Function at 0x1400165f0
Capabilities:
Get graphical window text
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
mov r14, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rbx, [rcx + 8]
mov qword [rsp + 0x158], rbx
mov r8d, 8
lea rdx, [rsp + 0x90]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x1400166a5
lea rdx, str.static
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400166a5
lea edx, [rax - 0x10]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov r8d, eax
bts r8d, 8
cmp eax, r8d
je 0x14001667c
mov edx, 0xfffffff0
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, 0xfffffff0
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetWindowLongW]
movzx ecx, al
lea eax, [rcx - 3]
cmp eax, 6
jbe 0x14001669d
lea eax, [rcx - 0xd]
cmp eax, 2
ja 0x1400166a5
and byte [r14 + 0x94], 0xfe
mov edx, 0x7f89
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [r14 + 0x58], rax
lea rdi, [r14 + 0x94]
mov qword [rsp + 0x88], rdi
test byte [rdi], 1
je 0x140016748
cmp qword [r14 + 0x68], 0
jne 0x140016739
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0xf8], eax
xor r9d, r9d
lea r8, [rsp + 0xa0]
lea edx, [rax + 0x5c]
lea ecx, [rax + 0x1f]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov qword [r14 + 0x68], rax
or byte [rdi], 0x10
cmp qword [r14 + 0x60], 0
jne 0x140016748
mov rcx, r14
call fcn.140017240
lea r13, [r14 + 0x80]
mov qword [rsp + 0x150], r13
mov r9, qword [rbx]
mov rcx, qword [0x1401f2908]
mov r8d, dword [0x1401f1e6c]
mov r10d, dword [0x1401f1e64]
sub r8d, r10d
mov eax, dword [0x1401f1e68]
mov edx, dword [0x1401f1e60]
sub eax, edx
xor r15d, r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r9
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], edx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.tooltips_class32
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [r13], rax
lea rsi, [r14 + 0x48]
mov qword [rsp + 0x60], rsi
cmp qword [rsi], r15
jne 0x14001688b
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x14001688b
lea r13d, [rax + 1]
mov dword [rsp + 0x148], r13d
movsxd rcx, r13d
mov eax, 2
mul rcx
mov r12, 0xffffffffffffffff
cmovo rax, r12
mov rcx, rax
call fcn.14002ec58
mov qword [rsi], rax
jmp 0x140016840
mov rdx, qword [rsi]
test rdx, rdx
je 0x140016854
mov r8d, r13d
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov r13, qword [rsp + 0x150]
mov rcx, r14
call fcn.140017350
cmp qword [r14 + 0x50], 0
jne 0x140016894
mov eax, dword [r14 + 0x90]
shr eax, 2
test al, 1
jne 0x140016894
mov rdx, qword [rsi]
test rdx, rdx
je 0x1400168bd
mov rcx, r14
call fcn.140016380
jmp 0x1400168bd
mov r12, 0xffffffffffffffff
jmp 0x14001685c
xor r9d, r9d
mov edx, 0x401
lea r8d, [r9 + 1]
mov rcx, qword [r13]
call qword [sym.imp.USER32.dll_SendMessageW]
lea r9, [r14 + 0x70]
mov r8, qword [r14 + 0x50]
mov rdx, qword [rbx]
mov rcx, r13
call fcn.1400164b0
test byte [rdi], 1
je 0x140016b5a
mov qword [rsp + 0x150], r15
lea rax, [rsp + 0x150]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerSettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r13, r15
test eax, eax
cmove r13, qword [rsp + 0x150]
mov ecx, r15d
cmovne ecx, eax
test ecx, ecx
jne 0x140016b4c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x140], 0x18
lea rax, [rsp + 0x140]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x148]
xor r8d, r8d
lea rdx, str.Anchor_Color
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140016a3c
mov eax, dword [rsp + 0x148]
dec eax
cmp eax, 1
ja 0x140016a3c
mov eax, dword [rsp + 0x140]
test eax, eax
je 0x1400169a0
test al, 1
jne 0x140016a3c
shr rax, 1
cmp word [rsp + rax*2 + 0x6e], 0
je 0x1400169a6
jmp 0x140016a3c
mov word [rsp + 0x70], r15w
lea rsi, [rsp + 0x70]
mov qword [rsp + 0x60], 0xffffffffffffffff
mov dword [rsp + 0x68], r12d
mov rdi, r15
nop dword [rax]
mov rbx, rsi
movzx eax, word [rsi]
test ax, ax
je 0x140016a00
nop dword [rax + rax]
cmp ax, 0x2c
je 0x1400169ec
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextW]
mov rbx, rax
movzx eax, word [rax]
test ax, ax
jne 0x1400169d0
jmp 0x140016a00
mov word [rbx], r15w
mov rcx, rsi
call fcn.14003df88
mov dword [rsp + rdi*4 + 0x60], eax
lea rsi, [rbx + 2]
cmp dword [rsp + rdi*4 + 0x60], 0xffffffff
je 0x140016a3c
inc rdi
cmp rdi, 2
jl 0x1400169c0
cmp word [rsi], 0
je 0x140016a3c
mov rcx, rsi
call fcn.14003df88
movzx ecx, al
shl ecx, 0x10
movzx eax, byte [rsp + 0x64]
shl eax, 8
or ecx, eax
movzx eax, byte [rsp + 0x60]
or ecx, eax
mov dword [r14 + 0x88], ecx
mov dword [rsp + 0x140], 0x18
lea rax, [rsp + 0x140]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x148]
xor r8d, r8d
lea rdx, str.Anchor_Color_Visited
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140016b4c
mov eax, dword [rsp + 0x148]
dec eax
cmp eax, 1
ja 0x140016b4c
mov eax, dword [rsp + 0x140]
test eax, eax
je 0x140016ab6
test al, 1
jne 0x140016b4c
shr rax, 1
cmp word [rsp + rax*2 + 0x6e], 0
je 0x140016abc
jmp 0x140016b4c
mov word [rsp + 0x70], r15w
lea rsi, [rsp + 0x70]
mov qword [rsp + 0x60], 0xffffffffffffffff
mov dword [rsp + 0x68], r12d
mov rdi, r15
mov rbx, rsi
movzx eax, word [rsi]
test ax, ax
je 0x140016b10
nop dword [rax]
cmp ax, 0x2c
je 0x140016afc
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextW]
mov rbx, rax
movzx eax, word [rax]
test ax, ax
jne 0x140016ae0
jmp 0x140016b10
mov word [rbx], r15w
mov rcx, rsi
call fcn.14003df88
mov dword [rsp + rdi*4 + 0x60], eax
lea rsi, [rbx + 2]
cmp dword [rsp + rdi*4 + 0x60], 0xffffffff
je 0x140016b4c
inc rdi
cmp rdi, 2
jl 0x140016ad2
cmp word [rsi], 0
je 0x140016b4c
mov rcx, rsi
call fcn.14003df88
movzx edx, al
shl edx, 0x10
movzx eax, byte [rsp + 0x64]
shl eax, 8
or edx, eax
movzx eax, byte [rsp + 0x60]
or edx, eax
mov dword [r14 + 0x8c], edx
test r13, r13
je 0x140016b5a
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret