Function at 0x422270
Capabilities:
Get graphical window text
Parse pe header

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
call fcn.004ac4d0
push 0
push 0x10ca0001
mov eax, 0x55f0cc
push eax
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push 0x4e
call fcn.0042f3f9
push 0
mov eax, str.Office_Installer
push eax
push 0x14
push 0xaf
push 0x10
push 0x19
push 0x3f
call fcn.00434910
push 3
call fcn.004ab838
push eax
push 0x3f
call fcn.0047e8af
push 1
push dword [0xc06610]
push 0x12
push 0x46
push 0x12
push 0x8e
push 0x40
call fcn.00434910
push 0
push dword [0xc065a8]
push 0x1e
push 0x1f4
push 0xc
push 0xfd
push 0x41
call fcn.00434910
push 4
call fcn.004ab838
push eax
push 0x41
call fcn.0047e8af
push 3
push 0x24e
push 0x2e
push 0xfd
push 0x4f
call fcn.0047d927
push 1
push 0x4f
call fcn.0047c911
push 0xa
push 0
push dword [0xc065a8]
push 0x23
push 0xe1
push 0x3c
push 0xa
push 0x24
call fcn.0041a638
push 5
push 0
push dword [0xc06564]
push 0x23
push 0xe1
push 0x64
push 0xa
push 0x25
call fcn.0041a638
push 0xb
push 0
push dword [0xc065b0]
push 0x23
push 0xe1
push 0x8c
push 0xa
push 0x35
call fcn.0041a638
push 7
push 0
push dword [0xc06540]
push 0x23
push 0xe1
push 0xb4
push 0xa
push 0x26
call fcn.0041a638
push 8
push 0
push dword [0xc064c0]
push 0x23
push 0xe1
push 0x186
push 0xa
push 0x3a
call fcn.0041a638
push 0xf
push 0
push dword [0xc065e8]
push 0x23
push 0xe1
push 0x1ae
push 0xa
push 0x3b
call fcn.0041a638
push 6
push 0
push dword [0xc06490]
push 0x23
push 0xe1
push 0x1d6
push 0xa
push 0x2a
call fcn.0041a638
push 0xd
push 0
push dword [0xc064a4]
push 0x23
push 0xe1
push 0x1fe
push 0xa
push 0x2b
call fcn.0041a638
push 0
push 0x1f4
push 0x266
push 0x3c
push 0xf2
push 0x13
call fcn.00438fb2
push 0x12
call fcn.004a4e59
push eax
push 0x23
push 0x23
push 0
push 0
push 0x4c
call fcn.0047e501
push edx
call fcn.004ac330
pop edx
push eax
push 0
push edx
call fcn.004ac330
pop edx
push eax
mov edx, str.OS:
push edx
call fcn.004ac370
mov edx, dword [0xc06568]
push edx
call fcn.004ac370
mov edx, str.__build
push edx
call fcn.004ac370
mov edx, dword [0xc06570]
push edx
call fcn.004ac370
call fcn.004ac460
push 0x12
push 0x1d6
push 0xa
push 0x32
push 0x4d
call fcn.0043d6c2
add dword [esp + 0x14], edx
call fcn.00434910
call fcn.0043d6e0
push 3
call fcn.004ab838
push eax
push 0x4d
call fcn.0047e8af
push 0
mov eax, 0x55f0cc
push eax
mov eax, 0x56240e
push eax
push 0x23
push 0x82
push 0x28
push 0
push 0x2f
call fcn.0041c08a
push 0
mov eax, 0x55f0cc
push eax
mov eax, 0x5685c4
push eax
push 0x23
push 0x82
push 0x28
push 0x8c
push 0x30
call fcn.0041c08a
push 0
mov eax, 0x55f0cc
push eax
push dword [0xc06558]
push 0x23
push 0x82
push 0x1ae
push 0x1c7
push 0x2e
call fcn.0041c08a
push 0x800
push 0x145
push 0x249
push 0x5a
push 0
push 0x50
call fcn.00438130
call fcn.0047e890
push 1
push 0x13
call fcn.0047c911
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push 0x14
call fcn.00438fb2
push 0
push 0x23
push 0xe6
push 0
push 0
push 0x42
call fcn.0043c4d8
push 1
call fcn.004ab838
push eax
push 0x42
call fcn.0047e8af
push 0x1e
push 0
push 0x153
push 0x42
call fcn.0047dcb3
push eax
call sub.USER32.dll_SendMessageW
push dword [0xc06b3c]
call fcn.004a5ce1
push dword [0xc06b3c]
call fcn.004a5cf6
or eax, eax
je 0x42272e
mov ebp, dword [0xc06b40]
push dword [ebp + 8]
push 0xffffffff
push 0x42
call fcn.0047de52
jmp 0x422705
push 1
push 0x42
call fcn.0047c8d9
push 0
push 0x23
push 0x5a
push 0
push 0xf0
push 0x48
call fcn.0043c4d8
push 1
call fcn.004ab838
push eax
push 0x48
call fcn.0047e8af
push 0x19
push 0
push 0x153
push 0x48
call fcn.0047dcb3
push eax
call sub.USER32.dll_SendMessageW
mov eax, 0x56ee2c
push eax
push 0xffffffff
push 0x48
call fcn.0047de52
mov eax, 0x56b74e
push eax
push 0xffffffff
push 0x48
call fcn.0047de52
push 1
push 0x48
call fcn.0047c8d9
mov dword [esp + 0x18], 0x2d
mov dword [esp], 0x14
push 0
mov eax, str.Word
push eax
push 0x19
push 0x64
push dword [esp + 0x28]
push 0
push 0x56
call fcn.00438594
mov ebx, dword [esp + 0x18]
add ebx, dword [esp]
mov dword [esp + 0x18], ebx
push 0
mov eax, str.Excel
push eax
push 0x19
push 0x64
push dword [esp + 0x28]
push 0
push 0x57
call fcn.00438594
mov ebx, dword [esp + 0x18]
add ebx, dword [esp]
mov dword [esp + 0x18], ebx
push 0
mov eax, str.Access
push eax
push 0x19
push 0x64
push dword [esp + 0x28]
push 0
push 0x58
call fcn.00438594
mov ebx, dword [esp + 0x18]
add ebx, dword [esp]
mov dword [esp + 0x18], ebx
push 0
mov eax, str.Publisher
push eax
push 0x19
push 0x64
push dword [esp + 0x28]
push 0
push 0x59
call fcn.00438594
mov ebx, dword [esp + 0x18]
add ebx, dword [esp]
mov dword [esp + 0x18], ebx
push 0
mov eax, str.Teams
push eax
push 0x19
push 0x78
push dword [esp + 0x28]
push 0
push 0x5a
call fcn.00438594
mov ebx, dword [esp + 0x18]
add ebx, dword [esp]
mov dword [esp + 0x18], ebx
push 0
mov eax, str.OneDrive_for_business
push eax
push 0x19
push 0x9a
push dword [esp + 0x28]
push 0
push 0x5b
call fcn.00438594
mov ebx, dword [esp + 0x18]
add ebx, dword [esp]
mov dword [esp + 0x18], ebx
push 0
mov eax, str.Skype_for_business
push eax
push 0x19
push 0x98
push dword [esp + 0x28]
push 0
push 0x5c
call fcn.00438594
mov ebx, dword [esp + 0x18]
add ebx, dword [esp]
mov dword [esp + 0x18], ebx
push 0
mov eax, str.OneNote
push eax
push 0x19
push 0x64
push dword [esp + 0x28]
push 0
push 0x5d
call fcn.00438594
mov ebx, dword [esp + 0x18]
add ebx, dword [esp]
mov dword [esp + 0x18], ebx
push 0
mov eax, str.Outlook
push eax
push 0x19
push 0x64
push dword [esp + 0x28]
push 0
push 0x5e
call fcn.00438594
mov ebx, dword [esp + 0x18]
add ebx, dword [esp]
mov dword [esp + 0x18], ebx
push 0
mov eax, str.PowerPoint
push eax
push 0x19
push 0x64
push dword [esp + 0x28]
push 0
push 0x5f
call fcn.00438594
mov ebx, dword [esp + 0x18]
add ebx, dword [esp]
mov dword [esp + 0x18], ebx
push 0
mov eax, str.OneDrive
push eax
push 0x19
push 0x64
push dword [esp + 0x28]
push 0
push 0x60
call fcn.00438594
mov ebx, dword [esp + 0x18]
add ebx, dword [esp]
mov dword [esp + 0x18], ebx
push 0
mov eax, str.Project
push eax
push 0x19
push 0x56
push dword [esp + 0x28]
push 0
push 0x61
call fcn.00438594
mov ebx, dword [esp + 0x18]
add ebx, dword [esp]
mov dword [esp + 0x18], ebx
push 0
mov eax, str.ProjectPro
push eax
push 0x19
push 0x56
push dword [esp + 0x28]
push 0
push 0x62
call fcn.00438594
mov ebx, dword [esp + 0x18]
add ebx, dword [esp]
mov dword [esp + 0x18], ebx
push 0
mov eax, str.ProjectMondo
push eax
push 0x19
push 0x64
push dword [esp + 0x28]
push 0
push 0x63
call fcn.00438594
mov ebx, dword [esp + 0x18]
add ebx, dword [esp]
mov dword [esp + 0x18], ebx
push 0
mov eax, str.Visio
push eax
push 0x19
push 0x58
push dword [esp + 0x28]
push 0
push 0x64
call fcn.00438594
mov ebx, dword [esp + 0x18]
add ebx, dword [esp]
mov dword [esp + 0x18], ebx
push 0
mov eax, str.VisioPro
push eax
push 0x19
push 0x58
push dword [esp + 0x28]
push 0
push 0x65
call fcn.00438594
mov ebx, dword [esp + 0x18]
add ebx, dword [esp]
mov dword [esp + 0x18], ebx
push 0
mov eax, str.VisioMondo
push eax
push 0x19
push 0x58
push dword [esp + 0x28]
push 0
push 0x66
call fcn.00438594
mov ebx, dword [esp + 0x18]
add ebx, dword [esp]
mov dword [esp + 0x18], ebx
push 0
push dword [0xc065c8]
push 0x19
push 0xa4
push dword [esp + 0x28]
push 0
push 0x67
call fcn.00438594
mov ebx, dword [esp + 0x18]
add ebx, dword [esp]
mov dword [esp + 0x18], ebx
push 0
mov eax, 0x55f0cc
push eax
push dword [0xc064fc]
push 0x23
push 0x82
push 0x19a
push 0x154
push 0x31
call fcn.0041c08a
push 1
mov eax, 0x55f0cc
push eax
push 0x16
push 0x14a
push 0x181
push 0
push 0x53
call fcn.00434910
push 0
push 0x23
push 0x14a
push 0x19a
push 0
push 0x43
call fcn.0043c4d8
push 1
call fcn.004ab838
push eax
push 0x43
call fcn.0047e8af
push 0x19
push 0
push 0x153
push 0x43
call fcn.0047dcb3
push eax
call sub.USER32.dll_SendMessageW
push 0x43
call fcn.00424306
push 0
push 0x43
call fcn.0047c8d9
push 1
push 0x64
mov eax, str.Langs
push eax
push 0x145
push 0x64
push 0
push 0x1f4
push 0x52
call fcn.0043451b
mov dword [esp + 4], 0
jmp 0x422c72
push dword [0xc06b14]
call fcn.0049bc37
cmp eax, dword [esp + 4]
jl 0x422cba
mov edx, dword [0xc06b18]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xc06b14]
push dword [ebp]
push 0xffffffff
push 0x52
call fcn.0047de52
inc dword [esp + 4]
jno 0x422c72
push 0
mov eax, 0x55f0cc
push eax
push 0x140
push 0xfa
push 0x2d
push 0xf0
push 0x44
call fcn.00434910
mov ebx, dword [0xc06474]
and ebx, ebx
jle 0x422d03
push 0x292521
push 2
push 0x50
call fcn.0043c246
jmp 0x422d18
push dword [0xc06514]
push 2
push 0x50
call fcn.0043c246
call fcn.0047e890
push 1
push 0x14
call fcn.0047c911
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push 0x17
call fcn.00438fb2
push 0
mov eax, 0x55f0cc
push eax
push dword [0xc064a0]
push 0x23
push 0x104
push 0
push 0
push 0x36
call fcn.0041c08a
push 0
mov eax, 0x55f0cc
push eax
push dword [0xc064b4]
push 0x23
push 0x82
push 0
push 0x10e
push 0x37
call fcn.0041c08a
push 0
push 0x23
push 0x14a
push 0x50
push 0
push 0x47
call fcn.0043c4d8
push 1
call fcn.004ab838
push eax
push 0x47
call fcn.0047e8af
push 0x19
push 0
push 0x153
push 0x47
call fcn.0047dcb3
push eax
call sub.USER32.dll_SendMessageW
push 0x47
call fcn.00424306
push dword [0xc0645c]
push 0xffffffff
push 0x47
call fcn.0047de52
push 0
push 0x47
call fcn.0047c8d9
push 0
mov eax, 0x55f0cc
push eax
push 0x12c
push 0x1f4
push 0x96
push 0
push 0x45
call fcn.00434910
push 1
mov eax, 0x55f0cc
push eax
push 0x16
push 0x14a
push 0x37
push 0
push 0x55
call fcn.00434910
call fcn.0047e890
push 1
push 0x17
call fcn.0047c911
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push 0x15
call fcn.00438fb2
push 0x40000001
push 0x246
mov eax, str.Office_C2R_Product:
push eax
push 0x118
push 0x248
push 0
push 0
push 0x3e
call fcn.0043451b
push 0
push 0
push 0xfe
push 0x19
push 1
call sub.COMCTL32.dll_ImageList_Create
push eax
push 1
push 0x1003
push 0x3e
call fcn.0047dcb3
push eax
call sub.USER32.dll_SendMessageW
push 1
call fcn.004ab838
push eax
push 0x3e
call fcn.0047e8af
push 0x800
push 0x118
push 0x249
push 0
push 0
push 0x51
call fcn.00438130
mov ebx, dword [0xc06474]
and ebx, ebx
jle 0x422f7a
push 0x292521
push 2
push 0x51
call fcn.0043c246
jmp 0x422f8f
push dword [0xc06514]
push 2
push 0x51
call fcn.0043c246
push 1
push 0x51
call fcn.0047c911
push 0
mov eax, 0x55f0cc
push eax
push dword [0xc06538]
push 0x23
push 0x82
push 0x12c
push 0
push 0x32
call fcn.0041c08a
push 0
mov eax, 0x55f0cc
push eax
push dword [0xc0650c]
push 0x23
push 0x82
push 0x12c
push 0x8c
push 0x34
call fcn.0041c08a
push 0
mov eax, 0x55f0cc
push eax
push dword [0xc065fc]
push 0x23
push 0xdc
push 0x12c
push 0x16d
push 0x33
call fcn.0041c08a
call fcn.0047e890
push 1
push 0x15
call fcn.0047c911
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push 0x16
call fcn.00438fb2
call fcn.0047e890
push 1
push 0x16
call fcn.0047c911
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push 0x19
call fcn.00438fb2
push 0
push 0x23
push 0x14a
push 0
push 0
push 0x1c
call fcn.0043c4d8
push 1
call fcn.004ab838
push eax
push 0x1c
call fcn.0047e8af
push 0x19
push 0
push 0x153
push 0x1c
call fcn.0047dcb3
push eax
call sub.USER32.dll_SendMessageW
push 0x1c
call fcn.00424306
push 0
push 0x1c
call fcn.0047c8d9
push 0
push 0x23
push 0x5a
push 0
push 0x154
push 0x1d
call fcn.0043c4d8
push 1
call fcn.004ab838
push eax
push 0x1d
call fcn.0047e8af
push 0x19
push 0
push 0x153
push 0x1d
call fcn.0047dcb3
push eax
call sub.USER32.dll_SendMessageW
mov eax, 0x56ee2c
push eax
push 0xffffffff
push 0x1d
call fcn.0047de52
mov eax, 0x56b74e
push eax
push 0xffffffff
push 0x1d
call fcn.0047de52
mov eax, 0x570d34
push eax
push 0xffffffff
push 0x1d
call fcn.0047de52
push 1
push 0x1d
call fcn.0047c8d9
push 1
push 0x64
mov eax, str.Langs
push eax
push 0x145
push 0x64
push 0
push 0x1b8
push 0x1e
call fcn.0043451b
mov dword [esp + 4], 0
jmp 0x4231e6
push dword [0xc06b14]
call fcn.0049bc37
cmp eax, dword [esp + 4]
jl 0x42322e
mov edx, dword [0xc06b18]
imul edx, dword [esp + 4]
mov ebp, edx
push ebp
mov eax, 1
pop ebp
add ebp, eax
shl ebp, 2
add ebp, dword [0xc06b14]
push dword [ebp]
push 0xffffffff
push 0x1e
call fcn.0047de52
inc dword [esp + 4]
jno 0x4231e6
push 1
mov eax, 0x55f0cc
push eax
push 0x16
push 0x14d
push 0x37
push 0
push 0x54
call fcn.00434910
push 0
mov eax, 0x55f0cc
push eax
push dword [0xc064c0]
push 0x23
push 0x14d
push 0x50
push 0
push 0x20
call fcn.0041c08a
push 0
mov eax, 0x55f0cc
push eax
push dword [0xc06468]
push 0x23
push 0x5a
push 0x50
push 0x156
push 0x21
call fcn.0041c08a
push 0
mov eax, 0x55f0cc
push eax
push dword [0xc06580]
push 0x23
push 0x1b0
push 0x96
push 0
push 0x22
call fcn.0041c08a
push 1
push 0x22
call fcn.00420f7c
push 1
mov eax, 0x55f0cc
push eax
push 0x1e
push 0x19a
push 0xd2
push 0
push 0x3c
call fcn.00434910
push 1
mov eax, 0x55f0cc
push eax
push 0x1e
push 0x1a4
push 0xe1
push 0
push 0x3d
call fcn.00434910
push 0
mov eax, 0x55f0cc
push eax
push 0x12c
push 0x1ae
push 0x10e
push 0
push 0x46
call fcn.00434910
call fcn.0047e890
push 1
push 0x19
call fcn.0047c911
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push 0x1a
call fcn.00438fb2
push 0x4000000d
push 0x28a
mov eax, str.Licenses
push eax
push 0x1a4
push 0x258
push 0
push 0
push 0x1f
call fcn.0043451b
push 0
call fcn.004ab838
push eax
push 0x1f
call fcn.0047e8af
push 0
push dword [0xc06504]
push 0xffffffff
push 0x1f
call fcn.0047df0f
push 0
mov eax, 0x55f0cc
push eax
push dword [0xc0650c]
push 0x23
push 0x82
push 0x1ae
push 0
push 0x27
call fcn.0041c08a
push 0
mov eax, 0x55f0cc
push eax
push dword [0xc065e4]
push 0x23
push 0x82
push 0x1ae
push 0x8c
push 0x28
call fcn.0041c08a
push 0
push dword [0xc06510]
push 0x1c
push 0xaa
push 0x1b3
push 0x12c
push 0x29
call fcn.00438594
call fcn.0047e890
push 1
push 0x1a
call fcn.0047c911
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push 0x1b
call fcn.00438fb2
push 0
push dword [0xc065d8]
push 0x1e
push 0x12c
push 0
push 0
push 0x49
call fcn.00438594
push 0
push dword [0xc065cc]
push 0x1e
push 0x15e
push 0x23
push 0
push 0x4a
call fcn.00438594
push 0
push dword [0xc0649c]
push 0x1e
push 0x15e
push 0x46
push 0
push 0x4b
call fcn.00438594
call fcn.0047e890
push 1
push 0x1b
call fcn.0047c911
push 0
push 0x1f4
push 0x28e
push 0x3c
push 0xf2
push 0x18
call fcn.00438fb2
push 0
mov eax, 0x569340
push eax
mov eax, str.Go_msfree.su
push eax
push 0x23
push 0x82
push 0
push 0
push 0x38
call fcn.0041c08a
push 0
mov eax, 0x55f0cc
push eax
mov eax, str.Donate
push eax
push 0x23
push 0x82
push 0
push 0x8c
push 0x39
call fcn.0041c08a
push 0xc
call fcn.004a4e59
push eax
push 0x1c2
push 0x1c2
push 0x28
push 0x50
push 0xe
call fcn.0047e501
call fcn.0047e890
push 1
push 0x18
call fcn.0047c911
xor eax, eax
add esp, 8
pop ebx
pop ebp
ret 0x10