Function at 0x4025b0
Capabilities:
Access peb ldr_data
Get graphical window text
Get kernel32 base address
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ecx, 0xc
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x48c]
lea edx, [ebp - 0x49e]
push ebx
xor ebx, ebx
mov eax, ebx
sub esp, 0x56c
mov dword [ebp - 0x48e], 0
mov dword [ebp - 0x460], 0
rep stosd dword es:[edi], eax
mov dword [esp], edx
mov dword [ebp - 0x49e], 0x42
mov dword [ebp - 0x48a], 0x104
mov eax, dword [0x40b024]
mov dword [ebp - 0x482], 0xffff0001
mov dword [ebp - 0x49a], eax
mov eax, dword [0x40c20c]
mov dword [ebp - 0x496], eax
mov eax, dword [0x40c210]
mov dword [ebp - 0x492], eax
mov eax, dword [0x40b020]
mov dword [ebp - 0x47c], eax
call dword [sym.imp.comdlg32.dll_PrintDlgW]
sub esp, 4
test eax, eax
jne 0x402649
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x496]
mov dword [esp + 4], 1
mov dword [0x40c20c], eax
mov eax, dword [ebp - 0x492]
mov dword [0x40c210], eax
mov eax, dword [ebp - 0x48e]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_SetMapMode]
mov dword [ebp - 0x4f0], 0x14
mov dword [ebp - 0x4ec], 0x40b6b8
sub esp, 8
mov dword [ebp - 0x4e8], 0
mov dword [ebp - 0x4e4], 0
mov dword [ebp - 0x4e0], 0
test byte [ebp - 0x48a], 0x20
je 0x402725
mov eax, ebx
mov ecx, 0x14
lea edi, [ebp - 0x3f8]
mov esi, dword [ebp - 0x49a]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x400]
mov dword [ebp - 0x400], 0x58
mov dword [ebp - 0x3cc], 0x806
mov dword [ebp - 0x3fc], esi
mov dword [ebp - 0x3e4], str.output.prn
mov dword [ebp - 0x3e0], 0x104
mov dword [ebp - 0x3c4], 0x409144
mov dword [esp], edx
call dword [sym.imp.comdlg32.dll_GetSaveFileNameW]
sub esp, 4
test eax, eax
je 0x402641
mov dword [ebp - 0x4e8], str.output.prn
mov eax, dword [0x40b02c]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowTextLengthW]
lea ebx, [eax + 1]
sub esp, 4
lea edx, [ebx + ebx]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x53c], eax
call eax
mov dword [ebp - 0x544], eax
sub esp, 0xc
test eax, eax
je 0x40322f
mov ecx, dword [ebp - 0x544]
mov eax, dword [0x40b02c]
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowTextW]
sub esp, 0xc
mov dword [ebp - 0x51c], eax
lea eax, [ebp - 0x4f0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x48e]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_StartDocW]
sub esp, 8
test eax, eax
jg 0x4027fe
mov eax, dword [ebp - 0x48e]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_DeleteDC]
mov ecx, dword [ebp - 0x544]
sub esp, 4
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x48e]
mov ebx, dword [sym.imp.gdi32.dll_GetDeviceCaps]
mov dword [esp + 4], 0x5a
mov dword [esp], eax
call ebx
mov edi, dword [sym.imp.kernel32.dll_MulDiv]
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [0x40bd90]
mov dword [esp + 8], 0x9ec
mov dword [esp], eax
call edi
mov esi, eax
mov eax, dword [ebp - 0x48e]
sub esp, 0xc
mov dword [esp + 4], 0x71
mov dword [esp], eax
call ebx
sub esi, eax
mov eax, dword [ebp - 0x48e]
sub esp, 8
mov dword [ebp - 0x4fc], esi
mov dword [esp + 4], 0x6f
mov dword [esp], eax
call ebx
mov esi, eax
mov eax, dword [ebp - 0x48e]
sub esp, 8
mov dword [esp + 4], 0x5a
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [0x40bd94]
mov dword [esp + 8], 0x9ec
mov dword [esp], eax
call edi
sub esi, eax
mov eax, dword [ebp - 0x48e]
sub esp, 0xc
mov dword [ebp - 0x4f4], esi
mov dword [esp + 4], 0x58
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [0x40bd98]
mov dword [esp + 8], 0x9ec
mov dword [esp], eax
call edi
mov esi, eax
mov eax, dword [ebp - 0x48e]
sub esp, 0xc
mov dword [esp + 4], 0x70
mov dword [esp], eax
call ebx
sub esi, eax
mov eax, dword [ebp - 0x48e]
sub esp, 8
mov dword [ebp - 0x500], esi
mov dword [esp + 4], 0x6e
mov dword [esp], eax
call ebx
mov esi, eax
mov eax, dword [ebp - 0x48e]
sub esp, 8
mov dword [esp + 4], 0x58
mov dword [esp], eax
call ebx
mov dword [ebp - 0x520], edi
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [0x40bd9c]
mov dword [esp + 8], 0x9ec
mov dword [esp], eax
call edi
lea edi, [ebp - 0x45c]
mov ecx, 0x17
sub esp, 0xc
sub esi, eax
mov dword [ebp - 0x4f8], esi
mov esi, 0x40b040
rep movsd dword es:[edi], dword [esi]
call dbg.get_dpi
mov dword [esp + 4], 0x5a
mov esi, eax
mov eax, dword [ebp - 0x48e]
mov dword [esp], eax
call ebx
mov edi, dword [ebp - 0x520]
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x45c]
mov dword [esp + 8], esi
mov dword [esp], eax
call edi
sub esp, 0xc
mov dword [ebp - 0x45c], eax
lea eax, [ebp - 0x45c]
sub dword [ebp - 0x44c], 0x64
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_CreateFontIndirectW]
mov ebx, dword [sym.imp.gdi32.dll_SelectObject]
sub esp, 4
mov dword [ebp - 0x548], eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x48e]
mov dword [ebp - 0x550], ebx
mov dword [esp], eax
call ebx
sub esp, 8
cmp word [ebp - 0x47e], 0
mov dword [ebp - 0x54c], eax
je 0x402ff1
mov eax, dword [ebp - 0x51c]
mov ecx, dword [ebp - 0x544]
xor edx, edx
mov dword [ebp - 0x540], 1
lea eax, [ecx + eax*2]
mov dword [ebp - 0x51c], eax
mov dword [ebp - 0x538], 1
mov edi, dword [ebp - 0x544]
xor esi, esi
lea esi, [esi]
test byte [ebp - 0x48a], 2
je 0x4030e0
movzx eax, word [ebp - 0x484]
mov ecx, dword [ebp - 0x538]
cmp eax, ecx
jl 0x4031ac
movzx eax, word [ebp - 0x486]
cmp eax, ecx
setle al
movzx eax, al
mov dword [ebp - 0x520], eax
mov eax, dword [ebp - 0x48e]
mov dword [ebp - 0x528], eax
movzx eax, word [0x40bfa8]
test ax, ax
je 0x40314a
mov dword [ebp - 0x524], edi
mov edx, 0x40bfaa
xor ecx, ecx
xor ebx, ebx
jmp 0x402ab3
cmp ax, 0x26
je 0x402e08
mov edi, ecx
xor ebx, ebx
add ecx, 0xb
cmp ax, 0x70
cmovne ecx, edi
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x402acf
test ebx, ebx
jne 0x402a90
cmp ax, 0x26
je 0x402e18
movzx eax, word [edx]
add edx, 2
add ecx, 1
test ax, ax
jne 0x402ab3
mov edi, dword [ebp - 0x524]
lea edx, [ecx + ecx + 2]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x53c]
call eax
mov dword [ebp - 0x52c], eax
sub esp, 0xc
test eax, eax
je 0x402ff1
movzx eax, word [0x40bfa8]
test ax, ax
je 0x40313f
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x524], edi
mov ebx, 0x40bfaa
mov dword [ebp - 0x530], esi
mov edi, edx
mov esi, ecx
mov edx, dword [ebp - 0x52c]
jmp 0x402b61
cmp ax, 0x26
je 0x402e28
xor edi, edi
cmp ax, 0x70
je 0x403050
movzx eax, word [ebx]
add ebx, 2
test ax, ax
je 0x402b84
lea ecx, [edx + esi*2]
test edi, edi
jne 0x402b40
cmp ax, 0x26
je 0x402e40
add ebx, 2
mov word [ecx], ax
add esi, 1
movzx eax, word [ebx - 2]
test ax, ax
jne 0x402b61
mov eax, dword [ebp - 0x52c]
mov ecx, esi
mov edi, dword [ebp - 0x524]
mov esi, dword [ebp - 0x530]
lea eax, [eax + ecx*2]
mov ecx, dword [ebp - 0x520]
xor edx, edx
mov word [eax], dx
test ecx, ecx
je 0x402bc4
mov eax, dword [ebp - 0x528]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_StartPage]
sub esp, 4
test eax, eax
jle 0x403154
lea eax, [ebp - 0x4dc]
xor ebx, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x528]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GetTextMetricsW]
mov eax, dword [ebp - 0x4fc]
sub esp, 8
cmp word [0x40b4b0], 0
mov dword [ebp - 0x524], eax
jne 0x4030f0
mov eax, dword [ebp - 0x4f4]
imul ebx, dword [ebp - 0x4dc]
add ebx, dword [ebp - 0x524]
mov dword [ebp - 0x524], eax
mov eax, dword [ebp - 0x52c]
cmp word [eax], 0
jne 0x402e50
lea esi, [esi]
mov edx, dword [0x40b09c]
test esi, esi
je 0x402cd0
test edx, edx
jne 0x402d38
mov edx, esi
mov ecx, dword [ebp - 0x520]
mov dword [ebp - 0x50c], edx
test ecx, ecx
jne 0x402ee0
cmp dword [ebp - 0x51c], edi
jbe 0x402f50
mov esi, dword [ebp - 0x524]
cmp ebx, esi
jge 0x402f50
mov ecx, dword [ebp - 0x4dc]
add ecx, dword [ebp - 0x4cc]
jmp 0x402ca1
cmp ax, 0xa
lea edx, [ebx + ecx]
cmove ebx, edx
add edi, 2
cmp dword [ebp - 0x51c], edi
jbe 0x402f50
cmp ebx, esi
jge 0x402f50
movzx eax, word [edi]
cmp ax, 0xa
je 0x402c80
cmp ax, 0xd
je 0x402c80
cmp dword [ebp - 0x51c], edi
jbe 0x402f50
xor esi, esi
mov edx, dword [0x40b09c]
test esi, esi
jne 0x402c36
lea esi, [esi]
mov ecx, dword [ebp - 0x51c]
cmp dword [ebp - 0x51c], edi
ja 0x402d06
jmp 0x4031c0
mov word [ebp + esi*2 - 0x400], ax
add esi, 1
cmp esi, 0x1f3
ja 0x402d2f
add edi, 2
cmp ecx, edi
jbe 0x402c36
movzx eax, word [edi]
cmp ax, 0xd
je 0x402c36
cmp ax, 0xa
je 0x402c36
cmp ax, 9
je 0x402ea0
cmp esi, 0x1f3
jbe 0x402ce8
test edx, edx
je 0x402cfb
lea esi, [esi]
nop
lea eax, [ebp - 0x508]
lea ecx, [ebp - 0x400]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x50c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x4f8]
sub eax, dword [ebp - 0x500]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x530], ecx
mov dword [esp + 8], esi
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GetTextExtentExPointW]
mov eax, dword [ebp - 0x50c]
mov ecx, dword [ebp - 0x530]
sub esp, 0x1c
cmp eax, esi
mov edx, eax
jae 0x402dab
cmp word [ebp + eax*2 - 0x400], 0x20
jne 0x403090
mov edx, dword [ebp - 0x520]
test edx, edx
jne 0x403040
sub esi, eax
je 0x402c54
lea edx, [esi + esi]
lea eax, [ecx + eax*2]
mov dword [esp], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call sym._memcpy
mov eax, dword [ebp - 0x4cc]
add eax, dword [ebp - 0x4dc]
add ebx, eax
cmp dword [ebp - 0x51c], edi
jbe 0x402f52
cmp ebx, dword [ebp - 0x524]
jl 0x402c28
jmp 0x402f52
add ecx, 1
xor ebx, ebx
jmp 0x402aa8
mov ebx, 1
jmp 0x402aa8
mov edi, 0x26
add esi, 1
mov word [ecx], di
xor edi, edi
jmp 0x402b56
mov edi, 1
jmp 0x402b56
add eax, 2
cmp word [eax], 0
jne 0x402e50
mov ecx, dword [ebp - 0x52c]
lea edx, [ebp - 0x508]
mov dword [esp + 0xc], edx
sub eax, ecx
mov dword [esp + 4], ecx
sar eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x528]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GetTextExtentPoint32W]
mov eax, dword [ebp - 0x4dc]
sub esp, 0x10
add eax, eax
sub dword [ebp - 0x524], eax
jmp 0x402c28
mov eax, 8
jmp 0x402ec6
mov word [ebp + esi*2 - 0x400], 0x20
add esi, 1
sub eax, 1
je 0x402cf3
cmp esi, 0x1f3
jbe 0x402eb0
test edx, edx
je 0x402ebd
jmp 0x402d38
mov dword [ebp - 0x534], esi
lea ecx, [ebp - 0x400]
lea eax, [ebp - 0x500]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x500]
mov dword [esp + 0x14], ecx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x530], ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], 4
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_ExtTextOutW]
mov eax, dword [ebp - 0x50c]
mov esi, dword [ebp - 0x534]
mov ecx, dword [ebp - 0x530]
sub esp, 0x20
jmp 0x402db9
xor esi, esi
mov eax, dword [ebp - 0x52c]
cmp word [eax], 0
je 0x402f80
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x520]
lea edx, [ebp - 0x500]
mov dword [esp], 0
mov eax, dword [ebp - 0x528]
call sym._notepad_print_header.part.0
mov eax, dword [ebp - 0x520]
test eax, eax
jne 0x40311d
mov ecx, dword [ebp - 0x52c]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
add dword [ebp - 0x538], 1
mov edx, 1
sub esp, 0xc
cmp dword [ebp - 0x51c], edi
ja 0x402a28
add dword [ebp - 0x540], 1
mov ecx, dword [ebp - 0x540]
mov edx, 1
movzx eax, word [ebp - 0x47e]
cmp eax, ecx
jge 0x402a0f
mov eax, dword [ebp - 0x48e]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_EndDoc]
mov eax, dword [ebp - 0x54c]
sub esp, 4
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x48e]
mov dword [esp], eax
mov eax, dword [ebp - 0x550]
call eax
mov eax, dword [ebp - 0x548]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_DeleteObject]
sub esp, 4
jmp 0x4027ba
mov dword [ebp - 0x534], esi
mov esi, eax
jmp 0x402eec
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x534], edx
mov dword [esp + 8], 0x409100
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xb
mov dword [esp], ecx
call dword [sym.imp.shlwapi.dll_wnsprintfW]
mov edx, dword [ebp - 0x534]
add esi, eax
jmp 0x402b56
test eax, eax
je 0x402dab
mov dword [ebp - 0x530], edi
nop
mov edi, edx
sub edx, 1
je 0x403134
cmp word [ecx + edx*2], 0x20
jne 0x4030a0
mov dword [ebp - 0x534], edi
mov edi, dword [ebp - 0x530]
test edx, edx
jle 0x402dab
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x50c], eax
jmp 0x402dab
mov dword [ebp - 0x520], 1
jmp 0x402a5f
mov dword [esp + 4], 0x40b4b0
mov ecx, dword [ebp - 0x520]
lea edx, [ebp - 0x500]
mov dword [esp], 1
mov eax, dword [ebp - 0x528]
call sym._notepad_print_header.part.0
mov ebx, eax
jmp 0x402bfc
mov eax, dword [ebp - 0x528]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_EndPage]
sub esp, 4
jmp 0x402f8e
mov edi, dword [ebp - 0x530]
jmp 0x402dab
mov eax, dword [ebp - 0x52c]
jmp 0x402b9b
mov edx, 2
jmp 0x402ad9
mov eax, dword [0x40b024]
mov dword [esp + 0xc], 0x30
mov dword [esp + 8], str.Print_Error
mov dword [esp + 4], str.StartPage_failed
mov dword [esp], eax
call dword [sym.imp.user32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x52c]
sub esp, 0x10
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x402ff1
test edx, edx
jne 0x402fd0
jmp 0x402ff1
test edx, edx
je 0x402c40
lea eax, [ebp - 0x508]
lea ecx, [ebp - 0x400]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x50c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x4f8]
sub eax, dword [ebp - 0x500]
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x530], ecx
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_GetTextExtentExPointW]
mov eax, dword [ebp - 0x50c]
mov ecx, dword [ebp - 0x530]
sub esp, 0x1c
jmp 0x402dab
mov eax, dword [ebp - 0x48e]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_DeleteDC]
push eax
call dbg.ShowLastError
jmp 0x402641