Function at 0x40fad0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x154
push ebx
push esi
push edi
push ebp
mov edi, dword [esp + 0x168]
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov ebx, eax
push edi
and eax, 0x20
and ebx, 0x1f
mov ebp, dword [sym.imp.USER32.dll_GetParent]
mov dword [esp + 0x24], eax
call ebp
mov esi, dword [esp + 0x16c]
push 2
mov dword [esp + 0x20], eax
push esi
call dword [sym.imp.GDI32.dll_SetBkMode]
lea eax, [esp + 0x44]
mov ebp, dword [sym.imp.USER32.dll_GetClientRect]
push eax
push edi
call ebp
mov ebp, dword [esp + 0x48]
lea edx, [esp + 0x44]
lea ecx, [esp + 0x34]
mov eax, dword [edx]
push 0
push 0
push 0x31
mov dword [ecx], eax
mov eax, dword [edx + 8]
push edi
mov edx, dword [edx + 0xc]
mov dword [ecx + 4], ebp
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0x10], eax
test eax, eax
je 0x40fb61
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x10], eax
push 0xf
mov ebp, dword [sym.imp.USER32.dll_GetSysColor]
call ebp
push eax
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0x12
call ebp
push eax
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [esp + 0x1c]
push edi
push esi
push 0x135
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x40]
push eax
mov ebp, dword [sym.imp.GDI32.dll_IntersectClipRect]
mov eax, dword [esp + 0x38]
push ecx
push edx
push eax
push esi
call ebp
mov ebp, dword [esp + 0x170]
test ebp, 0x10
je 0x40fbf6
cmp ebx, 7
je 0x40fbf6
mov eax, dword [esp + 0x40]
push 0xf00021
sub eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x44]
sub eax, dword [esp + 0x3c]
push eax
push ecx
push edx
push esi
call dword [sym.imp.GDI32.dll_PatBlt]
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov dword [esp + 0x28], eax
push 0
push 0
push 0xf2
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0x18], 0
mov ecx, eax
and ecx, 3
mov dword [esp + 0x30], ecx
cmp ecx, 1
sbb ecx, ecx
and eax, 4
inc ecx
mov dword [esp + 0x54], eax
sar eax, 1
or eax, ecx
mov edx, eax
shl eax, 3
sub eax, edx
add eax, eax
cmp dword [esp + 0x28], 0
mov dword [esp + 0x14], eax
jne 0x40fc5d
add ecx, 2
mov eax, ecx
shl ecx, 3
sub ecx, eax
mov eax, dword [esp + 0x14]
lea edx, [eax + ecx*2]
mov dword [esp + 0x14], edx
test ebp, 0xa
jne 0x40fc6e
test ebx, ebx
je 0x40fc6e
cmp ebx, 1
jne 0x40fc83
lea eax, [esp + 0x64]
push 0x100
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov dword [esp + 0x24], eax
cmp ebx, 9
ja case.0x40fc8c.8
jmp dword [ebx*4 + 0x40fff4]
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x64]
push eax
lea eax, [esp + 0x48]
push ebx
push ecx
push edx
push eax
push esi
push edi
call fcn.0040f790
add esp, 0x1c
jmp case.0x40fc8c.8
mov dword [esp + 0x18], 0xd
test ebp, 4
je 0x40fed7
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
test edi, edi
je 0x40fed7
mov eax, dword [0x4291d0]
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ebx, eax
test ebx, ebx
je 0x40fed0
mov eax, dword [esp + 0x18]
push 0xcc0020
mov ecx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x48]
push ecx
cmp dword [esp + 0x2c], 0
push edi
push 0xd
push 0xe
je 0x40fea8
sub eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x50]
sub eax, 0xd
cdq
sub eax, edx
sar eax, 1
add ecx, eax
mov eax, dword [esp + 0x54]
push ecx
sub eax, 0xe
jmp 0x40fec0
cmp dword [esp + 0x30], 2
jne case.0x40fc8c.2
mov dword [esp + 0x18], 0x1a
jmp case.0x40fc8c.2
test ebp, 6
je case.0x40fc8c.8
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
lea edx, [esp + 0x64]
push eax
push ecx
push edx
push esi
call fcn.0040de90
add esp, 0x10
cmp dword [esp + 0x20], 0
jne 0x40fd8d
lea eax, [esp + 0x20]
lea ecx, [esp + 0x54]
push eax
push ecx
push 0x425820
push esi
call fcn.0040de90
add esp, 0x10
add dword [esp + 0x34], 4
mov eax, dword [esp + 0x30]
add eax, dword [esp + 0x34]
add eax, 4
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x20]
add eax, dword [esp + 0x38]
test ebp, 0x20
mov dword [esp + 0x40], eax
je 0x40fe2a
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x3c]
lea ecx, [esp + 0x34]
lea edx, [esp + 0x54]
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [esp + 0x4c]
push edx
push edi
mov esi, dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [edx + 4], ebx
mov dword [edx + 8], ebp
mov dword [edx + 0xc], eax
mov dword [esp + 0x64], ecx
call esi
lea ecx, [esp + 0x5c]
push ecx
push edi
call esi
lea eax, [esp + 0x54]
mov ecx, dword [esp + 0x1c]
push eax
mov esi, dword [sym.imp.USER32.dll_ScreenToClient]
push ecx
call esi
lea ecx, [esp + 0x5c]
mov eax, dword [esp + 0x1c]
push ecx
push eax
call esi
lea ecx, [esp + 0x54]
push 1
mov edx, dword [esp + 0x20]
push ecx
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x154
ret
mov eax, dword [esp + 0x20]
dec dword [esp + 0x4c]
dec dword [esp + 0x50]
push 0xf
cdq
sub eax, edx
push 2
sar eax, 1
push 2
add dword [esp + 0x54], eax
lea eax, [esp + 0x50]
push eax
push esi
call fcn.0040dca0
lea eax, [esp + 0x58]
add esp, 0x14
push 1
push 1
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
lea ecx, [esp + 0x44]
push 0xf
push 0
push 0
push ecx
push esi
call fcn.0040dca0
add esp, 0x14
cmp dword [esp + 0x28], 0
jne 0x40fe8b
mov eax, dword [0x4291bc]
push eax
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
lea eax, [esp + 0x34]
push 0x20
mov ecx, dword [esp + 0x28]
push eax
lea edx, [esp + 0x6c]
push ecx
push edx
push esi
call dword [sym.imp.USER32.dll_DrawTextA]
jmp case.0x40fc8c.8
sub eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x50]
sub eax, 0xd
cdq
sub eax, edx
sar eax, 1
add ecx, eax
mov eax, dword [esp + 0x4c]
push ecx
push eax
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push ebx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
test ebp, 2
je 0x40ff2a
cmp dword [esp + 0x20], 0
je 0x40fef3
mov eax, dword [esp + 0x4c]
sub eax, 0x12
mov dword [esp + 0x3c], eax
jmp 0x40fefe
mov eax, dword [esp + 0x44]
add eax, 0x12
mov dword [esp + 0x34], eax
cmp dword [esp + 0x28], 0
jne 0x40ff12
mov eax, dword [0x4291bc]
push eax
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
lea eax, [esp + 0x34]
push 0x24
mov ecx, dword [esp + 0x28]
push eax
lea edx, [esp + 0x6c]
push ecx
push edx
push esi
call dword [sym.imp.USER32.dll_DrawTextA]
test ebp, 8
je case.0x40fc8c.8
lea eax, [esp + 0x30]
lea ecx, [esp + 0x54]
lea edx, [esp + 0x64]
push eax
push ecx
push edx
push esi
call fcn.0040de90
mov eax, dword [esp + 0x50]
sub eax, dword [esp + 0x48]
sub eax, dword [esp + 0x40]
add esp, 0x10
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x30]
add eax, dword [esp + 0x38]
cmp dword [esp + 0x20], 0
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x44]
je 0x40ff86
sub dword [esp + 0x4c], 0x12
mov dword [esp + 0x34], eax
jmp 0x40ff8d
add eax, 0x12
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x54]
push 1
add eax, dword [esp + 0x38]
push 1
lea ecx, [esp + 0x3c]
mov dword [esp + 0x44], eax
push ecx
call dword [sym.imp.USER32.dll_InflateRect]
lea ecx, [esp + 0x44]
lea eax, [esp + 0x34]
push ecx
push eax
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
lea ecx, [esp + 0x34]
push ecx
push esi
call dword [sym.imp.USER32.dll_DrawFocusRect]
mov eax, dword [esp + 0x2c]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [esp + 0x10], 0
je 0x40ffe8
mov eax, dword [esp + 0x10]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x154
ret