Function at 0x475a20
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0xcc
push ebx
mov ebx, dword [0x5289c4]
push ebp
push esi
mov esi, dword [0x528930]
push edi
push 0xc
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ebx
mov dword [0x52898c], 1
call fcn.0048ac32
push 0x70
mov dword [0x528988], eax
call fcn.0048ac32
mov ecx, dword [0x528988]
lea ebp, [ebx*4]
push ebp
mov dword [ecx + 8], eax
mov edx, dword [0x528988]
mov dword [edx + 4], 3
call fcn.0048ac32
mov ecx, dword [0x528988]
push ebp
mov edx, dword [ecx + 8]
mov dword [edx + 4], eax
call fcn.0048ac32
mov ecx, dword [0x528988]
push ebp
mov edx, dword [ecx + 8]
mov dword [edx + 8], eax
call fcn.0048ac32
mov ecx, dword [0x528988]
add esp, 0x14
mov edx, dword [ecx + 8]
mov dword [edx + 0xc], eax
mov eax, dword [0x528988]
mov ecx, dword [eax + 8]
xor eax, eax
test ebx, ebx
mov dword [ecx + 0x10], ebx
jle 0x475ad6
mov edx, dword [0x528988]
mov ecx, dword [edx + 8]
mov edx, dword [ecx + 4]
mov dword [edx + eax*4], eax
inc eax
cmp eax, ebx
jl 0x475ac2
mov eax, dword [0x528988]
push 1
push 0
push ebx
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 4]
push edx
call fcn.00473fd0
mov edx, dword [0x528988]
mov ecx, ebp
xor eax, eax
push 0
mov edx, dword [edx + 8]
push 0
mov edi, dword [edx + 8]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edx, dword [0x528988]
mov ecx, ebp
xor eax, eax
mov edx, dword [edx + 8]
mov edi, dword [edx + 0xc]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.00474140
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 0x34]
add esp, 0x18
rep stosd dword es:[edi], eax
mov ecx, dword [0x517ff4]
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x5c]
push 0x40
push eax
push 0x9f6
push ecx
mov dword [esp + 0x30], 0xffff0002
mov dword [esp + 0x34], 0x23
mov dword [esp + 0x2c], 0xffff0000
mov dword [esp + 0x50], 1
call edi
lea eax, [esp + 0x1c]
lea edx, [esp + 0x5c]
push eax
push 0
push 0x1100
push esi
mov dword [esp + 0x44], edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x528988]
push 0x40
mov dword [ecx], eax
mov edx, dword [0x528988]
lea ecx, [esp + 0x60]
mov eax, dword [edx]
mov edx, dword [0x517ff4]
mov dword [esp + 0x20], eax
push ecx
mov eax, 2
push 0xa00
push edx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
call edi
mov ecx, dword [0x528988]
mov eax, dword [0x5289c4]
push eax
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x60]
mov eax, dword [edx + 0x14]
push eax
push ecx
lea edx, [esp + 0xa8]
push str._s___u__u_
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea ecx, [esp + 0x1c]
lea eax, [esp + 0x9c]
push ecx
push 0
push 0x1100
push esi
mov dword [esp + 0x44], eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [0x528988]
mov ecx, dword [edx + 8]
mov dword [ecx], eax
mov edi, dword [0x5289cc]
lea esi, [edi*4]
push esi
call fcn.0048ac32
mov edx, dword [0x528988]
push esi
mov ecx, dword [edx + 8]
mov dword [ecx + 0x20], eax
call fcn.0048ac32
mov edx, dword [0x528988]
push esi
mov ecx, dword [edx + 8]
mov dword [ecx + 0x24], eax
call fcn.0048ac32
mov edx, dword [0x528988]
add esp, 0xc
mov ecx, dword [edx + 8]
mov dword [ecx + 0x28], eax
mov edx, dword [0x528988]
mov eax, dword [edx + 8]
xor edx, edx
cmp ebx, edx
mov dword [eax + 0x2c], edi
jle 0x475cc8
mov dword [esp + 0x10], edx
mov ecx, dword [0x5289f0]
mov edi, dword [0x5289ec]
mov ecx, dword [ecx + edx*4]
mov eax, ecx
shl eax, 5
add eax, ecx
lea eax, [eax + eax*2]
test dword [edi + eax*8 + 0x20c], 0xfffffffe
jne 0x475cc3
mov eax, dword [0x528988]
mov eax, dword [eax + 8]
mov edi, dword [eax + 0x20]
mov eax, dword [esp + 0x10]
mov dword [eax + edi], ecx
add eax, 4
mov dword [esp + 0x10], eax
inc edx
cmp edx, ebx
jl 0x475c84
mov edx, dword [0x528988]
mov ecx, esi
xor eax, eax
push 1
mov edx, dword [edx + 8]
push 0
mov edi, dword [edx + 0x24]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edx, dword [0x528988]
mov ecx, esi
xor eax, eax
mov edx, dword [edx + 8]
mov edi, dword [edx + 0x28]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.00474140
mov eax, dword [0x528988]
add esp, 8
lea edx, [esp + 0x5c]
mov ecx, dword [eax]
mov eax, 3
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov eax, dword [0x517ff4]
push 0x40
push edx
push 0xa01
push eax
mov dword [esp + 0x2c], ecx
call dword [sym.imp.USER32.dll_LoadStringA]
mov ecx, dword [0x528988]
mov eax, dword [ecx + 8]
lea ecx, [esp + 0x5c]
mov edx, dword [eax + 0x2c]
mov eax, dword [eax + 0x30]
push edx
push eax
push ecx
lea edx, [esp + 0xa8]
push str._s___u__u_
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [esp + 0x28]
add esp, 0x14
lea ecx, [esp + 0x1c]
lea eax, [esp + 0x9c]
push ecx
push 0
push 0x1100
push edx
mov dword [esp + 0x44], eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x528988]
mov edx, dword [ecx + 8]
mov dword [edx + 0x1c], eax
mov eax, dword [0x5289d0]
lea esi, [eax*4]
push esi
call fcn.0048ac32
mov ecx, dword [0x528988]
push esi
mov edx, dword [ecx + 8]
mov dword [edx + 0x3c], eax
call fcn.0048ac32
mov ecx, dword [0x528988]
push esi
mov edx, dword [ecx + 8]
mov dword [edx + 0x40], eax
call fcn.0048ac32
mov ecx, dword [0x528988]
add esp, 0xc
mov edx, dword [ecx + 8]
mov dword [edx + 0x44], eax
mov eax, dword [0x528988]
mov edx, dword [0x5289d0]
xor edi, edi
mov ecx, dword [eax + 8]
mov dword [ecx + 0x48], edx
xor edx, edx
test ebx, ebx
jle 0x475e3f
cmp edi, dword [0x5289d0]
je 0x475e3f
mov eax, dword [0x5289f0]
mov ebx, dword [0x5289ec]
mov ecx, dword [eax + edx*4]
mov eax, ecx
shl eax, 5
add eax, ecx
lea eax, [eax + eax*2]
mov eax, dword [ebx + eax*8 + 0x20c]
and al, 0xfe
cmp eax, 2
jne 0x475e36
mov eax, dword [0x528988]
inc edi
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x3c]
mov dword [eax + edi*4 - 4], ecx
mov eax, dword [esp + 0x18]
inc edx
cmp edx, eax
jl 0x475df8
mov edx, dword [0x528988]
mov ecx, esi
xor eax, eax
push 2
mov edx, dword [edx + 8]
push 0
mov edi, dword [edx + 0x40]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edx, dword [0x528988]
mov ecx, esi
xor eax, eax
mov edx, dword [edx + 8]
mov edi, dword [edx + 0x44]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.00474140
mov eax, dword [0x528988]
add esp, 8
lea edx, [esp + 0x5c]
mov ecx, dword [eax]
mov eax, 4
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov eax, dword [0x517ff4]
push 0x40
push edx
push 0xa02
push eax
mov dword [esp + 0x2c], ecx
call dword [sym.imp.USER32.dll_LoadStringA]
mov ecx, dword [0x528988]
mov eax, dword [ecx + 8]
lea ecx, [esp + 0x5c]
mov edx, dword [eax + 0x48]
mov eax, dword [eax + 0x4c]
push edx
push eax
push ecx
lea edx, [esp + 0xa8]
push str._s___u__u_
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [esp + 0x28]
add esp, 0x14
lea ecx, [esp + 0x1c]
lea eax, [esp + 0x9c]
push ecx
push 0
push 0x1100
push edx
mov dword [esp + 0x44], eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x528988]
mov edx, dword [ecx + 8]
mov dword [edx + 0x38], eax
mov eax, dword [0x52898c]
mov ecx, dword [0x528988]
mov esi, eax
inc eax
mov dword [esp + 0x58], esi
mov dword [0x52898c], eax
lea eax, [eax + eax*2]
shl eax, 2
push eax
push ecx
call fcn.0048c170
lea esi, [esi + esi*2]
add esp, 8
shl esi, 2
mov dword [0x528988], eax
xor edx, edx
add eax, esi
mov dword [eax], edx
xor ebx, ebx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov eax, dword [0x4a5558]
test eax, eax
je 0x475f66
mov eax, dword [ebx*4 + 0x4a555c]
inc ebx
test eax, eax
jne 0x475f5a
lea ecx, [ebx*8]
sub ecx, ebx
shl ecx, 2
push ecx
call fcn.0048ac32
mov edx, dword [0x528988]
mov ecx, 0xd
lea edi, [esp + 0x20]
add esp, 4
mov dword [esi + edx + 8], eax
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, dword [0x517ff4]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x5c]
push 0x40
push eax
mov edi, 1
push 0x9f7
push ecx
mov dword [esp + 0x30], 0xffff0002
mov dword [esp + 0x34], 0x23
mov dword [esp + 0x2c], 0xffff0000
mov dword [esp + 0x50], edi
call dword [sym.imp.USER32.dll_LoadStringA]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
push 0
lea edx, [esp + 0x64]
push 0x1100
push ecx
mov dword [esp + 0x44], edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [0x528988]
mov dword [esi + edx], eax
mov eax, dword [0x528988]
mov ecx, dword [esi + eax]
mov dword [esp + 0x40], edi
mov dword [esp + 0x1c], ecx
xor ecx, ecx
mov dword [esp + 0x3c], ecx
cmp ebx, ecx
mov dword [esi + eax + 4], ecx
jle 0x47607b
xor edi, edi
mov dword [esp + 0x10], ebx
push ebp
call fcn.0048ac32
mov edx, dword [0x528988]
push ebp
mov ecx, dword [esi + edx + 8]
mov dword [ecx + edi + 4], eax
call fcn.0048ac32
mov edx, dword [0x528988]
push ebp
mov ecx, dword [esi + edx + 8]
mov dword [ecx + edi + 8], eax
call fcn.0048ac32
mov edx, dword [0x528988]
add esp, 0xc
add edi, 0x1c
mov ecx, dword [esi + edx + 8]
mov dword [ecx + edi - 0x10], eax
mov edx, dword [0x528988]
mov eax, dword [esi + edx + 8]
mov dword [eax + edi - 0xc], 0
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
jne 0x47601c
mov ecx, dword [esp + 0x18]
xor eax, eax
test ecx, ecx
mov dword [esp + 0x10], eax
jle 0x476149
xor ebp, ebp
test ebx, ebx
jle 0x476134
mov ecx, dword [0x5289f0]
mov ecx, dword [ecx + eax*4]
mov eax, ecx
mov dword [esp + 0x50], ecx
shl eax, 5
add eax, ecx
lea edx, [eax + eax*2]
mov eax, dword [0x5289ec]
lea ecx, [eax + edx*8 + 0xe0]
mov dword [esp + 0x54], ecx
mov edi, dword [ebp*4 + 0x4a5558]
mov eax, dword [esp + 0x54]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x4760ed
test cl, cl
je 0x4760e9
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x4760ed
add eax, 2
add edi, 2
test cl, cl
jne 0x4760c9
xor eax, eax
jmp 0x4760f2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4760fd
inc ebp
cmp ebp, ebx
jl 0x4760be
jmp 0x476134
mov ecx, dword [0x528988]
lea eax, [ebp*8]
sub eax, ebp
mov edi, dword [esp + 0x50]
mov edx, dword [esi + ecx + 8]
shl eax, 2
lea ecx, [edx + eax]
mov edx, dword [edx + eax + 0x10]
mov ecx, dword [ecx + 4]
mov dword [ecx + edx*4], edi
mov edx, dword [0x528988]
mov ecx, dword [esi + edx + 8]
lea eax, [ecx + eax + 0x10]
inc dword [eax]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x47608d
test ebx, ebx
jle 0x4761dc
xor edi, edi
mov dword [esp + 0x10], ebx
mov edx, dword [0x528988]
mov eax, dword [esi + edx + 8]
add eax, edi
mov ebp, dword [eax + 0x10]
mov ecx, dword [eax + 4]
shl ebp, 2
push ebp
push ecx
call fcn.0048c170
mov edx, dword [0x528988]
push ebp
mov ecx, dword [esi + edx + 8]
mov dword [ecx + edi + 4], eax
mov edx, dword [0x528988]
mov eax, dword [esi + edx + 8]
mov ecx, dword [eax + edi + 8]
push ecx
call fcn.0048c170
mov edx, dword [0x528988]
push ebp
mov ecx, dword [esi + edx + 8]
mov dword [ecx + edi + 8], eax
mov edx, dword [0x528988]
mov eax, dword [esi + edx + 8]
mov ecx, dword [eax + edi + 0xc]
push ecx
call fcn.0048c170
mov edx, dword [0x528988]
add esp, 0x18
add edi, 0x1c
mov ecx, dword [esi + edx + 8]
mov dword [ecx + edi - 0x10], eax
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
jne 0x476157
xor edi, edi
test ebx, ebx
jle 0x47627d
xor ebp, ebp
mov edx, dword [esp + 0x58]
push edi
push edx
call fcn.00474140
mov edx, dword [0x517ff4]
add esp, 8
lea eax, [esp + 0x5c]
lea ecx, [edi + 0xa0a]
push 0x40
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
mov eax, dword [0x528988]
mov ecx, dword [esi + eax + 8]
mov edx, dword [ecx + ebp + 0x10]
lea eax, [ecx + ebp]
push edx
lea ecx, [esp + 0x60]
mov eax, dword [eax + 0x14]
lea edx, [esp + 0xa0]
push eax
push ecx
push str._s___u__u_
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [esp + 0x28]
add esp, 0x14
lea ecx, [esp + 0x1c]
lea eax, [esp + 0x9c]
push ecx
push 0
push 0x1100
push edx
mov dword [esp + 0x44], eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x528988]
inc edi
add ebp, 0x1c
cmp edi, ebx
mov edx, dword [esi + ecx + 8]
mov dword [edx + ebp - 0x1c], eax
jl 0x4761e8
mov eax, dword [0x528988]
mov dword [esi + eax + 4], ebx
mov ecx, dword [0x528988]
mov edx, dword [ecx + 8]
mov ecx, dword [esp + 0x14]
mov eax, dword [edx]
push eax
push 9
push 0x110b
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret