Function at 0x1400d8f70
Capabilities:
Extract resource via kernel32 functions
Get graphical window text

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2d8
mov rax, qword [0x14016a900]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov rax, qword [0x140172488]
xor r12d, r12d
test rax, rax
mov word [0x1401d45b0], r12w
mov r14, r9
mov r15b, r8b
setne dil
mov rbp, rdx
mov esi, ecx
test rax, rax
jne 0x1400d8ffb
mov dl, r12b
mov byte [0x1401d25ae], r12b
mov byte [0x1401d25ad], dl
mov byte [0x1401d5c3f], r12b
mov byte [0x1401d5cd0], r12b
mov dword [0x1401d25a8], ecx
mov word [0x1401d56b0], r12w
mov byte [0x1401d25ac], r12b
mov byte [0x1401d5cd3], r12b
jmp 0x1400d9007
mov dl, byte [0x1401d25ad]
mov ecx, dword [0x1401d25a8]
mov ebx, 0x880
mov r13d, 1
cmp ecx, 7
jg 0x1400d9167
je 0x1400d915d
test ecx, ecx
je 0x1400d9141
sub ecx, r13d
je 0x1400d9097
sub ecx, r13d
je 0x1400d9097
sub ecx, r13d
je 0x1400d9085
sub ecx, r13d
je 0x1400d9073
sub ecx, r13d
je 0x1400d906c
cmp ecx, r13d
jne 0x1400d921c
mov ecx, 0x223
call fcn.140096d58
mov rdx, rax
lea rcx, [0x1401d45b0]
mov r8, rbx
call fcn.14009ccc8
jmp 0x1400d920e
mov ecx, 0x24e
jmp 0x1400d9050
mov rcx, rbp
call fcn.1400876ec
mov ecx, 0x212
jmp 0x1400d91ef
mov rcx, rbp
call fcn.1400876ec
mov ecx, 0x211
jmp 0x1400d91ef
mov rcx, rbp
call fcn.1400876ec
cmp dword [0x1401d25a8], r13d
mov ecx, r12d
mov rbx, rax
setne cl
add ecx, 0x20f
call fcn.140096d58
mov r9, rbx
lea rcx, [0x1401d45b0]
mov r8, rax
mov edx, 0x880
call fcn.1400027fc
test dil, dil
jne 0x1400d9151
cmp dword [0x1401724a4], r12d
je 0x1400d90e8
cmp qword [0x1401734e8], r13
ja 0x1400d90f4
cmp dword [0x14019de44], r13d
mov al, r12b
ja 0x1400d90f7
mov al, r13b
lea rdx, [rsp + 0xc0]
mov byte [0x1401d25ad], al
lea rcx, [0x14019de40]
call fcn.140006c54
cmp byte [rsp + 0x1e2], r12b
je 0x1400d9136
lea rdx, [0x14012b208]
lea rcx, [rsp + 0xc0]
call fcn.14009fdf0
test eax, eax
mov al, r13b
je 0x1400d9139
mov al, r12b
mov byte [0x1401d25ae], al
jmp 0x1400d9151
test dil, dil
movzx eax, dl
cmove eax, r13d
mov byte [0x1401d25ad], al
lea rax, str.CMDWNDADD
jmp 0x1400d9215
mov ecx, 0x672
jmp 0x1400d9050
sub ecx, 8
je 0x1400d91e2
sub ecx, r13d
je 0x1400d91d9
sub ecx, r13d
je 0x1400d91b4
sub ecx, r13d
je 0x1400d91aa
sub ecx, r13d
je 0x1400d91a0
sub ecx, r13d
je 0x1400d9197
cmp ecx, r13d
jne 0x1400d921c
lea rax, str.CMDWNDREAD
jmp 0x1400d9215
lea rax, str.CMDWNDBENCH
jmp 0x1400d9215
mov ecx, 0x556
jmp 0x1400d9050
mov ecx, 0x543
jmp 0x1400d9050
mov ecx, 0x50b
call fcn.140096d58
mov rdx, rax
lea rcx, [0x1401d45b0]
mov r8, rbx
call fcn.14009ccc8
lea rax, str.CMDWNDCONVERT
jmp 0x1400d9215
lea rax, str.CMDWNDFIND
jmp 0x1400d9215
mov rcx, rbp
call fcn.1400876ec
mov ecx, 0x216
mov rbx, rax
call fcn.140096d58
mov r9, rbx
lea rcx, [0x1401d45b0]
mov r8, rax
mov edx, 0x880
call fcn.1400027fc
lea rax, str.CMDWNDOTHER
mov qword [0x1401d5f38], rax
test dil, dil
je 0x1400d922d
call fcn.1400dad9c
xor al, al
jmp 0x1400d96d4
call fcn.1400d5b28
test al, al
je 0x1400d9276
mov rcx, rbp
mov dword [rsp + 0x30], esi
call fcn.140111acc
mov rcx, qword [0x140172470]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov edx, 0x800f
mov byte [rsp + 0x40], r15b
mov qword [rsp + 0x48], r14
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
setne al
jmp 0x1400d96d4
mov word [0x1401d25b0], r12w
mov word [0x1401d57b0], r12w
mov word [0x1401d5c40], r12w
mov qword [0x1401d5ca8], r12
mov qword [0x1401d5cc8], r12
mov qword [0x1401d5cc0], r12
mov qword [0x1401d5cb8], r12
mov qword [0x1401d5cb0], r12
mov byte [0x1401d5c3d], r12b
mov byte [0x1401d5c3e], r12b
mov dword [0x1401d5ca4], r12d
call fcn.1401109e4
mov dword [0x1401d5c38], eax
mov qword [0x1401d25a0], r12
mov word [0x1401d5ce0], r12w
mov qword [0x1401d5c30], r12
call fcn.1400559c4
mov byte [0x1401d5cd1], r12b
mov byte [0x1401d5cd2], r12b
call fcn.1400d5b7c
movzx r8d, al
lea rdx, str.SystemProgressBar
lea rcx, [0x14012b730]
call fcn.1400add30
test eax, eax
setne byte [0x1401d25af]
call fcn.14007a19c
cmp eax, 0x601
lea rdx, str.TaskbarProgressBar
mov r8d, r12d
lea rcx, [0x14012b730]
setae r8b
call fcn.1400add30
test eax, eax
setne byte [0x1401d5c3c]
cmp dword [0x1401d25a8], 2
ja 0x1400d936e
mov eax, dword [0x1401724a4]
neg eax
mov qword [0x1401734f0], r12
sbb rcx, rcx
and qword [0x140173508], rcx
mov rdx, qword [0x1401d5f38]
mov r8d, 5
mov rcx, qword [0x1401af2d0]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, qword [0x1401af2d0]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, qword [0x1401af2d0]
mov rdx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movsxd rbx, eax
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rsi, rax
call fcn.140106ff0
cmp dword [0x1401724a4], r13d
je 0x1400d93ec
mov rcx, qword [0x140172470]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400d93ec
mov dil, r12b
jmp 0x1400d9427
cmp dword [0x1401d25a8], 0xe
mov dil, r13b
je 0x1400d9427
mov ecx, dword [rsi]
mov edx, 0xffff0000
mov eax, ecx
and eax, edx
cmp eax, edx
jne 0x1400d9419
mov eax, dword [rsi + 0xc]
and eax, 0x3ff5f7ff
or eax, 0x800a0800
mov dword [rsi + 0xc], eax
jmp 0x1400d9427
and ecx, 0x3ff5f7ff
or ecx, 0x800a0800
mov dword [rsi], ecx
mov r8, qword [0x140172470]
lea r9, [fcn.1400d7de0]
mov rcx, qword [0x1401af2d0]
test r14, r14
mov rdx, rsi
mov qword [rsp + 0x20], r12
cmovne r9, r14
cmp dword [0x1401724a4], r13d
cmove r8, r12
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov qword [0x140172488], rax
test dil, dil
je 0x1400d94b4
mov dl, r13b
lea rcx, [0x1401a2f60]
call fcn.1400b88d4
mov rcx, qword [0x140172488]
mov ebx, 0x80
mov edx, ebx
mov r9, rax
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
lea rcx, [0x1401a2f60]
call fcn.1400b88d4
mov rcx, qword [0x140172488]
mov r9, rax
mov r8, r13
mov edx, ebx
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1401d25a8], 0xe
jne 0x1400d94ec
mov rcx, qword [0x140172488]
xor r8d, r8d
mov edx, 0x9a
call fcn.14001094c
mov rcx, qword [0x140172488]
xor r8d, r8d
mov edx, 0xa3
call fcn.14001094c
mov byte [0x1401d5cd0], r13b
cmp dword [0x1401d25a8], 8
jne 0x1400d95af
cmp dword [0x140188060], r12d
jne 0x1400d95af
cmp word [0x140181f28], r12w
lea rbx, str.___s
je 0x1400d9554
lea rcx, [0x140181f28]
call fcn.1400876ec
cmp word [rax], 0x2d
jne 0x1400d9535
cmp word [rax + 2], r12w
jne 0x1400d9535
mov eax, r12d
jmp 0x1400d953a
sbb eax, eax
or eax, r13d
neg eax
sbb ecx, ecx
add ecx, 0x215
call fcn.140096d58
mov rdx, rax
mov rcx, rbx
call fcn.1400d7624
cmp word [0x140183f2e], r12w
je 0x1400d9573
mov ecx, 0x213
call fcn.140096d58
mov rdx, rax
mov rcx, rbx
call fcn.1400d7624
cmp dword [0x14018805c], r12d
je 0x1400d9591
mov ecx, 0x218
call fcn.140096d58
mov rdx, rax
mov rcx, rbx
call fcn.1400d7624
cmp byte [0x140188348], r12b
je 0x1400d95af
mov ecx, 0x217
call fcn.140096d58
mov rdx, rax
mov rcx, rbx
call fcn.1400d7624
test r15b, r15b
je 0x1400d95cf
mov rcx, qword [0x140172488]
mov edx, 0x111
xor r9d, r9d
lea r8d, [rdx - 0x69]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400d9617
mov eax, dword [0x1401d25a8]
sub eax, 0xe
neg eax
sbb ebx, ebx
and ebx, 5
test dil, dil
je 0x1400d9608
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [rsp + 0x8c], r13b
je 0x1400d9608
movzx eax, word [rsp + 0x90]
neg ax
sbb ecx, ecx
and ebx, ecx
mov rcx, qword [0x140172488]
mov edx, ebx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [0x1401d25a8]
cmp eax, 2
jbe 0x1400d9630
cmp eax, 0xe
jne 0x1400d9673
mov rcx, qword [0x140172488]
mov ebx, 0xa6
mov edx, ebx
mov r8, rbp
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rcx, qword [0x140172488]
mov edx, ebx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call fcn.1400b7074
mov r8d, 0x800
lea rcx, [0x1401d35b0]
mov rdx, rbp
call fcn.14009ccc8
cmp word [0x1401d45b0], r12w
jne 0x1400d9697
mov rcx, qword [0x140172488]
lea rdx, [0x1401d45b0]
mov r8d, 0x880
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp qword [0x140172488], r12
je 0x1400d9226
call fcn.1400dad9c
mov ecx, dword [0x1401d25a8]
cmp ecx, 0xe
je 0x1400d96c8
mov rcx, qword [0x140172488]
xor edx, edx
call fcn.1400d75b8
mov ecx, dword [0x1401d25a8]
test ecx, ecx
jne 0x1400d96d1
call fcn.1400db0dc
mov al, r13b
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.140105c50
add rsp, 0x2d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret