Function at 0x6c647b30
Capabilities:
Check for peb beingdebugged flag
Get graphical window text

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x868
mov r12, rcx
cmp edx, 0x110
je 0x6c647ed8
cmp edx, 0x111
je 0x6c647c50
cmp edx, 0x4e
je 0x6c647b80
xor eax, eax
add rsp, 0x868
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [r9 + 0x10]
cmp eax, 0xffffff32
je 0x6c647f50
cmp eax, 0xffffff38
je 0x6c647f20
cmp eax, 0xffffff31
jne 0x6c647b63
mov edx, 0xb5d
call qword [sym.imp.user32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xe
mov rcx, rax
mov r14, qword [sym.imp.user32.dll_SendMessageW]
mov r13, rax
call r14
mov edx, 0x10
mov rcx, r12
mov rbx, rax
call qword [sym.imp.user32.dll_GetWindowLongPtrW]
mov rdi, rax
test ebx, ebx
jne 0x6c647f80
mov rsi, qword [rax + 0x10]
mov rcx, qword [0x6c663008]
mov rbx, qword [sym.imp.user32.dll_LoadStringW]
test rsi, rsi
je 0x6c6481e7
lea r13, [rsp + 0x460]
mov r9d, 0x200
mov edx, 0x420
mov r8, r13
call rbx
mov r9d, 0x10
mov r8, rsi
mov rdx, r13
mov rcx, r12
call qword [sym.imp.user32.dll_MessageBoxW]
mov r8d, 1
xor edx, edx
mov rcx, r12
call qword [sym.imp.user32.dll_SetWindowLongPtrW]
mov eax, 1
jmp 0x6c647b65
cmp r8, 0xb5e
jne 0x6c647b63
mov edx, 0x10
lea r13, [rsp + 0x60]
call qword [sym.imp.user32.dll_GetWindowLongPtrW]
mov rdi, r13
mov ecx, 0x13
mov rdx, rax
xor eax, eax
rep stosq qword [rdi], rax
mov dword [rsp + 0x60], 0x98
mov qword [rsp + 0x68], r12
mov eax, dword [rdx + 0x4c]
mov ecx, dword [rdx + 0x28]
cmp eax, 3
je 0x6c6481a0
mov edx, 0x4b7
lea r15, str..cer
cmp eax, 4
je 0x6c647d00
mov edx, 0x4bb
lea r15, str..pfx
cmp eax, 2
je 0x6c647d00
cmp ecx, 3
je 0x6c64845f
mov edx, 0x4bc
lea r15, [0x6c655870]
cmp ecx, 4
je 0x6c647d00
xor edx, edx
lea r15, str..cer
lea rax, [0x6c6558a0]
cmp ecx, 2
sete dl
cmove r15, rax
lea edx, [rdx + rdx*2 + 0x4b6]
nop word cs:[rax + rax]
mov rcx, qword [0x6c663008]
mov rbx, qword [sym.imp.user32.dll_LoadStringW]
xor r9d, r9d
lea r8, [rsp + 0x58]
call rbx
movsxd r14, eax
mov rax, r15
nop
add rax, 2
cmp word [rax], 0
jne 0x6c647d20
sub rax, r15
lea rdi, [rsp + 0x460]
xor r9d, r9d
mov edx, 0x41f
sar rax, 1
mov rcx, qword [0x6c663008]
mov r8, rdi
lea rsi, [0x6c655950]
lea ebp, [r14 + rax + 4]
call rbx
movsxd rbx, eax
mov rax, rsi
nop
add rax, 2
cmp word [rax], 0
jne 0x6c647d60
sub rax, rsi
sar rax, 1
lea r8d, [rbx + rax + 2]
add r8d, ebp
mov rdx, qword gs:[0x30]
mov rax, qword [rdx + 0x60]
movsxd r8, r8d
xor edx, edx
add r8, r8
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x6c647e7c
add r14, r14
mov rdx, qword [rsp + 0x58]
mov rcx, rax
mov r8, r14
call sym.memcpy
lea r8, [rbp + r14]
xor r9d, r9d
xor eax, eax
mov word [r8], r9w
nop dword [rax]
movzx edx, word [r15 + rax]
mov word [r8 + rax + 2], dx
add rax, 2
test dx, dx
jne 0x6c647dc8
cmp word [r15], 0
je 0x6c64825e
mov rax, r15
nop word [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x6c647df0
sub rax, r15
sar rax, 1
add eax, 1
cdqe
add rax, rax
mov rdx, qword [rsp + 0x460]
add rbx, rbx
lea rcx, [r8 + rax + 2]
mov r8, rbx
call sym.memcpy
xor ecx, ecx
add rbx, rax
lea rax, [0x6c655950]
mov word [rbx], cx
lea r8, [rbx + 2]
mov rdx, r8
nop word cs:[rax + rax]
movzx ecx, word [rax]
add rax, 2
add rdx, 2
mov word [rdx - 2], cx
test cx, cx
jne 0x6c647e40
lea rax, [0x6c655950]
nop dword [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x6c647e60
sub rax, rsi
xor edx, edx
sar rax, 1
add eax, 1
cdqe
mov word [r8 + rax*2], dx
xor eax, eax
mov qword [rsp + 0x78], rbp
mov rcx, r13
mov qword [rsp + 0x90], rdi
mov dword [rsp + 0x98], 0x104
mov word [rsp + 0x460], ax
call qword [sym.imp.comdlg32.dll_GetSaveFileNameW]
test eax, eax
jne 0x6c6481b8
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r8, qword [rsp + 0x78]
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x6c647b63
mov rbx, qword [r9 + 0x30]
mov edx, 0x10
mov r8, rbx
call qword [sym.imp.user32.dll_SetWindowLongPtrW]
mov rbx, qword [rbx + 0x20]
test rbx, rbx
je 0x6c647b63
mov edx, 0xb5d
mov rcx, r12
call qword [sym.imp.user32.dll_GetDlgItem]
mov r9, rbx
xor r8d, r8d
mov edx, 0xc
mov rcx, rax
call qword [sym.imp.user32.dll_SendMessageW]
xor eax, eax
jmp 0x6c647b65
call qword [sym.imp.user32.dll_GetParent]
mov r9d, 3
xor r8d, r8d
mov edx, 0x470
mov rcx, rax
call qword [sym.imp.user32.dll_PostMessageW]
mov eax, 1
jmp 0x6c647b65
mov edx, 0x10
call qword [sym.imp.user32.dll_GetWindowLongPtrW]
cmp dword [rax + 0x4c], 2
je 0x6c647b63
mov r8d, 0x74
xor edx, edx
mov rcx, r12
call qword [sym.imp.user32.dll_SetWindowLongPtrW]
mov eax, 1
jmp 0x6c647b65
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
add ebx, 1
mov rsi, qword [sym.imp.kernel32.dll_HeapAlloc]
xor edx, edx
lea r8, [rbx + rbx]
mov rcx, qword [rax + 0x30]
call rsi
mov rbp, rax
test rax, rax
je 0x6c647b63
mov r8, rbx
mov edx, 0xd
mov r9, rax
mov rcx, r13
call r14
mov eax, dword [rdi + 0x4c]
mov edx, dword [rdi + 0x28]
lea rbx, [0x6c655470]
cmp eax, 2
je 0x6c64800b
lea rbx, [0x6c655480]
cmp eax, 3
je 0x6c64800b
lea rbx, [0x6c655460]
cmp edx, 3
je 0x6c64800b
lea rbx, [0x6c655440]
cmp edx, 4
je 0x6c64800b
cmp edx, 2
lea rbx, [0x6c655430]
lea rax, str..ctl
cmove rbx, rax
mov rcx, rbp
mov edx, 0x2e
call qword [sym.imp.ucrtbase.dll_wcsrchr]
mov rcx, rax
test rax, rax
je 0x6c648032
mov rdx, rbx
call qword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
je 0x6c6480d1
cmp word [rbp], 0
mov rax, rbp
je 0x6c648494
add rax, 2
cmp word [rax], 0
jne 0x6c648040
sub rax, rbp
sar rax, 1
cmp word [rbx], 0
je 0x6c648072
mov rdx, rbx
nop dword [rax]
add rdx, 2
cmp word [rdx], 0
jne 0x6c648060
sub rdx, rbx
sar rdx, 1
add eax, edx
add eax, 1
mov r8, rbp
movsxd r9, eax
mov rdx, qword gs:[0x30]
mov rax, qword [rdx + 0x60]
add r9, r9
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapReAlloc]
mov rbp, rax
test rax, rax
je 0x6c6480d1
cmp word [rax], 0
mov rdx, rax
je 0x6c6480ba
nop dword [rax + rax]
add rdx, 2
cmp word [rdx], 0
jne 0x6c6480b0
xor eax, eax
nop dword [rax]
movzx ecx, word [rbx + rax]
mov word [rdx + rax], cx
add rax, 2
test cx, cx
jne 0x6c6480c0
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov rcx, rbp
mov r15, qword [sym.imp.kernel32.dll_CreateFileW]
mov dword [rsp + 0x28], 0
mov r8d, 3
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
call r15
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x6c648268
mov r14, qword [rdi + 0x10]
mov rcx, qword [0x6c663008]
mov rbx, qword [sym.imp.user32.dll_LoadStringW]
test r14, r14
je 0x6c648470
lea r10, [rsp + 0x60]
mov r9d, 0x200
mov edx, 0x4b5
mov r8, r10
mov qword [rsp + 0x48], r10
call rbx
mov r10, qword [rsp + 0x48]
mov rcx, r12
mov r9d, 4
mov r8, r14
mov rdx, r10
call qword [sym.imp.user32.dll_MessageBoxW]
mov rcx, r13
cmp eax, 6
je 0x6c648208
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rbx, qword [sym.imp.kernel32.dll_HeapFree]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r8, rbp
xor edx, edx
mov rcx, qword [rax + 0x30]
call rbx
jmp 0x6c647c2b
mov edx, 0x4ba
lea r15, str..p7b
jmp 0x6c647d00
mov rbx, qword [rsp + 0x90]
mov rcx, r12
mov edx, 0xb5d
call qword [sym.imp.user32.dll_GetDlgItem]
xor r8d, r8d
mov edx, 0xc
mov rcx, rax
mov r9, rbx
call qword [sym.imp.user32.dll_SendMessageW]
jmp 0x6c647eaf
lea rsi, [rsp + 0x60]
mov r9d, 0x200
mov edx, 0x4b0
mov r8, rsi
call rbx
mov rcx, qword [0x6c663008]
jmp 0x6c647bfe
call qword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 2
xor r9d, r9d
mov dword [rsp + 0x20], eax
mov r8d, 3
mov rcx, rbp
mov qword [rsp + 0x30], 0
mov edx, 0x40000000
mov dword [rsp + 0x28], 0
call r15
cmp rax, 0xffffffffffffffff
je 0x6c64826f
movq xmm1, rax
movq xmm0, rbp
xor eax, eax
punpcklqdq xmm0, xmm1
movups xmmword [rdi + 0x80], xmm0
jmp 0x6c647b65
mov eax, 2
jmp 0x6c647e08
mov eax, 1
jmp 0x6c648213
mov r13, qword [rdi + 0x10]
mov rcx, qword [0x6c663008]
mov rbx, qword [sym.imp.user32.dll_LoadStringW]
test r13, r13
je 0x6c64849b
lea rdi, [rsp + 0x460]
mov r9d, 0x200
mov edx, 0x422
mov r8, rdi
call rbx
xor r9d, r9d
xor edx, edx
mov ecx, 0x1100
mov rax, qword gs:[0x30]
mov r8d, dword [rax + 0x68]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.kernel32.dll_FormatMessageW]
mov rax, rdi
cmp word [rsp + 0x460], 0
je 0x6c6482fa
nop dword [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x6c6482f0
sub rax, rdi
mov rdx, rbp
sar rax, 1
cmp word [rbp], 0
je 0x6c64831a
nop word [rax + rax]
add rdx, 2
cmp word [rdx], 0
jne 0x6c648310
mov rcx, qword [rsp + 0x58]
sub rdx, rbp
sar rdx, 1
add eax, edx
cmp word [rcx], 0
mov rdx, rcx
je 0x6c64833a
add rdx, 2
cmp word [rdx], 0
jne 0x6c648330
sub rdx, rcx
sar rdx, 1
lea r8d, [rax + rdx + 3]
xor edx, edx
mov r9, qword gs:[0x30]
mov rax, qword [r9 + 0x60]
movsxd r8, r8d
add r8, r8
mov rcx, qword [rax + 0x30]
call rsi
mov rbx, rax
test rax, rax
je 0x6c6484bc
mov rdx, rax
mov rax, rdi
nop word [rax + rax]
movzx ecx, word [rax]
add rax, 2
add rdx, 2
mov word [rdx - 2], cx
test cx, cx
jne 0x6c648378
cmp word [rsp + 0x460], 0
mov rax, rdi
je 0x6c6483aa
nop word [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x6c6483a0
sub rax, rdi
sar rax, 1
cdqe
lea rcx, [rbx + rax*2]
xor eax, eax
nop dword [rax + rax]
movzx edx, word [rbp + rax]
mov word [rcx + rax], dx
add rax, 2
test dx, dx
jne 0x6c6483c0
cmp word [rbp], 0
mov rax, rbp
je 0x6c6483ea
nop dword [rax]
add rax, 2
cmp word [rax], 0
jne 0x6c6483e0
sub rax, rbp
mov r8, qword [rsp + 0x58]
sar rax, 1
cdqe
lea rcx, [rcx + rax*2]
xor eax, eax
mov dword [rcx], 0xa003a
nop dword [rax + rax]
movzx edx, word [r8 + rax]
mov word [rcx + rax + 4], dx
add rax, 2
test dx, dx
jne 0x6c648408
mov rdx, rbx
mov r8, r13
mov rcx, r12
mov r9d, 0x10
call qword [sym.imp.user32.dll_MessageBoxW]
mov r8, rbx
xor edx, edx
mov rbx, qword [sym.imp.kernel32.dll_HeapFree]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
call rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.kernel32.dll_LocalFree]
jmp 0x6c64817a
mov edx, 0x4b8
lea r15, [0x6c6558b0]
jmp 0x6c647d00
lea r14, [rsp + 0x460]
mov r9d, 0x200
mov edx, 0x4b0
mov r8, r14
call rbx
mov rcx, qword [0x6c663008]
jmp 0x6c64812d
xor eax, eax
jmp 0x6c648050
lea r13, [rsp + 0x60]
mov r9d, 0x200
mov edx, 0x4b0
mov r8, r13
call rbx
mov rcx, qword [0x6c663008]
jmp 0x6c64828a
mov rbx, qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x6c64844f