Function at 0x402500
Capabilities:
Access peb ldr_data
Get graphical window text
Get kernel32 base address
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ecx, 0xc
mov ebp, esp
push edi
push esi
lea edx, [ebp - 0x490]
lea esi, [ebp - 0x4a0]
push ebx
xor ebx, ebx
mov edi, edx
mov eax, ebx
sub esp, 0x56c
mov dword [ebp - 0x4a0], 0x42
rep stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x48c], 0x104
mov dword [ebp - 0x484], 0xffff0001
mov word [edi], ax
mov eax, dword [0x40b024]
mov dword [ebp - 0x49c], eax
mov eax, dword [0x40c20c]
mov dword [ebp - 0x498], eax
mov eax, dword [0x40c210]
mov dword [ebp - 0x494], eax
mov eax, dword [0x40b020]
mov dword [ebp - 0x47e], eax
mov dword [esp], esi
call dword [sym.imp.comdlg32.dll_PrintDlgW]
sub esp, 4
test eax, eax
jne 0x40258c
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x498]
mov dword [0x40c20c], eax
mov eax, dword [ebp - 0x494]
mov dword [0x40c210], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x490]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_SetMapMode]
mov dword [ebp - 0x4f0], 0x14
mov dword [ebp - 0x4ec], 0x40b6b8
sub esp, 8
mov dword [ebp - 0x4e8], 0
mov dword [ebp - 0x4e4], 0
mov dword [ebp - 0x4e0], 0
test byte [ebp - 0x48c], 0x20
je 0x402668
mov eax, ebx
mov ecx, 0x14
lea edi, [ebp - 0x3f8]
mov esi, dword [ebp - 0x49c]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x400]
mov dword [ebp - 0x400], 0x58
mov dword [ebp - 0x3cc], 0x806
mov dword [ebp - 0x3fc], esi
mov dword [ebp - 0x3e4], str.output.prn
mov dword [ebp - 0x3e0], 0x104
mov dword [ebp - 0x3c4], 0x409104
mov dword [esp], edx
call dword [sym.imp.comdlg32.dll_GetSaveFileNameW]
sub esp, 4
test eax, eax
je 0x402584
mov dword [ebp - 0x4e8], str.output.prn
mov eax, dword [0x40b02c]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowTextLengthW]
lea ebx, [eax + 1]
sub esp, 4
lea edx, [ebx + ebx]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x53c], eax
call eax
mov dword [ebp - 0x540], eax
sub esp, 0xc
test eax, eax
je 0x403161
mov dword [esp + 8], ebx
mov edx, dword [ebp - 0x540]
mov dword [esp + 4], edx
mov eax, dword [0x40b02c]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowTextW]
mov dword [ebp - 0x51c], eax
sub esp, 0xc
lea eax, [ebp - 0x4f0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x490]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_StartDocW]
sub esp, 8
test eax, eax
jg 0x402741
mov eax, dword [ebp - 0x490]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_DeleteDC]
mov ebx, dword [ebp - 0x540]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x5a
mov eax, dword [ebp - 0x490]
mov ebx, dword [sym.imp.gdi32.dll_GetDeviceCaps]
mov dword [esp], eax
call ebx
mov edi, dword [sym.imp.kernel32.dll_MulDiv]
sub esp, 8
mov dword [esp + 8], 0x9ec
mov dword [esp + 4], eax
mov eax, dword [0x40bd90]
mov dword [esp], eax
call edi
sub esp, 0xc
mov esi, eax
mov dword [esp + 4], 0x71
mov eax, dword [ebp - 0x490]
mov dword [esp], eax
call ebx
sub esp, 8
sub esi, eax
mov dword [ebp - 0x4fc], esi
mov dword [esp + 4], 0x6f
mov eax, dword [ebp - 0x490]
mov dword [esp], eax
call ebx
sub esp, 8
mov esi, eax
mov dword [esp + 4], 0x5a
mov eax, dword [ebp - 0x490]
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [esp + 8], 0x9ec
mov dword [esp + 4], eax
mov eax, dword [0x40bd94]
mov dword [esp], eax
call edi
sub esp, 0xc
sub esi, eax
mov dword [ebp - 0x4f4], esi
mov dword [esp + 4], 0x58
mov eax, dword [ebp - 0x490]
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [esp + 8], 0x9ec
mov dword [esp + 4], eax
mov eax, dword [0x40bd98]
mov dword [esp], eax
call edi
sub esp, 0xc
mov esi, eax
mov dword [esp + 4], 0x70
mov eax, dword [ebp - 0x490]
mov dword [esp], eax
call ebx
sub esp, 8
sub esi, eax
mov dword [ebp - 0x500], esi
mov dword [esp + 4], 0x6e
mov eax, dword [ebp - 0x490]
mov dword [esp], eax
call ebx
sub esp, 8
mov esi, eax
mov dword [esp + 4], 0x58
mov eax, dword [ebp - 0x490]
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [esp + 8], 0x9ec
mov dword [esp + 4], eax
mov eax, dword [0x40bd9c]
mov dword [esp], eax
mov dword [ebp - 0x520], edi
call edi
lea edi, [ebp - 0x45c]
mov ecx, 0x17
sub esp, 0xc
sub esi, eax
mov dword [ebp - 0x4f8], esi
mov esi, 0x40b040
rep movsd dword es:[edi], dword [esi]
call dbg.get_dpi
mov dword [esp + 4], 0x5a
mov esi, eax
mov eax, dword [ebp - 0x490]
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x45c]
mov dword [esp], eax
mov edi, dword [ebp - 0x520]
call edi
sub esp, 0xc
mov dword [ebp - 0x45c], eax
lea eax, [ebp - 0x45c]
sub dword [ebp - 0x44c], 0x64
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_CreateFontIndirectW]
mov ebx, dword [sym.imp.gdi32.dll_SelectObject]
sub esp, 4
mov esi, eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x490]
mov dword [esp], eax
call ebx
sub esp, 8
cmp word [ebp - 0x480], 0
mov dword [ebp - 0x550], eax
je 0x402e37
mov eax, dword [ebp - 0x51c]
mov edx, dword [ebp - 0x540]
mov edi, 1
mov dword [ebp - 0x544], esi
mov dword [ebp - 0x548], ebx
mov ecx, edi
lea eax, [edx + eax*2]
mov dword [ebp - 0x51c], eax
xor eax, eax
mov dword [ebp - 0x530], 0
mov edi, dword [ebp - 0x540]
mov dword [ebp - 0x538], 1
mov dword [ebp - 0x54c], ecx
lea esi, [esi]
test byte [ebp - 0x48c], 2
je 0x402fc8
movzx edx, word [ebp - 0x486]
mov ebx, dword [ebp - 0x538]
cmp edx, ebx
jl 0x40314e
movzx eax, word [ebp - 0x488]
cmp eax, ebx
setle al
movzx eax, al
mov dword [ebp - 0x528], eax
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0x52c], eax
movzx eax, word [0x40bfa8]
test ax, ax
je 0x403064
mov edx, 0x40bfaa
xor ecx, ecx
xor esi, esi
jmp 0x402a03
cmp ax, 0x26
je 0x402c38
mov ebx, ecx
xor esi, esi
add ecx, 0xb
cmp ax, 0x70
cmovne ecx, ebx
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x402a1f
test esi, esi
jne 0x4029e0
cmp ax, 0x26
je 0x402c48
movzx eax, word [edx]
add edx, 2
add ecx, 1
test ax, ax
jne 0x402a03
lea edx, [ecx + ecx + 2]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x53c]
call eax
mov dword [ebp - 0x520], eax
sub esp, 0xc
test eax, eax
je 0x402e2b
movzx eax, word [0x40bfa8]
test ax, ax
je 0x40306e
mov ecx, 0x40bfaa
mov dword [ebp - 0x524], edi
xor esi, esi
xor edx, edx
mov ebx, ecx
xor edi, edi
jmp 0x402aa1
cmp ax, 0x26
je 0x402c58
xor esi, esi
cmp ax, 0x70
je 0x402f98
movzx eax, word [ebx]
add ebx, 2
test ax, ax
je 0x402acc
mov ecx, dword [ebp - 0x520]
add ecx, edx
test esi, esi
jne 0x402a80
cmp ax, 0x26
je 0x402c70
add ebx, 2
mov word [ecx], ax
add edi, 1
movzx eax, word [ebx - 2]
lea edx, [edi + edi]
test ax, ax
jne 0x402aa1
mov eax, dword [ebp - 0x520]
mov edi, dword [ebp - 0x524]
add edx, eax
xor eax, eax
mov word [edx], ax
mov edx, dword [ebp - 0x528]
test edx, edx
je 0x402b03
mov eax, dword [ebp - 0x52c]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_StartPage]
sub esp, 4
test eax, eax
jle 0x403079
lea eax, [ebp - 0x4dc]
xor esi, esi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x52c]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GetTextMetricsW]
mov ebx, dword [ebp - 0x4fc]
sub esp, 8
cmp word [0x40b4b0], 0
jne 0x403020
mov eax, dword [ebp - 0x4f4]
imul esi, dword [ebp - 0x4dc]
mov dword [ebp - 0x524], eax
mov eax, dword [ebp - 0x520]
add esi, ebx
cmp word [eax], 0
jne 0x402c80
mov ebx, esi
mov esi, dword [ebp - 0x530]
lea esi, [esi]
mov edx, dword [0x40b09c]
test esi, esi
je 0x402e78
mov eax, esi
test edx, edx
jne 0x402cd0
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 0x528]
test eax, eax
jne 0x402f18
mov eax, dword [ebp - 0x51c]
mov esi, dword [ebp - 0x524]
cmp edi, eax
setb dl
mov eax, edx
cmp ebx, esi
jge 0x402d88
test dl, dl
je 0x402d88
mov edx, dword [ebp - 0x4dc]
add edx, dword [ebp - 0x4cc]
jmp 0x402bf0
cmp ax, 0xa
lea ecx, [ebx + edx]
mov eax, dword [ebp - 0x51c]
cmove ebx, ecx
add edi, 2
cmp edi, eax
setb al
cmp ebx, esi
jge 0x402d88
test al, al
je 0x402d88
movzx eax, word [edi]
cmp ax, 0xa
je 0x402bc8
cmp ax, 0xd
je 0x402bc8
xor esi, esi
lea esi, [esi]
mov eax, dword [ebp - 0x51c]
mov ecx, dword [ebp - 0x524]
cmp edi, eax
setb al
cmp ebx, ecx
jge 0x402c25
test al, al
jne 0x402b68
mov dword [ebp - 0x530], esi
mov ebx, eax
jmp 0x402d94
add ecx, 1
xor esi, esi
jmp 0x4029f8
mov esi, 1
jmp 0x4029f8
mov esi, 0x26
add edi, 1
mov word [ecx], si
lea edx, [edi + edi]
xor esi, esi
jmp 0x402a96
mov esi, 1
jmp 0x402a96
add eax, 2
cmp word [eax], 0
jne 0x402c80
lea edx, [ebp - 0x508]
mov dword [esp + 0xc], edx
mov ebx, dword [ebp - 0x520]
sub eax, ebx
mov dword [esp + 4], ebx
sar eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x52c]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GetTextExtentPoint32W]
mov eax, dword [ebp - 0x4dc]
sub esp, 0x10
add eax, eax
sub dword [ebp - 0x524], eax
jmp 0x402b5a
lea eax, [ebp - 0x508]
mov dword [esp + 0x14], 0
lea edx, [ebp - 0x400]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x50c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x4f8]
sub eax, dword [ebp - 0x500]
mov dword [esp + 4], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x530], edx
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GetTextExtentExPointW]
mov eax, dword [ebp - 0x50c]
mov edx, dword [ebp - 0x530]
sub esp, 0x1c
cmp eax, esi
mov ecx, eax
jae 0x402d43
cmp word [ebp + eax*2 - 0x400], 0x20
jne 0x402fe0
mov ecx, dword [ebp - 0x528]
test ecx, ecx
jne 0x402f88
sub esi, eax
je 0x402b94
lea ecx, [esi + esi]
lea eax, [edx + eax*2]
mov dword [esp], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call sym._memcpy
mov eax, dword [ebp - 0x4cc]
add eax, dword [ebp - 0x4dc]
add ebx, eax
jmp 0x402c08
mov dword [ebp - 0x530], 0
mov ebx, eax
mov eax, dword [ebp - 0x520]
cmp word [eax], 0
je 0x402dc2
mov dword [esp + 4], eax
lea edx, [ebp - 0x500]
mov dword [esp], 0
mov ecx, dword [ebp - 0x528]
mov eax, dword [ebp - 0x52c]
call sym._notepad_print_header.part.0
mov eax, dword [ebp - 0x528]
test eax, eax
jne 0x40304d
mov ecx, dword [ebp - 0x520]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
add dword [ebp - 0x538], 1
mov eax, 1
sub esp, 0xc
test bl, bl
jne 0x402978
mov ecx, dword [ebp - 0x54c]
movzx edx, word [ebp - 0x480]
add ecx, 1
mov eax, 1
cmp edx, ecx
jge 0x402951
mov esi, dword [ebp - 0x544]
mov ebx, dword [ebp - 0x548]
mov eax, dword [ebp - 0x490]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_EndDoc]
mov eax, dword [ebp - 0x550]
sub esp, 4
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x490]
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [esp], esi
call dword [sym.imp.gdi32.dll_DeleteObject]
sub esp, 4
jmp 0x4026fd
mov eax, dword [ebp - 0x51c]
mov ecx, dword [ebp - 0x51c]
cmp edi, eax
jb 0x402eae
jmp 0x4030dd
mov word [ebp + esi*2 - 0x400], ax
add esi, 1
cmp esi, 0x1f3
ja 0x402ed3
add edi, 2
cmp edi, ecx
jae 0x402b76
movzx eax, word [edi]
cmp ax, 0xd
je 0x402b76
cmp ax, 0xa
je 0x402b76
cmp ax, 9
je 0x402ee0
cmp esi, 0x1f3
jbe 0x402e90
test edx, edx
je 0x402ea3
jmp 0x402b76
mov eax, 8
jmp 0x402f02
mov word [ebp + esi*2 - 0x400], 0x20
add esi, 1
sub eax, 1
je 0x402e9b
cmp esi, 0x1f3
jbe 0x402ef0
test edx, edx
je 0x402efd
jmp 0x402b76
mov dword [ebp - 0x534], esi
lea edx, [ebp - 0x400]
lea eax, [ebp - 0x500]
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], 0
mov dword [ebp - 0x530], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 4
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0x500]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x52c]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_ExtTextOutW]
mov eax, dword [ebp - 0x50c]
mov esi, dword [ebp - 0x534]
mov edx, dword [ebp - 0x530]
sub esp, 0x20
jmp 0x402d51
mov dword [ebp - 0x534], esi
mov esi, eax
jmp 0x402f24
mov eax, dword [ebp - 0x538]
mov dword [esp + 8], 0x4090c0
mov dword [esp + 4], 0xb
mov dword [esp + 0xc], eax
mov dword [esp], ecx
call dword [sym.imp.shlwapi.dll_wnsprintfW]
add edi, eax
lea edx, [edi + edi]
jmp 0x402a96
mov dword [ebp - 0x528], 1
jmp 0x4029af
test eax, eax
jne 0x402ff9
jmp 0x402d43
sub ecx, 1
je 0x402d43
cmp word [edx + ecx*2], 0x20
jne 0x402ff0
test ecx, ecx
jle 0x402d43
add ecx, 1
mov dword [ebp - 0x50c], ecx
mov eax, ecx
jmp 0x402d43
mov dword [esp + 4], 0x40b4b0
lea edx, [ebp - 0x500]
mov dword [esp], 1
mov ecx, dword [ebp - 0x528]
mov eax, dword [ebp - 0x52c]
call sym._notepad_print_header.part.0
mov esi, eax
jmp 0x402b35
mov eax, dword [ebp - 0x52c]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_EndPage]
sub esp, 4
jmp 0x402dd0
mov edx, 2
jmp 0x402a23
mov edx, dword [ebp - 0x520]
jmp 0x402ada
mov esi, dword [ebp - 0x544]
mov ebx, dword [ebp - 0x548]
mov dword [esp + 0xc], 0x30
mov dword [esp + 8], str.Print_Error
mov dword [esp + 4], str.StartPage_failed
mov eax, dword [0x40b024]
mov dword [esp], eax
call dword [sym.imp.user32.dll_MessageBoxW]
mov edx, dword [ebp - 0x520]
sub esp, 0x10
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x402e37
xor eax, eax
test edx, edx
je 0x402b80
lea eax, [ebp - 0x508]
mov dword [esp + 0x14], 0
lea edx, [ebp - 0x400]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x50c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x4f8]
sub eax, dword [ebp - 0x500]
mov dword [esp + 4], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x530], edx
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GetTextExtentExPointW]
mov eax, dword [ebp - 0x50c]
mov edx, dword [ebp - 0x530]
sub esp, 0x1c
jmp 0x402d43
mov ecx, dword [ebp - 0x54c]
test eax, eax
jne 0x402e14
jmp 0x402e2b
mov eax, dword [ebp - 0x490]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_DeleteDC]
push edi
call dbg.ShowLastError
jmp 0x402584