Function at 0x14009bc10
Capabilities:
Get graphical window text

Disassembly:
jmp 0x14009bc10
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov r8d, 0xa8
xor edx, edx
mov rcx, qword [rsp + 0x70]
call fcn.1400139e0
mov rax, qword [rsp + 0x70]
mov byte [rax + 0x79], 1
mov r9d, 0x64
lea r8, [0x140004940]
lea rdx, [0x14000da90]
mov ecx, 8
call sym.ProcessHacker.exe_PhCreateHashtable
mov rcx, qword [rsp + 0x70]
mov qword [rcx + 0x80], rax
mov ecx, 0x64
call sym.ProcessHacker.exe_PhCreateList
mov rcx, qword [rsp + 0x70]
mov qword [rcx + 0x88], rax
mov ecx, 2
call sym.ProcessHacker.exe_PhCreateList
mov rcx, qword [rsp + 0x70]
mov qword [rcx + 0x90], rax
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov qword [rax + 8], rcx
lea rdx, str.explorer
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call sym.ProcessHacker.exe_PhSetControlTheme
lea r9, [0x140001dd0]
mov r8, qword [rsp + 0x70]
mov edx, 0x401
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x41f
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0xfffffffe
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x64
lea r9, str.Name
mov r8b, 1
xor edx, edx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.140013c40
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x50
lea r9, str.Base_address
mov r8b, 1
mov edx, 1
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.140013c40
mov byte [rsp + 0x40], 1
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x3c
lea r9, str.Size
mov r8b, 1
mov edx, 2
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.14000c040
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0xa0
lea r9, str.Description
mov r8b, 1
mov edx, 3
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.140013c40
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0xb4
lea r9, str.Company_name
xor r8d, r8d
mov edx, 4
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.140013c40
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x64
lea r9, str.Version
xor r8d, r8d
mov edx, 5
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.140013c40
mov dword [rsp + 0x38], 0x4000
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0xb4
lea r9, str.File_name
xor r8d, r8d
mov edx, 6
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.140013c40
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x50
lea r9, str.Type
xor r8d, r8d
mov edx, 7
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.140013c40
mov byte [rsp + 0x40], 1
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x28
lea r9, str.Load_count
xor r8d, r8d
mov edx, 8
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.14000c040
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x46
lea r9, str.Verification_status
xor r8d, r8d
mov edx, 9
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.140013c40
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x64
lea r9, str.Verified_signer
xor r8d, r8d
mov edx, 0xa
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.140013c40
mov byte [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x32
lea r9, str.ASLR
xor r8d, r8d
mov edx, 0xb
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.14000c040
mov byte [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x64
lea r9, str.Time_stamp
xor r8d, r8d
mov edx, 0xc
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.14000c040
mov byte [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x46
lea r9, str.CF_Guard
xor r8d, r8d
mov edx, 0xd
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.14000c040
mov byte [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x64
lea r9, str.Load_time
xor r8d, r8d
mov edx, 0xe
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.14000c040
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x50
lea r9, str.Load_reason
xor r8d, r8d
mov edx, 0xf
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.140013c40
mov byte [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x8c
lea r9, str.File_modified_time
xor r8d, r8d
mov edx, 0x10
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.14000c040
mov byte [rsp + 0x40], 1
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x46
lea r9, str.File_size
xor r8d, r8d
mov edx, 0x11
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.14000c040
mov byte [rsp + 0x40], 1
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x46
lea r9, str.Entry_point
xor r8d, r8d
mov edx, 0x12
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.14000c040
mov byte [rsp + 0x40], 1
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x46
lea r9, str.Parent_base_address
xor r8d, r8d
mov edx, 0x13
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.14000c040
mov byte [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x32
lea r9, [0x1403eee40]
xor r8d, r8d
mov edx, 0x14
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.14000c040
mov byte [rsp + 0x40], 1
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x46
lea r9, str.Image_coherency
xor r8d, r8d
mov edx, 0x15
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.14000c040
mov dword [rsp + 0x40], 0xa00000
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x64
lea r9, str.Timeline
xor r8d, r8d
mov edx, 0x16
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.140002370
mov dword [rsp + 0x38], 0x4000
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0xc8
lea r9, str.Original_name
xor r8d, r8d
mov edx, 0x17
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.140013c40
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x50
lea r9, str.Service
xor r8d, r8d
mov edx, 0x18
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.140013c40
xor r9d, r9d
mov r8d, 1
mov edx, 0x41f
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov r8d, 1
mov edx, 0x40e
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40d
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rsp + 0x70]
add rax, 0x38
lea r9, [0x14000e1c0]
mov r8d, 0x19
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx + 8]
mov rcx, rax
call fcn.1400136d0
mov rax, qword [rsp + 0x70]
add rax, 0x18
mov rcx, qword [rsp + 0x70]
mov r8, qword [rcx + 0x88]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx + 8]
mov rcx, rax
call sym.ProcessHacker.exe_PhInitializeTreeNewFilterSupport
add rsp, 0x50
pop rdi
ret