Function at 0x408804
Capabilities:
Get graphical window text
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push dword [ebx + 0x18]
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0x88], eax
push dword [ebx + 0x28]
push dword [ebx + 0x24]
push dword [ebx + 0x18]
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x8c], eax
push dword [ebp - 0x8c]
push dword [ebp - 0x88]
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x90], eax
push 1
push dword [ebp - 0x88]
call sub.gdi32.dll_SetBkMode
push 0x11
call sub.gdi32.dll_GetStockObject
push eax
push dword [ebx + 0x18]
call sub.gdi32.dll_SelectObject
push eax
push eax
push dword [ebp - 0x88]
call sub.gdi32.dll_SelectObject
push dword [ebx + 0x18]
call sub.gdi32.dll_SelectObject
push dword [ebx + 0x14]
call sub.user32.dll_GetWindowTextLengthA
inc eax
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0x40
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 8], eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebx + 0x14]
call sub.user32.dll_GetWindowTextA
lea eax, [ebx + 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call sub.user32.dll_CopyRect
cmp dword [esi + 0x34], 0
je 0x4088b6
sub dword [ebx + 0x24], 0x14
lea eax, [ebx + 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_CopyRect
lea eax, [ebx + 0x1c]
push eax
lea eax, [ebp - 0x38]
push eax
call sub.user32.dll_CopyRect
lea eax, [ebx + 0x1c]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.user32.dll_CopyRect
test dword [esi + 0x3c], 1
je 0x408900
push 0xfffffffffffffffe
push 0xfffffffffffffffe
lea eax, [ebp - 0x38]
push eax
call sub.user32.dll_InflateRect
push 0xfffffffffffffffe
push 0xfffffffffffffffe
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_InflateRect
test dword [esi + 0x3c], 4
je 0x408923
push 0xfffffffffffffffe
push 0xfffffffffffffffe
lea eax, [ebp - 0x38]
push eax
call sub.user32.dll_InflateRect
push 0xfffffffffffffffe
push 0xfffffffffffffffe
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_InflateRect
cmp dword [esi + 0x34], 0
je 0x40892d
add dword [ebx + 0x24], 0x14
lea eax, [ebx + 0x1c]
push eax
lea eax, [ebp - 0x58]
push eax
call sub.user32.dll_CopyRect
push dword [ebp - 0x50]
pop dword [ebp - 0x58]
sub dword [ebp - 0x58], 0x14
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x6c], 0
test dword [esi + 0x3c], 0x40000000
je 0x408968
test dword [esi + 0x3c], 0x20000000
jne 0x408a8f
test dword [esi + 0x3c], 8
jne 0x408987
push 0x10
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x88]
call sub.user32.dll_FillRect
jmp 0x408a8f
push dword [ebx + 0x14]
call sub.user32.dll_GetParent
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0xac]
push eax
push dword [ebp - 0x80]
call sub.user32.dll_GetClientRect
mov eax, dword [ebp - 0xa4]
sub eax, dword [ebp - 0xac]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xa0]
sub eax, dword [ebp - 0xa8]
mov dword [ebp - 0xb4], eax
push dword [ebp - 0x88]
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0x94], eax
push dword [ebp - 0xb4]
push dword [ebp - 0xb0]
push dword [ebp - 0x88]
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x98], eax
push dword [ebp - 0x98]
push dword [ebp - 0x94]
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x9c], eax
push 0
push dword [ebp - 0x94]
push 0x14
push dword [ebp - 0x80]
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0xac]
push eax
push dword [ebx + 0x14]
call sub.user32.dll_GetWindowRect
lea eax, [ebp - 0xac]
push eax
push dword [ebp - 0x80]
call sub.user32.dll_ScreenToClient
push 0xcc0020
push dword [ebp - 0xa8]
push dword [ebp - 0xac]
push dword [ebp - 0x94]
push dword [ebx + 0x28]
push dword [ebx + 0x24]
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
push dword [ebp - 0x88]
call sub.gdi32.dll_BitBlt
push dword [ebp - 0x9c]
push dword [ebp - 0x94]
call sub.gdi32.dll_SelectObject
push dword [ebp - 0x98]
call sub.gdi32.dll_DeleteObject
push dword [ebp - 0x94]
call sub.gdi32.dll_DeleteDC
test dword [ebx + 0x10], 1
je 0x408b77
mov dword [ebp - 0x6c], 2
test dword [esi + 0x3c], 0x40000000
je 0x408ac4
mov al, byte [ebp - 0x6c]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x88]
call fcn.00407fc6
jmp 0x408cef
test dword [esi + 0x3c], 0x20000000
je 0x408ae5
mov al, byte [ebp - 0x6c]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x88]
call fcn.00407d29
jmp 0x408cef
test dword [esi + 0x3c], 0x80000000
je 0x408b33
test dword [esi + 0x3c], 1
je 0x408b2c
push 0x10
call sub.user32.dll_GetSysColor
mov dword [ebp - 0xb8], eax
push 0x14
call sub.user32.dll_GetSysColor
mov dword [ebp - 0xbc], eax
push dword [ebp - 0xbc]
push dword [ebp - 0xb8]
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x88]
call fcn.00404d27
jmp 0x408b4f
test dword [esi + 0x3c], 1
je 0x408b4f
push 0xf
push 0xa
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x88]
call sub.user32.dll_DrawEdge
push 1
push 1
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_OffsetRect
test dword [esi + 0x3c], 1
je 0x408b72
push 1
push 1
lea eax, [ebp - 0x38]
push eax
call sub.user32.dll_OffsetRect
jmp 0x408cef
mov eax, dword [0x4101a7]
cmp eax, dword [ebx + 0x14]
jne 0x408b8a
mov dword [ebp - 0x6c], 1
jmp 0x408b91
mov dword [ebp - 0x6c], 0
test dword [esi + 0x3c], 0x40000000
je 0x408bbf
cmp dword [esi + 0x44], 0
je 0x408ba7
mov dword [ebp - 0x6c], 2
mov al, byte [ebp - 0x6c]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x88]
call fcn.00407fc6
jmp 0x408ce2
test dword [esi + 0x3c], 0x20000000
je 0x408bed
cmp dword [esi + 0x44], 0
je 0x408bd5
mov dword [ebp - 0x6c], 2
mov al, byte [ebp - 0x6c]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x88]
call fcn.00407d29
jmp 0x408ce2
test dword [esi + 0x3c], 0x80000000
je 0x408c93
test dword [esi + 0x3c], 1
je 0x408ce2
test dword [esi + 0x3c], 2
je 0x408c16
cmp dword [ebp - 0x6c], 1
je 0x408c1f
test dword [esi + 0x3c], 2
jne 0x408c91
cmp dword [esi + 0x44], 0
je 0x408c5c
push 0x10
call sub.user32.dll_GetSysColor
mov dword [ebp - 0xb8], eax
push 0x14
call sub.user32.dll_GetSysColor
mov dword [ebp - 0xbc], eax
push dword [ebp - 0xbc]
push dword [ebp - 0xb8]
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x88]
call fcn.00404d27
jmp 0x408c91
push 0x14
call sub.user32.dll_GetSysColor
mov dword [ebp - 0xb8], eax
push 0x10
call sub.user32.dll_GetSysColor
mov dword [ebp - 0xbc], eax
push dword [ebp - 0xbc]
push dword [ebp - 0xb8]
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x88]
call fcn.00404d27
jmp 0x408ce2
test dword [esi + 0x3c], 1
je 0x408ce2
test dword [esi + 0x3c], 2
je 0x408cab
cmp dword [ebp - 0x6c], 1
je 0x408cb4
test dword [esi + 0x3c], 2
jne 0x408ce2
cmp dword [esi + 0x44], 0
je 0x408ccf
push 0xf
push 0xa
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x88]
call sub.user32.dll_DrawEdge
jmp 0x408ce2
push 0xf
push 5
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x88]
call sub.user32.dll_DrawEdge
cmp dword [esi + 0x44], 0
je 0x408cef
mov dword [ebp - 0x6c], 2
test dword [ebx + 0x10], 4
je 0x408d25
mov dword [ebp - 0x6c], 3
push 0x11
call sub.user32.dll_GetSysColor
push eax
push dword [ebp - 0x88]
call sub.gdi32.dll_SetTextColor
cmp dword [esi], 0
je 0x408daa
push dword [esi]
pop dword [ebp - 0x5c]
jmp 0x408daa
cmp dword [esi + 4], 0
je 0x408d3f
cmp dword [ebp - 0x6c], 1
je 0x408d37
cmp dword [ebp - 0x6c], 2
jne 0x408d3f
push dword [esi + 4]
pop dword [ebp - 0x5c]
jmp 0x408d49
cmp dword [esi], 0
je 0x408d49
push dword [esi]
pop dword [ebp - 0x5c]
cmp dword [esi + 0x1c], 0
je 0x408d65
cmp dword [ebp - 0x6c], 2
jne 0x408d65
push dword [esi + 0x1c]
push dword [ebp - 0x88]
call sub.gdi32.dll_SetTextColor
jmp 0x408daa
cmp dword [esi + 0x18], 0
je 0x408d81
cmp dword [ebp - 0x6c], 1
jne 0x408d81
push dword [esi + 0x18]
push dword [ebp - 0x88]
call sub.gdi32.dll_SetTextColor
jmp 0x408daa
cmp dword [esi + 0x20], 0
je 0x408d97
push dword [esi + 0x20]
push dword [ebp - 0x88]
call sub.gdi32.dll_SetTextColor
jmp 0x408daa
push 0x12
call sub.user32.dll_GetSysColor
push eax
push dword [ebp - 0x88]
call sub.gdi32.dll_SetTextColor
cmp dword [esi + 0x28], 0
je 0x408dcc
cmp dword [ebp - 0x6c], 1
je 0x408dbc
cmp dword [ebp - 0x6c], 2
jne 0x408dcc
push dword [esi + 0x28]
push dword [ebp - 0x88]
call sub.gdi32.dll_SelectObject
jmp 0x408de0
cmp dword [esi + 0x24], 0
je 0x408de0
push dword [esi + 0x24]
push dword [ebp - 0x88]
call sub.gdi32.dll_SelectObject
cmp dword [ebp - 0x5c], 0
je 0x408e6f
cmp dword [ebp - 4], 1
jbe 0x408e6f
test dword [esi + 0x3c], 0x40
je 0x408e18
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
push 3
push eax
call fcn.0040c998
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x38]
shr eax, 2
add dword [ebp - 0x38], eax
jmp 0x408e6f
test dword [esi + 0x3c], 0x80
je 0x408e46
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
push 3
push eax
call fcn.0040c998
push dword [ebp - 0x20]
pop dword [ebp - 0x28]
sub dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x38]
shr eax, 2
sub dword [ebp - 0x30], eax
jmp 0x408e6f
test dword [esi + 0x3c], 0x100
je 0x408e6d
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
push 3
push eax
call fcn.0040c998
sub dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x34]
shr eax, 1
add dword [ebp - 0x34], eax
jmp 0x408e6f
jmp 0x408df9
cmp dword [ebp - 0x6c], 0
jne 0x408e88
cmp dword [esi + 8], 0
je 0x408e88
push dword [esi + 8]
pop dword [ebp - 0x68]
jmp 0x408ed0
cmp dword [ebp - 0x6c], 1
jne 0x408ea1
cmp dword [esi + 0xc], 0
je 0x408ea1
push dword [esi + 0xc]
pop dword [ebp - 0x68]
jmp 0x408ed0
cmp dword [ebp - 0x6c], 2
jne 0x408eba
cmp dword [esi + 0x10], 0
je 0x408eba
push dword [esi + 0x10]
pop dword [ebp - 0x68]
jmp 0x408ed0
cmp dword [ebp - 0x6c], 3
jne 0x408f45
cmp dword [esi + 0x14], 0
je 0x408f45
push dword [esi + 0x14]
pop dword [ebp - 0x68]
test dword [esi + 0x3c], 1
je 0x408efe
test dword [esi + 0x3c], 0x80000000
je 0x408ef1
push 0xffffffffffffffff
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
call sub.user32.dll_InflateRect
jmp 0x408efe
push 0xfffffffffffffffe
push 0xfffffffffffffffe
lea eax, [ebp - 0x18]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [esi + 0x3c]
and eax, 0x10
push eax
push dword [ebp - 0x68]
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x88]
call fcn.00403c19
test dword [esi + 0x3c], 1
je 0x408f45
test dword [esi + 0x3c], 0x80000000
je 0x408f38
push 1
push 1
lea eax, [ebp - 0x18]
push eax
call sub.user32.dll_InflateRect
jmp 0x408f45
push 2
push 2
lea eax, [ebp - 0x18]
push eax
call sub.user32.dll_InflateRect
cmp dword [ebp - 0x5c], 0
je 0x408fd7
cmp dword [ebp - 0x6c], 3
jne 0x408f6d
push 0
push 1
push dword [ebp - 0x5c]
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x88]
call fcn.0040385f
jmp 0x408fd7
test dword [esi + 0x3c], 0x20000000
jne 0x408f8b
test dword [esi + 0x3c], 0x40000000
je 0x408f9b
cmp dword [ebp - 0x6c], 1
je 0x408f8b
cmp dword [ebp - 0x6c], 2
jne 0x408f9b
push 0x40
push dword [ebp - 0x5c]
push dword [ebx + 0x18]
call fcn.00403b22
mov dword [ebp - 0x5c], eax
push 0
push 0
push dword [ebp - 0x5c]
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x88]
call fcn.0040385f
test dword [esi + 0x3c], 0x20000000
jne 0x408fcf
test dword [esi + 0x3c], 0x40000000
je 0x408fd7
cmp dword [ebp - 0x6c], 1
je 0x408fcf
cmp dword [ebp - 0x6c], 2
jne 0x408fd7
push dword [ebp - 0x5c]
call sub.user32.dll_DestroyIcon
cmp dword [ebp - 4], 1
jbe 0x40905b
dec dword [ebp - 4]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xac]
push eax
call sub.user32.dll_CopyRect
push 0x411
lea eax, [ebp - 0xac]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0x88]
call sub.user32.dll_DrawTextA
mov eax, dword [ebp - 0xa0]
sub eax, dword [ebp - 0xa8]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0xa0]
shr eax, 1
mov dword [ebp - 0xa0], eax
push dword [ebp - 0xa0]
push 0
lea eax, [ebp - 0x38]
push eax
call sub.user32.dll_OffsetRect
push 0x11
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0x88]
call sub.user32.dll_DrawTextA
cmp dword [esi + 0x34], 0
je 0x4091a7
mov eax, dword [ebx + 0x14]
cmp dword [0x4101af], eax
je 0x409133
push 0x10
call sub.user32.dll_GetSysColor
push eax
push 1
push 0
call sub.gdi32.dll_CreatePen
mov dword [ebp - 0x74], eax
push dword [ebp - 0x74]
push dword [ebp - 0x88]
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x78], eax
add dword [ebp - 0x54], 4
sub dword [ebp - 0x4c], 4
push 0
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push dword [ebp - 0x88]
call sub.gdi32.dll_MoveToEx
push dword [ebp - 0x4c]
push dword [ebp - 0x58]
push dword [ebp - 0x88]
call sub.gdi32.dll_LineTo
push 0x14
call sub.user32.dll_GetSysColor
push eax
push 1
push 0
call sub.gdi32.dll_CreatePen
mov dword [ebp - 0x74], eax
push eax
push dword [ebp - 0x88]
call sub.gdi32.dll_SelectObject
push eax
call sub.gdi32.dll_DeleteObject
inc dword [ebp - 0x58]
push 0
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push dword [ebp - 0x88]
call sub.gdi32.dll_MoveToEx
push dword [ebp - 0x4c]
push dword [ebp - 0x58]
push dword [ebp - 0x88]
call sub.gdi32.dll_LineTo
push dword [ebp - 0x78]
push dword [ebp - 0x88]
call sub.gdi32.dll_SelectObject
push eax
call sub.gdi32.dll_DeleteObject
dec dword [ebp - 0x58]
sub dword [ebp - 0x54], 4
add dword [ebp - 0x4c], 4
jmp 0x409168
push 0xfffffffffffffffd
push 0
lea eax, [ebp - 0x58]
push eax
call sub.user32.dll_InflateRect
sub dword [ebp - 0x50], 3
push 0xf
push 2
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x88]
call sub.user32.dll_DrawEdge
add dword [ebp - 0x50], 3
push 3
push 0
lea eax, [ebp - 0x58]
push eax
call sub.user32.dll_InflateRect
test dword [esi + 0x3c], 0x400
jne 0x40917a
test dword [esi + 0x3c], 0x200
je 0x40918d
push 1
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x88]
call fcn.004092f4
jmp 0x4091a7
test dword [esi + 0x3c], 0x800
je 0x4091a7
push 0
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x88]
call fcn.004092f4
test dword [ebx + 0x10], 0x10
je 0x4092a2
test dword [esi + 0x3c], 4
je 0x4092a2
test dword [esi + 0x3c], 1
jne 0x4091dc
cmp dword [esi + 8], 0
jne 0x4091dc
cmp dword [esi + 0x10], 0
jne 0x4091dc
cmp dword [esi + 0xc], 0
je 0x4091eb
push 0xfffffffffffffffc
push 0xfffffffffffffffc
lea eax, [ebp - 0x48]
push eax
call sub.user32.dll_InflateRect
jmp 0x4091f8
push 0xffffffffffffffff
push 0xffffffffffffffff
lea eax, [ebp - 0x48]
push eax
call sub.user32.dll_InflateRect
push 0x11
call sub.user32.dll_GetSysColor
mov edx, eax
push edx
push 0x12
call sub.user32.dll_GetSysColor
pop edx
push eax
push edx
call fcn.004033b2
push eax
push 0x20
call fcn.004032b0
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x48]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x44]
mov dword [ebp - 0x64], eax
inc dword [ebp - 0x48]
dec dword [ebp - 0x60]
push dword [ebp - 0x70]
push 1
push dword [ebp - 0x60]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push dword [ebp - 0x88]
call fcn.00403cd1
inc eax
dec dword [ebp - 0x48]
dec dword [ebp - 0x64]
inc dword [ebp - 0x44]
push dword [ebp - 0x70]
push 0
push dword [ebp - 0x64]
push dword [ebp - 0x44]
push eax
push dword [ebp - 0x88]
call fcn.00403cd1
push dword [ebp - 0x70]
push 0
push dword [ebp - 0x64]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push dword [ebp - 0x88]
call fcn.00403cd1
inc eax
inc dword [ebp - 0x48]
push dword [ebp - 0x70]
push 1
push dword [ebp - 0x60]
push eax
push dword [ebp - 0x48]
push dword [ebp - 0x88]
call fcn.00403cd1
push dword [ebp - 8]
call sub.KERNEL32.DLL_GlobalFree
push 0xcc0020
push 0
push 0
push dword [ebp - 0x88]
push dword [ebx + 0x28]
push dword [ebx + 0x24]
push 0
push 0
push dword [ebx + 0x18]
call sub.gdi32.dll_BitBlt
push dword [ebp - 0x90]
push dword [ebp - 0x88]
call sub.gdi32.dll_SelectObject
push dword [ebp - 0x8c]
call sub.gdi32.dll_DeleteObject
push dword [ebp - 0x88]
call sub.gdi32.dll_DeleteDC
leave
ret