Function at 0x47c720
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x84
mov eax, dword [0x5ac004]
xor eax, esp
mov dword [esp + 0x80], eax
push esi
push 0
mov esi, ecx
push 1
push 0x109d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x60
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0051fd40
add esp, 0xc
mov dword [esp + 8], 0x60
lea eax, [esp + 8]
mov dword [esp + 0xc], 0x1d
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 8
push eax
push 0x7fffffff
push 0x1091
push dword [esi + 0x1c]
mov dword [esp + 0x30], 0
mov dword [esp + 0x20], 0x572e2c
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x60
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0051fd40
add esp, 0xc
mov dword [esp + 8], 0x60
lea eax, [esp + 8]
mov dword [esp + 0xc], 0x1d
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 8
push eax
push 0x7fffffff
push 0x1091
push dword [esi + 0x1c]
mov dword [esp + 0x30], 1
mov dword [esp + 0x20], 0x57a914
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x60
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0051fd40
add esp, 0xc
mov dword [esp + 8], 0x60
lea eax, [esp + 8]
mov dword [esp + 0xc], 0x1d
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 8
push eax
push 0x7fffffff
push 0x1091
push dword [esi + 0x1c]
mov dword [esp + 0x30], 2
mov dword [esp + 0x20], 0x572e70
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x60
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0051fd40
add esp, 0xc
mov dword [esp + 8], 0x60
lea eax, [esp + 8]
mov dword [esp + 0xc], 0x1d
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 8
push eax
push 0x7fffffff
push 0x1091
push dword [esi + 0x1c]
mov dword [esp + 0x30], 3
mov dword [esp + 0x20], 0x56e374
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x60
push 0
lea eax, [esp + 0x10]
push eax
call fcn.0051fd40
add esp, 0xc
mov dword [esp + 8], 0x60
lea eax, [esp + 8]
mov dword [esp + 0xc], 0x1d
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 8
push eax
push 0x7fffffff
push 0x1091
push dword [esi + 0x1c]
mov dword [esp + 0x30], 4
mov dword [esp + 0x20], str.Extension
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.Priority
mov dword [esp + 0x40], 0
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.Cycles
mov dword [esp + 0x40], 0
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 2
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.Cycles_delta
mov dword [esp + 0x40], 0
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 0x57a94c
mov dword [esp + 0x40], 0
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 4
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.Kernel_delta
mov dword [esp + 0x40], 0
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 5
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 0x57a980
mov dword [esp + 0x40], 0
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 6
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.User_delta
mov dword [esp + 0x40], 0
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 7
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.Total_time
mov dword [esp + 0x40], 0
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 8
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.Total_delta
mov dword [esp + 0x40], 0
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 9
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 0x572f94
mov dword [esp + 0x40], 1
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0xa
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.Private_bytes_delta
mov dword [esp + 0x40], 1
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0xb
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.Peak_private_bytes
mov dword [esp + 0x40], 1
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0xc
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 0x56e0e4
mov dword [esp + 0x40], 1
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword ds:[esp + 8], 0x101
mov dword [esp + 0xc], 0xd
mov dword [esp + 0x10], 0
lea eax, [esp + 8]
mov dword [esp + 0x1c], str.Peak_virtual_size
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x40], 1
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0xe
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 0x578fd0
mov dword [esp + 0x40], 1
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 0x5792cc
mov dword [esp + 0x40], 1
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 0x572fcc
mov dword [esp + 0x40], 1
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x11
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.Peak_working_set
mov dword [esp + 0x40], 1
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x12
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.Private_WS
mov dword [esp + 0x40], 1
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x13
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.Shareable_WS
mov dword [esp + 0x40], 1
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
mov dword [esp + 0xc], 0x14
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], str.Shared_WS
mov dword [esp + 0x30], 1
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x27
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.Paged_pool_bytes
mov dword [esp + 0x40], 1
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x28
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.Peak_paged_pool_bytes
mov dword [esp + 0x40], 1
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x29
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.Nonpaged_pool_bytes
mov dword [esp + 0x40], 1
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x2a
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.Peak_nonpaged_pool_bytes
mov dword [esp + 0x40], 1
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x15
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.Page_priority
mov dword [esp + 0x40], 1
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x16
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 0x57aa88
mov dword [esp + 0x40], 2
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x17
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 0x57aa94
mov dword [esp + 0x40], 2
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x18
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 0x57aaac
mov dword [esp + 0x40], 2
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x19
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 0x57aac4
mov dword [esp + 0x40], 2
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x1a
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 0x57aae8
mov dword [esp + 0x40], 2
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x1b
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 0x57aaf8
mov dword [esp + 0x40], 2
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x1c
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 0x57ab14
mov dword [esp + 0x40], 2
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x1d
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 0x57ab2c
mov dword [esp + 0x40], 2
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x1e
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 0x56e374
mov dword [esp + 0x40], 2
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword ds:[esp + 8], 0x101
mov dword [esp + 0xc], 0x1f
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], 0x57ab50
lea eax, [esp + 8]
mov dword [esp + 0x30], 2
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x20
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 0x57ab68
mov dword [esp + 0x40], 2
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x21
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 0x57ab80
mov dword [esp + 0x40], 2
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x22
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.I_O_priority
mov dword [esp + 0x40], 2
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x23
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 0x56e0c8
mov dword [esp + 0x40], 3
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x24
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.Peak_handles
mov dword [esp + 0x40], 3
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x25
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.GDI_handles
mov dword [esp + 0x40], 3
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, ds:[esp + 8]
mov dword [esp + 8], 0x101
push eax
mov dword [esp + 0x10], 0x26
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], str.USER_handles
mov dword [esp + 0x34], 3
push 0
push 0x104d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x68
jb 0x47d596
lea eax, [esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x2b
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.Running_time
mov dword [esp + 0x40], 3
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x2c
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.Suspended_time
mov dword [esp + 0x40], 3
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x2d
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.Hang_count
mov dword [esp + 0x40], 3
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x2e
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.Ghost_count
mov dword [esp + 0x40], 3
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x68
jb 0x47d596
cmp byte [0x5b3884], 0
jne 0x47d513
push 0
push 4
lea eax, [esp + 0x74]
push eax
push 0x1a
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x47d500
cmp dword [esp + 0x6c], 0
setne byte [0x5b35f7]
xor ecx, ecx
lea eax, [esp + 0x80]
lock or dword [eax], ecx
mov byte [0x5b3884], 1
cmp byte [0x5b35f7], 0
jne 0x47d596
lea eax, [esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x2f
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.ContextSwitches
mov dword [esp + 0x40], 4
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 8]
mov dword [esp + 8], 0x101
push eax
push 0
push 0x104d
push dword [esi + 0x1c]
mov dword [esp + 0x1c], 0x30
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], str.NetworkTxRxBytes
mov dword [esp + 0x40], 4
call dword [sym.imp.USER32.dll_SendMessageW]
cmp byte [0x5b1804], 0
je 0x47d5cc
mov eax, dword [esi + 0x28]
mov dword [esp + 0x78], eax
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x70]
push eax
push 0x5b29c0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 1
call sym.ProcessHacker.exe_PhInvokeCallback
mov ecx, dword [esp + 0x84]
pop esi
xor ecx, esp
call fcn.0051e068
mov esp, ebp
pop ebp
ret