Function at 0x140050c54
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xa8
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov rsi, rcx
lea r15, [rcx + 0x1c0]
xor r13d, r13d
mov qword [r15], r13
mov r14, qword [0x140111ae8]
mov rax, r14
neg rax
sbb edi, edi
not edi
mov ebx, 0x80004005
and edi, ebx
test r14, r14
je 0x140050cb3
lea edx, [r13 + 1]
mov rcx, r14
call fcn.140060e0c
test eax, eax
cmove edi, ebx
mov r12d, 0x80004002
test edi, edi
js 0x14005105e
lea rcx, [rsi + 0x10]
lea rdx, str._0_9_
call fcn.14005be44
test eax, eax
cmovne edi, ebx
test edi, edi
js 0x14005105e
lea rcx, [rsi + 0x80]
lea rdx, str._a_zA_Z__
call fcn.14005be44
test eax, eax
cmovne edi, ebx
test edi, edi
js 0x14005105e
lea rcx, [rsi + 0xb8]
lea rdx, str.__n_r
call fcn.14005be44
test eax, eax
cmovne edi, ebx
test edi, edi
js 0x14005105e
lea rcx, [rsi + 0x48]
lea rdx, str._sxmlns:_a_zA_Z___s_s_____________s_a_zA_Z_:
call fcn.14005be44
test eax, eax
cmovne edi, ebx
test edi, edi
js 0x14005105e
lea rcx, [rsi + 0xf0]
lea rdx, str.___semantics____
call fcn.14005be44
test eax, eax
cmovne edi, ebx
test edi, edi
js 0x14005105e
mov r12, r13
mov rbx, r13
lea r8, [0x1400f20a0]
mov edx, 0xc352
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov ecx, 0x80004005
cmove edi, ecx
test edi, edi
js 0x140050d99
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
jne 0x140050d9e
mov edi, 0x80004005
test edi, edi
js 0x140050db3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test rax, rax
jne 0x140050db8
mov edi, 0x80004005
test edi, edi
js 0x140051058
mov rdx, r12
lea rcx, [rbp + 0x7f]
call fcn.14005c484
nop
lea rbx, [rsi + 0x128]
mov r8b, 1
mov edx, 0xbb8
mov rcx, rbx
call fcn.14001ffb8
lea rax, [rbp + 0x77]
mov qword [rbp + 0x67], rax
mov rcx, qword [rbp + 0x7f]
add rcx, 0xffffffffffffffe8
call fcn.14005eab4
add rax, 0x18
mov qword [rbp + 0x77], rax
mov r8, rbx
lea rdx, [rbp + 0x77]
mov rcx, rsi
call fcn.1400523d4
nop
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140050e36
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400739fa.0]
mov r12, r13
mov rbx, r13
lea r8, [0x1400f20a0]
mov edx, 0xc351
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r13, rax
test rax, rax
mov eax, 0x80004005
cmove edi, eax
test edi, edi
js 0x140050e7c
mov rdx, r13
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
jne 0x140050e7e
mov eax, 0x80004005
mov edi, eax
test edi, edi
js 0x140050e93
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test rax, rax
jne 0x140050e98
mov edi, 0x80004005
test edi, edi
js 0x140051055
mov rdx, r13
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
lea r9, [0x140109e80]
mov rdx, r12
lea rcx, [rbp - 0x31]
call fcn.14005e8ec
nop
lea rbx, [rsi + 0x170]
mov r8b, 1
mov edx, 0x64
mov rcx, rbx
call fcn.14001ffb8
lea rax, [rbp - 0x59]
mov qword [rbp - 0x21], rax
mov rdi, qword [rbp - 0x31]
lea rcx, [rdi - 0x18]
call fcn.14005eab4
add rax, 0x18
mov qword [rbp - 0x59], rax
mov r8, rbx
lea rdx, [rbp - 0x59]
mov rcx, rsi
call fcn.1400523d4
nop
or eax, 0xffffffff
lock xadd dword [rdi - 8], eax
xor r13d, r13d
sub eax, 1
jg 0x140050f31
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
mov rax, qword [rax + 8]
call qword [case.0x1400739fa.0]
lea rbx, [rsi + 0x1b8]
mov qword [rsp + 0x20], rbx
lea r9, [0x1400f1940]
xor edx, edx
lea r8d, [rdx + 7]
lea rcx, [0x1400edd38]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test eax, eax
js 0x140051058
mov rcx, qword [rbx]
mov qword [rbp + 0x67], r13
test rcx, rcx
je 0x140050f85
mov rdx, qword [rcx]
mov rax, qword [rdx]
lea r8, [rbp + 0x67]
lea rdx, [0x1400f1950]
call qword [case.0x1400739fa.0]
nop
lea rcx, str.SelectionLanguage
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp - 0x19], rax
test rax, rax
je 0x140051114
mov word [rbp - 0x49], r13w
lea rcx, [rbp - 0x49]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, 8
mov word [rbp - 0x49], ax
lea rcx, str.XPath
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp - 0x41], rax
test rax, rax
je 0x14005111f
mov rcx, qword [rbp + 0x67]
test rcx, rcx
je 0x140051008
movups xmm0, xmmword [rbp - 0x49]
movaps xmmword [rbp - 9], xmm0
movsd xmm1, qword [rbp - 0x39]
movsd qword [rbp + 7], xmm1
mov rax, qword [rcx]
lea r8, [rbp - 9]
mov rdx, rbx
mov rax, qword [rax + 0x280]
call qword [case.0x1400739fa.0]
mov edi, eax
lea rcx, [rbp - 0x49]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rbp + 0x67]
test rcx, rcx
je 0x140051034
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400739fa.0]
nop
test edi, edi
js 0x140051058
mov rcx, r15
call fcn.14005de54
mov edi, eax
mov r12d, 0x80004002
test eax, eax
js 0x14005105e
cmp qword [r15], r13
cmove edi, r12d
jmp 0x14005105e
xor r13d, r13d
mov r12d, 0x80004002
mov qword [rbp + 0x6f], r13
test edi, edi
js 0x1400510e0
mov rcx, qword [r15]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400739fa.0]
mov rcx, qword [r15]
mov rax, qword [rcx]
lea r8, [rbp + 0x6f]
lea rdx, [0x1400f2cc0]
mov rax, qword [rax]
call qword [case.0x1400739fa.0]
mov edi, eax
test eax, eax
js 0x1400510e0
mov rdx, qword [rbp + 0x6f]
test rdx, rdx
cmove edi, r12d
test edi, edi
js 0x1400510e0
lea rbx, [rsi + 0x1c8]
test rdx, rdx
je 0x1400510db
test rbx, rbx
je 0x1400510db
mov qword [rbp - 0x51], r13
lea r8, [rbp - 0x51]
call fcn.1400626cc
mov edi, eax
test eax, eax
js 0x1400510e0
mov rax, qword [rbp - 0x51]
add rax, 0xd8
mov qword [rbx], rax
mov edi, r13d
jmp 0x1400510e0
mov edi, 0x80070057
mov dword [rsi + 0x1d0], r13d
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x1400510fe
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400739fa.0]
nop
mov eax, edi
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x8007000e
call fcn.1400160a0
nop
mov eax, 0xa
mov word [rbp - 0x49], ax
mov ecx, 0x8007000e
mov dword [rbp - 0x41], ecx
call fcn.1400160a0
int3