Function at 0x140012600
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x750]
sub rsp, 0x850
mov rax, qword [0x1400dbc58]
xor rax, rsp
mov qword [rbp + 0x740], rax
mov rdi, rdx
mov r12, rcx
xor edx, edx
lea rcx, [rbp + 0x340]
mov r8d, 0x400
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, 0x1ff
lea rdx, [rbp + 0x340]
mov rcx, rdi
mov dword [rsp + 0x24], eax
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor r13d, r13d
test eax, eax
je 0x140012891
lea rdx, [rbp + 0x340]
mov rcx, r12
call fcn.140011c78
movsxd rcx, eax
lea rax, [0x140000000]
shl rcx, 7
lea rdx, [rax + 0x869c0]
add rdx, rcx
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdx + rbx*2], r13w
jne 0x1400126a8
lea rcx, [rbp + 0x340]
call fcn.140012ee8
lea rcx, [rbp + 0x340]
cmp rax, rcx
jbe 0x140012891
movzx edx, word [rax - 2]
movsxd rcx, ebx
lea rbx, [rax + rcx*2]
mov ecx, 0x28
movzx eax, word [rbx]
cmp cx, dx
jne 0x1400126f0
mov ecx, 0x29
cmp cx, ax
je 0x140012704
mov ecx, 0x5b
cmp cx, dx
jne 0x14001270b
mov ecx, 0x5d
cmp cx, ax
jne 0x14001270b
add rbx, 2
movzx eax, word [rbx]
test ax, ax
je 0x140012813
mov r8d, Ordinal_16
lea rdx, str.___Microsoft
mov rcx, rbx
mov r14, r13
mov rsi, r13
mov r15, r13
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
jne 0x14001274c
mov rsi, 0xfffffffffffffffd
lea r14d, [rax + 3]
mov r15, rsi
mov r13, rsi
add rbx, 0x1a
lea r8, [r13 + 7]
mov rcx, rbx
lea r13, [0x140000000]
lea rdx, [r13 + 0x88998]
lea rdx, [rdx + r14*2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
jne 0x140012782
lea r9, str.winword.exe
lea r8, str.OpusApp
jmp 0x14001283f
lea rdx, [r13 + 0x889c8]
mov rcx, rbx
lea rdx, [rdx + r14*2]
lea r8, [r15 + 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
jne 0x1400127ca
mov edx, dword [rsp + 0x20]
lea r9, str.excel.exe
lea r8, str.XLMAIN
mov rcx, rdi
call fcn.140012d9c
test al, al
je 0x140012891
mov eax, 4
jmp 0x140012854
lea rdx, [r13 + 0x889a8]
mov rcx, rbx
lea rdx, [rdx + r14*2]
lea r8, [rsi + 0xd]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
jne 0x140012891
mov edx, dword [rsp + 0x20]
lea r9, str.powerpnt.exe
lea r8, str.PPTFrameClass
mov rcx, rdi
call fcn.140012d9c
test al, al
je 0x140012891
mov eax, 2
jmp 0x140012854
mov r8d, 0x12
lea rdx, str.Microsoft_Excel__
lea rcx, [rbp + 0x340]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
jne 0x140012891
lea r9, str.excel.exe
lea r8, str.XLMAIN
mov edx, dword [rsp + 0x20]
mov rcx, rdi
call fcn.140012d9c
test al, al
je 0x140012891
mov eax, 1
mov ecx, dword [rsp + 0x24]
lea r8, [rbp + 0x340]
mov dword [rsp + 0x38], ecx
mov edx, 0x1ff
lea rcx, [rsp + 0x3c]
mov qword [rsp + 0x30], rdi
mov dword [rbp + 0x33c], eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rcx, [r12 + 0x28]
lea rdx, [rsp + 0x30]
call fcn.140010dd8
mov al, 1
jmp 0x140012893
xor al, al
mov rcx, qword [rbp + 0x740]
xor rcx, rsp
call fcn.14007e630
mov rbx, qword [rsp + 0x8a0]
add rsp, 0x850
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret