Function at 0x427c40
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x23
push 0
push 0
dec ecx
jne 0x426e44
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x427cc7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0x201
jne 0x426ee0
push 1
push 0
push 0
push 0
push 0x42cd24
call sub.user32.dll_PeekMessageA
lea eax, [ebp - 0x88]
push eax
mov ecx, 0x427cd8
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e8d0
mov eax, dword [ebp - 0x88]
mov edx, 0x427cf8
call fcn.00404668
je 0x427c9c
lea eax, [ebp - 0x8c]
push eax
mov ecx, 0x427cfc
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e8d0
mov eax, dword [ebp - 0x8c]
mov edx, 0x427cf8
call fcn.00404668
jne 0x426ee0
call fcn.00425504
jmp 0x427c9c
lea eax, [ebp - 0x90]
push eax
mov ecx, 0x427d04
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e8d0
mov eax, dword [ebp - 0x90]
mov edx, 0x427cf8
call fcn.00404668
jne 0x427052
cmp ebx, 0x201
jne 0x427c9c
push 0x427ce0
push 0x427d0c
call sub.user32.dll_FindWindowA
mov esi, eax
test esi, esi
jne 0x426f65
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x427d18
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e8d0
cmp dword [ebp - 0x1c], 0
je 0x426f65
mov eax, dword [ebp - 0x1c]
call fcn.0040471c
push eax
push 0x427d0c
call sub.user32.dll_FindWindowA
mov esi, eax
test esi, esi
je 0x427c9c
call sub.user32.dll_GetForegroundWindow
xor edx, edx
push edx
push eax
mov eax, esi
cdq
cmp edx, dword [esp + 4]
jne 0x426f82
cmp eax, dword [esp]
pop edx
pop eax
jne 0x427c9c
lea eax, [ebp - 8]
push eax
call sub.user32.dll_GetCursorPos
mov dword [ebp - 0x84], 0x181
mov dword [ebp - 0x80], 0x1ca
mov dword [ebp - 0x7c], 0x1ae
mov dword [ebp - 0x78], 0x1de
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x84]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x426fee
lea eax, [ebp - 0x94]
call fcn.00426bf4
mov eax, dword [ebp - 0x94]
mov edx, 0x427d2c
call fcn.0040db58
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call fcn.00424e14
mov dword [ebp - 0x84], 0x17e
mov dword [ebp - 0x80], 0x224
mov dword [ebp - 0x7c], 0x1b0
mov dword [ebp - 0x78], 0x238
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x84]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x427c9c
lea eax, [ebp - 0x98]
call fcn.00426bf4
mov eax, dword [ebp - 0x98]
mov edx, 0x427d2c
call fcn.0040db58
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call fcn.00424e14
jmp 0x427c9c
cmp ebx, 0x201
jne 0x427c9c
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov ebx, 0x13
lea eax, [ebp - 0x74]
xor edx, edx
mov dword [eax], edx
add eax, 4
dec ebx
jne 0x42707a
push 0x427d30
push 0x427d0c
call sub.user32.dll_FindWindowA
push 0
push 0x427d3c
push 0
push eax
call sub.user32.dll_FindWindowExA
push 0x42cd40
push pe_nt_image_headers32
push 0xd
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x9c]
push eax
mov ecx, 0x427d48
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e8d0
mov eax, dword [ebp - 0x9c]
push eax
lea eax, [ebp - 0xa0]
mov edx, 0x42cd40
mov ecx, pe_nt_image_headers32
call fcn.004044d4
mov edx, dword [ebp - 0xa0]
pop eax
call fcn.00404668
je 0x427114
push 0x42cd40
push 1
mov ecx, 0x427d48
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e67c
push 0x427ce0
push 0x427d0c
call sub.user32.dll_FindWindowA
mov esi, eax
test esi, esi
jne 0x42715c
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x427d18
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e8d0
cmp dword [ebp - 0x1c], 0
je 0x42715c
mov eax, dword [ebp - 0x1c]
call fcn.0040471c
push eax
push 0x427d0c
call sub.user32.dll_FindWindowA
mov esi, eax
test esi, esi
je 0x427c9c
call sub.user32.dll_GetForegroundWindow
xor edx, edx
push edx
push eax
mov eax, esi
cdq
cmp edx, dword [esp + 4]
jne 0x427179
cmp eax, dword [esp]
pop edx
pop eax
jne 0x427c9c
mov ebx, 0x13
lea edi, [ebp - 0x74]
push 0
push 0x427d50
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.user32.dll_FindWindowExA
mov dword [edi], eax
mov eax, dword [edi]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4271c0
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4271ba
inc dword [ebp - 0x10]
add edi, 4
dec ebx
jne 0x427189
lea eax, [ebp - 8]
push eax
call sub.user32.dll_GetCursorPos
mov dword [ebp - 0x84], 0x1a9
mov dword [ebp - 0x80], 0x151
mov dword [ebp - 0x7c], 0x1ef
mov dword [ebp - 0x78], 0x16d
cmp dword [ebp - 0x10], 2
jne 0x427286
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x84]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x427286
mov edi, dword [ebp - 0x14]
test edi, edi
jle 0x427286
lea esi, [ebp - 0x74]
mov ebx, 0x42ce40
cmp dword [esi], 0
je 0x42727a
mov eax, dword [esi]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x42727a
mov eax, ebx
push eax
push pe_nt_image_headers32
push 0xd
mov eax, dword [esi]
push eax
call sub.user32.dll_SendMessageA
cmp dword [ebp - 0x18], 0
jne 0x427260
push ebx
push 1
mov ecx, 0x427d58
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e67c
mov eax, dword [esi]
mov dword [0x42e140], eax
jmp 0x427277
push ebx
push 1
mov ecx, 0x427d5c
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e67c
inc dword [ebp - 0x18]
add ebx, 0x100
add esi, 4
dec edi
jne 0x427217
mov dword [ebp - 0x84], 0x134
mov dword [ebp - 0x80], 0x8d
mov dword [ebp - 0x7c], 0x1dc
mov dword [ebp - 0x78], 0x1dd
cmp dword [ebp - 0x10], 0
jne 0x427538
cmp dword [ebp - 0x14], 2
jl 0x427538
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x84]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x427538
lea eax, [ebp - 0xa4]
push eax
mov ecx, 0x427d60
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e8d0
mov eax, dword [ebp - 0xa4]
mov edx, 0x427cf8
call fcn.00404668
jne 0x427305
call fcn.00426c84
mov ecx, 0x427d5c
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e944
test al, al
je 0x427506
mov ecx, 0x427d58
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e944
test al, al
je 0x427506
push 0x427d68
push 1
mov ecx, 0x427d04
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e67c
lea eax, [ebp - 0xa8]
mov edx, 0x42cd40
mov ecx, pe_nt_image_headers32
call fcn.004044d4
cmp dword [ebp - 0xa8], 0
je 0x427393
push 0x42cd40
push 1
mov ecx, 0x427d6c
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e67c
jmp 0x4273d0
lea eax, [ebp - 0xac]
push eax
mov ecx, 0x427d48
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e8d0
mov eax, dword [ebp - 0xac]
call fcn.0040471c
push eax
push 1
mov ecx, 0x427d6c
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e67c
xor eax, eax
push ebp
push 0x427417
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xb0]
push eax
mov ecx, 0x427d74
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e8d0
mov eax, dword [ebp - 0xb0]
call fcn.0040c610
mov ebx, eax
mov eax, ebx
call fcn.00426ccc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x427421
mov eax, dword [0x42e14c]
call fcn.00405594
mov edi, eax
test edi, edi
jl 0x42749a
inc edi
xor ebx, ebx
mov edx, dword [0x42e14c]
mov edx, dword [edx + ebx*8]
mov eax, dword [ebp - 4]
cmp edx, eax
jge 0x427496
mov edx, dword [0x42e14c]
cmp eax, dword [edx + ebx*8 + 4]
jge 0x427496
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0xb8]
lea eax, [ebx + 1]
call fcn.0040c670
mov ecx, dword [ebp - 0xb8]
lea eax, [ebp - 0xb4]
mov edx, 0x427d8c
call fcn.00404570
mov eax, dword [ebp - 0xb4]
call fcn.0040471c
mov ecx, eax
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e8d0
jmp 0x42749a
inc ebx
dec edi
jne 0x427434
push dword [ebp - 0x20]
push 0x427da0
lea edx, [ebp - 0xc0]
mov eax, dword [ebp - 8]
call fcn.0040c670
push dword [ebp - 0xc0]
push 0x427dac
lea edx, [ebp - 0xc4]
mov eax, dword [ebp - 4]
call fcn.0040c670
push dword [ebp - 0xc4]
push 0x427db8
lea eax, [ebp - 0xbc]
mov edx, 6
call fcn.004045e4
mov eax, dword [ebp - 0xbc]
call fcn.0040471c
push eax
push 1
mov ecx, 0x427dbc
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e67c
lea eax, [ebp - 0xc8]
push eax
mov ecx, 0x427d60
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e8d0
mov eax, dword [ebp - 0xc8]
mov edx, 0x427cf8
call fcn.00404668
jne 0x427538
call fcn.00426c84
mov dword [ebp - 0x84], 0x1e9
mov dword [ebp - 0x80], 0x66
mov dword [ebp - 0x7c], 0x1f9
mov dword [ebp - 0x78], 0x7f
cmp dword [ebp - 0x10], 0
jne 0x427819
cmp dword [ebp - 0x14], 2
jl 0x427819
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x84]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x427819
call fcn.00426c84
mov ebx, 1
lea eax, [ebp - 0x1c]
call fcn.0040426c
cmp ebx, 0x63
jg 0x4275db
lea edx, [ebp - 0xcc]
mov eax, ebx
call fcn.0040c670
mov eax, dword [ebp - 0xcc]
call fcn.0040471c
mov ecx, eax
mov edx, 0x427dc0
mov eax, 0x80000000
call fcn.0040e97c
test al, al
jne 0x4275d5
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040c670
jmp 0x4275db
inc ebx
cmp ebx, 0x63
jle 0x42759c
mov ecx, 0x427d5c
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e944
test al, al
je 0x4277e7
mov ecx, 0x427d58
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e944
test al, al
je 0x4277e7
lea eax, [ebp - 0xd0]
mov edx, 0x42cd40
mov ecx, pe_nt_image_headers32
call fcn.004044d4
cmp dword [ebp - 0xd0], 0
je 0x42764e
push 0x42cd40
push 1
mov ecx, 0x427d6c
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e67c
jmp 0x42768b
lea eax, [ebp - 0xd4]
push eax
mov ecx, 0x427d48
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e8d0
mov eax, dword [ebp - 0xd4]
call fcn.0040471c
push eax
push 1
mov ecx, 0x427d6c
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e67c
lea eax, [ebp - 0xd8]
push eax
mov ecx, 0x427d5c
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e8d0
mov eax, dword [ebp - 0xd8]
call fcn.0040471c
push eax
push 1
lea eax, [ebp - 0xdc]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x427de0
call fcn.00404570
mov eax, dword [ebp - 0xdc]
call fcn.0040471c
mov edx, eax
mov ecx, 0x427d5c
mov eax, 0x80000000
call fcn.0040e67c
lea eax, [ebp - 0xe0]
push eax
mov ecx, 0x427d58
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e8d0
mov eax, dword [ebp - 0xe0]
call fcn.0040471c
push eax
push 1
lea eax, [ebp - 0xe4]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x427de0
call fcn.00404570
mov eax, dword [ebp - 0xe4]
call fcn.0040471c
mov edx, eax
mov ecx, 0x427d58
mov eax, 0x80000000
call fcn.0040e67c
push 0x427e00
lea edx, [ebp - 0xec]
mov eax, dword [ebp - 8]
call fcn.0040c670
push dword [ebp - 0xec]
push 0x427dac
lea edx, [ebp - 0xf0]
mov eax, dword [ebp - 4]
call fcn.0040c670
push dword [ebp - 0xf0]
push 0x427db8
lea eax, [ebp - 0xe8]
mov edx, 5
call fcn.004045e4
mov eax, dword [ebp - 0xe8]
call fcn.0040471c
push eax
push 1
lea eax, [ebp - 0xf4]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x427de0
call fcn.00404570
mov eax, dword [ebp - 0xf4]
call fcn.0040471c
mov edx, eax
mov ecx, 0x427dbc
mov eax, 0x80000000
call fcn.0040e67c
mov ecx, 0x427d5c
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e6f4
mov ecx, 0x427d58
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e6f4
lea eax, [ebp - 0xf8]
push eax
mov ecx, 0x427d60
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e8d0
mov eax, dword [ebp - 0xf8]
mov edx, 0x427cf8
call fcn.00404668
jne 0x427819
call fcn.00426c84
mov dword [ebp - 0x84], 0x174
mov dword [ebp - 0x80], 0x194
mov dword [ebp - 0x7c], 0x1bd
mov dword [ebp - 0x78], 0x1b0
cmp dword [ebp - 0x10], 4
jne 0x4279ff
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x84]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4279ff
mov ebx, 1
lea eax, [ebp - 0x1c]
call fcn.0040426c
cmp ebx, 0x63
jg 0x4278ad
lea edx, [ebp - 0xfc]
mov eax, ebx
call fcn.0040c670
mov eax, dword [ebp - 0xfc]
call fcn.0040471c
mov ecx, eax
mov edx, 0x427e08
mov eax, 0x80000000
call fcn.0040e97c
test al, al
jne 0x4278a7
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040c670
jmp 0x4278ad
inc ebx
cmp ebx, 0x63
jle 0x42786e
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x100]
mov edx, 0x42cd40
mov ecx, pe_nt_image_headers32
call fcn.004044d4
cmp dword [ebp - 0x100], 0
je 0x4278ef
push 0x42cd40
push 1
mov ecx, 0x427d6c
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e67c
jmp 0x42792c
lea eax, [ebp - 0x104]
push eax
mov ecx, 0x427d48
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e8d0
mov eax, dword [ebp - 0x104]
call fcn.0040471c
push eax
push 1
mov ecx, 0x427d6c
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e67c
mov edi, dword [ebp - 0x14]
test edi, edi
jle 0x4279ff
lea esi, [ebp - 0x74]
mov ebx, 0x42ce40
cmp dword [esi], 0
je 0x4279ef
mov eax, dword [esi]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4279ef
mov eax, dword [ebp - 0x28]
dec eax
je 0x427969
dec eax
je 0x427978
dec eax
je 0x427987
dec eax
je 0x427996
jmp 0x4279a3
lea eax, [ebp - 0x24]
mov edx, 0x427e30
call fcn.00404304
jmp 0x4279a3
lea eax, [ebp - 0x24]
mov edx, 0x427e3c
call fcn.00404304
jmp 0x4279a3
lea eax, [ebp - 0x24]
mov edx, 0x427e48
call fcn.00404304
jmp 0x4279a3
lea eax, [ebp - 0x24]
mov edx, 0x427e54
call fcn.00404304
mov eax, ebx
push eax
push pe_nt_image_headers32
push 0xd
mov eax, dword [esi]
push eax
call sub.user32.dll_SendMessageA
push ebx
push 1
mov eax, dword [ebp - 0x24]
call fcn.0040471c
push eax
lea eax, [ebp - 0x108]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x427e60
call fcn.00404570
mov eax, dword [ebp - 0x108]
call fcn.0040471c
mov edx, eax
mov eax, 0x80000000
pop ecx
call fcn.0040e67c
inc dword [ebp - 0x28]
add ebx, 0x100
add esi, 4
dec edi
jne 0x42793f
mov dword [ebp - 0x84], 0xf0
mov dword [ebp - 0x80], 0x1e0
mov dword [ebp - 0x7c], 0x139
mov dword [ebp - 0x78], 0x1fd
cmp dword [ebp - 0x10], 0xc
jne 0x427c9c
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x84]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x427c9c
mov ebx, 1
lea eax, [ebp - 0x1c]
call fcn.0040426c
cmp ebx, 0x63
jg 0x427a93
lea edx, [ebp - 0x10c]
mov eax, ebx
call fcn.0040c670
mov eax, dword [ebp - 0x10c]
call fcn.0040471c
mov ecx, eax
mov edx, 0x427e80
mov eax, 0x80000000
call fcn.0040e97c
test al, al
jne 0x427a8d
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040c670
jmp 0x427a93
inc ebx
cmp ebx, 0x63
jle 0x427a54
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x110]
mov edx, 0x42cd40
mov ecx, pe_nt_image_headers32
call fcn.004044d4
cmp dword [ebp - 0x110], 0
je 0x427ad5
push 0x42cd40
push 1
mov ecx, 0x427d6c
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e67c
jmp 0x427b12
lea eax, [ebp - 0x114]
push eax
mov ecx, 0x427d48
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e8d0
mov eax, dword [ebp - 0x114]
call fcn.0040471c
push eax
push 1
mov ecx, 0x427d6c
mov edx, 0x427ce0
mov eax, 0x80000000
call fcn.0040e67c
mov edi, dword [ebp - 0x14]
test edi, edi
jle 0x427c9c
lea ebx, [ebp - 0x74]
mov esi, 0x42ce40
cmp dword [ebx], 0
je 0x427c8c
mov eax, dword [ebx]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x427c8c
mov eax, dword [ebp - 0x28]
cmp eax, 0xc
ja case.0x427b4a.0
jmp dword [eax*4 + 0x427b51]
lea eax, [ebp - 0x24]
mov edx, 0x427ea0
call fcn.00404304
jmp case.0x427b4a.0
lea eax, [ebp - 0x24]
mov edx, 0x427eac
call fcn.00404304
jmp case.0x427b4a.0
lea eax, [ebp - 0x24]
mov edx, 0x427eb8
call fcn.00404304
jmp case.0x427b4a.0
lea eax, [ebp - 0x24]
mov edx, 0x427ec4
call fcn.00404304
jmp case.0x427b4a.0
lea eax, [ebp - 0x24]
mov edx, 0x427ed0
call fcn.00404304
jmp case.0x427b4a.0
lea eax, [ebp - 0x24]
mov edx, 0x427edc
call fcn.00404304
jmp case.0x427b4a.0
lea eax, [ebp - 0x24]
mov edx, 0x427ee8
call fcn.00404304
jmp case.0x427b4a.0
lea eax, [ebp - 0x24]
mov edx, 0x427ef4
call fcn.00404304
jmp case.0x427b4a.0
lea eax, [ebp - 0x24]
mov edx, 0x427f00
call fcn.00404304
jmp case.0x427b4a.0
lea eax, [ebp - 0x24]
mov edx, 0x427e30
call fcn.00404304
jmp case.0x427b4a.0
lea eax, [ebp - 0x24]
mov edx, 0x427f0c
call fcn.00404304
jmp case.0x427b4a.0
lea eax, [ebp - 0x24]
mov edx, 0x427e54
call fcn.00404304
mov eax, esi
push eax
push pe_nt_image_headers32
push 0xd
mov eax, dword [ebx]
push eax
call sub.user32.dll_SendMessageA
push esi
push 1
mov eax, dword [ebp - 0x24]
call fcn.0040471c
push eax
lea eax, [ebp - 0x118]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x427f18
call fcn.00404570
mov eax, dword [ebp - 0x118]
call fcn.0040471c
mov edx, eax
mov eax, 0x80000000
pop ecx
call fcn.0040e67c
inc dword [ebp - 0x28]
add esi, 0x100
add ebx, 4
dec edi
jne 0x427b25
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427cce
lea eax, [ebp - 0x118]
mov edx, 0x25
call fcn.00404290
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404290
ret