Function at 0x140002ce0
Capabilities:
Get graphical window text
Query or enumerate registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x5a0]
sub rsp, 0x6a0
mov rax, qword [0x140021170]
xor rax, rsp
mov qword [rbp + 0x580], rax
mov rax, qword [0x140023d28]
mov dword [rsp + 0x40], 5
test rax, rax
je 0x140002d25
lea rcx, [rsp + 0x40]
call rax
test eax, eax
je 0x140002fa3
mov qword [rsp + 0x6b8], rsi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
test rax, rax
jne 0x140002db3
lea rcx, str.GetForegroundWindow__NULL_r_n
call fcn.1400011a0
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetTopWindow]
mov rsi, rax
test rax, rax
jne 0x140002d6f
lea rcx, str.GetTopWindow__NULL_r_n
call fcn.1400011a0
jmp 0x140002f9b
lea rcx, [rbp + 0x181]
xor edx, edx
mov r8d, 0x3ff
mov byte [rbp + 0x180], 0
call fcn.1400062d0
lea rdx, [rbp + 0x180]
mov r8d, 0x400
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rdx, [rbp + 0x180]
lea rcx, str.GetTopWindow___s_r_n
call fcn.1400011a0
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x140002f9b
cmp dword [rsp + 0x60], 0
jne 0x140002f9b
cmp dword [rsp + 0x64], 0
jne 0x140002f9b
mov qword [rsp + 0x6b0], rbx
mov qword [rsp + 0x6c0], rdi
mov qword [rsp + 0x6c8], r12
xor ecx, ecx
mov qword [rsp + 0x698], r14
mov qword [rsp + 0x690], r15
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r12d, 1
mov ecx, r12d
mov edi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, dword [rsp + 0x68]
mov edx, dword [rsp + 0x60]
mov r14d, dword [rsp + 0x6c]
mov r8d, dword [rsp + 0x64]
mov dword [rsp + 0x30], eax
sub ebx, edx
sub r14d, r8d
lea rcx, str._d___d__d_x__d___d_x__d__r_n
mov r9d, ebx
mov dword [rsp + 0x28], edi
mov r15d, eax
mov dword [rsp + 0x20], r14d
call fcn.1400011a0
cmp ebx, edi
jne 0x140002f73
cmp r14d, r15d
jne 0x140002f73
lea edx, [r12 - 0x11]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, 2
lea r8, [rsp + 0x50]
bt eax, 0x17
mov eax, dword [rsp + 0x40]
lea rdx, str.Control_PanelDesktop
cmovae eax, ecx
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x40], eax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140002f73
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea rdx, str.SCRNSAVE.EXE
xor r8d, r8d
mov dword [rsp + 0x48], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002f68
lea rdx, [rsp + 0x44]
mov rcx, rsi
mov dword [rsp + 0x44], eax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [rsp + 0x44]
test ecx, ecx
je 0x140002f68
call fcn.140002c30
mov rdi, rax
test rax, rax
je 0x140002f68
lea rdx, [rbp + 0x180]
lea rcx, [rsp + 0x70]
mov r8d, 0x104
lea rsi, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov edx, dword [rsp + 0x44]
test eax, eax
lea rbx, [rbp + 0x180]
lea rcx, str.__4d___ws_____ws_r_n
cmove rbx, rsi
mov r8, rdi
mov r9, rbx
call fcn.1400011a0
mov rdx, rdi
mov rcx, rbx
call fcn.140004bd4
mov ecx, dword [rsp + 0x40]
test eax, eax
cmove ecx, r12d
mov dword [rsp + 0x40], ecx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rsp + 0x698]
mov r12, qword [rsp + 0x6c8]
mov rdi, qword [rsp + 0x6c0]
mov rbx, qword [rsp + 0x6b0]
mov r15, qword [rsp + 0x690]
mov rsi, qword [rsp + 0x6b8]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.140004730
add rsp, 0x6a0
pop rbp
ret