Function at 0x40f4a8
Capabilities:
Get graphical window text

Disassembly:
add byte [eax], al
mov edx, dword [ebx + 0x8398]
shr edx, 8
sub dword [ebx + 0x8398], edx
jmp 0x40f430
add edi, 3
cmp esi, dword [ebx + 0x83b8]
jb 0x40f43c
inc edi
cmp esi, 0x100
ja 0x40f447
add edi, 8
cmp eax, 0xb0
ja 0x40f460
cmp dword [ebx + 0x8388], 0x2a00
jb 0x40f46c
cmp dword [esp], 0x40
jae 0x40f46c
mov dword [ebx + 0x83b8], 0x7f00
jmp 0x40f476
mov dword [ebx + 0x83b8], 0x2001
mov ecx, dword [ebx + 0x55a8]
mov edx, esi
inc dword [ebx + 0x55a8]
mov eax, ebx
mov dword [ebx + ecx*4 + 0x5598], esi
mov ecx, edi
and dword [ebx + 0x55a8], 3
mov dword [ebx + 0x55b0], edi
mov dword [ebx + 0x55ac], esi
call 0x2e40f923
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp
add esp, 0xffffffec
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x40f711
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.0040272c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040520c
mov edx, dword [ebp - 0x10]
mov eax, 0x41eb2c
call fcn.00403780
mov eax, 0x41eb54
mov edx, 0x40f724
call fcn.00403780
cmp byte [0x41eb95], 0
jne 0x40f51a
mov eax, dword [0x41eb2c]
push eax
mov ecx, dword [0x41ecd4]
mov edx, dword [0x41ed00]
mov eax, 0x80000002
call fcn.00406d68
mov eax, 0x41eb54
mov edx, 0x40f7c8
call fcn.00403780
cmp byte [0x41eb95], 0
je 0x40f53c
call fcn.0040fcd8
jmp 0x40f6f6
mov eax, 0x41eb54
mov edx, 0x40f838
call fcn.00403780
xor eax, eax
mov dword [ebp - 4], eax
push 0
mov eax, dword [0x41ee08]
call fcn.00403aa4
push eax
call sub.user32.dll_FindWindowA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40f577
push 0x3e8
call sub.kernel32.dll_Sleep
jmp 0x40f550
mov eax, 0x41eb54
mov edx, 0x40f8d0
call fcn.00403780
push 0xea60
call sub.kernel32.dll_Sleep
push 0
push 0x40f94c
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_FindWindowExA
mov dword [ebp - 4], eax
mov eax, dword [0x41ece8]
call fcn.00403aa4
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 8], eax
mov eax, 0x41eb54
mov edx, 0x40f95c
call fcn.00403780
cmp dword [ebp - 8], 0
jne 0x40f5e0
mov eax, dword [0x41ecf0]
call fcn.00403aa4
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40f6be
mov eax, 0x41eb54
mov edx, 0x40fa0c
call fcn.00403780
mov eax, dword [0x41ee0c]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40f6be
call dword [ebp - 0xc]
mov eax, 0x41eb54
mov edx, 0x40fa38
call fcn.00403780
push 0xbb8
call sub.kernel32.dll_Sleep
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
mov eax, 0x41eb54
mov edx, 0x40fab0
call fcn.00403780
push 0x1f4
call sub.kernel32.dll_Sleep
push 0
push 0xd
push 0x101
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
mov eax, 0x41eb54
mov edx, 0x40fb00
call fcn.00403780
push 0xc8
call sub.kernel32.dll_Sleep
mov eax, 0x40fbc0
call fcn.00419614
mov eax, 0x41eb54
mov edx, 0x40fbd0
call fcn.00403780
push 0x3e8
call sub.kernel32.dll_Sleep
mov eax, 0x41eb54
mov edx, 0x40fc94
call fcn.00403780
mov eax, dword [0x41ecfc]
call fcn.00403aa4
mov edx, eax
mov eax, 0x41eba8
mov ecx, 0xbb8
call fcn.00406a50
test al, al
je 0x40f6f6
call fcn.0040fcd8
mov eax, 0x41eb54
mov edx, 0x40fcb4
call fcn.00403780
call fcn.00412b18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f718
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403750
ret