Function at 0x140004ec0
Capabilities:
Get graphical window text
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x158
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xc0], xmm6
mov rsi, rcx
mov rax, qword [0x1400a47b8]
xor rax, rbp
mov qword [rbp + 0xb8], rax
lea r13, [rcx + 0x20]
lea rbx, [rcx + 8]
mov eax, 0x46505d80
mov r14d, 0xe5f48c43
mov r15, qword [sym.imp.USER32.dll_SendMessageW]
lea rdi, [rbp + 0x20]
xorps xmm6, xmm6
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140004f30
mov rax, qword [rbp - 0x10]
mov eax, 0xb3706a11
nop dword [rax]
cmp eax, 0xc99476a
jle 0x140005000
cmp eax, 0x5508bca3
jg 0x140005050
cmp eax, 0x22fcd26d
jle 0x1400050fe
cmp eax, 0x4bdc43c7
jg 0x140005306
cmp eax, 0x22fcd26e
je 0x140005397
cmp eax, 0x46505d80
jne 0x140004f30
mov eax, 0x210
call fcn.14002d5a0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
mov eax, 0x10
call fcn.14002d5a0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x10], rax
mov eax, 0x10
call fcn.14002d5a0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x38], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov rcx, qword [rax]
sub rsp, 0x20
mov edx, 0xe
xor r8d, r8d
xor r9d, r9d
call r15
add rsp, 0x20
mov dword [rbp + 0x18], eax
mov ecx, dword [rbp + 0x18]
add ecx, 1
shl rcx, 2
sub rsp, 0x20
call fcn.14002d31c
add rsp, 0x20
mov qword [rbp - 0x40], rax
mov eax, 0xd6f4ed6e
jmp 0x140004f30
cmp eax, 0xc99d0d5e
jle 0x1400050c0
cmp eax, 0xdef7c54e
jle 0x140005129
cmp eax, 0xf0ee88be
jg 0x140005326
cmp eax, 0xdef7c54f
je 0x1400053a5
cmp eax, 0xe5f48c43
jne 0x140004f30
mov eax, 0x3c8f360
jmp 0x140004f30
cmp eax, 0x69f4533b
jle 0x140005286
cmp eax, 0x76266dc7
jg 0x14000534a
cmp eax, 0x69f4533c
je 0x1400053af
cmp eax, 0x6ff15344
jne 0x140004f30
mov rcx, qword [rbp - 0x50]
sub rsp, 0x40
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
add rsp, 0x40
mov qword [rbp + 8], rax
mov eax, 0xc99d0d5f
jmp 0x140004f30
cmp eax, 0xaa40aa37
jle 0x1400052db
cmp eax, 0xb3706a10
jg 0x14000537e
cmp eax, 0xaa40aa38
je 0x1400053c5
cmp eax, 0xab8a42ce
jne 0x140004f30
cmp byte [rbp + 0x1e], 0
mov eax, 0x76266dc8
cmovne eax, r14d
jmp 0x140004f30
cmp eax, 0xc99476b
je 0x1400053cf
cmp eax, 0x1426428c
je 0x1400053f7
cmp eax, 0x188503f2
jne 0x140004f30
mov eax, 0x3c8f360
jmp 0x140004f30
cmp eax, 0xc99d0d5f
je 0x14000540d
cmp eax, 0xcf7589b9
je 0x140005423
cmp eax, 0xd6f4ed6e
jne 0x140004f30
mov qword [rbp - 8], r13
mov rax, qword [rbp - 0x40]
mov rcx, qword [rbp - 8]
mov qword [rcx], rax
mov r9, qword [rbp - 0x40]
mov eax, dword [rbp + 0x18]
mov qword [rbp - 0x48], rax
mov r8, qword [rbp - 0x48]
movabs rax, 0xbec8363d9c38d921
add r8, rax
movabs rcx, 0x30a47bd2ea104c3f
sub r8, rcx
sub r8, rax
movabs rax, 0xdf13e73b20db9525
add r8, rax
add r8, rcx
sub r8, rax
add r8, 1
mov rax, qword [rbp]
mov rcx, qword [rax]
sub rsp, 0x20
mov edx, 0xd
call r15
add rsp, 0x20
mov qword [rbp - 0x10], rdi
mov rax, qword [rbp - 0x10]
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
mov r8d, 0x208
xor edx, edx
call fcn.1400321d0
add rsp, 0x20
mov rax, qword [rbp - 0x10]
movups xmmword [rax], xmm6
movups xmmword [rax + 0x10], xmm6
movups xmmword [rax + 0x20], xmm6
movups xmmword [rax + 0x30], xmm6
movups xmmword [rax + 0x40], xmm6
movups xmmword [rax + 0x50], xmm6
movups xmmword [rax + 0x60], xmm6
movups xmmword [rax + 0x70], xmm6
movups xmmword [rax + 0x80], xmm6
mov qword [rax + 0x90], 0
mov dword [rbp + 0x20], 0x98
mov rax, qword [rbp]
mov rax, qword [rax]
mov qword [rbp + 0x28], rax
lea rax, str.Text_Files__.txt_
mov qword [rbp + 0x38], rax
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0x50], rax
mov dword [rbp + 0x58], 0x104
mov dword [rbp + 0x80], 0x81800
lea rax, [0x14005a288]
mov qword [rbp + 0x88], rax
sub rsp, 0x20
mov rcx, rdi
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
add rsp, 0x20
test eax, eax
mov eax, 0x6ff15344
mov ecx, 0xa35ae2b8
cmove eax, ecx
jmp 0x140004f30
cmp eax, 0x5508bca4
je 0x140005443
cmp eax, 0x625c5e58
je 0x140004f20
cmp eax, 0x68ef3473
jne 0x140004f30
mov rdx, qword [rbp - 0x70]
mov r9, qword [rbp + 0x10]
mov rcx, qword [rbp + 8]
mov r8d, dword [rbp - 0x24]
sub rsp, 0x30
mov qword [rsp + 0x20], 0
call r12
add rsp, 0x30
test eax, eax
mov eax, 0xcf7589b9
cmove eax, r14d
jmp 0x140004f30
cmp eax, 0xa35ae2b8
je 0x140005455
cmp eax, 0xa82728b3
je 0x14000545f
cmp eax, 0xa97efff8
jne 0x140004f30
mov eax, 0xaa40aa38
jmp 0x140004f30
cmp eax, 0x4bdc43c8
je 0x14000547e
cmp eax, 0x4c87820f
jne 0x140004f30
mov eax, 0x188503f2
jmp 0x140004f30
cmp eax, 0xf0ee88bf
je 0x1400054c2
cmp eax, 0x3c8f360
jne 0x140004f30
mov rax, qword [rbp - 0x20]
mov eax, 0x22fcd26e
jmp 0x140004f30
cmp eax, 0x76266dc8
je 0x1400054dd
cmp eax, 0x767a80f7
jne 0x140004f30
mov rax, qword [rbp - 8]
mov rax, qword [rax]
mov qword [rbp - 0x60], rax
cmp qword [rbp - 0x60], 0
sete byte [rbp + 0x1d]
mov eax, 0x1426428c
jmp 0x140004f30
cmp eax, 0xc590be02
jne 0x1400054f2
mov rax, qword [rbp - 0x18]
mov eax, 0x625c5e58
jmp 0x140004f30
mov rax, qword [rbp - 0x58]
mov eax, 0xa97efff8
jmp 0x140004f30
mov eax, 0xaa40aa38
jmp 0x140004f30
cmp byte [rbp + 0x1f], 0
mov eax, 0xc99476b
mov ecx, 0xdef7c54f
cmovne eax, ecx
jmp 0x140004f30
mov eax, 0xc590be02
jmp 0x140004f30
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x58], rax
mov rax, qword [rbp - 0x58]
mov rax, qword [rbp + 0x10]
mov dword [rax], 0
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x20], rax
mov eax, 0x4bdc43c8
jmp 0x140004f30
cmp byte [rbp + 0x1d], 0
mov eax, 0x5508bca4
mov ecx, 0x188503f2
cmovne eax, ecx
jmp 0x140004f30
mov rax, qword [rbp + 8]
cmp rax, 0xffffffffffffffff
sete byte [rbp + 0x1f]
mov eax, 0x69f4533c
jmp 0x140004f30
mov byte [rsi + 0x18], 0
mov rcx, qword [rbp + 8]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
mov eax, 0x767a80f7
jmp 0x140004f30
mov rax, qword [rbp - 0x60]
mov qword [rbp - 0x78], rax
mov eax, 0xf0ee88bf
jmp 0x140004f30
mov eax, 0xc590be02
jmp 0x140004f30
mov rax, qword [rbp - 0x68]
add eax, 1
mov dword [rbp - 0x24], eax
mov rax, qword [rbp - 8]
mov rax, qword [rax]
mov qword [rbp - 0x70], rax
mov eax, 0x68ef3473
jmp 0x140004f30
mov rax, qword [rbp - 0x20]
mov rax, qword [rbp - 0x38]
mov dword [rax], 0xfeff
mov r9, qword [rbp + 0x10]
mov rcx, qword [rbp + 8]
mov rdx, qword [rbp - 0x20]
sub rsp, 0x30
mov qword [rsp + 0x20], 0
mov r8d, 2
call r12
add rsp, 0x30
test eax, eax
sete byte [rbp + 0x1e]
mov eax, 0xab8a42ce
jmp 0x140004f30
mov rcx, qword [rbp - 0x78]
sub rsp, 0x20
call fcn.14002d2e8
add rsp, 0x20
mov eax, 0x4c87820f
jmp 0x140004f30
mov rax, qword [rbp - 0x48]
add rax, rax
mov qword [rbp - 0x68], rax
mov eax, 0xa82728b3
jmp 0x140004f30
cmp eax, 0xb3706a11
jne 0x140004f30
mov rcx, qword [rbp + 0xb8]
xor rcx, rbp
sub rsp, 0x20
call fcn.14002d600
add rsp, 0x20
movaps xmm6, xmmword [rbp + 0xc0]
lea rsp, [rbp + 0xd8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret