Function at 0x40aba0
Capabilities:
Get graphical window text
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x41b911
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c8
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov dword [esp + 0x68], ebp
mov eax, dword [ebp + 4]
push eax
call sub.MFC42u.DLL_CWnd::FromHandle
mov esi, eax
mov dword [esp + 0x50], esi
mov ecx, dword [esi + 0x20]
push ecx
call dword [sym.imp.USER32.dll_GetWindowDC]
push eax
call sub.MFC42u.DLL_CDC::FromHandle
mov edi, eax
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x28]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, esi
call sub.MFC42u.DLL_CWnd::IsWindowEnabled
test eax, eax
sete bl
lea ecx, [esp + 0x54]
mov byte [esp + 0x1f], bl
call fcn.0041af0a
lea ecx, [esp + 0x38]
mov dword [esp + 0x2e0], 0
call fcn.0041af0a
test edi, edi
mov byte [esp + 0x2e0], 1
jne 0x40ac32
xor eax, eax
jmp 0x40ac35
mov eax, dword [edi + 4]
mov esi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
call esi
push eax
lea ecx, [esp + 0x58]
call sub.MFC42u.DLL_CDC::Attach
test edi, edi
jne 0x40ac50
xor eax, eax
jmp 0x40ac53
mov eax, dword [edi + 4]
push eax
call esi
push eax
lea ecx, [esp + 0x3c]
call sub.MFC42u.DLL_CDC::Attach
call fcn.00404040
mov eax, dword [eax]
add eax, 0xbc
jne 0x40ac72
xor eax, eax
jmp 0x40ac75
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x58]
push eax
push ecx
call sub.MFC42u.DLL_CDC::SelectGdiObject
mov dword [esp + 0x64], eax
call fcn.00404040
mov eax, dword [eax]
add eax, 0xd4
jne 0x40ac96
xor eax, eax
jmp 0x40ac99
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x3c]
push eax
push edx
call sub.MFC42u.DLL_CDC::SelectGdiObject
mov dword [esp + 0x6c], eax
call fcn.00404040
mov eax, dword [eax]
mov esi, dword [sym.imp.GDI32.dll_GetObjectW]
add eax, 0xbc
lea ecx, [esp + 0xa8]
push ecx
push 0x18
mov edx, dword [eax + 4]
push edx
call esi
call fcn.00404040
mov eax, dword [eax]
lea ecx, [esp + 0x80]
add eax, 0xd4
push ecx
push 0x18
mov edx, dword [eax + 4]
push edx
call esi
call fcn.00404040
mov esi, dword [eax]
call fcn.00404040
mov ecx, dword [eax]
mov eax, dword [esi + 0xc8]
add eax, dword [ecx + 0xc4]
mov dword [esp + 0x20], eax
call fcn.00404040
mov esi, dword [eax]
call fcn.00404040
mov edx, dword [eax]
mov eax, dword [esi + 0xd0]
mov ecx, dword [edx + 0xcc]
add eax, ecx
mov ecx, dword [esp + 0x84]
test bl, bl
mov dword [esp + 0x4c], eax
je 0x40ad45
lea eax, [ecx + ecx]
mov dword [esp + 0x24], 2
cdq
and edx, 7
add eax, edx
sar eax, 3
jmp 0x40ad92
mov al, byte [ebp + 0xc]
test al, al
je 0x40ad73
mov dl, byte [ebp + 0xd]
test dl, dl
je 0x40ad73
mov dword [esp + 0x24], 1
test al, al
je 0x40ad86
mov al, byte [ebp + 0xd]
test al, al
je 0x40ad86
mov eax, ecx
cdq
and edx, 7
add eax, edx
sar eax, 3
jmp 0x40ad92
mov dl, byte [ebp + 0xf]
neg dl
sbb edx, edx
and edx, 0xfffffffd
add edx, 3
mov dword [esp + 0x24], edx
jmp 0x40ad5b
mov al, byte [ebp + 0xf]
neg al
sbb eax, eax
and al, 0xf4
add eax, 0xc
mov dword [esp + 0x18], eax
mov al, byte [ebp + 0xd]
test al, al
je 0x40ada8
mov dl, byte [ebp + 0xc]
test dl, dl
je 0x40adaf
test al, al
jne 0x40adcb
mov al, byte [ebp + 0xc]
test al, al
je 0x40adcb
mov ebx, dword [esp + 0x24]
mov eax, ecx
mov ecx, dword [esp + 0x18]
add ebx, 4
cdq
sub eax, edx
mov dword [esp + 0x24], ebx
sar eax, 1
add ecx, eax
mov dword [esp + 0x18], ecx
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x28]
sub esi, ebx
call fcn.00404040
mov ecx, dword [eax]
mov ebx, dword [ecx + 0xc4]
call fcn.00404040
mov edx, dword [eax]
mov ebp, dword [esp + 0x58]
lea eax, [esp + 0x54]
push 0xcc0020
mov ecx, dword [edx + 0xc4]
mov edx, dword [esp + 0x28]
neg eax
sbb eax, eax
push ebx
push 1
and eax, ebp
mov ebp, dword [sym.imp.GDI32.dll_StretchBlt]
push 0
push edx
push eax
mov eax, dword [edi + 4]
push ecx
push esi
push 0
push 0
push eax
call ebp
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
sub esi, ebx
mov ebx, dword [esp + 0x30]
sub eax, ecx
sub ebx, edx
mov dword [esp + 0x14], eax
call fcn.00404040
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc4]
mov dword [esp + 0x10], edx
call fcn.00404040
mov eax, dword [eax]
mov edx, dword [esp + 0x58]
push 0xcc0020
mov ecx, dword [eax + 0xc4]
lea eax, [esp + 0x58]
neg eax
sbb eax, eax
and eax, edx
mov edx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push 1
push edx
mov edx, dword [esp + 0x34]
push edx
push eax
mov eax, dword [esp + 0x38]
sub esi, eax
mov eax, dword [edi + 4]
push esi
push ebx
push ecx
push 0
push eax
call ebp
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
sub ebx, ecx
sub esi, eax
call fcn.00404040
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc8]
mov dword [esp + 0x10], edx
call fcn.00404040
mov ecx, dword [eax]
mov eax, dword [esp + 0xb0]
mov edx, dword [ecx + 0xc8]
sub eax, edx
mov dword [esp + 0x14], eax
call fcn.00404040
mov edx, dword [eax]
mov eax, dword [edx + 0xc8]
mov dword [esp + 0x20], eax
call fcn.00404040
mov ecx, dword [eax]
mov edx, dword [esp + 0x10]
push 0xcc0020
push edx
mov eax, dword [ecx + 0xc8]
mov ecx, dword [esp + 0x60]
sub esi, eax
lea eax, [esp + 0x5c]
mov edx, dword [esp + 0x2c]
push 1
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esp + 0x20]
push ecx
mov ecx, dword [edi + 4]
push edx
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
push esi
push 0
push ecx
call ebp
mov eax, dword [esp + 0x84]
cdq
and edx, 7
add eax, edx
mov esi, eax
mov eax, dword [esp + 0x88]
cdq
sub eax, edx
mov ebx, eax
sar esi, 3
sar ebx, 1
call fcn.00404040
mov edx, dword [eax]
mov eax, dword [edx + 0xcc]
mov dword [esp + 0x10], eax
call fcn.00404040
mov ecx, dword [eax]
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x38]
push 0xcc0020
neg eax
mov ecx, dword [ecx + 0xcc]
sbb eax, eax
and eax, edx
mov edx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0x20]
push esi
push 0
push edx
push eax
mov eax, dword [edi + 4]
push ecx
push esi
push 0
push 0
push eax
call ebp
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x2c]
sub eax, edx
mov dword [esp + 0x14], eax
call fcn.00404040
mov ecx, dword [eax]
mov edx, dword [ecx + 0xcc]
mov dword [esp + 0x10], edx
call fcn.00404040
mov eax, dword [eax]
mov ecx, dword [esp + 0x3c]
push 0xcc0020
mov edx, dword [eax + 0xcc]
lea eax, [esp + 0x3c]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, ebx
sub ecx, dword [esp + 0x50]
mov dword [esp + 0x4c], ecx
push ecx
mov ecx, dword [esp + 0x18]
push esi
push ecx
mov ecx, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x60]
push eax
mov eax, dword [esp + 0x2c]
sub eax, ecx
push eax
push esi
push edx
mov edx, dword [edi + 4]
push 0
push edx
call ebp
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x2c]
sub eax, edx
mov dword [esp + 0x10], eax
call fcn.00404040
mov eax, dword [eax]
mov ecx, dword [eax + 0xd0]
mov dword [esp + 0x14], ecx
call fcn.00404040
mov edx, dword [eax]
mov eax, ebx
sub eax, dword [edx + 0xd0]
mov dword [esp + 0x20], eax
call fcn.00404040
mov eax, dword [eax]
mov ecx, dword [eax + 0xd0]
mov dword [esp + 0x24], ecx
call fcn.00404040
mov edx, dword [eax]
mov eax, dword [esp + 0x10]
push 0xcc0020
mov ecx, dword [edx + 0xd0]
mov edx, dword [esp + 0x40]
sub eax, ecx
mov ecx, eax
lea eax, [esp + 0x3c]
neg eax
sbb eax, eax
and eax, edx
mov edx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x28]
push esi
push edx
mov edx, dword [esp + 0x28]
push edx
push eax
mov eax, dword [esp + 0x3c]
push eax
push esi
push ecx
mov ecx, dword [edi + 4]
push 0
push ecx
call ebp
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x2c]
sub eax, ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
sub ecx, esi
mov edx, dword [esp + 0x3c]
sub ecx, eax
lea eax, [esp + 0x38]
push 0xcc0020
neg eax
sbb eax, eax
push ebx
and eax, edx
mov edx, dword [esp + 0x20]
push esi
push ebx
push edx
push eax
mov eax, dword [esp + 0x28]
push eax
push esi
push 0
push ecx
mov ecx, dword [edi + 4]
push ecx
call ebp
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
sub eax, ecx
mov dword [esp + 0x14], eax
call fcn.00404040
mov edx, dword [eax]
mov eax, dword [edx + 0xcc]
mov dword [esp + 0x10], eax
call fcn.00404040
mov ecx, dword [eax]
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x38]
push 0xcc0020
neg eax
sbb eax, eax
mov ecx, dword [ecx + 0xcc]
and eax, edx
mov edx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0x20]
push esi
push ebx
push edx
push eax
mov eax, dword [esp + 0x2c]
push ecx
push esi
sub eax, esi
push 0
push eax
mov eax, dword [edi + 4]
push eax
call ebp
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
sub eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x30]
sub eax, edx
mov dword [esp + 0x20], eax
call fcn.00404040
mov ecx, dword [eax]
mov eax, dword [ecx + 0xcc]
add eax, ebx
mov dword [esp + 0x10], eax
call fcn.00404040
mov edx, dword [eax]
mov ebx, dword [esp + 0x3c]
lea eax, [esp + 0x38]
push 0xcc0020
mov ecx, dword [edx + 0xcc]
mov edx, dword [esp + 0x4c]
neg eax
push edx
mov edx, dword [esp + 0x18]
sbb eax, eax
push esi
and eax, ebx
push edx
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x5c]
push edx
push eax
mov eax, dword [esp + 0x2c]
sub eax, ebx
push eax
mov eax, dword [esp + 0x3c]
push esi
sub eax, esi
push ecx
push eax
mov eax, dword [edi + 4]
push eax
call ebp
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x34]
mov edx, dword [esp + 0x2c]
sub eax, ecx
sub ebx, edx
mov dword [esp + 0x20], eax
call fcn.00404040
mov ecx, dword [eax]
mov edx, dword [ecx + 0xd0]
mov dword [esp + 0x48], edx
call fcn.00404040
mov ecx, dword [eax]
mov eax, dword [esp + 0x88]
sub eax, dword [ecx + 0xd0]
mov dword [esp + 0x10], eax
call fcn.00404040
mov edx, dword [eax]
mov eax, dword [edx + 0xd0]
mov dword [esp + 0x14], eax
call fcn.00404040
mov ecx, dword [eax]
mov edx, dword [esp + 0x48]
push 0xcc0020
push edx
mov eax, dword [ecx + 0xd0]
mov ecx, dword [esp + 0x44]
sub ebx, eax
lea eax, [esp + 0x40]
mov edx, dword [esp + 0x20]
push esi
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esp + 0x1c]
push ecx
push edx
mov ecx, dword [edi + 4]
push eax
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x3c]
push esi
sub eax, esi
push ebx
push eax
push ecx
call ebp
mov ebx, dword [esp + 0x50]
lea edx, [esp + 0xc0]
push edx
mov eax, dword [ebx + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [ebx + 0x20]
push 0
push 0
push 0xe
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dl, byte [esp + 0x1f]
mov ebp, eax
mov byte [esp + 0x70], dl
lea esi, [ebp + 0xa]
mov eax, esi
test esi, esi
jge 0x40b27c
xor eax, eax
add eax, eax
push eax
call fcn.004129a7
add esp, 4
mov dword [esp + 0x74], eax
test esi, esi
mov ecx, eax
jbe 0x40b2a2
mov edx, esi
test ecx, ecx
je 0x40b29c
mov word [ecx], 0
add ecx, 2
dec edx
jne 0x40b293
lea esi, [eax + esi*2]
mov dword [esp + 0x78], esi
mov dword [esp + 0x7c], esi
mov edx, dword [ebx + 0x20]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp + 1]
push eax
push ecx
push 0xd
push edx
mov byte [esp + 0x2f0], 2
call esi
push 1
mov ecx, edi
call sub.MFC42u.DLL_CDC::SetBkMode
mov eax, dword [ebx + 0x20]
push 0
push 0
push 0x31
push eax
call esi
push eax
call sub.MFC42u.DLL_CGdiObject::FromHandle
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 0x30]
mov esi, dword [edi]
mov dword [esp + 0x50], eax
mov al, byte [esp + 0x1f]
test al, al
je 0x40b2fd
push 0x11
jmp 0x40b2ff
push 0x12
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
mov ecx, edi
call dword [esi + 0x38]
mov edx, dword [esp + 0x74]
mov eax, dword [edi]
lea ecx, [esp + 0xc0]
push 0x108025
push ecx
push ebp
push edx
mov ecx, edi
call dword [eax + 0x70]
mov esi, dword [esp + 0x68]
mov al, byte [esi + 0xe]
test al, al
jne 0x40b37e
mov al, byte [esi + 0xd]
test al, al
jne 0x40b37e
mov al, byte [esi + 0xf]
test al, al
je 0x40b37e
call dword [sym.imp.USER32.dll_GetCapture]
mov ebp, eax
test ebp, ebp
je 0x40b37e
lea eax, [esp + 0xd0]
push 0x104
push eax
push ebp
call dword [sym.imp.USER32.dll_GetClassNameW]
lea ecx, [esp + 0xd0]
push 0x41fe0c
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40b37e
push 0xfffffffffffffff0
push ebp
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov eax, dword [ebx + 0x20]
lea edx, [esp + 0x98]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov al, byte [esi + 0xe]
test al, al
je 0x40b3bd
push 3
push 2
push 3
push 2
lea ecx, [esp + 0xa8]
call sub.MFC42u.DLL_CRect::DeflateRect
mov edx, dword [edi + 4]
lea ecx, [esp + 0x98]
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawFocusRect]
mov ecx, dword [esp + 0x50]
mov eax, dword [edi]
push ecx
mov ecx, edi
call dword [eax + 0x30]
mov edx, dword [edi + 4]
mov eax, dword [ebx + 0x20]
push edx
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x64]
pop edi
pop esi
pop ebp
test eax, eax
pop ebx
je 0x40b3e6
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x48]
push eax
push ecx
call sub.MFC42u.DLL_CDC::SelectGdiObject
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x40b3fc
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x2c]
push eax
push edx
call sub.MFC42u.DLL_CDC::SelectGdiObject
mov eax, dword [esp + 0x64]
push eax
call fcn.0041299c
add esp, 4
lea ecx, [esp + 0x28]
mov byte [esp + 0x2d0], 0
call sub.MFC42u.DLL_CDC::CDC
lea ecx, [esp + 0x44]
mov dword [esp + 0x2d0], 0xffffffff
call sub.MFC42u.DLL_CDC::CDC
mov ecx, dword [esp + 0x2c8]
mov dword fs:[0], ecx
add esp, 0x2d4
ret