Function at 0x18016fef0
Capabilities:
Get graphical window text
Get keyboard layout

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x13a0
call fcn.1802b8650
sub rsp, rax
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x28], 0xfffffffffffffffe
mov qword [rbp + 0x13c0], rbx
mov rax, qword [0x1803fc9f0]
xor rax, rbp
mov qword [rbp + 0x1360], rax
mov rax, rdx
mov r15, rcx
xor edi, edi
mov dword [rbp + 4], edi
mov rcx, qword [0x180412640]
test rcx, rcx
je 0x18017052e
cmp dword [rcx + 0x130], edi
je 0x18017052e
test rdx, rdx
jne 0x18016ff6c
call qword [sym.imp.USER32.dll_GetFocus]
test rax, rax
je 0x18016ff9c
mov rcx, qword [0x180412640]
mov rdx, rax
call fcn.1801789f0
test eax, eax
jne 0x18016ff9c
mov byte [rbp], 1
mov ecx, 0x37006a
mov rax, qword [0x180400a08]
cmp dword [rax + 0x40c], 0
cmovne r15, rcx
mov qword [rbp + 0x13b0], r15
jmp 0x18016ffa0
mov byte [rbp], 0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r13, rax
mov qword [rbp + 0x30], rax
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x10c0]
call fcn.1802c7550
test r13, r13
je 0x18016ffde
mov r8d, 0x104
lea rdx, [rbp + 0x10c0]
mov rcx, r13
call qword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x18016ffef
movabs rax, 0x4e574f4e4b4e55
mov qword [rbp + 0x10c0], rax
mov byte [rbp + 0x11c3], 0
mov rcx, qword [0x180412640]
call fcn.180178430
mov r12d, eax
mov r14d, edi
mov dword [rbp + 0x10], edi
mov rcx, qword [0x180412640]
lea rdx, [rbp + 0x10c0]
cmp r13, qword [rcx + 0x1b48]
je 0x18017005f
mov qword [rcx + 0x1b48], r13
mov rcx, qword [0x180412640]
mov qword [rcx + 0x1b40], rdi
mov rcx, qword [0x180412640]
add rcx, 0x1b60
mov r8d, 0x104
call fcn.1802b1e30
mov r14d, 1
mov dword [rbp + 0x10], r14d
jmp 0x180170233
add rcx, 0x1b60
mov r8d, 0x103
call fcn.1802d58d0
test eax, eax
je 0x180170233
mov dword [rbp + 0xc], 1
test r12d, r12d
je 0x180170202
mov rax, qword [0x180412640]
mov rcx, qword [rax + 0x1b40]
test rcx, rcx
je 0x180170202
mov byte [rbp + 0x1250], r14b
mov r8d, 0x104
lea rdx, [rbp + 0x1250]
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov byte [rbp + 0x1353], r14b
mov r8d, 0x103
lea rdx, [rbp + 0x1250]
lea rcx, [rbp + 0x10c0]
call fcn.1802d58d0
test eax, eax
jne 0x180170106
mov rcx, qword [0x180412640]
add rcx, 0x1b60
mov r8d, 0x104
lea rdx, [rbp + 0x10c0]
call fcn.1802b1e30
mov dword [rbp + 0xc], edi
jmp 0x180170233
lea rdx, [0x180035524]
lea rcx, [rbp + 0x68]
call fcn.1800aaba0
nop
mov ebx, 1
mov dword [rbp + 4], ebx
mov rcx, qword [0x180412640]
add rcx, 0x1b18
xor r8d, r8d
lea rdx, [rbp + 0x68]
call fcn.1800ab700
test eax, eax
je 0x18017016a
lea rdx, [0x180035958]
lea rcx, [rbp + 0x48]
call fcn.1800aaba0
nop
mov esi, 3
mov ebx, esi
mov dword [rbp + 4], ebx
lea rcx, [rbp + 0x48]
call fcn.180123260
test al, al
jne 0x18017016f
xor dil, dil
jmp 0x180170172
mov esi, 3
mov dil, 1
test bl, 2
je 0x180170187
and ebx, 0xfffffffd
mov dword [rbp + 4], ebx
lea rcx, [rbp + 0x48]
call fcn.1800ad110
nop
test bl, 1
je 0x18017019b
and ebx, 0xfffffffe
mov dword [rbp + 4], ebx
lea rcx, [rbp + 0x68]
call fcn.1800ad110
test dil, dil
je 0x1801701fe
lea rdx, [0x180035968]
lea rcx, [rbp + 0x10c0]
call fcn.1802c77c8
lea rcx, [rbp + 0x10c0]
cmp rax, rcx
jne 0x1801701fe
lea rdx, [0x180035988]
lea rcx, [rbp + 0x10c0]
call fcn.1802c77c8
test rax, rax
jne 0x1801701fe
mov rcx, qword [0x180412640]
add rcx, 0x1b60
mov r8d, 0x104
lea rdx, [rbp + 0x10c0]
call fcn.1802b1e30
xor edi, edi
mov dword [rbp + 0xc], edi
jmp 0x180170238
xor edi, edi
jmp 0x180170207
mov esi, 3
mov rcx, qword [0x180412640]
add rcx, 0x1b60
mov r8d, 0x104
lea rdx, [rbp + 0x10c0]
call fcn.1802b1e30
mov r14d, 1
mov dword [rbp + 0x10], r14d
jmp 0x180170238
mov esi, 3
test r12d, r12d
je 0x180170294
call qword [sym.imp.USER32.dll_GetFocus]
mov rbx, rax
mov rcx, qword [0x180412640]
cmp rax, qword [rcx + 0x1b40]
je 0x180170294
mov rcx, rax
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
jne 0x180170286
lea rcx, [0x1800359f0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x180170286
mov rax, qword [0x180412640]
mov qword [rax + 0x1b40], rdi
jmp 0x180170294
mov rax, qword [0x180412640]
mov qword [rax + 0x1b40], rbx
lea rcx, [rbp + 0x10b0]
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
test eax, eax
je 0x1801702b5
mov byte [rbp + 0x10b9], 0
movzx eax, byte [rbp + 0x10b0]
jmp 0x1801702bd
xor al, al
mov byte [rbp + 0x10b0], al
mov ebx, edi
mov dword [rbp + 8], ebx
test al, al
je 0x180170309
mov rdx, qword [0x180412640]
add rdx, 0x1c64
mov r8d, 9
lea rcx, [rbp + 0x10b0]
call fcn.1802d82e0
test eax, eax
je 0x180170336
mov ebx, 1
mov dword [rbp + 8], ebx
mov rcx, qword [0x180412640]
add rcx, 0x1c64
lea rdx, [rbp + 0x10b0]
jmp 0x18017032b
mov rcx, qword [0x180412640]
add rcx, 0x1c64
cmp byte [rcx], 0
jne 0x180170336
mov ebx, 1
mov dword [rbp + 8], ebx
lea rdx, [0x180035ac8]
mov r8d, 0xa
call fcn.1802b1e30
mov rax, qword [0x180412640]
mov ecx, dword [rax + 0x1c74]
cmp dword [rax + 0x1c70], ecx
je 0x180170359
mov ebx, 1
mov dword [rbp + 8], ebx
mov dword [rax + 0x1c70], ecx
mov edi, 0x24
xor edx, edx
lea r8d, [rdi + 0x5c]
lea rcx, [rbp + 0x11d0]
call fcn.1802c7550
test r14d, r14d
jne 0x180170379
test ebx, ebx
je 0x1801703b7
mov r9d, 0x80
lea r8, [rbp + 0x11d0]
lea rdx, [rbp + 0x10c0]
mov rcx, qword [0x180412640]
call fcn.1801763f0
lea rcx, [rbp + 0x11d0]
or rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp byte [rcx + rax], 0
jne 0x1801703a4
lea rdi, [rax + 0x25]
mov esi, 4
lea rdx, [rdi + 0x10]
xor eax, eax
cmp rdx, rdi
cmova rax, rdx
test rax, rax
je 0x180170508
xor eax, eax
cmp rdx, rdi
cmova rax, rdx
cmp rax, 0x400
ja 0x18017042b
xor eax, eax
cmp rdx, rdi
cmova rax, rdx
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1801703fa
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1802b8650
sub rsp, rcx
lea rbx, [rsp + 0x30]
mov qword [rbp + 0x18], rbx
test rbx, rbx
je 0x180170508
mov dword [rbx], 0xcccc
add rbx, 0x10
mov qword [rbp + 0x18], rbx
jmp 0x180170453
xor ecx, ecx
cmp rdx, rdi
cmova rcx, rdx
call fcn.1802d7b48
mov rbx, rax
mov qword [rbp + 0x20], rax
test rax, rax
je 0x180170453
mov dword [rax], 0xdddd
add rbx, 0x10
mov qword [rbp + 0x20], rbx
test rbx, rbx
je 0x180170508
mov rdx, rbx
lea rcx, [rbp + 0x38]
call fcn.18016ab00
nop
movzx eax, byte [rbp]
mov byte [rbx], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbx + 4], eax
mov dword [rbx + 8], r13d
mov dword [rbx + 0xc], r15d
cmp esi, 4
jne 0x1801704e0
mov rdx, qword [0x180412640]
add rdx, 0x1c64
lea rcx, [rbx + 0x10]
lea r8d, [rsi + 6]
call fcn.1802b1e30
mov rax, qword [0x180412640]
mov ecx, dword [rax + 0x1c70]
mov dword [rbx + 0x1c], ecx
lea rdx, [rbp + 0x11d0]
lea rcx, [rbp + 0x11d0]
mov r10, rbx
sub r10, rcx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
mov byte [r10 + rdx + 0x20], al
lea rdx, [rdx + 1]
test al, al
jne 0x1801704d0
mov qword [rsp + 0x20], 0
mov r9d, 1
mov r8, rdi
mov rdx, rbx
mov ecx, esi
call fcn.18017f810
nop
lea rcx, [rbp + 0x38]
call fcn.18016bd20
jmp 0x180170530
lea rdx, [0x180035ae0]
lea rcx, [rbp + 0x90]
call fcn.1800b0450
lea rdx, [0x1803f5e58]
lea rcx, [rbp + 0x90]
call fcn.1802c76f0
jmp 0x180170530
mov rcx, qword [rbp + 0x1360]
xor rcx, rbp
call fcn.1802b85a0
mov rbx, qword [rbp + 0x13c0]
lea rsp, [rbp + 0x1370]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret