a38
cmp ax, 0x26
je 0x402dc8
movzx eax, word [edx]
add edx, 2
add ecx, 1
test ax, ax
jne 0x402a5b
mov edi, dword [ebp - 0x50c]
lea edx, [ecx + ecx + 2]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x524]
call eax
mov dword [ebp - 0x514], eax
sub esp, 0xc
test eax, eax
je 0x402fa1
movzx eax, word [0x40cfa8]
test ax, ax
je 0x4030ef
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x50c], edi
mov ebx, 0x40cfaa
mov dword [ebp - 0x518], esi
mov edi, edx
mov esi, ecx
mov edx, dword [ebp - 0x514]
jmp 0x402b11
cmp ax, 0x26
je 0x402dd8
xor edi, edi
cmp ax, 0x70
je 0x403000
movzx eax, word [ebx]
add ebx, 2
test ax, ax
je 0x402b34
lea ecx, [edx + esi*2]
test edi, edi
jne 0x402af0
cmp ax, 0x26
je 0x402df0
add ebx, 2
mov word [ecx], ax
add esi, 1
movzx eax, word [ebx - 2]
test ax, ax
jne 0x402b11
mov eax, dword [ebp - 0x514]
mov ecx, esi
mov edi, dword [ebp - 0x50c]
mov esi, dword [ebp - 0x518]
lea eax, [eax + ecx*2]
mov ecx, dword [ebp - 0x508]
xor edx, edx
mov word [eax], dx
test ecx, ecx
je 0x402b74
mov eax, dword [ebp - 0x510]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_StartPage]
sub esp, 4
test eax, eax
jle 0x403104
lea eax, [ebp - 0x4d0]
xor ebx, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x510]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GetTextMetricsW]
mov eax, dword [ebp - 0x4f0]
sub esp, 8
cmp word [0x40c4b0], 0
mov dword [ebp - 0x50c], eax
jne 0x4030a0
mov eax, dword [ebp - 0x4e8]
imul ebx, dword [ebp - 0x4d0]
add ebx, dword [ebp - 0x50c]
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 0x514]
cmp word [eax], 0
jne 0x402e00
lea esi, [esi]
mov edx, dword [0x40c09c]
test esi, esi
je 0x402c80
test edx, edx
jne 0x402ce8
mov edx, esi
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x500], edx
test ecx, ecx
jne 0x402e90
cmp dword [ebp - 0x504], edi
jbe 0x402f00
mov esi, dword [ebp - 0x50c]
cmp ebx, esi
jge 0x402f00
mov ecx, dword [ebp - 0x4d0]
add ecx, dword [ebp - 0x4c0]
jmp 0x402c51
cmp ax, 0xa
lea edx, [ebx + ecx]
cmove ebx, edx
add edi, 2
cmp dword [ebp - 0x504], edi
jbe 0x402f00
cmp ebx, esi
jge 0x402f00
movzx eax, word [edi]
cmp ax, 0xa
je 0x402c30
cmp ax, 0xd
je 0x402c30
cmp dword [ebp - 0x504], edi
jbe 0x402f00
xor esi, esi
mov edx, dword [0x40c09c]
test esi, esi
jne 0x402be6
lea esi, [esi]
mov ecx, dword [ebp - 0x504]
cmp dword [ebp - 0x504], edi
ja 0x402cb6
jmp 0x403170
mov word [ebp + esi*2 - 0x3f4], ax
add esi, 1
cmp esi, 0x1f3
ja 0x402cdf
add edi, 2
cmp ecx, edi
jbe 0x402be6
movzx eax, word [edi]
cmp ax, 0xd
je 0x402be6
cmp ax, 0xa
je 0x402be6
cmp ax, 9
je 0x402e50
cmp esi, 0x1f3
jbe 0x402c98
test edx, edx
je 0x402cab
lea esi, [esi]
nop
lea eax, [ebp - 0x4fc]
lea ecx, [ebp - 0x3f4]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x500]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x4ec]
sub eax, dword [ebp - 0x4f4]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x518], ecx
mov dword [esp + 8], esi
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GetTextExtentExPointW]
mov eax, dword [ebp - 0x500]
mov ecx, dword [ebp - 0x518]
sub esp, 0x1c
cmp eax, esi
mov edx, eax
jae 0x402d5b
cmp word [ebp + eax*2 - 0x3f4], 0x20
jne 0x403040
mov edx, dword [ebp - 0x508]
test edx, edx
jne 0x402ff0
sub esi, eax
je 0x402c04
lea edx, [esi + esi]
lea eax, [ecx + eax*2]
mov dword [esp], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call sub.ucrtbase.dll_memcpy
mov eax, dword [ebp - 0x4c0]
add eax, dword [ebp - 0x4d0]
add ebx, eax
cmp dword [ebp - 0x504], edi
jbe 0x402f02
cmp ebx, dword [ebp - 0x50c]
jl 0x402bd8
jmp 0x402f02
add ecx, 1
xor ebx, ebx
jmp 0x402a50
mov ebx, 1
jmp 0x402a50
mov edi, 0x26
add esi, 1
mov word [ecx], di
xor edi, edi
jmp 0x402b06
mov edi, 1
jmp 0x402b06
add eax, 2
cmp word [eax], 0
jne 0x402e00
mov ecx, dword [ebp - 0x514]
lea edx, [ebp - 0x4fc]
mov dword [esp + 0xc], edx
sub eax, ecx
mov dword [esp + 4], ecx
sar eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x510]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GetTextExtentPoint32W]
mov eax, dword [ebp - 0x4d0]
sub esp, 0x10
add eax, eax
sub dword [ebp - 0x50c], eax
jmp 0x402bd8
mov eax, 8
jmp 0x402e76
mov word [ebp + esi*2 - 0x3f4], 0x20
add esi, 1
sub eax, 1
je 0x402ca3
cmp esi, 0x1f3
jbe 0x402e60
test edx, edx
je 0x402e6d
jmp 0x402ce8
mov dword [ebp - 0x51c], esi
lea ecx, [ebp - 0x3f4]
lea eax, [ebp - 0x4f4]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x4f4]
mov dword [esp + 0x14], ecx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x518], ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], 4
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_ExtTextOutW]
mov eax, dword [ebp - 0x500]
mov esi, dword [ebp - 0x51c]
mov ecx, dword [ebp - 0x518]
sub esp, 0x20
jmp 0x402d69
xor esi, esi
mov eax, dword [ebp - 0x514]
cmp word [eax], 0
je 0x402f30
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x508]
lea edx, [ebp - 0x4f4]
mov dword [esp], 0
mov eax, dword [ebp - 0x510]
call fcn.004012d0
mov eax, dword [ebp - 0x508]
test eax, eax
jne 0x4030cd
mov ecx, dword [ebp - 0x514]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
add dword [ebp - 0x520], 1
mov edx, 1
sub esp, 0xc
cmp dword [ebp - 0x504], edi
ja 0x4029d0
add dword [ebp - 0x528], 1
mov ecx, dword [ebp - 0x528]
mov edx, 1
movzx eax, word [ebp - 0x472]
cmp eax, ecx
jge 0x4029bb
mov eax, dword [ebp - 0x482]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_EndDoc]
mov eax, dword [ebp - 0x534]
sub esp, 4
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x482]
mov dword [esp], eax
mov eax, dword [ebp - 0x538]
call eax
mov eax, dword [ebp - 0x530]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_DeleteObject]
sub esp, 4
jmp 0x40275a
mov dword [ebp - 0x51c], esi
mov esi, eax
jmp 0x402e9c
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x51c], edx
mov dword [esp + 8], 0x40a0e0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xb
mov dword [esp], ecx
call dword [sym.imp.shlwapi.dll_wnsprintfW]
mov edx, dword [ebp - 0x51c]
add esi, eax
jmp 0x402b06
test eax, eax
je 0x402d5b
mov dword [ebp - 0x518], edi
nop
mov edi, edx
sub edx, 1
je 0x4030e4
cmp word [ecx + edx*2], 0x20
jne 0x403050
mov dword [ebp - 0x51c], edi
mov edi, dword [ebp - 0x518]
test edx, edx
jle 0x402d5b
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x500], eax
jmp 0x402d5b
mov dword [ebp - 0x508], 1
jmp 0x402a07
mov dword [esp + 4], 0x40c4b0
mov ecx, dword [ebp - 0x508]
lea edx, [ebp - 0x4f4]
mov dword [esp], 1
mov eax, dword [ebp - 0x510]
call fcn.004012d0
mov ebx, eax
jmp 0x402bac
mov eax, dword [ebp - 0x510]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_EndPage]
sub esp, 4
jmp 0x402f3e
mov edi, dword [ebp - 0x518]
jmp 0x402d5b
mov eax, dword [ebp - 0x514]
jmp 0x402b4b
mov edx, 2
jmp 0x402a81
mov eax, dword [0x40c024]
mov dword [esp + 0xc], 0x30
mov dword [esp + 8], str.Print_Error
mov dword [esp + 4], str.StartPage_failed
mov dword [esp], eax
call dword [sym.imp.user32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x514]
sub esp, 0x10
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x402fa1
test edx, edx
jne 0x402f80
jmp 0x402fa1
test edx, edx
je 0x402bf0
lea eax, [ebp - 0x4fc]
lea ecx, [ebp - 0x3f4]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x500]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x4ec]
sub eax, dword [ebp - 0x4f4]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x518], ecx
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GetTextExtentExPointW]
mov eax, dword [ebp - 0x500]
mov ecx, dword [ebp - 0x518]
sub esp, 0x1c
jmp 0x402d5b
mov eax, dword [ebp - 0x482]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_DeleteDC]
push eax
call fcn.00401a70
jmp 0x4025e1