Function at 0x1400071d0
Capabilities:
Get graphical window text
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x140091240]
xor rax, rsp
mov qword [rsp + 0x138], rax
mov rbx, rcx
mov qword [rsp + 0x78], rcx
xorps xmm0, xmm0
movups xmmword [r11 - 0x40], xmm0
lea rdi, [rcx + 8]
mov qword [rsp + 0x68], rdi
mov r8d, 8
lea rdx, [r11 - 0x40]
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x140007297
lea rdx, str.static
lea rcx, [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140007297
mov edx, 0xfffffff0
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov r8d, eax
bts r8d, 8
cmp eax, r8d
je 0x14000726f
mov edx, 0xfffffff0
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, 0xfffffff0
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_GetWindowLongW]
movzx ecx, al
lea eax, [rcx - 3]
cmp eax, 6
jbe 0x140007290
lea eax, [rcx - 0xd]
cmp eax, 2
ja 0x140007297
and byte [rbx + 0x94], 0xfe
mov edx, 0x7f89
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rbx + 0x58], rax
lea r14, [rbx + 0x94]
mov qword [rsp + 0x70], r14
test byte [r14], 1
je 0x140007341
cmp qword [rbx + 0x68], 0
jne 0x140007332
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x100], rax
mov dword [rsp + 0x108], eax
xor r9d, r9d
lea r8, [rsp + 0xb0]
mov edx, 0x5c
mov ecx, 0x1f
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov qword [rbx + 0x68], rax
or byte [r14], 0x10
cmp qword [rbx + 0x60], 0
jne 0x140007341
mov rcx, rbx
call fcn.140006890
lea r13, [rbx + 0x80]
mov qword [rsp + 0x60], r13
mov r9, qword [rdi]
mov rcx, qword [0x140093e68]
mov r8d, dword [0x140091e2c]
mov r10d, dword [0x140091e24]
sub r8d, r10d
mov eax, dword [0x140091e28]
mov edx, dword [0x140091e20]
sub eax, edx
xor esi, esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], r9
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], edx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.tooltips_class32
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [r13], rax
lea r15, [rbx + 0x48]
mov qword [rsp + 0x88], r15
cmp qword [r15], rsi
jne 0x14000743e
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x14000743e
lea r12d, [rax + 1]
mov dword [rsp + 0x80], r12d
movsxd rcx, r12d
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rcx, rax
call fcn.140036f34
mov qword [r15], rax
jmp 0x14000742a
mov rdx, qword [r15]
test rdx, rdx
je 0x14000743e
mov r8d, r12d
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, rbx
call fcn.140006980
cmp qword [rbx + 0x50], 0
jne 0x14000746c
mov eax, dword [rbx + 0x90]
shr eax, 2
test al, 1
jne 0x14000746c
mov rdx, qword [r15]
test rdx, rdx
je 0x140007497
mov rcx, rbx
call fcn.140006d40
jmp 0x140007497
xor r9d, r9d
mov edx, 0x401
mov r8d, 1
mov rcx, qword [r13]
call qword [sym.imp.USER32.dll_SendMessageW]
lea r9, [rbx + 0x70]
mov r8, qword [rbx + 0x50]
mov rdx, qword [rdi]
mov rcx, r13
call fcn.140006e80
test byte [r14], 1
je 0x14000762c
mov qword [rsp + 0x98], 0
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0xa0], rsi
mov r9d, 0x2001f
lea r8, str.SoftwareMicrosoftInternet_ExplorerSettings
lea rcx, [rsp + 0x90]
call fcn.140007010
mov rdi, qword [rsp + 0x90]
test eax, eax
jne 0x14000761e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x110], xmm0
mov qword [rsp + 0x120], rax
mov dword [rsp + 0x80], 0x18
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str.Anchor_Color
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000758d
mov eax, dword [rsp + 0x88]
dec eax
cmp eax, 1
ja 0x14000758d
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x14000756d
test al, 1
jne 0x14000758d
shr rax, 1
cmp word [rsp + rax*2 + 0x10e], 0
je 0x140007575
jmp 0x14000758d
mov word [rsp + 0x110], si
lea rcx, [rsp + 0x110]
call fcn.140007110
cmp eax, 0xffffffff
je 0x14000758d
mov dword [rbx + 0x88], eax
mov dword [rsp + 0x80], 0x18
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str.Anchor_Color_Visited
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000761e
mov eax, dword [rsp + 0x88]
dec eax
cmp eax, 1
ja 0x14000761e
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x1400075fe
test al, 1
jne 0x14000761e
shr rax, 1
cmp word [rsp + rax*2 + 0x10e], 0
je 0x140007606
jmp 0x14000761e
mov word [rsp + 0x110], si
lea rcx, [rsp + 0x110]
call fcn.140007110
cmp eax, 0xffffffff
je 0x14000761e
mov dword [rbx + 0x8c], eax
test rdi, rdi
je 0x14000762c
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.140036b80
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret