Function at 0x1400df4b0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x220
mov r11, qword [rsp + 0x270]
mov r12, r8
mov r14, rcx
cmp word [r11], 0
je 0x1400df4f1
mov rax, qword [rcx + 0x1018]
cmp word [rax], 0
jne 0x1400df4f1
mov r13b, 1
jmp 0x1400df4f4
xor r13b, r13b
mov rbp, 0xffffffffffffffff
mov qword [rcx + 0x1018], r11
mov rax, rbp
inc rax
cmp word [r11 + rax*2], 0
jne 0x1400df505
mov qword [rcx + 0x1020], rax
xor edi, edi
mov rax, qword [rsp + 0x278]
mov esi, edi
mov qword [rcx + 0x1030], rax
mov eax, dword [rcx]
mov qword [rcx + 8], rdx
lea rdx, str.ahk_
mov dword [rcx], edi
mov qword [rcx + 0x1028], r9
mov rcx, r12
mov qword [rsp + 0x250], rbx
mov dword [rsp + 0x270], eax
call fcn.1400d6b70
mov r15, rax
test rax, rax
je 0x1400df91e
test esi, esi
je 0x1400df57c
movzx eax, word [r15 - 2]
cmp ax, 0x20
je 0x1400df57c
cmp ax, 9
jne 0x1400df8f5
lea rbx, [r15 + 8]
mov r8d, 2
mov rcx, rbx
lea rdx, [0x14011120c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400df5d7
or dword [r14], 2
lea rcx, [rbx + 4]
call fcn.1400669e0
mov qword [r14 + 0x1038], rax
cmp rax, 0xffff
je 0x1400df87f
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400df87f
mov qword [r14 + 0x1038], rdi
jmp 0x1400dfa62
mov r8d, 6
lea rdx, str.parent
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400df631
or dword [r14], 0x100
lea rcx, [rbx + 0xc]
call fcn.1400669e0
mov qword [r14 + 0x1040], rax
cmp rax, 0xffff
je 0x1400df87f
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400df87f
mov qword [r14 + 0x1040], rdi
jmp 0x1400dfa62
mov r8d, 3
lea rdx, [0x14011e298]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400df664
or dword [r14], 4
lea rcx, [rbx + 6]
call fcn.140005d80
mov dword [r14 + 0x1048], eax
jmp 0x1400df87f
mov r8d, 5
lea rdx, str.group
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400df77b
or dword [r14], 0x10
lea rdx, [rbx + 0xa]
nop word [rax + rax]
movzx eax, word [rdx]
cmp ax, 0x20
je 0x1400df69f
cmp ax, 9
jne 0x1400df6a5
add rdx, 2
jmp 0x1400df690
mov r8d, 0xfd
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
movzx r9d, word [rsp + 0x20]
lea r8, [rsp + 0x20]
mov word [rsp + 0x21a], di
test r9w, r9w
je 0x1400df75c
movzx edx, r9w
nop word [rax + rax]
lea rcx, [0x140110770]
mov eax, SafeArrayAllocDescriptor
nop dword [rax]
cmp dx, ax
je 0x1400df712
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x1400df6f0
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
jne 0x1400df6e0
jmp 0x1400df721
test r8, r8
je 0x1400df721
mov word [r8], di
movzx r9d, word [rsp + 0x20]
test r9w, r9w
je 0x1400df75c
mov rbx, qword [0x140136080]
test rbx, rbx
je 0x1400df75c
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400df76a
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x1400df740
mov qword [r14 + 0x1050], rdi
xor eax, eax
jmp 0x1400dfa62
mov qword [r14 + 0x1050], rbx
test rbx, rbx
je 0x1400df763
jmp 0x1400df87f
mov r8d, 3
lea rdx, [0x140119150]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400df7a4
add rbx, 6
mov eax, 0x1058
or dword [r14], 0x20
jmp 0x1400df7cf
mov r8d, 5
lea rdx, str.class
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1400df8f5
add rbx, 0xa
mov eax, 0x810
or dword [r14], 8
lea rdi, [rax + r14]
movzx eax, word [rbx]
cmp ax, 0x20
je 0x1400df7e2
cmp ax, 9
jne 0x1400df7e8
add rbx, 2
jmp 0x1400df7d3
mov r8d, 0x3ff
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor ebx, ebx
lea rdx, str.ahk_
mov rcx, rdi
mov word [rdi + 0x7fe], bx
call fcn.1400d6b70
test rax, rax
je 0x1400df84c
cmp rax, rdi
je 0x1400df849
movzx ecx, word [rax - 2]
cmp cx, 0x20
je 0x1400df843
cmp cx, 9
je 0x1400df843
lea rcx, [rax + 8]
lea rdx, str.ahk_
call fcn.1400d6b70
test rax, rax
jne 0x1400df817
jmp 0x1400df84c
mov word [rax - 2], bx
jmp 0x1400df84c
mov word [rax], bx
lea rcx, [r14 + 0x1058]
cmp rdi, rcx
jne 0x1400df87f
mov rax, qword [r14 + 8]
cmp dword [rax + 0x30], 4
je 0x1400df876
mov edx, 0x5c
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
jne 0x1400df876
mov al, 1
jmp 0x1400df878
xor al, al
mov byte [r14 + 0x1858], al
test esi, esi
jne 0x1400df8f7
mov rax, r12
movzx ecx, word [rax]
cmp cx, 0x20
je 0x1400df895
cmp cx, 9
jne 0x1400df89b
add rax, 2
jmp 0x1400df886
cmp r15, rax
jbe 0x1400df8f7
or dword [r14], 1
lea rcx, [r14 + 0x10]
mov eax, 0x400
mov rbx, r15
sub rbx, r12
mov rdx, r12
sar rbx, 1
cmp rbx, rax
cmova rbx, rax
lea r8, [rbx - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor eax, eax
mov word [r14 + rbx*2 + 0xe], ax
mov rax, rbp
nop word [rax + rax]
inc rax
cmp word [r14 + rax*2 + 0x10], 0
jne 0x1400df8e0
mov qword [r14 + 0x1010], rax
jmp 0x1400df8f7
dec esi
lea rcx, [r15 + 8]
inc esi
lea rdx, str.ahk_
call fcn.1400d6b70
mov r15, rax
test rax, rax
je 0x1400df918
xor edi, edi
jmp 0x1400df563
test esi, esi
jne 0x1400df953
xor edi, edi
mov r8d, 0x3ff
mov dword [r14], 1
mov rdx, r12
lea rcx, [r14 + 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [r14 + 0x80e], di
inc rbp
cmp word [r14 + rbp*2 + 0x10], 0
jne 0x1400df940
mov qword [r14 + 0x1010], rbp
mov eax, dword [r14]
cmp eax, dword [rsp + 0x270]
jne 0x1400df968
test r13b, r13b
je 0x1400dfa5d
lea rbx, [r14 + 0x1898]
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400dfa5d
test eax, eax
je 0x1400dfa5d
mov rdi, rbx
test al, 1
jne 0x1400df99e
mov rax, qword [r14 + 0x1018]
cmp word [rax], 0
je 0x1400df9c4
lea rdi, [r14 + 0x1898]
mov r8d, 0x7fff
lea rdx, [r14 + 0x18ac]
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor ebp, ebp
test eax, eax
jne 0x1400df9c6
mov word [r14 + 0x18ac], bp
mov rbx, rdi
jmp 0x1400df9c6
xor ebp, ebp
test byte [r14], 4
je 0x1400df9dc
mov rcx, qword [rbx]
lea rdx, [r14 + 0x18a8]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test byte [r14], 0x20
mov rdi, rbx
je 0x1400dfa28
mov rcx, qword [rbx]
lea rdx, [rsp + 0x270]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x1400dfa28
movzx r9d, byte [r14 + 0x1858]
lea rdx, [r14 + 0x11aac]
mov ecx, dword [rsp + 0x270]
call fcn.140099f90
test eax, eax
jne 0x1400dfa28
mov word [r14 + 0x11aac], bp
lea rdi, [r14 + 0x1898]
test byte [r14], 8
je 0x1400dfa44
mov rcx, qword [rdi]
lea rdx, [r14 + 0x118aa]
mov r8d, 0x101
call qword [sym.imp.USER32.dll_GetClassNameW]
test dword [r14], 0x100
je 0x1400dfa5d
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_GetParent]
mov qword [r14 + 0x18a0], rax
mov eax, 1
mov rbx, qword [rsp + 0x250]
lea r11, [rsp + 0x220]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret