Function at 0x401711
Capabilities:
Get graphical window text
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0xc], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x401921
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetWindowTextLengthW]
call eax
sub esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x401911
mov eax, dword [ebp - 0x18]
add eax, 1
cmp eax, 0x3f800000
ja 0x401799
add eax, eax
jmp 0x40179e
mov eax, 0xffffffff
mov dword [esp], eax
call sym.operator_new___unsigned_int_
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x401911
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetWindowTextW]
call eax
sub esp, 0xc
test eax, eax
setne al
test al, al
je 0x401900
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
call eax
sub esp, 0xc
test eax, eax
setne al
test al, al
je 0x401817
mov dword [ebp - 0x10], 0xfde9
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0x1c]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call eax
sub esp, 0x20
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym.operator_new___unsigned_int_
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov ecx, dword [ebp - 0x20]
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp - 0x24]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0x1c]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call eax
sub esp, 0x20
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x28]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
test eax, eax
setne al
test al, al
je 0x4018ef
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0x24], 0
je 0x401900
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym.operator_delete___void_
cmp dword [ebp - 0x1c], 0
je 0x401911
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym.operator_delete___void_
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
leave
ret