Function at 0x1400b9a04
Capabilities:
Extract resource via kernel32 functions
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1240
call fcn.1400fe810
sub rsp, rax
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x1230], rax
xor r14d, r14d
mov r12, r9
mov r13b, r8b
cmp qword [0x1401561c8], r14
mov rbp, rdx
mov word [0x140187f80], r14w
setne sil
cmp sil, r14b
jne 0x1400b9a7c
mov byte [0x14018775c], r14b
mov byte [0x1401876f7], r14b
mov byte [0x1401876f2], r14b
mov dword [0x14018798c], ecx
mov word [0x140187e80], r14w
jmp 0x1400b9a82
mov ecx, dword [0x14018798c]
cmp ecx, 7
mov r15d, 0x880
lea rbx, [0x140187f80]
jg 0x1400b9db1
je 0x1400b9d9f
cmp ecx, r14d
je 0x1400b9bea
jle 0x1400b9e19
cmp ecx, 2
jle 0x1400b9b37
cmp ecx, 3
je 0x1400b9afe
cmp ecx, 4
je 0x1400b9aef
cmp ecx, 5
je 0x1400b9ad5
cmp ecx, 6
jne 0x1400b9e19
mov ecx, 0x672
jmp 0x1400b9ada
mov ecx, 0x223
call fcn.14005fad8
mov r8, r15
mov rcx, rbx
mov rdx, rax
call fcn.140065d00
jmp 0x1400b9b24
mov rcx, rdx
call fcn.140050ce8
mov ecx, 0x212
jmp 0x1400b9b0b
mov rcx, rdx
call fcn.140050ce8
mov ecx, 0x211
mov rdi, rax
call fcn.14005fad8
mov r9, rdi
mov rdx, r15
mov rcx, rbx
mov r8, rax
call fcn.1400e0c0c
lea rdx, str.CMDWNDOTHER
mov qword [0x1401876f8], rdx
jmp 0x1400b9e19
mov rcx, rdx
call fcn.140050ce8
cmp dword [0x14018798c], 1
mov ecx, r14d
setne cl
mov rdi, rax
add ecx, 0x20f
call fcn.14005fad8
mov r9, rdi
mov rdx, r15
mov r8, rax
mov rcx, rbx
call fcn.1400e0c0c
cmp sil, r14b
jne 0x1400b9bde
cmp dword [0x1401571f0], r14d
je 0x1400b9b83
cmp qword [0x140157280], 1
ja 0x1400b9baf
cmp dword [0x140164e74], r14d
je 0x1400b9baf
lea rcx, [0x140164e70]
call fcn.1400785a0
cmp eax, r14d
jne 0x1400b9ba6
cmp dword [0x140164e74], 1
je 0x1400b9baf
mov byte [0x14018775c], r14b
jmp 0x1400b9bb6
mov byte [0x14018775c], 1
lea rcx, [0x140164e70]
call fcn.1400785a0
cmp eax, r14d
je 0x1400b9bd7
mov byte [0x1401876f7], 1
cmp dword [0x140164e74], r14d
jne 0x1400b9bde
mov byte [0x1401876f7], r14b
lea rax, str.CMDWNDADD
jmp 0x1400b9e12
lea rax, str.CMDWNDADD
mov qword [0x1401876f8], rax
cmp sil, r14b
jne 0x1400b9e22
mov byte [0x14018775c], 1
mov word [0x140189080], r14w
mov word [0x140187a80], r14w
mov word [0x140187990], r14w
mov qword [0x140187980], r14
mov qword [0x140187960], r14
mov qword [0x140187968], r14
mov qword [0x140187970], r14
mov qword [0x140187978], r14
mov byte [0x1401876f4], r14b
mov byte [0x1401876f3], r14b
mov dword [0x140187758], r14d
call fcn.1400ee424
mov qword [0x14018a080], r14
mov word [0x140187760], r14w
mov qword [0x1401879f8], r14
mov dword [0x140187988], eax
call fcn.140097074
mov byte [0x1401876f1], r14b
mov byte [0x1401876f0], r14b
call fcn.1400b599c
lea rdx, str.SystemProgressBar
lea rcx, [0x14010f618]
movzx r8d, al
call fcn.14009b908
cmp eax, r14d
setne byte [0x1401876f6]
call fcn.140044e44
mov r8d, r14d
cmp eax, 0x601
lea rdx, str.TaskbarProgressBar
lea rcx, [0x14010f618]
setae r8b
call fcn.14009b908
cmp eax, r14d
mov eax, dword [0x14018798c]
setne byte [0x1401876f5]
cmp eax, r14d
je 0x1400b9cf5
cmp eax, 1
je 0x1400b9cf5
cmp eax, 2
jne 0x1400b9d15
mov eax, dword [0x1401571f0]
mov qword [0x1401582b8], r14
neg eax
sbb rcx, rcx
and rcx, qword [0x140157278]
mov qword [0x140157278], rcx
mov rdx, qword [0x1401876f8]
mov rcx, qword [0x140149f18]
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, qword [0x140149f18]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, qword [0x140149f18]
mov rdx, rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
xor ecx, ecx
movsxd rdi, eax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r8, rdi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.1400e9de0
cmp dword [0x1401571f0], 1
je 0x1400b9e2e
mov rcx, qword [0x140158350]
call qword [sym.imp.USER32.dll_IsWindowVisible]
cmp eax, r14d
je 0x1400b9e2e
mov dil, r14b
jmp 0x1400b9e5e
mov rcx, rdx
call fcn.140050ce8
mov ecx, 0x216
jmp 0x1400b9b0b
sub ecx, 8
je 0x1400b9e0b
sub ecx, 1
je 0x1400b9de7
sub ecx, 1
je 0x1400b9ddd
sub ecx, 1
je 0x1400b9dd3
cmp ecx, 1
jne 0x1400b9e19
lea rax, str.CMDWNDBENCH
jmp 0x1400b9e12
mov ecx, 0x556
jmp 0x1400b9ada
mov ecx, 0x543
jmp 0x1400b9ada
mov ecx, 0x50b
call fcn.14005fad8
mov r8, r15
mov rcx, rbx
mov rdx, rax
call fcn.140065d00
lea rdx, str.CMDWNDCONVERT
jmp 0x1400b9b2b
lea rax, str.CMDWNDFIND
mov qword [0x1401876f8], rax
cmp sil, r14b
je 0x1400b9c08
call fcn.1400b77d8
xor al, al
jmp 0x1400ba06d
mov ecx, dword [rbx]
mov edx, 0xffff0000
mov dil, 1
mov eax, ecx
and eax, edx
cmp eax, edx
jne 0x1400b9e50
and dword [rbx + 0xc], 0x3ff5f7ff
or dword [rbx + 0xc], 0x800a0800
jmp 0x1400b9e5e
and ecx, 0x3ff5f7ff
or ecx, 0x800a0800
mov dword [rbx], ecx
mov r8, qword [0x140158350]
mov rcx, qword [0x140149f18]
cmp r12, r14
lea r9, [fcn.1400b8cd0]
mov rdx, rbx
mov qword [rsp + 0x20], r14
cmovne r9, r12
cmp dword [0x1401571f0], 1
cmove r8, r14
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov qword [0x1401561c8], rax
cmp dil, r14b
je 0x1400b9eeb
lea rcx, [0x1401679c0]
mov dl, 1
call fcn.1400a4b08
mov rcx, qword [0x1401561c8]
mov edi, 0x80
xor r8d, r8d
mov edx, edi
mov r9, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [0x1401679c0]
xor edx, edx
call fcn.1400a4b08
mov rcx, qword [0x1401561c8]
lea r8d, [rdi - 0x7f]
mov r9, rax
mov edx, edi
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x14018798c], 7
jne 0x1400b9fab
cmp dword [0x14016ec5c], r14d
jne 0x1400b9fab
lea r12, [0x1401152a8]
cmp word [0x140169b28], r14w
je 0x1400b9f50
lea rcx, [0x140169b28]
call fcn.140050ce8
lea rdi, [0x14010bbbc]
mov ecx, 2
mov rsi, rax
repe cmpsw word [rsi], word [rdi]
mov ecx, 0x215
je 0x1400b9f40
mov ecx, 0x214
call fcn.14005fad8
mov rcx, r12
mov rdx, rax
call fcn.1400b7148
cmp word [0x14016bb2e], r14w
je 0x1400b9f6f
mov ecx, 0x213
call fcn.14005fad8
mov rcx, r12
mov rdx, rax
call fcn.1400b7148
cmp dword [0x14016ec58], r14d
je 0x1400b9f8d
mov ecx, 0x218
call fcn.14005fad8
mov rcx, r12
mov rdx, rax
call fcn.1400b7148
cmp byte [0x14016ee08], r14b
je 0x1400b9fab
mov ecx, 0x217
call fcn.14005fad8
mov rcx, r12
mov rdx, rax
call fcn.1400b7148
mov rcx, qword [0x1401561c8]
cmp r13b, r14b
je 0x1400b9fcb
xor r9d, r9d
mov edx, 0x111
lea r8d, [r9 + 0x6e]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400b9fd6
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov edx, dword [0x14018798c]
cmp edx, r14d
je 0x1400b9ff4
cmp edx, 1
je 0x1400b9ff4
cmp edx, 2
jne 0x1400ba02a
mov ecx, 0x28a
call fcn.14005fad8
lea rcx, [rsp + 0x30]
mov r9, rbp
mov r8, rax
mov edx, 0x900
call fcn.1400e0c0c
mov rcx, qword [0x1401561c8]
lea r8, [rsp + 0x30]
mov edx, 0xa5
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp word [0x140187f80], r14w
jne 0x1400ba04b
mov rcx, qword [0x1401561c8]
lea rdx, [0x140187f80]
mov r8d, r15d
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp qword [0x1401561c8], r14
je 0x1400b9e27
call fcn.1400b77d8
cmp dword [0x14018798c], r14d
jne 0x1400ba06b
call fcn.1400b7768
mov al, 1
mov rcx, qword [rsp + 0x1230]
xor rcx, rsp
call fcn.1400e9d80
mov rbx, qword [rsp + 0x1290]
add rsp, 0x1240
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret