Function at 0x401920
Capabilities:
Access peb ldr_data
Get graphical window text
Get kernel32 base address
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ecx, 0xc
mov ebp, esp
push edi
push esi
lea edx, [ebp - 0x482]
lea esi, [ebp - 0x492]
push ebx
xor ebx, ebx
mov edi, edx
mov eax, ebx
sub esp, 0x54c
mov dword [ebp - 0x492], 0x42
rep stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x47e], 0x104
mov dword [ebp - 0x476], 0xffff0001
mov word [edi], ax
mov eax, dword [0x408004]
mov dword [esp], esi
mov dword [ebp - 0x48e], eax
mov eax, dword [0x4091ec]
mov dword [ebp - 0x48a], eax
mov eax, dword [0x4091f0]
mov dword [ebp - 0x486], eax
mov eax, dword [section..data]
mov dword [ebp - 0x470], eax
call dword [sym.imp.comdlg32.dll_PrintDlgW]
sub esp, 4
test eax, eax
jne 0x4019ac
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x48a]
mov dword [esp + 4], 1
mov dword [0x4091ec], eax
mov eax, dword [ebp - 0x486]
mov dword [0x4091f0], eax
mov eax, dword [ebp - 0x482]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_SetMapMode]
mov dword [ebp - 0x4e4], 0x14
mov dword [ebp - 0x4e0], 0x408698
sub esp, 8
mov dword [ebp - 0x4dc], 0
mov dword [ebp - 0x4d8], 0
mov dword [ebp - 0x4d4], 0
test byte [ebp - 0x47e], 0x20
je 0x401a88
mov eax, ebx
mov ecx, 0x14
lea edi, [ebp - 0x3ec]
mov esi, dword [ebp - 0x48e]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x3f4]
mov dword [ebp - 0x3f4], 0x58
mov dword [ebp - 0x3c0], 0x806
mov dword [ebp - 0x3f0], esi
mov dword [ebp - 0x3d8], str.output.prn
mov dword [ebp - 0x3d4], 0x104
mov dword [ebp - 0x3b8], 0x40a354
mov dword [esp], edx
call dword [sym.imp.comdlg32.dll_GetSaveFileNameW]
sub esp, 4
test eax, eax
je 0x4019a4
mov dword [ebp - 0x4dc], str.output.prn
mov eax, dword [0x40800c]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowTextLengthW]
lea ebx, [eax + 1]
sub esp, 4
lea edx, [ebx + ebx]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x524], eax
call eax
mov dword [ebp - 0x52c], eax
sub esp, 0xc
test eax, eax
je 0x40256f
mov ecx, dword [ebp - 0x52c]
mov eax, dword [0x40800c]
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowTextW]
sub esp, 0xc
mov dword [ebp - 0x504], eax
lea eax, [ebp - 0x4e4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x482]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_StartDocW]
sub esp, 8
test eax, eax
jg 0x401b61
mov eax, dword [ebp - 0x482]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_DeleteDC]
mov ecx, dword [ebp - 0x52c]
sub esp, 4
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x482]
mov ebx, dword [sym.imp.gdi32.dll_GetDeviceCaps]
mov dword [esp + 4], 0x5a
mov dword [esp], eax
call ebx
mov edi, dword [sym.imp.kernel32.dll_MulDiv]
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [0x408d70]
mov dword [esp + 8], 0x9ec
mov dword [esp], eax
call edi
mov esi, eax
mov eax, dword [ebp - 0x482]
sub esp, 0xc
mov dword [esp + 4], 0x71
mov dword [esp], eax
call ebx
sub esi, eax
mov eax, dword [ebp - 0x482]
sub esp, 8
mov dword [ebp - 0x4f0], esi
mov dword [esp + 4], 0x6f
mov dword [esp], eax
call ebx
mov esi, eax
mov eax, dword [ebp - 0x482]
sub esp, 8
mov dword [esp + 4], 0x5a
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [0x408d74]
mov dword [esp + 8], 0x9ec
mov dword [esp], eax
call edi
sub esi, eax
mov eax, dword [ebp - 0x482]
sub esp, 0xc
mov dword [ebp - 0x4e8], esi
mov dword [esp + 4], 0x58
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [0x408d78]
mov dword [esp + 8], 0x9ec
mov dword [esp], eax
call edi
mov esi, eax
mov eax, dword [ebp - 0x482]
sub esp, 0xc
mov dword [esp + 4], 0x70
mov dword [esp], eax
call ebx
sub esi, eax
mov eax, dword [ebp - 0x482]
sub esp, 8
mov dword [ebp - 0x4f4], esi
mov dword [esp + 4], 0x6e
mov dword [esp], eax
call ebx
mov esi, eax
mov eax, dword [ebp - 0x482]
sub esp, 8
mov dword [esp + 4], 0x58
mov dword [esp], eax
call ebx
mov dword [ebp - 0x508], edi
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [0x408d7c]
mov dword [esp + 8], 0x9ec
mov dword [esp], eax
call edi
lea edi, [ebp - 0x450]
mov ecx, 0x17
sub esi, eax
mov eax, dword [0x408004]
sub esp, 0xc
mov dword [ebp - 0x4ec], esi
mov esi, 0x408020
rep movsd dword es:[edi], dword [esi]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetDpiForWindow]
mov esi, eax
mov eax, dword [ebp - 0x482]
sub esp, 4
mov dword [esp + 4], 0x5a
mov dword [esp], eax
call ebx
mov edi, dword [ebp - 0x508]
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x450]
mov dword [esp + 8], esi
mov dword [esp], eax
call edi
sub dword [ebp - 0x440], 0x64
sub esp, 0xc
mov dword [ebp - 0x450], eax
lea eax, [ebp - 0x450]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_CreateFontIndirectW]
mov ebx, dword [sym.imp.gdi32.dll_SelectObject]
sub esp, 4
mov dword [ebp - 0x530], eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x482]
mov dword [ebp - 0x538], ebx
mov dword [esp], eax
call ebx
sub esp, 8
cmp word [ebp - 0x472], 0
mov dword [ebp - 0x534], eax
je 0x402337
mov eax, dword [ebp - 0x504]
mov ecx, dword [ebp - 0x52c]
xor edx, edx
mov dword [ebp - 0x528], 1
lea eax, [ecx + eax*2]
mov dword [ebp - 0x504], eax
mov dword [ebp - 0x520], 1
mov edi, dword [ebp - 0x52c]
xor esi, esi
test byte [ebp - 0x47e], 2
je 0x402418
movzx eax, word [ebp - 0x478]
mov ecx, dword [ebp - 0x520]
cmp eax, ecx
jl 0x4024ec
movzx eax, word [ebp - 0x47a]
cmp eax, ecx
setle al
movzx eax, al
mov dword [ebp - 0x508], eax
mov eax, dword [ebp - 0x482]
mov dword [ebp - 0x510], eax
movzx eax, word [0x408f88]
test ax, ax
je 0x40248a
mov dword [ebp - 0x50c], edi
mov edx, 0x408f8a
xor ecx, ecx
xor ebx, ebx
jmp 0x401e1b
cmp ax, 0x26
je 0x402168
mov edi, ecx
xor ebx, ebx
add ecx, 0xb
cmp ax, 0x70
cmovne ecx, edi
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x401e35
test ebx, ebx
jne 0x401df8
cmp ax, 0x26
je 0x402170
movzx eax, word [edx]
add edx, 2
inc ecx
test ax, ax
jne 0x401e1b
mov edi, dword [ebp - 0x50c]
lea edx, [ecx + ecx + 2]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x524]
call eax
mov dword [ebp - 0x514], eax
sub esp, 0xc
mov ecx, eax
test eax, eax
je 0x402337
movzx eax, word [0x408f88]
test ax, ax
je 0x40247f
xor edx, edx
mov dword [ebp - 0x50c], edi
mov ebx, 0x408f8a
mov dword [ebp - 0x518], esi
mov edi, edx
xor esi, esi
mov edx, ecx
jmp 0x401ec1
cmp ax, 0x26
je 0x402180
xor esi, esi
cmp ax, 0x70
je 0x402390
movzx eax, word [ebx]
add ebx, 2
test ax, ax
je 0x401ee2
lea ecx, [edx + edi*2]
test esi, esi
jne 0x401ea0
cmp ax, 0x26
je 0x402190
add ebx, 2
mov word [ecx], ax
inc edi
movzx eax, word [ebx - 2]
test ax, ax
jne 0x401ec1
mov eax, dword [ebp - 0x514]
mov edx, edi
mov esi, dword [ebp - 0x518]
mov edi, dword [ebp - 0x50c]
lea eax, [eax + edx*2]
mov ecx, dword [ebp - 0x508]
xor edx, edx
mov word [eax], dx
test ecx, ecx
je 0x401f22
mov eax, dword [ebp - 0x510]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_StartPage]
sub esp, 4
test eax, eax
jle 0x402494
lea eax, [ebp - 0x4d0]
xor ebx, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x510]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GetTextMetricsW]
mov eax, dword [ebp - 0x4f0]
sub esp, 8
cmp word [0x408490], 0
mov dword [ebp - 0x50c], eax
jne 0x402430
mov eax, dword [ebp - 0x4e8]
imul ebx, dword [ebp - 0x4d0]
add ebx, dword [ebp - 0x50c]
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 0x514]
cmp word [eax], 0
jne 0x4021a0
lea esi, [esi]
nop
mov edx, dword [0x40807c]
test esi, esi
je 0x402030
test edx, edx
jne 0x402098
mov edx, esi
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x500], edx
test ecx, ecx
jne 0x402228
cmp dword [ebp - 0x504], edi
jbe 0x402298
mov esi, dword [ebp - 0x50c]
cmp ebx, esi
jge 0x402298
mov ecx, dword [ebp - 0x4c0]
add ecx, dword [ebp - 0x4d0]
jmp 0x402001
cmp ax, 0xa
lea edx, [ebx + ecx]
cmove ebx, edx
add edi, 2
cmp dword [ebp - 0x504], edi
jbe 0x402298
cmp ebx, esi
jge 0x402298
movzx eax, word [edi]
cmp ax, 0xa
je 0x401fe0
cmp ax, 0xd
je 0x401fe0
cmp dword [ebp - 0x504], edi
jbe 0x402298
xor esi, esi
mov edx, dword [0x40807c]
test esi, esi
jne 0x401f96
lea esi, [esi]
mov ecx, dword [ebp - 0x504]
cmp dword [ebp - 0x504], edi
ja 0x402064
jmp 0x402500
mov word [ebp + esi*2 - 0x3f4], ax
inc esi
cmp esi, 0x1f3
ja 0x40208d
add edi, 2
cmp ecx, edi
jbe 0x401f96
movzx eax, word [edi]
cmp ax, 0xd
je 0x401f96
cmp ax, 0xa
je 0x401f96
cmp ax, 9
je 0x4021f8
cmp esi, 0x1f3
jbe 0x402048
test edx, edx
je 0x402059
lea esi, [esi]
lea eax, [ebp - 0x4fc]
lea ecx, [ebp - 0x3f4]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x500]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x4ec]
sub eax, dword [ebp - 0x4f4]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x518], ecx
mov dword [esp + 8], esi
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GetTextExtentExPointW]
mov eax, dword [ebp - 0x500]
mov ecx, dword [ebp - 0x518]
sub esp, 0x1c
cmp eax, esi
mov edx, eax
jae 0x40210b
cmp word [ebp + eax*2 - 0x3f4], 0x20
jne 0x4023d0
mov edx, dword [ebp - 0x508]
test edx, edx
jne 0x402380
sub esi, eax
je 0x401fb4
lea edx, [esi + esi]
lea eax, [ecx + eax*2]
mov dword [esp], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call sym._memcpy
mov eax, dword [ebp - 0x4c0]
add eax, dword [ebp - 0x4d0]
add ebx, eax
cmp dword [ebp - 0x504], edi
jbe 0x40229a
cmp ebx, dword [ebp - 0x50c]
jl 0x401f88
jmp 0x40229a
inc ecx
xor ebx, ebx
jmp 0x401e10
mov ebx, 1
jmp 0x401e10
mov esi, 0x26
inc edi
mov word [ecx], si
xor esi, esi
jmp 0x401eb6
mov esi, 1
jmp 0x401eb6
add eax, 2
cmp word [eax], 0
jne 0x4021a0
mov ecx, dword [ebp - 0x514]
lea edx, [ebp - 0x4fc]
mov dword [esp + 0xc], edx
sub eax, ecx
mov dword [esp + 4], ecx
sar eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x510]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GetTextExtentPoint32W]
mov eax, dword [ebp - 0x4d0]
mov ecx, dword [ebp - 0x50c]
sub esp, 0x10
neg eax
lea eax, [ecx + eax*2]
mov dword [ebp - 0x50c], eax
jmp 0x401f88
mov eax, 8
jmp 0x402212
mov word [ebp + esi*2 - 0x3f4], 0x20
inc esi
dec eax
je 0x402051
cmp esi, 0x1f3
jbe 0x402200
test edx, edx
je 0x40220b
jmp 0x402098
mov dword [ebp - 0x51c], esi
lea ecx, [ebp - 0x3f4]
lea eax, [ebp - 0x4f4]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x4f4]
mov dword [esp + 0x14], ecx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x518], ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], 4
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_ExtTextOutW]
mov eax, dword [ebp - 0x500]
mov esi, dword [ebp - 0x51c]
mov ecx, dword [ebp - 0x518]
sub esp, 0x20
jmp 0x402119
xor esi, esi
mov eax, dword [ebp - 0x514]
cmp word [eax], 0
je 0x4022c8
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x508]
lea edx, [ebp - 0x4f4]
mov dword [esp], 0
mov eax, dword [ebp - 0x510]
call sym._notepad_print_header.part.0
mov eax, dword [ebp - 0x508]
test eax, eax
jne 0x40245d
mov ecx, dword [ebp - 0x514]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
inc dword [ebp - 0x520]
mov edx, 1
sub esp, 0xc
cmp dword [ebp - 0x504], edi
ja 0x401d90
inc dword [ebp - 0x528]
mov ecx, dword [ebp - 0x528]
mov edx, 1
movzx eax, word [ebp - 0x472]
cmp eax, ecx
jge 0x401d7e
mov eax, dword [ebp - 0x482]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_EndDoc]
mov eax, dword [ebp - 0x534]
sub esp, 4
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x482]
mov dword [esp], eax
mov eax, dword [ebp - 0x538]
call eax
mov eax, dword [ebp - 0x530]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_DeleteObject]
sub esp, 4
jmp 0x401b1d
mov dword [ebp - 0x51c], esi
mov esi, eax
jmp 0x402234
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x51c], edx
mov dword [esp + 8], 0x40a480
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xb
mov dword [esp], ecx
call dword [sym.imp.shlwapi.dll_wnsprintfW]
mov edx, dword [ebp - 0x51c]
add edi, eax
jmp 0x401eb6
test eax, eax
je 0x40210b
mov dword [ebp - 0x518], edi
nop
mov edi, edx
dec edx
je 0x402474
cmp word [ecx + edx*2], 0x20
jne 0x4023e0
mov dword [ebp - 0x51c], edi
mov edi, dword [ebp - 0x518]
test edx, edx
jle 0x40210b
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x500], eax
jmp 0x40210b
mov dword [ebp - 0x508], 1
jmp 0x401dc7
mov dword [esp + 4], 0x408490
mov ecx, dword [ebp - 0x508]
lea edx, [ebp - 0x4f4]
mov dword [esp], 1
mov eax, dword [ebp - 0x510]
call sym._notepad_print_header.part.0
mov ebx, eax
jmp 0x401f5a
mov eax, dword [ebp - 0x510]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_EndPage]
sub esp, 4
jmp 0x4022d6
mov edi, dword [ebp - 0x518]
jmp 0x40210b
mov eax, dword [ebp - 0x514]
jmp 0x401ef9
mov edx, 2
jmp 0x401e3f
mov eax, dword [0x408004]
mov dword [esp + 0xc], 0x30
mov dword [esp + 8], str.Print_Error
mov dword [esp + 4], str.StartPage_failed
mov dword [esp], eax
call dword [sym.imp.user32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x514]
sub esp, 0x10
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x402337
test edx, edx
jne 0x402317
jmp 0x402337
test edx, edx
je 0x401fa0
lea eax, [ebp - 0x4fc]
lea ecx, [ebp - 0x3f4]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x500]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x4ec]
sub eax, dword [ebp - 0x4f4]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x518], ecx
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GetTextExtentExPointW]
mov eax, dword [ebp - 0x500]
mov ecx, dword [ebp - 0x518]
sub esp, 0x1c
jmp 0x40210b
mov eax, dword [ebp - 0x482]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_DeleteDC]
push edi
call sym._ShowLastError
jmp 0x4019a4