Function at 0x4656d0
Capabilities:
Get graphical window text
Write file on windows

Disassembly:
sub esp, 0xad0
push ebx
push esi
push edi
mov ecx, 0x13
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [0x4f2658]
mov ecx, 0xb
mov esi, str.Log_Files__.log_.logAll_Files__._.
lea edi, [esp + 0x4dc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x4c
rep movsd dword es:[edi], dword [esi]
mov al, byte [esp + 0x4dc]
xor ecx, ecx
test al, al
je 0x465741
lea eax, [esp + 0x4dc]
cmp byte [eax], 0x7c
jne 0x465726
mov byte [eax], 0
inc ecx
mov edx, ecx
and edx, 0xffff
lea eax, [esp + edx + 0x4dc]
mov dl, byte [esp + edx + 0x4dc]
test dl, dl
jne 0x46571e
lea edx, [esp + 0x10]
lea eax, [esp + 0x4dc]
lea ecx, [esp + 0x8dc]
push edx
mov dword [esp + 0x20], eax
mov byte [esp + 0x8e0], 0
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], pe_nt_image_headers32
mov dword [esp + 0x50], 0x4ad9f8
mov dword [esp + 0x48], 0x80806
call dword [sym.imp.comdlg32.dll_GetSaveFileNameA]
test eax, eax
je 0x465a5d
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [0x4f2658]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
call fcn.00445c60
add esp, 4
lea ecx, [esp + 0x8dc]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x465a5d
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
lea edx, [esp + 0x10]
push 0
push edx
push 2
push 0x4ad430
push ebx
call esi
test eax, eax
je 0x465a41
mov ecx, dword [0x4f2658]
lea eax, [esp + 0xe0]
push 0x400
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edi, [esp + 0xe0]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
push 0
dec ecx
push edx
lea eax, [esp + 0xe8]
push ecx
push eax
push ebx
call esi
test eax, eax
je 0x465a41
lea ecx, [esp + 0x10]
push 0
push ecx
push 4
push str._r_n_r_n
push ebx
call esi
test eax, eax
je 0x465a41
mov ebp, dword [0x4b5314]
mov si, word [ebp]
cmp si, 0xffff
je 0x465a2c
test si, si
je 0x465a2c
lea edx, [esp + 0x4e0]
lea eax, [esp + 0x60]
push edx
push eax
push ebp
call fcn.00464fc0
add esp, 0xc
cmp si, 0x76c
jbe 0x4658b5
mov ecx, dword [str.__Error]
mov edx, dword [0x4ad9f4]
mov dword [esp + 0xe0], ecx
mov dword [esp + 0xe4], edx
jmp 0x4658f0
cmp si, 0x708
jbe 0x4658d7
mov eax, dword [str.Warning]
mov ecx, dword [0x4ad9c4]
mov dword [esp + 0xe0], eax
mov dword [esp + 0xe4], ecx
jmp 0x4658f0
mov edx, dword [str.___Info]
mov eax, dword [0x4ad9ec]
mov dword [esp + 0xe0], edx
mov dword [esp + 0xe4], eax
or ecx, 0xffffffff
mov edi, 0x49f184
xor eax, eax
lea edx, [esp + 0xe0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0xe4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea edi, [esp + 0x64]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0xe4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x49f184
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0xe4]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x4e4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xe8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
dec ecx
push ecx
lea ecx, [esp + 0xec]
push ecx
push ebx
call esi
test eax, eax
je 0x465a41
lea edx, [esp + 0x10]
push 0
push edx
push 2
push 0x4ad430
push ebx
call esi
test eax, eax
je 0x465a41
add ebp, 6
push 0
push ebp
call fcn.0047e290
inc eax
push 0
push eax
call fcn.0047e290
inc eax
push 0
push eax
call fcn.0047e290
inc eax
push 0
push eax
call fcn.0047e290
add esp, 0x20
inc eax
mov ebp, eax
mov si, word [ebp]
cmp si, 0xffff
jne 0x465873
lea eax, [esp + 0x10]
push 0
push eax
push 2
push 0x4ad430
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xad0
ret