Function at 0x500d00
Capabilities:
Extract resource via kernel32 functions
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x21c]
sub esp, 0x21c
push 0xffffffffffffffff
push 0x554403
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x58cb30]
xor eax, ebp
mov dword [ebp + 0x218], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x5943e8]
test eax, eax
mov ebx, dword [ebp + 0x228]
mov edi, dword [ebp + 0x230]
setne cl
xor edx, edx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], edi
mov byte [ebp - 0xd], cl
mov word [0x5f8450], dx
test eax, eax
jne 0x500d9d
mov eax, dword [ebp + 0x224]
mov byte [0x5f9a51], dl
mov byte [0x5f9a52], dl
mov byte [0x5f9a9f], dl
mov byte [0x5f9b30], dl
mov dword [0x5f644c], eax
mov word [0x5f9550], dx
mov byte [0x5f9a50], dl
mov byte [0x5f9b33], dl
jmp 0x500da2
mov eax, dword [0x5f644c]
cmp eax, 0xe
ja case.default.0x500dab
jmp dword [eax*4 + 0x50155c]
test cl, cl
jne 0x500f22
mov byte [0x5f9a51], 1
mov dword [0x5f9d60], 0x56c10c
jmp case.default.0x500dab
push ebx
call fcn.004a3770
xor ecx, ecx
mov esi, eax
cmp dword [0x5f644c], 1
setne cl
add ecx, 0x20f
push ecx
call fcn.004b7300
push esi
push eax
push 0x880
push 0x5f8450
call fcn.00404ce0
add esp, 0x10
cmp byte [ebp - 0xd], 0
jne 0x500f22
cmp dword [0x5943f8], 0
mov eax, dword [0x5c3bd4]
je 0x500e25
cmp dword [0x59542c], 1
ja 0x500e32
test eax, eax
je 0x500e32
cmp eax, 1
je 0x500e32
xor al, al
jmp 0x500e34
mov al, 1
mov byte [0x5f9a51], al
xor eax, eax
mov dword [ebp + 0x124], 0
mov dword [ebp + 0x134], 0
mov dword [ebp + 0x138], 0
mov dword [ebp + 0x134], 0
mov dword [ebp + 0x138], 7
mov word [ebp + 0x124], ax
mov dword [ebp - 4], eax
mov dword [ebp + 0x140], eax
mov dword [ebp + 0x144], eax
mov dword [ebp - 4], 2
lea eax, [ebp]
push eax
mov ecx, 0x5c3bd0
call fcn.0040a200
cmp byte [ebp + 0x148], 0
je 0x500eb7
push 0x5589e8
lea eax, [ebp]
push eax
call fcn.004c1ba0
test eax, eax
jne 0x500eb7
mov al, 1
jmp 0x500eb9
xor al, al
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x138]
mov byte [0x5f9a52], al
cmp ecx, 8
jb 0x500f05
mov edx, dword [ebp + 0x124]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x500efb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x501557
push ecx
push edx
call fcn.0053000d
add esp, 8
xor eax, eax
mov dword [ebp + 0x134], 0
mov dword [ebp + 0x138], 7
mov word [ebp + 0x124], ax
mov dword [0x5f9d60], str.CMDWNDADD
jmp case.default.0x500dab
push ebx
call fcn.004a3770
push 0x211
mov esi, eax
call fcn.004b7300
push esi
push eax
push 0x880
push 0x5f8450
call fcn.00404ce0
add esp, 0x10
mov dword [0x5f9d60], 0x56c120
jmp case.default.0x500dab
push ebx
call fcn.004a3770
push 0x212
jmp 0x500f3c
push 0x880
push 0x24e
call fcn.004b7300
push eax
push 0x5f8450
call fcn.004bdae0
mov dword [0x5f9d60], 0x56c120
jmp case.default.0x500dab
push ebx
call fcn.004a3770
push 0x216
jmp 0x500f3c
push 0x880
push 0x223
jmp 0x500f7d
push 0x880
push 0x672
jmp 0x500f7d
push 0x880
push 0x50b
call fcn.004b7300
push eax
push 0x5f8450
call fcn.004bdae0
mov dword [0x5f9d60], 0x56c138
jmp case.default.0x500dab
mov dword [0x5f9d60], str.CMDWNDFIND
jmp case.default.0x500dab
push 0x880
push 0x543
jmp 0x500f7d
push 0x880
push 0x556
jmp 0x500f7d
mov dword [0x5f9d60], str.CMDWNDBENCH
jmp case.default.0x500dab
mov dword [0x5f9d60], str.CMDWNDREAD
cmp byte [ebp - 0xd], 0
je 0x501039
call fcn.00502c50
xor al, al
jmp 0x501532
call fcn.004fd510
test al, al
je 0x501084
mov eax, dword [ebp + 0x224]
push ebx
mov dword [ebp - 0x28], eax
call fcn.00538fcb
add esp, 4
mov dword [ebp - 0x24], eax
mov al, byte [ebp + 0x22c]
mov byte [ebp - 0x20], al
lea eax, [ebp - 0x28]
mov dword [ebp - 0x1c], edi
push eax
push 0
push 0x800f
push dword [0x5933dc]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
setne al
jmp 0x501532
xor eax, eax
mov word [0x5f6450], ax
mov word [0x5f9650], ax
mov word [0x5f9aa0], ax
mov dword [0x5f9b08], eax
mov dword [0x5f9b0c], eax
mov dword [0x5f9b28], eax
mov dword [0x5f9b2c], eax
mov dword [0x5f9b20], eax
mov dword [0x5f9b24], eax
mov dword [0x5f9b18], eax
mov dword [0x5f9b1c], eax
mov dword [0x5f9b10], eax
mov dword [0x5f9b14], eax
mov byte [0x5f9a9d], al
mov byte [0x5f9a9e], al
mov dword [0x5f9b04], eax
call fcn.00538625
mov dword [0x5f9a98], eax
xor eax, eax
mov dword [0x5f6448], 0
mov word [0x5f9b38], ax
mov dword [0x5f9a54], eax
call fcn.00467de0
mov byte [0x5f9b31], 0
mov byte [0x5f9b32], 0
call fcn.004fd560
movzx eax, al
push eax
push str.SystemProgressBar
push 0x558f04
call fcn.004cffa0
test eax, eax
setne byte [0x5f9a53]
call fcn.00495f30
cmp eax, 0x601
sbb eax, eax
inc eax
push eax
push str.TaskbarProgressBar
push 0x558f04
call fcn.004cffa0
test eax, eax
mov eax, dword [0x5f644c]
setne byte [0x5f9a9c]
test eax, eax
je 0x501167
cmp eax, 1
je 0x501167
cmp eax, 2
jne 0x501198
cmp dword [0x5943f8], 0
mov dword [0x595430], 0
mov dword [0x595434], 0
jne 0x501198
mov dword [0x595448], 0
mov dword [0x59544c], 0
push 5
push dword [0x5f9d60]
push dword [0x5d3758]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push dword [0x5d3758]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [0x5d3758]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebx
mov edi, eax
push esi
push edi
call fcn.00531d40
add esp, 0xc
cmp dword [0x5943f8], 1
je 0x501208
push dword [0x5933dc]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x501208
xor bl, bl
jmp 0x501243
cmp dword [0x5f644c], 0xe
mov bl, 1
je 0x501243
mov ecx, dword [edi]
mov eax, ecx
and eax, 0xffff0000
cmp eax, 0xffff0000
jne 0x501235
mov eax, dword [edi + 0xc]
and eax, 0x3ff5f7ff
or eax, 0x800a0800
mov dword [edi + 0xc], eax
jmp 0x501243
and ecx, 0x3ff5f7ff
or ecx, 0x800a0800
mov dword [edi], ecx
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x50124f
mov eax, fcn.004ffbc0
push 0
push eax
mov eax, dword [0x5943f8]
dec eax
neg eax
sbb eax, eax
and eax, dword [0x5933dc]
push eax
push edi
push dword [0x5d3758]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov dword [0x5943e8], eax
test bl, bl
je 0x5012b9
push 1
mov ecx, 0x5c8968
call fcn.004dab70
push eax
push 0
push 0x80
