Function at 0x4024d0
Capabilities:
Access peb ldr_data
Get graphical window text
Get kernel32 base address
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ecx, 0xc
mov ebp, esp
push edi
push esi
lea edx, [ebp - 0x484]
lea esi, [ebp - 0x494]
push ebx
xor ebx, ebx
mov edi, edx
mov eax, ebx
sub esp, 0x550
mov dword [ebp - 0x494], 0x42
rep stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x480], 0x104
mov dword [ebp - 0x478], 0xffff0001
mov word [edi], ax
mov eax, dword [0x40b024]
mov dword [ebp - 0x490], eax
mov eax, dword [0x40c20c]
mov dword [ebp - 0x48c], eax
mov eax, dword [0x40c210]
mov dword [ebp - 0x488], eax
mov eax, dword [0x40b020]
mov dword [ebp - 0x472], eax
mov dword [esp], esi
call dword [sym.imp.comdlg32.dll_PrintDlgW]
sub esp, 4
test eax, eax
jne 0x40255c
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x48c]
mov dword [0x40c20c], eax
mov eax, dword [ebp - 0x488]
mov dword [0x40c210], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x484]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_SetMapMode]
mov dword [ebp - 0x4e4], 0x14
mov dword [ebp - 0x4e0], 0x40b6b8
sub esp, 8
mov dword [ebp - 0x4dc], 0
mov dword [ebp - 0x4d8], 0
mov dword [ebp - 0x4d4], 0
test byte [ebp - 0x480], 0x20
je 0x402638
mov eax, ebx
mov ecx, 0x14
lea edi, [ebp - 0x3ec]
mov esi, dword [ebp - 0x490]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x3f4]
mov dword [ebp - 0x3f4], 0x58
mov dword [ebp - 0x3c0], 0x806
mov dword [ebp - 0x3f0], esi
mov dword [ebp - 0x3d8], str.output.prn
mov dword [ebp - 0x3d4], 0x104
mov dword [ebp - 0x3b8], 0x409104
mov dword [esp], edx
call dword [sym.imp.comdlg32.dll_GetSaveFileNameW]
sub esp, 4
test eax, eax
je 0x402554
mov dword [ebp - 0x4dc], str.output.prn
mov eax, dword [0x40b02c]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowTextLengthW]
lea ebx, [eax + 1]
sub esp, 4
lea edx, [ebx + ebx]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x528], eax
call eax
mov dword [ebp - 0x52c], eax
sub esp, 0xc
test eax, eax
je 0x40316b
mov dword [esp + 8], ebx
mov ecx, dword [ebp - 0x52c]
mov dword [esp + 4], ecx
mov eax, dword [0x40b02c]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowTextW]
mov dword [ebp - 0x504], eax
sub esp, 0xc
lea eax, [ebp - 0x4e4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x484]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_StartDocW]
sub esp, 8
test eax, eax
jg 0x402711
mov eax, dword [ebp - 0x484]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_DeleteDC]
mov ecx, dword [ebp - 0x52c]
sub esp, 4
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x5a
mov eax, dword [ebp - 0x484]
mov ebx, dword [sym.imp.gdi32.dll_GetDeviceCaps]
mov dword [esp], eax
call ebx
mov edi, dword [sym.imp.kernel32.dll_MulDiv]
sub esp, 8
mov dword [esp + 8], 0x9ec
mov dword [esp + 4], eax
mov eax, dword [0x40bd90]
mov dword [esp], eax
call edi
sub esp, 0xc
mov esi, eax
mov dword [esp + 4], 0x71
mov eax, dword [ebp - 0x484]
mov dword [esp], eax
call ebx
sub esp, 8
sub esi, eax
mov dword [ebp - 0x4f0], esi
mov dword [esp + 4], 0x6f
mov eax, dword [ebp - 0x484]
mov dword [esp], eax
call ebx
sub esp, 8
mov esi, eax
mov dword [esp + 4], 0x5a
mov eax, dword [ebp - 0x484]
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [esp + 8], 0x9ec
mov dword [esp + 4], eax
mov eax, dword [0x40bd94]
mov dword [esp], eax
call edi
sub esp, 0xc
sub esi, eax
mov dword [ebp - 0x4e8], esi
mov dword [esp + 4], 0x58
mov eax, dword [ebp - 0x484]
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [esp + 8], 0x9ec
mov dword [esp + 4], eax
mov eax, dword [0x40bd98]
mov dword [esp], eax
call edi
sub esp, 0xc
mov esi, eax
mov dword [esp + 4], 0x70
mov eax, dword [ebp - 0x484]
mov dword [esp], eax
call ebx
sub esp, 8
sub esi, eax
mov dword [ebp - 0x4f4], esi
mov dword [esp + 4], 0x6e
mov eax, dword [ebp - 0x484]
mov dword [esp], eax
call ebx
sub esp, 8
mov esi, eax
mov dword [esp + 4], 0x58
mov eax, dword [ebp - 0x484]
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [esp + 8], 0x9ec
mov dword [esp + 4], eax
mov eax, dword [0x40bd9c]
mov dword [esp], eax
mov dword [ebp - 0x508], edi
call edi
lea edi, [ebp - 0x450]
mov ecx, 0x17
sub esi, eax
mov eax, dword [0x40b024]
sub esp, 0xc
mov dword [ebp - 0x4ec], esi
mov esi, 0x40b040
rep movsd dword es:[edi], dword [esi]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetDpiForWindow]
sub esp, 4
mov esi, eax
mov dword [esp + 4], 0x5a
mov eax, dword [ebp - 0x484]
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x450]
mov dword [esp], eax
mov edi, dword [ebp - 0x508]
call edi
sub dword [ebp - 0x440], 0x64
mov dword [ebp - 0x450], eax
sub esp, 0xc
lea eax, [ebp - 0x450]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_CreateFontIndirectW]
mov ebx, dword [sym.imp.gdi32.dll_SelectObject]
sub esp, 4
mov esi, eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x484]
mov dword [esp], eax
call ebx
sub esp, 8
cmp word [ebp - 0x474], 0
mov dword [ebp - 0x53c], eax
je 0x402e15
mov ecx, dword [ebp - 0x52c]
mov eax, dword [ebp - 0x504]
mov edi, 1
mov dword [ebp - 0x530], esi
mov dword [ebp - 0x534], ebx
lea eax, [ecx + eax*2]
mov ecx, edi
mov dword [ebp - 0x504], eax
xor eax, eax
mov edx, dword [ebp - 0x52c]
mov dword [ebp - 0x538], ecx
xor edi, edi
mov dword [ebp - 0x524], 1
mov dword [ebp - 0x508], edx
lea esi, cs:[esi]
test byte [ebp - 0x480], 2
je 0x402fb0
movzx edx, word [ebp - 0x47a]
mov ecx, dword [ebp - 0x524]
cmp edx, ecx
jl 0x403158
movzx eax, word [ebp - 0x47c]
cmp eax, ecx
setle al
movzx eax, al
mov dword [ebp - 0x514], eax
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x518], eax
movzx eax, word [0x40bfa8]
test ax, ax
je 0x40304d
mov edx, 0x40bfaa
xor ecx, ecx
xor esi, esi
jmp 0x4029d3
cmp ax, 0x26
je 0x402c08
mov ebx, ecx
xor esi, esi
add ecx, 0xb
cmp ax, 0x70
cmovne ecx, ebx
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x4029ef
test esi, esi
jne 0x4029b0
cmp ax, 0x26
je 0x402c18
movzx eax, word [edx]
add edx, 2
add ecx, 1
test ax, ax
jne 0x4029d3
lea edx, [ecx + ecx + 2]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x528]
call eax
mov dword [ebp - 0x50c], eax
sub esp, 0xc
test eax, eax
je 0x402e09
movzx eax, word [0x40bfa8]
test ax, ax
je 0x403057
xor ecx, ecx
mov dword [ebp - 0x510], edi
mov esi, 0x40bfaa
xor ebx, ebx
xor edx, edx
mov edi, ecx
jmp 0x402a71
cmp ax, 0x26
je 0x402c28
xor edi, edi
cmp ax, 0x70
je 0x402f80
movzx eax, word [esi]
add esi, 2
test ax, ax
je 0x402a9c
mov ecx, dword [ebp - 0x50c]
add ecx, edx
test edi, edi
jne 0x402a50
cmp ax, 0x26
je 0x402c40
add esi, 2
mov word [ecx], ax
add ebx, 1
movzx eax, word [esi - 2]
lea edx, [ebx + ebx]
test ax, ax
jne 0x402a71
mov eax, dword [ebp - 0x50c]
mov edi, dword [ebp - 0x510]
add edx, eax
xor eax, eax
mov word [edx], ax
mov edx, dword [ebp - 0x514]
test edx, edx
je 0x402ad3
mov eax, dword [ebp - 0x518]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_StartPage]
sub esp, 4
test eax, eax
jle 0x403062
lea eax, [ebp - 0x4d0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x518]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GetTextMetricsW]
xor eax, eax
mov ebx, dword [ebp - 0x4f0]
sub esp, 8
cmp word [0x40b4b0], 0
jne 0x403000
neg eax
and eax, dword [ebp - 0x4d0]
lea esi, [eax + ebx]
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0x50c]
cmp word [eax], 0
jne 0x402c50
mov ebx, esi
mov esi, dword [ebp - 0x508]
lea esi, [esi]
mov edx, dword [0x40b09c]
test edi, edi
je 0x402e50
mov eax, edi
test edx, edx
jne 0x402ca0
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x500], eax
test ecx, ecx
jne 0x402ef8
mov eax, dword [ebp - 0x504]
mov edi, dword [ebp - 0x510]
cmp esi, eax
setb dl
mov eax, edx
cmp ebx, edi
jge 0x402d68
test dl, dl
je 0x402d68
mov edx, dword [ebp - 0x4c0]
add edx, dword [ebp - 0x4d0]
jmp 0x402bc0
cmp ax, 0xa
lea ecx, [ebx + edx]
mov eax, dword [ebp - 0x504]
cmove ebx, ecx
add esi, 2
cmp esi, eax
setb al
cmp ebx, edi
jge 0x402d68
test al, al
je 0x402d68
movzx eax, word [esi]
cmp ax, 0xa
je 0x402b98
cmp ax, 0xd
je 0x402b98
xor edi, edi
lea esi, [esi]
mov eax, dword [ebp - 0x504]
mov ecx, dword [ebp - 0x510]
cmp esi, eax
setb al
cmp ebx, ecx
jge 0x402bf5
test al, al
jne 0x402b38
mov dword [ebp - 0x508], esi
mov ebx, eax
jmp 0x402d72
add ecx, 1
xor esi, esi
jmp 0x4029c8
mov esi, 1
jmp 0x4029c8
mov edi, 0x26
add ebx, 1
mov word [ecx], di
lea edx, [ebx + ebx]
xor edi, edi
jmp 0x402a66
mov edi, 1
jmp 0x402a66
add eax, 2
cmp word [eax], 0
jne 0x402c50
lea edx, [ebp - 0x4fc]
mov dword [esp + 0xc], edx
mov ecx, dword [ebp - 0x50c]
sub eax, ecx
mov dword [esp + 4], ecx
sar eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x518]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GetTextExtentPoint32W]
mov eax, dword [ebp - 0x4d0]
sub esp, 0x10
add eax, eax
sub dword [ebp - 0x510], eax
jmp 0x402b2c
lea eax, [ebp - 0x4fc]
mov dword [esp + 0x14], 0
lea ecx, [ebp - 0x3f4]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x500]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x4ec]
sub eax, dword [ebp - 0x4f4]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x51c], ecx
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GetTextExtentExPointW]
mov eax, dword [ebp - 0x500]
mov ecx, dword [ebp - 0x51c]
sub esp, 0x1c
cmp eax, edi
mov dword [ebp - 0x508], eax
jae 0x402d15
lea edx, [ecx + eax*2]
cmp word [edx], 0x20
jne 0x402fc0
mov edx, dword [ebp - 0x514]
test edx, edx
jne 0x402f70
mov eax, dword [ebp - 0x508]
sub edi, eax
je 0x402b64
mov eax, dword [ebp - 0x508]
lea eax, [ecx + eax*2]
mov edx, eax
lea eax, [edi + edi]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp], ecx
call sym._memcpy
mov eax, dword [ebp - 0x4c0]
add eax, dword [ebp - 0x4d0]
add ebx, eax
jmp 0x402bd8
mov dword [ebp - 0x508], esi
mov ebx, eax
xor edi, edi
mov eax, dword [ebp - 0x50c]
cmp word [eax], 0
je 0x402da0
mov dword [esp + 4], eax
lea edx, [ebp - 0x4f4]
mov dword [esp], 0
mov ecx, dword [ebp - 0x514]
mov eax, dword [ebp - 0x518]
call sym._notepad_print_header.part.0
mov eax, dword [ebp - 0x514]
test eax, eax
jne 0x40302b
mov ecx, dword [ebp - 0x50c]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
add dword [ebp - 0x524], 1
mov eax, 1
sub esp, 0xc
test bl, bl
jne 0x402950
mov ecx, dword [ebp - 0x538]
movzx edx, word [ebp - 0x474]
add ecx, 1
mov eax, 1
cmp edx, ecx
jge 0x40292d
mov esi, dword [ebp - 0x530]
mov ebx, dword [ebp - 0x534]
mov eax, dword [ebp - 0x484]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_EndDoc]
mov eax, dword [ebp - 0x53c]
sub esp, 4
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x484]
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [esp], esi
call dword [sym.imp.gdi32.dll_DeleteObject]
sub esp, 4
jmp 0x4026cd
mov eax, dword [ebp - 0x504]
cmp esi, eax
jae 0x4030c6
mov dword [ebp - 0x508], ebx
mov ebx, dword [ebp - 0x504]
jmp 0x402e8a
mov word [ebp + edi*2 - 0x3f4], ax
add edi, 1
cmp edi, 0x1f3
ja 0x402ea7
add esi, 2
cmp esi, ebx
jae 0x402eb0
movzx eax, word [esi]
cmp ax, 0xa
je 0x402eb0
cmp ax, 0xd
je 0x402eb0
cmp ax, 9
je 0x402ec0
cmp edi, 0x1f3
jbe 0x402e70
test edx, edx
je 0x402e83
lea esi, cs:[esi]
mov ebx, dword [ebp - 0x508]
jmp 0x402b46
mov eax, 8
cmp edi, 0x1f3
ja 0x402ee9
mov word [ebp + edi*2 - 0x3f4], 0x20
lea ecx, [edi + 1]
mov edi, ecx
sub eax, 1
je 0x402e7b
cmp edi, 0x1f3
jbe 0x402ecd
test edx, edx
invalid