Function at 0x14003e180
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov r14, r8
mov rsi, rdx
mov rdi, rcx
xor edx, edx
mov rcx, r14
mov r8d, 0x90
call fcn.14010ed90
mov r9d, 0x64
mov dword [r14 + 0x68], 1
lea r8, [0x14003ea20]
lea rdx, [0x14001cb10]
lea ecx, [r9 - 0x5c]
call sym.ProcessHacker.exe_PhCreateHashtable
mov rdx, qword [0x1401967f8]
mov ecx, 0x10
mov qword [r14 + 0x70], rax
call sym.ProcessHacker.exe_PhCreateObject
mov rcx, qword [0x140196670]
xor r15d, r15d
mov r8d, 0x320
mov rbx, rax
mov dword [rax], r15d
lea edx, [r15 + 4]
mov dword [rax + 4], 0x64
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbx + 8], rax
xor r8d, r8d
lea rdx, str.explorer
mov qword [r14 + 0x78], rbx
mov rcx, rsi
mov qword [r14], rdi
mov qword [r14 + 8], rsi
call qword [sym.imp.UxTheme.dll_SetWindowTheme]
lea r9, [0x14003fe30]
mov r8, r14
mov edx, 0x401
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x41f
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
lea r9, [rbp - 0x30]
mov qword [rbp - 0x30], rax
xor r8d, r8d
or dword [rbp - 0x30], 0x15
mov edx, 0x405
mov qword [rbp - 0x18], rax
mov rcx, rsi
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 8], rax
lea rax, str.Name
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x2c], r15d
mov dword [rbp - 0x18], 0x64
mov dword [rbp - 0x14], 1
mov dword [rbp - 0x10], 0xfffffffe
mov dword [rbp - 0xc], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
lea r9, [rbp - 0x30]
mov qword [rbp - 0x30], rax
xor r8d, r8d
or dword [rbp - 0x30], 0x11
mov edx, 0x405
mov qword [rbp - 0x18], rax
mov rcx, rsi
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 8], rax
lea rax, str.Base_address
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x2c], 1
mov dword [rbp - 0x18], 0x50
mov qword [rbp - 0x14], 2
mov dword [rbp - 0xc], 2
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov qword [rbp - 0x30], rax
lea r9, [rbp - 0x30]
or dword [rbp - 0x30], 0x19
xor r8d, r8d
mov qword [rbp - 0x18], rax
mov edx, 0x405
mov qword [rbp - 0x10], rax
mov rcx, rsi
mov qword [rbp - 0x28], rax
mov qword [rbp - 8], rax
lea rax, str.Size
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x2c], 2
mov dword [rbp - 0x18], 0x3c
mov dword [rbp - 0x14], 2
mov dword [rbp - 0x10], 1
mov dword [rbp - 0xc], 2
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov qword [rbp - 0x10], 2
mov qword [rbp - 0x30], rax
lea r9, [rbp - 0x30]
or dword [rbp - 0x30], 0x11
xor r8d, r8d
mov qword [rbp - 0x18], rax
mov edx, 0x405
mov qword [rbp - 0x28], rax
mov rcx, rsi
mov qword [rbp - 8], rax
lea rax, str.Description
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x2c], 3
mov dword [rbp - 0x18], 0xa0
mov dword [rbp - 0x14], 1
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
lea r9, [rbp - 0x30]
mov qword [rbp - 0x30], rax
xor r8d, r8d
mov qword [rbp - 0x18], rax
mov edx, 0x405
mov qword [rbp - 0x10], rax
mov rcx, rsi
mov qword [rbp - 0x28], rax
mov qword [rbp - 8], rax
lea rax, str.Company_name
mov qword [rbp - 0x20], rax
mov eax, dword [rbp - 0x30]
and eax, 0xfffffffe
mov dword [rbp - 0x2c], 4
or eax, 0x10
mov dword [rbp - 0x18], 0xb4
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x14], 1
mov dword [rbp - 0x10], 0xffffffff
mov dword [rbp - 0xc], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
lea r9, [rbp - 0x30]
mov qword [rbp - 0x30], rax
xor r8d, r8d
mov qword [rbp - 0x18], rax
mov edx, 0x405
mov qword [rbp - 0x10], rax
mov rcx, rsi
mov qword [rbp - 0x28], rax
mov qword [rbp - 8], rax
lea rax, str.Version
mov qword [rbp - 0x20], rax
mov eax, dword [rbp - 0x30]
and eax, 0xfffffffe
mov dword [rbp - 0x2c], 5
or eax, 0x10
mov dword [rbp - 0x18], 0x64
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x14], 1
mov dword [rbp - 0x10], 0xffffffff
mov dword [rbp - 0xc], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x18], rax
lea r9, [rbp - 0x30]
mov qword [rbp - 0x10], rax
xor r8d, r8d
mov qword [rbp - 0x28], rax
mov edx, 0x405
mov qword [rbp - 8], rax
mov rcx, rsi
lea rax, str.File_name
mov dword [rbp - 0x2c], 6
mov qword [rbp - 0x20], rax
mov eax, dword [rbp - 0x30]
and eax, 0xfffffffe
mov dword [rbp - 0x18], 0xb4
or eax, 0x10
mov dword [rbp - 0x14], 1
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x10], 0xffffffff
mov dword [rbp - 0xc], 0x4000
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
lea r9, [rbp - 0x30]
mov qword [rbp - 0x30], rax
xor r8d, r8d
mov qword [rbp - 0x18], rax
mov edx, 0x405
mov qword [rbp - 0x10], rax
mov rcx, rsi
mov qword [rbp - 0x28], rax
mov qword [rbp - 8], rax
lea rax, str.Type
mov qword [rbp - 0x20], rax
mov eax, dword [rbp - 0x30]
and eax, 0xfffffffe
mov dword [rbp - 0x2c], 7
or eax, 0x10
mov dword [rbp - 0x18], 0x50
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x14], 1
mov dword [rbp - 0x10], 0xffffffff
mov dword [rbp - 0xc], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
lea r9, [rbp - 0x30]
mov qword [rbp - 0x30], rax
xor r8d, r8d
mov qword [rbp - 0x18], rax
mov edx, 0x405
mov qword [rbp - 0x10], rax
mov rcx, rsi
mov qword [rbp - 0x28], rax
mov qword [rbp - 8], rax
lea rax, str.Load_count
mov qword [rbp - 0x20], rax
mov eax, dword [rbp - 0x30]
and eax, 0xfffffffe
mov dword [rbp - 0x2c], 8
or eax, 0x18
mov dword [rbp - 0x18], 0x28
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x14], 2
mov dword [rbp - 0x10], 0xffffffff
mov dword [rbp - 0xc], 2
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 8], rax
lea rax, str.Verification_status
mov qword [rbp - 0x20], rax
mov eax, dword [rbp - 0x30]
and eax, 0xfffffffe
mov dword [rbp - 0x2c], 9
or eax, 0x10
mov dword [rbp - 0x18], 0x46
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x14], 1
mov dword [rbp - 0x10], 0xffffffff
mov dword [rbp - 0xc], r15d
lea r9, [rbp - 0x30]
xor r8d, r8d
mov edx, 0x405
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
lea r9, [rbp - 0x30]
mov qword [rbp - 0x30], rax
xor r8d, r8d
mov qword [rbp - 0x18], rax
mov edx, 0x405
mov qword [rbp - 0x10], rax
mov rcx, rsi
mov qword [rbp - 0x28], rax
mov qword [rbp - 8], rax
lea rax, str.Verified_signer
mov qword [rbp - 0x20], rax
mov eax, dword [rbp - 0x30]
and eax, 0xfffffffe
mov dword [rbp - 0x2c], 0xa
or eax, 0x10
mov dword [rbp - 0x18], 0x64
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x14], 1
mov dword [rbp - 0x10], 0xffffffff
mov dword [rbp - 0xc], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
lea r9, [rbp - 0x30]
mov qword [rbp - 0x30], rax
xor r8d, r8d
mov qword [rbp - 0x18], rax
mov edx, 0x405
mov qword [rbp - 0x10], rax
mov rcx, rsi
mov qword [rbp - 0x28], rax
mov qword [rbp - 8], rax
lea rax, str.ASLR
mov qword [rbp - 0x20], rax
mov eax, dword [rbp - 0x30]
and eax, 0xfffffffe
mov dword [rbp - 0x2c], 0xb
or eax, 0x18
mov dword [rbp - 0x18], 0x32
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x14], 1
mov dword [rbp - 0x10], 0xffffffff
mov dword [rbp - 0xc], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
lea r9, [rbp - 0x30]
mov qword [rbp - 0x30], rax
xor r8d, r8d
mov qword [rbp - 0x18], rax
mov edx, 0x405
mov qword [rbp - 0x10], rax
mov rcx, rsi
mov qword [rbp - 0x28], rax
mov qword [rbp - 8], rax
lea rax, str.Time_stamp
mov qword [rbp - 0x20], rax
mov eax, dword [rbp - 0x30]
and eax, 0xfffffffe
mov dword [rbp - 0x2c], 0xc
or eax, 0x18
mov dword [rbp - 0x18], 0x64
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x14], 1
mov dword [rbp - 0x10], 0xffffffff
mov dword [rbp - 0xc], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
lea rax, str.CF_Guard
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x2c], 0xd
mov dword [rbp - 0x18], 0x46
mov eax, dword [rbp - 0x30]
lea r9, [rbp - 0x30]
and eax, 0xfffffffe
mov dword [rbp - 0x14], 1
or eax, 0x18
mov dword [rbp - 0x10], 0xffffffff
xor r8d, r8d
mov dword [rbp - 0x30], eax
mov edx, 0x405
mov dword [rbp - 0xc], r15d
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
lea r9, [rbp - 0x30]
mov qword [rbp - 0x30], rax
xor r8d, r8d
mov qword [rbp - 0x18], rax
mov edx, 0x405
mov qword [rbp - 0x10], rax
mov rcx, rsi
mov qword [rbp - 0x28], rax
mov qword [rbp - 8], rax
lea rax, str.Load_time
mov qword [rbp - 0x20], rax
mov eax, dword [rbp - 0x30]
and eax, 0xfffffffe
mov dword [rbp - 0x2c], 0xe
or eax, 0x18
mov dword [rbp - 0x18], 0x64
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x14], 1
mov dword [rbp - 0x10], 0xffffffff
mov dword [rbp - 0xc], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
lea r9, [rbp - 0x30]
mov qword [rbp - 0x30], rax
xor r8d, r8d
mov qword [rbp - 0x18], rax
mov edx, 0x405
mov qword [rbp - 0x10], rax
mov rcx, rsi
mov qword [rbp - 0x28], rax
mov qword [rbp - 8], rax
lea rax, str.Load_reason
mov qword [rbp - 0x20], rax
mov eax, dword [rbp - 0x30]
and eax, 0xfffffffe
mov dword [rbp - 0x2c], 0xf
or eax, 0x10
mov dword [rbp - 0x18], 0x50
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x14], 1
mov dword [rbp - 0x10], 0xffffffff
mov dword [rbp - 0xc], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
lea r9, [rbp - 0x30]
mov qword [rbp - 0x30], rax
xor r8d, r8d
mov qword [rbp - 0x18], rax
mov edx, 0x405
mov qword [rbp - 0x10], rax
mov rcx, rsi
mov qword [rbp - 0x28], rax
mov qword [rbp - 8], rax
lea rax, str.File_modified_time
mov qword [rbp - 0x20], rax
mov eax, dword [rbp - 0x30]
and eax, 0xfffffffe
mov dword [rbp - 0x2c], 0x10
or eax, 0x18
mov dword [rbp - 0x18], 0x8c
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x14], 1
mov dword [rbp - 0x10], 0xffffffff
mov dword [rbp - 0xc], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x18], rax
lea r9, [rbp - 0x30]
mov qword [rbp - 0x10], rax
xor r8d, r8d
mov qword [rbp - 8], rax
mov edx, 0x405
lea rax, str.File_size
mov dword [rbp - 0x2c], 0x11
mov qword [rbp - 0x20], rax
mov rcx, rsi
mov eax, dword [rbp - 0x30]
and eax, 0xfffffffe
mov dword [rbp - 0x18], 0x46
or eax, 0x18
mov dword [rbp - 0x14], 2
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x10], 0xffffffff
mov dword [rbp - 0xc], 2
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
lea r9, [rbp - 0x30]
mov qword [rbp - 0x30], rax
xor r8d, r8d
mov qword [rbp - 0x18], rax
mov edx, 0x405
mov qword [rbp - 0x10], rax
mov rcx, rsi
mov qword [rbp - 0x28], rax
mov qword [rbp - 8], rax
lea rax, str.Entry_point
mov qword [rbp - 0x20], rax
mov eax, dword [rbp - 0x30]
and eax, 0xfffffffe
mov dword [rbp - 0x2c], 0x12
or eax, 0x18
mov dword [rbp - 0x18], 0x46
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x14], 1
mov dword [rbp - 0x10], 0xffffffff
mov dword [rbp - 0xc], r15d
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
lea r8d, [r15 + 1]
mov edx, 0x41f
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
lea r8d, [r15 + 1]
mov edx, 0x40e
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40d
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0x70]
lea rax, [0x14003f620]
mov rdi, qword [rsp + 0x80]
mov qword [r14 + 0x48], rax
lea rax, [r14 + 0x50]
mov qword [r14 + 0x38], rsi
mov dword [r14 + 0x40], 0x13
mov dword [r14 + 0x44], 0x13
mov qword [rax + 8], rax
mov qword [rax], rax
mov qword [r14 + 0x60], r15
mov rax, qword [r14 + 0x78]
mov qword [r14 + 0x20], rsi
mov rsi, qword [rsp + 0x78]
mov qword [r14 + 0x28], rax
mov qword [r14 + 0x18], r15
add rsp, 0x50
pop r15
pop r14
pop rbp
ret