Function at 0x40b6d6
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x4149eb
call fcn.00413720
push ecx
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
call sub.MFC42.DLL_CString::CString_3
mov ecx, dword [ebp + 0xc]
push 1
mov eax, 0x1000
pop edi
cmp ecx, eax
mov dword [ebp - 4], edi
jg 0x40b96a
je 0x40b94c
cmp ecx, 0x12
ja case.default.0x40b70c
jmp dword [ecx*4 + 0x40ba45]
push ebx
push edi
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x4232a0
jmp 0x40ba0f
push ebx
push 2
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x423290
jmp 0x40ba0f
push ebx
push 3
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x423284
jmp 0x40ba0f
push ebx
push 4
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x423274
jmp 0x40ba0f
push ebx
push 5
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x423260
jmp 0x40ba0f
push ebx
push 6
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x423254
jmp 0x40ba0f
push ebx
push 7
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x423248
jmp 0x40ba0f
push ebx
push 8
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push str.8.
jmp 0x40ba0f
push ebx
push 9
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x423230
jmp 0x40ba0f
push ebx
push 0xa
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x423224
jmp 0x40ba0f
push ebx
push 0xb
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x423214
jmp 0x40ba0f
push ebx
push 0xc
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push str.12.
jmp 0x40ba0f
push ebx
push 0xd
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push str.13.l
jmp 0x40ba0f
push ebx
push 0xe
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x4231e8
jmp 0x40ba0f
push ebx
push 0xf
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x4231d8
jmp 0x40ba0f
push ebx
push 0x10
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x4231cc
jmp 0x40ba0f
push ebx
push 0x11
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x4231c0
jmp 0x40ba0f
push ebx
push 0x12
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x4231ac
jmp 0x40ba0f
push ebx
push 0x13
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x4231a0
jmp 0x40ba0f
push ebx
push 0x14
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x423194
jmp 0x40ba0f
sub ecx, 0x1001
je 0x40b9f6
dec ecx
je 0x40b9db
dec ecx
je 0x40b9c0
sub ecx, 0xffd
je 0x40b9a5
dec ecx
jne case.default.0x40b70c
push ebx
push ebx
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x423188
jmp 0x40ba0f
push ebx
push 0x18
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x423174
jmp 0x40ba0f
push ebx
push 0x17
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x423168
jmp 0x40ba0f
push ebx
push 0x16
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x42315c
jmp 0x40ba0f
push ebx
push 0x15
push 0x402
push dword [esi + 0x7ad0]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x423150
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call sub.MFC42.DLL_CString::CString_4
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8