Function at 0x406f10
Capabilities:
Get graphical window text
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x170], eax
mov eax, dword [edi]
mov esi, dword [eax]
mov eax, dword [esi + 0x34]
test byte [eax + 0x34c], 2
je 0x40730b
push 0x40
lea eax, [ebp - 0xe8]
push 0
push eax
call fcn.0040eec0
push 0x40
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.0040eec0
push 0x40
lea eax, [ebp - 0x168]
push 0
push eax
call fcn.0040eec0
add esp, 0x24
lea eax, [ebp - 0xe8]
push eax
push 0x40
push 0xd
push dword [esi + 0x48]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
call esi
lea eax, [ebp - 0x128]
push eax
mov eax, dword [edi]
push 0x40
push 0xd
mov eax, dword [eax]
push dword [eax + 0x184]
call esi
lea eax, [ebp - 0x168]
push eax
mov eax, dword [edi]
push 0x40
push 0xd
mov eax, dword [eax]
push dword [eax + 0x188]
call esi
push 2
push 0x41
call fcn.00411154
push 0x82
mov esi, eax
push 0
push esi
call fcn.0040eec0
lea ecx, [ebp - 0xe8]
add esp, 0x14
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406fe0
push ebx
sub ecx, edx
lea eax, [ebp - 0xe8]
push ecx
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, esi
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x407004
sub ebx, ecx
lea eax, [ebp - 0xa2]
push 0x9b
push 0
sar ebx, 1
push eax
add ebx, ebx
call fcn.0040eec0
lea eax, [ebx + 1]
mov dword [ebp - 0xa8], 0xaa00
push ebx
mov byte [ebp - 0xa4], al
lea eax, [ebp - 0xa2]
push esi
push eax
mov byte [ebp - 0xa3], 0x91
call fcn.00410be0
mov eax, dword [ebp - 0x170]
add esp, 0x18
mov eax, dword [eax + 0x114]
cmp eax, 0xffffffff
je 0x407080
push 0
lea ecx, [ebp - 0x16c]
push ecx
push 0xa1
lea ecx, [ebp - 0xa8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x82
push 0
push esi
call fcn.0040eec0
lea ecx, [ebp - 0x128]
add esp, 0xc
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4070a0
sub ecx, edx
lea eax, [ebp - 0x128]
push ecx
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, esi
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x4070c3
sub ebx, ecx
lea eax, [ebp - 0xa2]
push 0x9b
push 0
sar ebx, 1
push eax
add ebx, ebx
call fcn.0040eec0
lea eax, [ebx + 1]
mov dword [ebp - 0xa8], 0xaa00
push ebx
mov byte [ebp - 0xa4], al
lea eax, [ebp - 0xa2]
push esi
push eax
mov byte [ebp - 0xa3], 0xa1
call fcn.00410be0
mov eax, dword [ebp - 0x170]
add esp, 0x18
mov eax, dword [eax + 0x114]
cmp eax, 0xffffffff
je 0x40713f
push 0
lea ecx, [ebp - 0x16c]
push ecx
push 0xa1
lea ecx, [ebp - 0xa8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x82
push 0
push esi
call fcn.0040eec0
lea ecx, [ebp - 0x168]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407158
sub ecx, edx
lea eax, [ebp - 0x168]
push ecx
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, esi
lea ecx, [ebx + 2]
nop dword [eax + eax]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x407180
sub ebx, ecx
lea eax, [ebp - 0xa2]
push 0x9b
push 0
sar ebx, 1
push eax
add ebx, ebx
call fcn.0040eec0
lea eax, [ebx + 1]
mov dword [ebp - 0xa8], 0xaa00
push ebx
mov byte [ebp - 0xa4], al
lea eax, [ebp - 0xa2]
push esi
push eax
mov byte [ebp - 0xa3], 0xb1
call fcn.00410be0
mov eax, dword [ebp - 0x170]
add esp, 0x18
mov eax, dword [eax + 0x114]
cmp eax, 0xffffffff
je 0x4071fc
push 0
lea ecx, [ebp - 0x16c]
push ecx
push 0xa1
lea ecx, [ebp - 0xa8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.0041115f
mov eax, dword [edi]
add esp, 4
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [eax]
push 0
push 0
push 0xf0
push dword [eax + 0x4c]
call ebx
test eax, eax
je 0x4072df
push 0xa
lea eax, [ebp - 0xe8]
push 0
push eax
call fcn.00412dd9
inc eax
push eax
push 0x42cf08
lea eax, [ebp - 0xe8]
push 0x40
push eax
call fcn.00401b10
add esp, 0x1c
lea eax, [ebp - 0xe8]
push eax
mov eax, dword [edi]
push 0
push 0xc
mov eax, dword [eax]
push dword [eax + 0x48]
call ebx
push 0xa
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00412dd9
inc eax
push eax
push 0x42cf08
lea eax, [ebp - 0x128]
push 0x40
push eax
call fcn.00401b10
add esp, 0x1c
lea eax, [ebp - 0x128]
push eax
mov eax, dword [edi]
push 0
push 0xc
mov eax, dword [eax]
push dword [eax + 0x184]
call ebx
push 0xa
lea eax, [ebp - 0x168]
push 0
push eax
call fcn.00412dd9
inc eax
push eax
push 0x42cf08
lea eax, [ebp - 0x168]
push 0x40
push eax
call fcn.00401b10
add esp, 0x1c
lea eax, [ebp - 0x168]
push eax
mov eax, dword [edi]
push 0
push 0xc
mov eax, dword [eax]
push dword [eax + 0x188]
call ebx
mov eax, dword [edi]
push 0
push 0
push 0xf0
mov eax, dword [eax]
push dword [eax + 0x190]
call ebx
pop ebx
test eax, eax
jne 0x40730b
push eax
push 0x42cc20
push 0x42d2c8
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret 4