push dword [0x5943e8]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
mov ecx, 0x5c8968
call fcn.004dab70
push eax
push 1
push 0x80
push dword [0x5943e8]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x5f644c], 0xe
jne 0x5012ed
push 0
push 0x9a
push dword [0x5943e8]
call fcn.004134e0
push 0
push 0xa3
push dword [0x5943e8]
call fcn.004134e0
mov byte [0x5f9b30], 1
cmp dword [0x5f644c], 8
jne 0x5013cc
cmp dword [0x5abf1c], 0
jne 0x5013cc
cmp word [0x5a5ee8], 0
je 0x501368
push 0x5a5ee8
mov esi, 0x55b588
call fcn.004a3770
mov cx, word [eax]
cmp cx, word [esi]
jne 0x501346
test cx, cx
je 0x501342
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x501346
add eax, 4
add esi, 4
test cx, cx
jne 0x501320
xor eax, eax
jmp 0x50134b
sbb eax, eax
or eax, 1
neg eax
sbb eax, eax
add eax, 0x215
push eax
call fcn.004b7300
push eax
push str.___s
call fcn.004ff3f0
add esp, 8
cmp word [0x5a7eee], 0
je 0x50138a
push 0x213
call fcn.004b7300
push eax
push str.___s
call fcn.004ff3f0
add esp, 8
cmp dword [0x5abf18], 0
je 0x5013ab
push 0x218
call fcn.004b7300
push eax
push str.___s
call fcn.004ff3f0
add esp, 8
cmp byte [0x5ac1e0], 0
je 0x5013cc
push 0x217
call fcn.004b7300
push eax
push str.___s
call fcn.004ff3f0
add esp, 8
cmp byte [ebp + 0x22c], 0
je 0x5013ef
push 0
push 0xa8
push 0x111
push dword [0x5943e8]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x50142a
mov esi, dword [0x5f644c]
sub esi, 0xe
neg esi
sbb esi, esi
and esi, 5
test bl, bl
je 0x50141d
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x40], 1
je 0x50141d
movzx eax, word [ebp - 0x3c]
neg eax
sbb eax, eax
and esi, eax
push esi
push dword [0x5943e8]
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [0x5f644c]
test eax, eax
je 0x501449
cmp eax, 1
je 0x501449
cmp eax, 2
je 0x501449
cmp eax, 0xe
jne 0x501485
mov esi, dword [ebp - 0x18]
push esi
push 0xa6
push dword [0x5943e8]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0xa6
push dword [0x5943e8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call fcn.004d8ef0
push 0x800
push esi
push 0x5f7450
call fcn.004bdae0
cmp word [0x5f8450], 0
jne 0x5014a5
push 0x880
push 0x5f8450
push dword [0x5943e8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [0x5943e8], 0
je 0x501032
call fcn.00502c50
mov eax, dword [0x5f644c]
cmp eax, 0xe
je 0x5014d3
push 0
push dword [0x5943e8]
call fcn.004ff380
mov eax, dword [0x5f644c]
test eax, eax
jne 0x501530
cmp byte [0x5f9b32], al
jne 0x501530
cmp byte [0x5b12d4], al
je 0x501530
mov eax, dword [0x594400]
test eax, eax
je 0x501530
xor esi, esi
push 0xa
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x50151d
cmp byte [0x5943f6], 0
jne 0x501529
call fcn.00463b70
inc esi
cmp esi, 0x14
jae 0x501529
mov eax, dword [0x594400]
jmp 0x5014f2
push dword [0x594400]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [0x5f9b32], 1
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x218]
xor ecx, ebp
call fcn.00530218
lea esp, [ebp + 0x21c]
pop ebp
ret 0x10
call fcn.005345df
mov dl, 0xd
push eax
add al, dl
or eax, 0xdd00050
push eax
add byte [ecx], dh
invalid