Function at 0x10022b00
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov dword [ebp - 4], 0
jmp 0x10022b19
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x10022b2c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x34], 0x24ec2e0c
jmp 0x10022b12
mov dword [ebp - 4], 0
jmp 0x10022b3c
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x10022b4f
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x60], 1
jmp 0x10022b35
mov dword [ebp - 4], 0
jmp 0x10022b5f
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x10022b75
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x94], 0
jmp 0x10022b58
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x34], 0
jmp 0x10022b9a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x34], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x34], 0xe
jg 0x10022c23
mov dword [ebp - 0x10], 0xd8cb4c23
mov dword [ebp - 0x28], 0
jmp 0x10022bbe
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x10022bd4
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa0], 0x2bb11acc
jmp 0x10022bb7
mov dword [ebp - 0x10], 0
jmp 0x10022be4
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x10022c1e
mov byte [ebp - 0xc], 0
movzx eax, byte [ebp - 0xc]
test eax, eax
je 0x10022c03
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
mov byte [ebp - 0xa], 0
movzx eax, byte [ebp - 0xa]
test eax, eax
je 0x10022c1c
push 0x25b0
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
jmp 0x10022bdd
jmp 0x10022b85
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x60], 1
jmp 0x10022c48
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x60], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x60], 0
jl 0x10022d6a
mov dword [ebp - 0x1c], 0x2bd42ca8
mov dword [ebp - 0x70], 0xfffffffb
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
mov dword [ebp + eax*4 - 0x34], 0xdbea5223
mov dword [ebp - 0x1c], 1
jmp 0x10022c89
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x10022d65
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x24], 0
jmp 0x10022caa
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10022cbd
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x44], 6
jmp 0x10022ca3
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x44], 1
jmp 0x10022ce2
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x44]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x44], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x44], 0
jl 0x10022d16
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
cmp dword [ebp + eax*4 - 0x34], 0
je 0x10022d02
jmp 0x10022d16
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x94], 0
je 0x10022d14
jmp 0x10022d16
jmp 0x10022ccd
mov dword [ebp - 0x14], 0
jmp 0x10022d26
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jg 0x10022d60
mov dword [ebp - 0x7c], 7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x60], 1
jne 0x10022d49
mov dword [ebp - 0x54], 1
jmp 0x10022d4d
and dword [ebp - 0x54], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x44]
imul eax, dword [ebp - 0x54]
mov dword [ebp - 0x70], eax
jmp 0x10022d1f
jmp 0x10022c82
jmp 0x10022c33
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10022f27
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 8], 0x76820624
mov dword [ebp - 0x84], 0x2280
mov dword [ebp - 8], 0x1d
jmp 0x10022d9d
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x10022dd8
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x68], 0x9ec4279c
mov dword [ebp - 0x18], 0
jmp 0x10022dc1
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xf
jl 0x10022dd6
mov dword [ebp - 0x64], 7
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], eax
jmp 0x10022dba
jmp 0x10022d96
mov dword [ebp - 8], 0xa
jmp 0x10022de8
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xb
jle 0x10022e80
mov dword [ebp - 0x4c], 0x1e6e2bfb
mov dword [ebp - 0x20], 0
jmp 0x10022e09
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10022e1c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x78], 0xf7e4
jmp 0x10022e02
cmp dword [ebp - 8], 0
jne 0x10022e2e
cmp dword [ebp - 8], 0
jne 0x10022e2e
and dword [ebp - 0x50], 0
jmp 0x10022e35
mov dword [ebp - 0x50], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x78]
cmp dword [ebp - 0x50], eax
jg 0x10022e4d
mov dword [ebp - 0x38], 1
jmp 0x10022e51
and dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x4c]
sub eax, 4
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x78]
add ecx, dword [ebp - 0x38]
cmp eax, ecx
jl 0x10022e71
mov dword [ebp - 0x48], 1
jmp 0x10022e75
and dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
jmp 0x10022de1
mov dword [ebp - 0x2c], 0
jmp 0x10022e90
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10022ea3
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x80], 0
jmp 0x10022e89
mov byte [ebp - 9], 0
movzx eax, byte [ebp - 9]
test eax, eax
je 0x10022ef4
push 0x253
push 0x660
push 0x2260
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1f6e
push 0x25d7
push 0x7ca
push 0x1f26
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov byte [ebp - 0xb], 0
movzx eax, byte [ebp - 0xb]
test eax, eax
je 0x10022f14
push 0x976
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
jmp 0x10022f3b
push 0xbf7
push 0
push 0x582
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esp, ebp
pop ebp
ret