Function at 0x1800b08f0
Capabilities:
Get graphical window text
Read .ini file

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x200
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x68], 0xfffffffffffffffe
mov qword [rbp + 0x230], rbx
mov rax, qword [0x1801dc960]
xor rax, rbp
mov qword [rbp + 0x1d0], rax
mov r12, rdx
mov rdi, rcx
mov edx, 0x55a0
lea rcx, str.line:_d__MyGetResults
call fcn.18005cd20
lea rdx, [sym.vrvhook64.dll_MyGetResults]
lea rcx, [0x18028d500]
call fcn.18000dae0
mov rsi, rax
test rax, rax
jne 0x1800b0964
mov eax, 0x8000ffff
jmp 0x1800b0f4b
mov rcx, rax
call fcn.18000d7e0
mov rbx, rax
cmp dword [0x18025caa4], 0
jne 0x1800b0985
mov rdx, r12
mov rcx, rdi
call rbx
jmp 0x1800b0f4b
mov rcx, rsi
call fcn.180083ad0
test eax, eax
je 0x1800b099e
mov rdx, r12
mov rcx, rdi
call rbx
jmp 0x1800b0f4b
mov rdx, r12
mov rcx, rdi
call rbx
mov r13d, eax
test eax, eax
js 0x1800b0f4b
cmp dword [0x1802633e4], 0
jne 0x1800b0f4b
lea rdx, str._OUTLOOK.EXE_
lea rcx, [0x18025c000]
call fcn.18010b680
test eax, eax
jne 0x1800b09dd
mov eax, r13d
jmp 0x1800b0f4b
lea rdx, [0x18025c000]
mov rcx, qword [str._IEXPLORE.EXE_CHROME.EXE_FIREFOX.EXE_360SE.EXE_QQBROWSER.EXE_SOGOUEXPLORER.EXE_BAIDUBROWSER.EXE_HAO123JUZI.EXE_LIEBAO.EXE_TANGO3.EXE_TWCHROME.EXE_THEWORLD.EXE_UCBROWSER.EXE_JUZI.EXE_360CHROME.EXE_115BR.EXE_MAXTHON.EXE_2345EXPLORER.EXE_115CHROME.EXE_HAO123BROWSER.EXE_BAIDUYUNGUANJIA.EXE_BAIDUNETDISK.EXE_360WANGPAN.EXE_WYDRIVE.EXE_FLASHUTIL_ACTIVEX.EXE_FOXMAIL.EXE_OUTLOOK.EXE_WLMAIL.EXE_ECLOUD.EXE_STEEDOS_DESKTOP.EXE_]
call fcn.1800f4d08
test rax, rax
jne 0x1800b09fd
mov eax, r13d
jmp 0x1800b0f4b
cmp dword [0x180250e70], 0
jne 0x1800b0a0e
mov eax, r13d
jmp 0x1800b0f4b
xor r15d, r15d
mov ebx, r15d
mov byte [rbp + 0xc0], bl
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0xc1]
call fcn.1800f4fb0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r14d, [r15 + 1]
test rax, rax
je 0x1800b0a89
mov r8d, 0x104
lea rdx, [rbp + 0xc0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rcx, [rbp + 0xc0]
call fcn.1800fd3f0
lea r8, [rbp + 0xc0]
mov edx, 0x55dd
lea rcx, str.line:_d__MyGetResults:
call fcn.18005cd20
lea rcx, [rbp + 0xc0]
call fcn.180064200
test eax, eax
cmovne ebx, r14d
call fcn.1800a79a0
mov edi, r15d
mov r8d, r14d
lea rdx, str.VpDlpSettings.ini
lea rcx, [rbp + 0x18]
call fcn.18001f690
nop
cmp qword [rax + 0x20], 0x10
jb 0x1800b0ab2
mov r9, qword [rax + 8]
jmp 0x1800b0ab6
lea r9, [rax + 8]
xor r8d, r8d
lea rdx, str.FuShun
lea rcx, [0x180162974]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, eax
cmp qword [rbp + 0x38], 0x10
jb 0x1800b0adf
mov rcx, qword [rbp + 0x20]
call fcn.1800f4b9c
mov qword [rbp + 0x38], 0xf
mov qword [rbp + 0x30], r15
mov byte [rbp + 0x20], 0
cmp esi, 1
jne 0x1800b0b27
lea rdx, [0x180165a70]
lea rcx, [rbp + 0xc0]
call fcn.1800f4d08
test rax, rax
jne 0x1800b0b24
lea rdx, str.Mail__
lea rcx, [rbp + 0xc0]
call fcn.1800f4d08
test rax, rax
je 0x1800b0b27
mov edi, r14d
test ebx, ebx
je 0x1800b0b33
mov eax, r13d
jmp 0x1800b0f4b
mov r14d, r15d
test edi, edi
mov ebx, 1
cmovne r14d, ebx
mov rsi, qword [r12]
mov dword [rbp], r15d
mov rax, qword [rsi]
lea rdx, [rbp]
mov rcx, rsi
call qword [rax + 0x38]
test eax, eax
jns 0x1800b0b62
mov eax, r13d
jmp 0x1800b0f4b
mov rcx, qword [0x1801e1b60]
test rcx, rcx
je 0x1800b0b73
mov rax, qword [rcx]
call qword [rax]
mov dword [0x1802633e0], r15d
mov qword [rbp + 0xb8], 0xf
mov qword [rbp + 0xb0], r15
mov byte [rbp + 0xa0], 0
mov r8d, 0x17
lea rdx, str.MSGTYPERPT_r_nMSGSTRING
lea rcx, [rbp + 0x98]
call fcn.180003700
nop
mov qword [rbp + 0x90], 0xf
mov qword [rbp + 0x88], r15
mov byte [rbp + 0x78], 0
mov r8d, 0x17
lea rdx, str.MSGTYPERPT_r_nMSGSTRING
lea rcx, [rbp + 0x70]
call fcn.180003700
nop
mov edi, r15d
cmp dword [rbp], r15d
jbe 0x1800b0df3
movabs r12, 0xffffffffffffff0
nop word [rax + rax]
mov qword [rbp + 0x10], r15
mov rax, qword [rsi]
lea r8, [rbp + 0x10]
mov edx, edi
mov rcx, rsi
call qword [rax + 0x40]
test eax, eax
js 0x1800b0d38
mov qword [rbp + 8], r15
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
lea r8, [rbp + 8]
mov edx, 0x80058000
call qword [rax + 0x28]
test eax, eax
js 0x1800b0d20
mov rbx, qword [rbp + 8]
test rbx, rbx
jne 0x1800b0c48
mov rax, r15
jmp 0x1800b0c96
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1800b0c5f
mov rax, r15
jmp 0x1800b0c96
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800b0c74
mov rcx, r12
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180124410
sub rsp, rcx
lea rcx, [rsp + 0x20]
mov r9d, 3
mov rdx, rbx
call fcn.180015500
mov r8, rax
mov edx, 0x5618
lea rcx, [0x180165a30]
call fcn.18005cd20
mov rbx, qword [rbp + 8]
test rbx, rbx
jne 0x1800b0cb8
mov rax, r15
jmp 0x1800b0d06
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1800b0ccf
mov rax, r15
jmp 0x1800b0d06
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800b0ce4
mov rcx, r12
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180124410
sub rsp, rcx
lea rcx, [rsp + 0x20]
mov r9d, 3
mov rdx, rbx
call fcn.180015500
mov r9d, r14d
mov r8, rax
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x98]
call fcn.18009b1e0
test eax, eax
je 0x1800b0d57
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x1800b0d38
mov rax, qword [0x1801deea0]
test rax, rax
je 0x1800b0d38
call rax
nop
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x1800b0d47
mov rax, qword [rcx]
call qword [rax + 0x10]
inc edi
cmp edi, dword [rbp]
jae 0x1800b0dee
jmp 0x1800b0c00
mov edx, 0x561c
lea rcx, [0x180165a08]
call fcn.18005cd20
mov r11, qword [0x1801deea0]
test r11, r11
je 0x1800b0d7c
mov rcx, qword [rbp + 8]
call r11
nop
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x1800b0d8c
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
cmp qword [rbp + 0x90], 0x10
jb 0x1800b0d9f
mov rcx, qword [rbp + 0x78]
call fcn.1800f4b9c
mov qword [rbp + 0x90], 0xf
mov qword [rbp + 0x88], r15
mov byte [rbp + 0x78], 0
cmp qword [rbp + 0xb8], 0x10
jb 0x1800b0dcb
mov rcx, qword [rbp + 0xa0]
call fcn.1800f4b9c
mov qword [rbp + 0xb8], 0xf
mov qword [rbp + 0xb0], r15
mov byte [rbp + 0xa0], 0
mov eax, 0x8000ffff
jmp 0x1800b0f4b
mov ebx, 1
mov rcx, qword [0x1801e1b60]
test rcx, rcx
je 0x1800b0e05
mov rax, qword [rcx]
call qword [rax + 8]
cmp qword [rbp + 0xb0], 0x17
ja 0x1800b0e1d
cmp qword [rbp + 0x88], 0x17
jbe 0x1800b0eea
lea rax, [rbp + 0x18]
mov qword [rbp + 0x10], rax
lea rax, [rbp + 0x40]
mov qword [rbp + 8], rax
mov qword [rbp + 0x38], 0xf
mov qword [rbp + 0x30], r15
mov byte [rbp + 0x20], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x18]
call fcn.1800035e0
nop
mov qword [rbp + 0x60], 0xf
mov qword [rbp + 0x58], r15
mov byte [rbp + 0x48], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x98]
lea rcx, [rbp + 0x40]
call fcn.1800035e0
nop
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x40]
call fcn.18007bdb0
test eax, eax
jne 0x1800b0eea
cmp qword [rbp + 0x90], 0x10
jb 0x1800b0e9e
mov rcx, qword [rbp + 0x78]
call fcn.1800f4b9c
mov qword [rbp + 0x90], 0xf
mov qword [rbp + 0x88], r15
mov byte [rbp + 0x78], 0
cmp qword [rbp + 0xb8], 0x10
jb 0x1800b0eca
mov rcx, qword [rbp + 0xa0]
call fcn.1800f4b9c
mov qword [rbp + 0xb8], 0xf
mov qword [rbp + 0xb0], r15
mov byte [rbp + 0xa0], 0
mov eax, 0x8000ffff
jmp 0x1800b0f4b
mov dword [0x1802633e0], ebx
cmp qword [rbp + 0x90], 0x10
jb 0x1800b0f03
mov rcx, qword [rbp + 0x78]
call fcn.1800f4b9c
mov qword [rbp + 0x90], 0xf
mov qword [rbp + 0x88], r15
mov byte [rbp + 0x78], 0
cmp qword [rbp + 0xb8], 0x10
jb 0x1800b0f2f
mov rcx, qword [rbp + 0xa0]
call fcn.1800f4b9c
mov qword [rbp + 0xb8], 0xf
mov qword [rbp + 0xb0], r15
mov byte [rbp + 0xa0], 0
mov eax, r13d
mov rcx, qword [rbp + 0x1d0]
xor rcx, rbp
call fcn.1800f4f80
mov rbx, qword [rbp + 0x230]
lea rsp, [rbp + 0x1e0]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret