Function at 0x496f00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x560f5f
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x60b3c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword fs:[0x2c]
mov edx, dword [eax]
mov eax, dword [0x61f73c]
cmp eax, dword [edx + 8]
jle 0x4972b6
push 0x61f73c
call fcn.0051028a
add esp, 4
cmp dword [0x61f73c], 0xffffffff
jne 0x4972b6
push 0x14
xorps xmm0, xmm0
mov dword [0x61f750], 0
push str.EstimatedBatteryTime
mov ecx, 0x61f740
mov dword [0x61f754], 0
movups xmmword [0x61f740], xmm0
call fcn.00417cb0
push str.RootCIMV2
mov ecx, 0x61f758
mov dword [ebp - 4], 0
call fcn.004968d0
push str.select_EstimatedRunTime_from_Win32_Battery
mov ecx, 0x61f75c
mov byte [ebp - 4], 1
call fcn.004968d0
push str.EstimatedRunTime
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 2
call fcn.004968d0
mov dword [ebp - 0x5c], 3
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 3
push ecx
lea eax, [ebp - 0x58]
push eax
push ecx
mov ecx, 0x61f760
call fcn.00497c00
push 0x497b30
push 1
push 8
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 5
push eax
call fcn.0050fddc
push 0xc
xorps xmm0, xmm0
mov dword [0x61f77c], 0
push str._no_battery_
mov ecx, 0x61f76c
mov dword [0x61f780], 0
movups xmmword [0x61f76c], xmm0
call fcn.00417cb0
mov dword [ebp - 4], 6
xorps xmm0, xmm0
push 0xa
push str.SystemType
mov ecx, 0x61f784
mov dword [0x61f794], 0
movups xmmword [0x61f784], xmm0
mov dword [0x61f798], 0
call fcn.00417cb0
push str.RootCIMV2
mov ecx, 0x61f79c
mov byte [ebp - 4], 7
call fcn.004968d0
push str.select_PCSystemTypeEx_from_Win32_ComputerSystem
mov ecx, 0x61f7a0
mov byte [ebp - 4], 8
call fcn.004968d0
push str.PCSystemTypeEx
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 9
call fcn.004968d0
mov dword [ebp - 0x5c], 0
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x58]
push ecx
push eax
push ecx
mov ecx, 0x61f7a4
call fcn.00497c00
push 0x497b30
push 1
push 8
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 0xc
push eax
call fcn.0050fddc
push 7
xorps xmm0, xmm0
mov dword [0x61f7c0], 0
push str._error_
mov ecx, 0x61f7b0
mov dword [0x61f7c4], 0
movups xmmword [0x61f7b0], xmm0
call fcn.00417cb0
mov byte [ebp - 4], 0xd
xorps xmm0, xmm0
push 0xa
push str.PowerState
mov ecx, 0x61f7c8
mov dword [0x61f7d8], 0
movups xmmword [0x61f7c8], xmm0
mov dword [0x61f7dc], 0
call fcn.00417cb0
push str.RootCIMV2
mov ecx, 0x61f7e0
mov byte [ebp - 4], 0xe
call fcn.004968d0
push str.select_PowerState_from_Win32_ComputerSystem
mov ecx, 0x61f7e4
mov byte [ebp - 4], 0xf
call fcn.004968d0
push str.PowerState
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x10
call fcn.004968d0
mov dword [ebp - 0x5c], 0
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x11
push ecx
lea eax, [ebp - 0x58]
push eax
push ecx
mov ecx, 0x61f7e8
call fcn.00497c00
push 0x497b30
push 1
push 8
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 0x13
push eax
call fcn.0050fddc
push 7
xorps xmm0, xmm0
mov dword [0x61f804], 0
push str._error_
mov ecx, 0x61f7f4
mov dword [0x61f808], 0
movups xmmword [0x61f7f4], xmm0
call fcn.00417cb0
mov byte [ebp - 4], 0x14
xorps xmm0, xmm0
push 0xe
movups xmmword [0x61f80c], xmm0
mov dword [0x61f81c], 0
mov dword [0x61f820], 0
push str.WorstDiskState
mov ecx, 0x61f80c
call fcn.00417cb0
push str.rootwmi
mov ecx, 0x61f824
mov byte [ebp - 4], 0x15
call fcn.004968d0
push str.select_PredictFailure_from_MSStorageDriver_FailurePredictStatus
mov ecx, 0x61f828
mov byte [ebp - 4], 0x16
call fcn.004968d0
push str.PredictFailure
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x17
call fcn.004968d0
mov dword [ebp - 0x5c], 1
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x18
push ecx
lea eax, [ebp - 0x58]
push eax
push ecx
mov ecx, 0x61f82c
call fcn.00497c00
push 0x497b30
push 1
push 8
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 0x1a
push eax
call fcn.0050fddc
push 0x18
xorps xmm0, xmm0
mov dword [0x61f848], 0
push str._error_or_not_supported_
mov ecx, 0x61f838
mov dword [0x61f84c], 0
movups xmmword [0x61f838], xmm0
call fcn.00417cb0
push 0x57fa10
mov dword [ebp - 4], 0xffffffff
call fcn.00510130
push 0x61f73c
call fcn.00510240
add esp, 8
push 2
xorps xmm0, xmm0
mov dword [ebp - 0x68], 0
push 0x5f4db0
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x64], 0
lea edi, [esi + 4]
movups xmmword [ebp - 0x78], xmm0
call fcn.00417cb0
lea eax, [ebp - 0x78]
mov dword [ebp - 4], 0x1b
push eax
mov ecx, edi
add esi, 0x14
call fcn.00497eb0
cmp eax, esi
je 0x49730a
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
jb 0x497301
mov esi, dword [esi]
push ecx
push esi
mov ecx, eax
call fcn.00439c70
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x64]
cmp ecx, 0x10
jb 0x497345
mov edx, dword [ebp - 0x78]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x49733b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x497ae5
push ecx
push edx
call fcn.0050fd95
add esp, 8
push 0x5e85f0
mov dword [ebp - 4], 0x1c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x4973b3
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4973b3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4973b3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4973b3
cmp word [eax + 4], 0
jne 0x4973b3
cmp dword [eax + 0x28], 0xfeef04bd
jne 0x4973b3
movzx ecx, word [eax + 0x36]
movzx esi, word [eax + 0x30]
movzx edx, word [eax + 0x32]
movzx eax, word [eax + 0x34]
push eax
push ecx
push esi
lea ecx, [ebp - 0x78]
call fcn.004965a0
add esp, 0xc
jmp 0x4973d7
push 7
xorps xmm0, xmm0
mov dword [ebp - 0x68], 0
push str.0.0.0.0
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x64], 0
movups xmmword [ebp - 0x78], xmm0
call fcn.00417cb0
mov dword [ebp - 4], 0x1d
lea ecx, [ebp - 0x28]
push 0xa
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push str.OS_Version
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
call fcn.00417cb0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x1e
push eax
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.00497eb0
mov ecx, eax
call fcn.0041c8c0
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x497454
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x49744a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x497aea
push ecx
push edx
call fcn.0050fd95
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp ecx, 0x10
jb 0x4974a1
mov edx, dword [ebp - 0x78]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x497497
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x497aea
push ecx
push edx
call fcn.0050fd95
add esp, 8
push 0xf
xorps xmm0, xmm0
mov dword [ebp - 0x68], 0
push str.Product_Version
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x64], 0
movups xmmword [ebp - 0x78], xmm0
call fcn.00417cb0
lea eax, [ebp - 0x78]
mov dword [ebp - 4], 0x1f
push eax
mov ecx, edi
call fcn.00497eb0
push 9
push str.4.1.1.949
mov ecx, eax
call fcn.00439c70
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x64]
cmp ecx, 0x10
jb 0x497520
mov edx, dword [ebp - 0x78]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x497516
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x497aef
push ecx
push edx
call fcn.0050fd95
add esp, 8
push 4
xorps xmm0, xmm0
mov dword [ebp - 0x68], 0
push str.UUID
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x64], 0
movups xmmword [ebp - 0x78], xmm0
call fcn.00417cb0
lea eax, [ebp - 0x78]
mov dword [ebp - 4], 0x20
push eax
mov ecx, edi
call fcn.00497eb0
push 0
push 0x5e3b9f
mov ecx, eax
call fcn.00439c70
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x64]
cmp ecx, 0x10
jb 0x49759f
mov edx, dword [ebp - 0x78]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x497595
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x497af4
push ecx
push edx
call fcn.0050fd95
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
mov dword [ebp - 4], 0x21
xor eax, eax
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x22
push eax
call fcn.00490920
test al, al
jne 0x4975f9
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x21
call fcn.00417680
jmp 0x497722
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x58]
push eax
call fcn.0049b900
add esp, 8
test al, al
jne 0x497691
call fcn.0045b3b0
push 1
lea ecx, [ebp - 0x118]
push ecx
mov ecx, eax
call fcn.0045b920
lea edx, [ebp - 0x60]
mov dword [ebp - 0x60], str.UIDService.cpp
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x5c], 0x6e
call fcn.00418540
mov edx, str.Failed_to_convert_wuuid_to_string
lea ecx, [ebp - 0x118]
call fcn.004185a0
lea ecx, [ebp - 0xc0]
call fcn.00459e90
lea eax, [ebp - 0xc0]
mov byte [ebp - 4], 0x23
push eax
mov dword [ebp - 0xc0], vtable.std::ios_base.0
call fcn.004f7d4c
add esp, 4
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x28]
call fcn.00417680
jmp 0x497722
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x21
call fcn.00417680
push 4
xorps xmm0, xmm0
mov dword [ebp - 0x68], 0
push str.UUID
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x64], 0
movups xmmword [ebp - 0x78], xmm0
call fcn.00417cb0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x24
push eax
mov ecx, edi
call fcn.00497eb0
lea ecx, [ebp - 0x58]
cmp eax, ecx
je 0x4976ea
cmp dword [ebp - 0x44], 0x10
push dword [ebp - 0x48]
cmovae ecx, dword [ebp - 0x58]
push ecx
mov ecx, eax
call fcn.00439c70
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0x64]
cmp ecx, 0x10
jb 0x497722
mov edx, dword [ebp - 0x78]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x497718
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x497af9
push ecx
push edx
call fcn.0050fd95
add esp, 8
push 0xa
xorps xmm0, xmm0
mov dword [ebp - 0x68], 0
push str.Machine_ID
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x64], 0
movups xmmword [ebp - 0x78], xmm0
call fcn.00417cb0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x25
push eax
mov ecx, edi
call fcn.00497eb0
push 9
push str.NO_REGKEY
mov ecx, eax
call fcn.00439c70
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0x64]
cmp ecx, 0x10
jb 0x49779b
mov edx, dword [ebp - 0x78]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x497791
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x497afe
push ecx
push edx
call fcn.0050fd95
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x26
push eax
call fcn.00490c50
test al, al
je 0x49784e
push 0xa
xorps xmm0, xmm0
mov dword [ebp - 0x68], 0
push str.Machine_ID
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x64], 0
movups xmmword [ebp - 0x78], xmm0
call fcn.00417cb0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x27
push eax
mov ecx, edi
call fcn.00497eb0
lea ecx, [ebp - 0x40]
cmp eax, ecx
je 0x497816
cmp dword [ebp - 0x2c], 0x10
push dword [ebp - 0x30]
cmovae ecx, dword [ebp - 0x40]
push ecx
mov ecx, eax
call fcn.00439c70
mov byte [ebp - 4], 0x26
mov ecx, dword [ebp - 0x64]
cmp ecx, 0x10
jb 0x49784e
mov edx, dword [ebp - 0x78]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x497844
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x497b03
push ecx
push edx
call fcn.0050fd95
add esp, 8
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0xffffffff
call fcn.0049dc30
xorps xmm0, xmm0
push 0xb
push str.OS_Platform
test al, al
je 0x4979fb
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
movups xmmword [ebp - 0x78], xmm0
sub eax, 0
je 0x4979a9
sub eax, 1
je 0x497950
sub eax, 1
je 0x4978f7
call fcn.00417cb0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x2b
push eax
mov ecx, edi
call fcn.00497eb0
push 7
push str.UNKNOWN
mov ecx, eax
call fcn.00439c70
mov ecx, dword [ebp - 0x64]
cmp ecx, 0x10
jb 0x497a66
mov edx, dword [ebp - 0x78]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x497a5c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x497b08
jmp 0x497a5c
call fcn.00417cb0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x28
push eax
mov ecx, edi
call fcn.00497eb0
push 5
push str.ARM64
mov ecx, eax
call fcn.00439c70
mov ecx, dword [ebp - 0x64]
cmp ecx, 0x10
jb 0x497a66
mov edx, dword [ebp - 0x78]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x497a5c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x497b0d
jmp 0x497a5c
call fcn.00417cb0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x2a
push eax
mov ecx, edi
call fcn.00497eb0
push 2
push 0x5f4e2c
mov ecx, eax
call fcn.00439c70
mov ecx, dword [ebp - 0x64]
cmp ecx, 0x10
jb 0x497a66
mov edx, dword [ebp - 0x78]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x497a5c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x497b12
jmp 0x497a5c
call fcn.00417cb0
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0x29
push eax
mov ecx, edi
call fcn.00497eb0
push 2
push 0x5f4e30
mov ecx, eax
call fcn.00439c70
mov ecx, dword [ebp - 0x64]
cmp ecx, 0x10
jb 0x497a66
mov edx, dword [ebp - 0x78]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x497a5c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x497b17
jmp 0x497a5c
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
call fcn.00417cb0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x2c
push eax
mov ecx, edi
call fcn.00497eb0
push 5
push str.ERROR
mov ecx, eax
call fcn.00439c70
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x497a66
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x497a5c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x497b1c
push ecx
push edx
call fcn.0050fd95
add esp, 8
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0x10
jb 0x497a9a
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x497a90
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x497b21
push ecx
push edx
call fcn.0050fd95
add esp, 8
mov ecx, dword [ebp - 0x44]
cmp ecx, 0x10
jb 0x497aca
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x497ac0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x497b21
push ecx
push edx
call fcn.0050fd95
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050fd4b
mov esp, ebp
pop ebp
ret
call fcn.0052865a
call fcn.0052865a
call fcn.0052865a
call fcn.0052865a
call fcn.0052865a
call fcn.0052865a
call fcn.0052865a
call fcn.0052865a
call fcn.0052865a
call fcn.0052865a
call fcn.0052865a
call fcn.0052865a
call fcn.0052865a
int3