Function at 0x1400c9b6c
Capabilities:
Extract resource via kernel32 functions
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2b0
mov rax, qword [0x1401542d0]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
xor r13d, r13d
mov r15, r9
cmp qword [0x14015cc90], r13
mov r12b, r8b
mov r14, rdx
mov word [0x1401b50c0], r13w
setne dil
test dil, dil
jne 0x1400c9bde
mov byte [0x1401b6748], r13b
mov byte [0x1401b6749], r13b
mov byte [0x1401b67b6], r13b
mov dword [0x1401b30b8], ecx
mov word [0x1401b61c0], r13w
jmp 0x1400c9be4
mov ecx, dword [0x1401b30b8]
lea rbx, [0x1401b50c0]
mov ebp, 5
mov esi, 0x880
cmp ecx, 7
jg 0x1400c9ed3
je 0x1400c9ec9
test ecx, ecx
je 0x1400c9d2d
jle 0x1400c9f70
cmp ecx, 2
jle 0x1400c9c76
cmp ecx, 3
je 0x1400c9c64
cmp ecx, 4
je 0x1400c9c52
cmp ecx, ebp
je 0x1400c9c4b
cmp ecx, 6
jne 0x1400c9f70
mov ecx, 0x223
call fcn.140088ebc
mov rdx, rax
mov r8, rsi
mov rcx, rbx
call fcn.14008eff0
jmp 0x1400c9f62
mov ecx, 0x24e
jmp 0x1400c9c33
mov rcx, r14
call fcn.140079c5c
mov ecx, 0x212
jmp 0x1400c9f45
mov rcx, r14
call fcn.140079c5c
mov ecx, 0x211
jmp 0x1400c9f45
mov rcx, r14
call fcn.140079c5c
cmp dword [0x1401b30b8], 1
mov ecx, r13d
mov rbx, rax
setne cl
add ecx, 0x20f
call fcn.140088ebc
mov r8, rax
lea rcx, [0x1401b50c0]
mov r9, rbx
mov rdx, rsi
call fcn.140002694
test dil, dil
jne 0x1400c9d21
cmp dword [0x14015abb0], r13d
je 0x1400c9cc6
cmp qword [0x14015bbf8], 1
ja 0x1400c9cd6
cmp dword [0x14017e624], 1
mov byte [0x1401b6748], r13b
ja 0x1400c9cdd
mov byte [0x1401b6748], 1
lea rdx, [rsp + 0xa0]
lea rcx, [0x14017e620]
call fcn.140005518
cmp byte [rsp + 0x1c2], r13b
je 0x1400c9d1a
lea rdx, [0x140111658]
lea rcx, [rsp + 0xa0]
call fcn.1400920d4
mov byte [0x1401b6749], 1
test eax, eax
je 0x1400c9d21
mov byte [0x1401b6749], r13b
lea rax, str.CMDWNDADD
jmp 0x1400c9f69
lea rax, str.CMDWNDADD
mov qword [0x1401b6a38], rax
test dil, dil
jne 0x1400c9f79
mov byte [0x1401b6748], 1
mov word [0x1401b30c0], r13w
mov word [0x1401b62c0], r13w
mov word [0x1401b6750], r13w
mov qword [0x1401b67b8], r13
mov qword [0x1401b67d8], r13
mov qword [0x1401b67d0], r13
mov qword [0x1401b67c8], r13
mov qword [0x1401b67c0], r13
mov byte [0x1401b67b4], r13b
mov byte [0x1401b67b5], r13b
mov dword [0x1401b674c], r13d
call fcn.1400f9ebc
mov dword [0x1401b30bc], eax
mov qword [0x1401b30b0], r13
mov word [0x1401b67e0], r13w
mov qword [0x1401b6740], r13
call fcn.140048b6c
mov byte [0x1401b67b7], r13b
mov byte [0x1401b6a40], r13b
call fcn.1400c6db4
movzx r8d, al
lea rdx, str.SystemProgressBar
lea rcx, [0x140111db8]
call fcn.1400a0584
test eax, eax
setne byte [0x1401b674a]
call fcn.14006c97c
cmp eax, 0x601
lea rdx, str.TaskbarProgressBar
mov r8d, r13d
lea rcx, [0x140111db8]
setae r8b
call fcn.1400a0584
test eax, eax
setne byte [0x1401b674b]
cmp dword [0x1401b30b8], 2
ja 0x1400c9e43
mov eax, dword [0x14015abb0]
neg eax
mov qword [0x14015bc00], r13
sbb rcx, rcx
and qword [0x14015bc18], rcx
mov rdx, qword [0x1401b6a38]
mov r8, rbp
mov rcx, qword [0x14018fc30]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, qword [0x14018fc30]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, qword [0x14018fc30]
mov rdx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movsxd rbx, eax
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rsi, rax
call fcn.1400f45d0
cmp dword [0x14015abb0], 1
je 0x1400c9f85
mov rcx, qword [0x14015bc78]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400c9f85
mov bl, r13b
jmp 0x1400c9fb4
mov ecx, 0x672
jmp 0x1400c9c33
sub ecx, 8
je 0x1400c9f38
sub ecx, 1
je 0x1400c9f2f
sub ecx, 1
je 0x1400c9f0e
sub ecx, 1
je 0x1400c9f04
sub ecx, 1
je 0x1400c9efa
cmp ecx, 1
jne 0x1400c9f70
lea rax, str.CMDWNDBENCH
jmp 0x1400c9f69
mov ecx, 0x556
jmp 0x1400c9c33
mov ecx, 0x543
jmp 0x1400c9c33
mov ecx, 0x50b
call fcn.140088ebc
mov rdx, rax
mov r8, rsi
mov rcx, rbx
call fcn.14008eff0
lea rax, str.CMDWNDCONVERT
jmp 0x1400c9f69
lea rax, str.CMDWNDFIND
jmp 0x1400c9f69
mov rcx, r14
call fcn.140079c5c
mov ecx, 0x216
mov rbx, rax
call fcn.140088ebc
mov r9, rbx
lea rcx, [0x1401b50c0]
mov r8, rax
mov rdx, rsi
call fcn.140002694
lea rax, str.CMDWNDOTHER
mov qword [0x1401b6a38], rax
test dil, dil
je 0x1400c9d4b
call fcn.1400cb8b4
xor al, al
jmp 0x1400ca1f4
mov ecx, dword [rsi]
mov edx, 0xffff0000
mov eax, ecx
mov bl, 1
and eax, edx
cmp eax, edx
jne 0x1400c9fa6
and dword [rsi + 0xc], 0x3ff5f7ff
or dword [rsi + 0xc], 0x800a0800
jmp 0x1400c9fb4
and ecx, 0x3ff5f7ff
or ecx, 0x800a0800
mov dword [rsi], ecx
mov r8, qword [0x14015bc78]
lea r9, [fcn.1400c8d50]
mov rcx, qword [0x14018fc30]
test r15, r15
mov rdx, rsi
mov qword [rsp + 0x20], r13
cmovne r9, r15
cmp dword [0x14015abb0], 1
cmove r8, r13
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov qword [0x14015cc90], rax
test bl, bl
je 0x1400ca040
mov dl, 1
lea rcx, [0x1401836b0]
call fcn.1400aa9c0
mov rcx, qword [0x14015cc90]
mov edi, 0x80
mov edx, edi
mov r9, rax
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
lea rcx, [0x1401836b0]
call fcn.1400aa9c0
mov rcx, qword [0x14015cc90]
lea r8d, [rdi - 0x7f]
mov r9, rax
mov edx, edi
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1401b30b8], 8
jne 0x1400ca108
cmp dword [0x14016d8dc], r13d
jne 0x1400ca108
cmp word [0x1401687a8], r13w
lea rdi, str.___s
je 0x1400ca0ad
lea rcx, [0x1401687a8]
call fcn.140079c5c
mov rcx, rax
movzx eax, word [rax]
cmp ax, word [0x1401157d8]
jne 0x1400ca098
movzx eax, word [rcx + 2]
mov ecx, 0x215
cmp ax, word [0x1401157da]
je 0x1400ca09d
mov ecx, 0x214
call fcn.140088ebc
mov rdx, rax
mov rcx, rdi
call fcn.1400c8668
cmp word [0x14016a7ae], r13w
je 0x1400ca0cc
mov ecx, 0x213
call fcn.140088ebc
mov rdx, rax
mov rcx, rdi
call fcn.1400c8668
cmp dword [0x14016d8d8], r13d
je 0x1400ca0ea
mov ecx, 0x218
call fcn.140088ebc
mov rdx, rax
mov rcx, rdi
call fcn.1400c8668
cmp byte [0x14016dbc0], r13b
je 0x1400ca108
mov ecx, 0x217
call fcn.140088ebc
mov rdx, rax
mov rcx, rdi
call fcn.1400c8668
test r12b, r12b
je 0x1400ca128
mov rcx, qword [0x14015cc90]
mov edx, 0x111
xor r9d, r9d
lea r8d, [rdx - 0x69]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400ca159
test bl, bl
je 0x1400ca14a
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [rsp + 0x6c], 1
je 0x1400ca14a
movzx eax, word [rsp + 0x70]
neg ax
sbb ecx, ecx
and ebp, ecx
mov rcx, qword [0x14015cc90]
mov edx, ebp
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x1401b30b8], 2
ja 0x1400ca1ae
mov rcx, qword [0x14015cc90]
mov ebx, 0xa6
mov edx, ebx
mov r8, r14
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rcx, qword [0x14015cc90]
mov edx, ebx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call fcn.14004572c
mov r8d, 0x800
lea rcx, [0x1401b40c0]
mov rdx, r14
call fcn.14008eff0
cmp word [0x1401b50c0], r13w
jne 0x1400ca1d2
mov rcx, qword [0x14015cc90]
lea rdx, [0x1401b50c0]
mov r8d, 0x880
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp qword [0x14015cc90], r13
je 0x1400c9f7e
call fcn.1400cb8b4
cmp dword [0x1401b30b8], r13d
jne 0x1400ca1f2
call fcn.1400cbbd8
mov al, 1
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400f3220
mov rbx, qword [rsp + 0x300]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret