The "View | Windows" tool in Ollydbg is very good at displaying all windows and children including the class name, class title, and ClsProc (handler function for that window), however it does not show you where the window was created so if you want to find out which call to CreateWindowEx created a specific window (which youd need to know if you want to stop a window such as a nagscreen from loading) then this must be done at runtime, which is why it is not possible for Ollydbg to show us.
Ollydbg's Conditional Breakpoint capability comes into play here to make things very easy for us. After using the View | Windows tool to find out the title or class of the window you want to break on, just do this (from the main CPU/disassembly window):
1. Press Ctrl+G, then type CreateWindowExA
2. Right-click on the first line of code in the CreateWindowExA function (it'll automatically be selected by the Goto), then select "Breakpoint | Conditional Breakpoint" (or simply Shift+F2)
3. Just enter the following to break when it creates a known window class:
[esp+8]=="Class text here"
Or this for known window titles:
[esp+12]=="Title text here"
Dont be afraid to play around with expressions and conditional breakpoints, theyre there to make things much easier for you and they dont take too much time to learn as the Ollydbg helpfile documents it well enough
