Function at 0x140016a80
Capabilities:
Get graphical window text
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
mov r14, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rbx, [rcx + 8]
mov qword [rsp + 0x158], rbx
mov r8d, 8
lea rdx, [rsp + 0x90]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x140016b35
lea rdx, str.static
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140016b35
lea edx, [rax - 0x10]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov r8d, eax
bts r8d, 8
cmp eax, r8d
je 0x140016b0c
mov edx, 0xfffffff0
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, 0xfffffff0
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetWindowLongW]
movzx ecx, al
lea eax, [rcx - 3]
cmp eax, 6
jbe 0x140016b2d
lea eax, [rcx - 0xd]
cmp eax, 2
ja 0x140016b35
and byte [r14 + 0x94], 0xfe
mov edx, 0x7f89
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [r14 + 0x58], rax
lea rdi, [r14 + 0x94]
mov qword [rsp + 0x88], rdi
test byte [rdi], 1
je 0x140016bd8
cmp qword [r14 + 0x68], 0
jne 0x140016bc9
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0xf8], eax
xor r9d, r9d
lea r8, [rsp + 0xa0]
lea edx, [rax + 0x5c]
lea ecx, [rax + 0x1f]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov qword [r14 + 0x68], rax
or byte [rdi], 0x10
cmp qword [r14 + 0x60], 0
jne 0x140016bd8
mov rcx, r14
call fcn.1400176d0
lea r13, [r14 + 0x80]
mov qword [rsp + 0x150], r13
mov r9, qword [rbx]
mov rcx, qword [0x1401f3908]
mov r8d, dword [0x1401f2e6c]
mov r10d, dword [0x1401f2e64]
sub r8d, r10d
mov eax, dword [0x1401f2e68]
mov edx, dword [0x1401f2e60]
sub eax, edx
xor r15d, r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r9
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], edx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.tooltips_class32
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [r13], rax
lea rsi, [r14 + 0x48]
mov qword [rsp + 0x60], rsi
cmp qword [rsi], r15
jne 0x140016d1b
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x140016d1b
lea r13d, [rax + 1]
mov dword [rsp + 0x148], r13d
movsxd rcx, r13d
mov eax, 2
mul rcx
mov r12, 0xffffffffffffffff
cmovo rax, r12
mov rcx, rax
call fcn.14002f008
mov qword [rsi], rax
jmp 0x140016cd0
mov rdx, qword [rsi]
test rdx, rdx
je 0x140016ce4
mov r8d, r13d
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov r13, qword [rsp + 0x150]
mov rcx, r14
call fcn.1400177e0
cmp qword [r14 + 0x50], 0
jne 0x140016d24
mov eax, dword [r14 + 0x90]
shr eax, 2
test al, 1
jne 0x140016d24
mov rdx, qword [rsi]
test rdx, rdx
je 0x140016d4d
mov rcx, r14
call fcn.140016810
jmp 0x140016d4d
mov r12, 0xffffffffffffffff
jmp 0x140016cec
xor r9d, r9d
mov edx, 0x401
lea r8d, [r9 + 1]
mov rcx, qword [r13]
call qword [sym.imp.USER32.dll_SendMessageW]
lea r9, [r14 + 0x70]
mov r8, qword [r14 + 0x50]
mov rdx, qword [rbx]
mov rcx, r13
call fcn.140016940
test byte [rdi], 1
je 0x140016fea
mov qword [rsp + 0x150], r15
lea rax, [rsp + 0x150]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerSettings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r13, r15
test eax, eax
cmove r13, qword [rsp + 0x150]
mov ecx, r15d
cmovne ecx, eax
test ecx, ecx
jne 0x140016fdc
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x140], 0x18
lea rax, [rsp + 0x140]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x148]
xor r8d, r8d
lea rdx, str.Anchor_Color
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140016ecc
mov eax, dword [rsp + 0x148]
dec eax
cmp eax, 1
ja 0x140016ecc
mov eax, dword [rsp + 0x140]
test eax, eax
je 0x140016e30
test al, 1
jne 0x140016ecc
shr rax, 1
cmp word [rsp + rax*2 + 0x6e], 0
je 0x140016e36
jmp 0x140016ecc
mov word [rsp + 0x70], r15w
lea rsi, [rsp + 0x70]
mov qword [rsp + 0x60], 0xffffffffffffffff
mov dword [rsp + 0x68], r12d
mov rdi, r15
nop dword [rax]
mov rbx, rsi
movzx eax, word [rsi]
test ax, ax
je 0x140016e90
nop dword [rax + rax]
cmp ax, 0x2c
je 0x140016e7c
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextW]
mov rbx, rax
movzx eax, word [rax]
test ax, ax
jne 0x140016e60
jmp 0x140016e90
mov word [rbx], r15w
mov rcx, rsi
call fcn.14003e338
mov dword [rsp + rdi*4 + 0x60], eax
lea rsi, [rbx + 2]
cmp dword [rsp + rdi*4 + 0x60], 0xffffffff
je 0x140016ecc
inc rdi
cmp rdi, 2
jl 0x140016e50
cmp word [rsi], 0
je 0x140016ecc
mov rcx, rsi
call fcn.14003e338
movzx ecx, al
shl ecx, 0x10
movzx eax, byte [rsp + 0x64]
shl eax, 8
or ecx, eax
movzx eax, byte [rsp + 0x60]
or ecx, eax
mov dword [r14 + 0x88], ecx
mov dword [rsp + 0x140], 0x18
lea rax, [rsp + 0x140]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x148]
xor r8d, r8d
lea rdx, str.Anchor_Color_Visited
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140016fdc
mov eax, dword [rsp + 0x148]
dec eax
cmp eax, 1
ja 0x140016fdc
mov eax, dword [rsp + 0x140]
test eax, eax
je 0x140016f46
test al, 1
jne 0x140016fdc
shr rax, 1
cmp word [rsp + rax*2 + 0x6e], 0
je 0x140016f4c
jmp 0x140016fdc
mov word [rsp + 0x70], r15w
lea rsi, [rsp + 0x70]
mov qword [rsp + 0x60], 0xffffffffffffffff
mov dword [rsp + 0x68], r12d
mov rdi, r15
mov rbx, rsi
movzx eax, word [rsi]
test ax, ax
je 0x140016fa0
nop dword [rax]
cmp ax, 0x2c
je 0x140016f8c
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharNextW]
mov rbx, rax
movzx eax, word [rax]
test ax, ax
jne 0x140016f70
jmp 0x140016fa0
mov word [rbx], r15w
mov rcx, rsi
call fcn.14003e338
mov dword [rsp + rdi*4 + 0x60], eax
lea rsi, [rbx + 2]
cmp dword [rsp + rdi*4 + 0x60], 0xffffffff
je 0x140016fdc
inc rdi
cmp rdi, 2
jl 0x140016f62
cmp word [rsi], 0
je 0x140016fdc
mov rcx, rsi
call fcn.14003e338
movzx edx, al
shl edx, 0x10
movzx eax, byte [rsp + 0x64]
shl eax, 8
or edx, eax
movzx eax, byte [rsp + 0x60]
or edx, eax
mov dword [r14 + 0x8c], edx
test r13, r13
je 0x140016fea
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret