Function at 0x140213cc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x1403ceac0]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov r13, rcx
xor edi, edi
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], di
mov dword [rsp + 0x40], 1
lea r8d, [rdi + 2]
lea rdx, [0x14032669c]
lea rcx, [rsp + 0x50]
call fcn.14002b640
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], di
mov rdx, qword [str.plat]
mov r15, 0xffffffffffffffff
mov r8, r15
inc r8
cmp word [rdx + r8*2], 0
jne 0x140213d53
lea rcx, [rsp + 0x70]
call fcn.14002b640
nop
lea rdx, [rsp + 0x70]
lea rcx, [r13 + 0x10]
call fcn.14004b2e0
lea rcx, [rsp + 0x50]
cmp rax, rcx
je 0x140213da0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rcx, rax
call fcn.14002b640
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140213de1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140213ddc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140214818
call fcn.140296f94
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], di
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140213e34
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140213e2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14021481e
call fcn.140296f94
lea rcx, [0x14035cb50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x140213f80
mov edx, 1
lea r8d, [rdx + 0xf]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140213f80
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140213f80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x140213f80
cmp word [rax + 4], 0
jne 0x140213f80
cmp dword [rax + 0x28], 0xfeef04bd
jne 0x140213f80
movzx r14d, word [rax + 0x32]
movzx esi, word [rax + 0x30]
movzx edi, word [rax + 0x36]
movzx ebx, word [rax + 0x34]
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x70]
call fcn.1402b60e0
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
mov r9d, r14d
lea r8, str._d._d._d._d
mov edx, 0x100
lea rcx, [rbp - 0x70]
call fcn.14003b790
test eax, eax
jns 0x140213f4f
lea rax, str.Failed_to_format_version
mov qword [rsp + 0x20], rax
mov r9d, 0xb0
lea r8, str.XMLUpdater::v2::CSubstitutionManager::GetOsVersion
lea rdx, str.E:BT0a209782_47a3_49ff_a189_59d4c06152f0WebAdvisor_XmlUpdater_srcXmlUpdaterSubstitutionManager.cpp
mov ecx, 1
call fcn.140213350
xor edi, edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], di
mov rdx, qword [str._UNKNOWN]
mov r8, r15
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], di
jne 0x140213f40
jmp 0x140213fdb
xor edi, edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], di
lea rax, [rbp - 0x70]
mov r8, r15
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], di
jne 0x140213f70
lea rdx, [rbp - 0x70]
jmp 0x140213fdb
lea rax, str.Failed_to_retrieve_kernel_verison
mov qword [rsp + 0x20], rax
mov r9d, 0xa9
lea r8, str.XMLUpdater::v2::CSubstitutionManager::GetOsVersion
lea rdx, str.E:BT0a209782_47a3_49ff_a189_59d4c06152f0WebAdvisor_XmlUpdater_srcXmlUpdaterSubstitutionManager.cpp
mov ecx, 1
call fcn.140213350
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], di
mov rdx, qword [str._UNKNOWN]
mov r8, r15
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140213fd0
lea rcx, [rsp + 0x50]
call fcn.14002b640
nop
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], di
mov rdx, qword [0x1403ce5f0]
mov r8, r15
inc r8
cmp word [rdx + r8*2], 0
jne 0x140214001
lea rcx, [rsp + 0x70]
call fcn.14002b640
nop
lea rdx, [rsp + 0x70]
lea rcx, [r13 + 0x10]
call fcn.14004b2e0
lea rcx, [rsp + 0x50]
cmp rax, rcx
je 0x14021404e
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rcx, rax
call fcn.14002b640
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14021408f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14021408a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140214824
call fcn.140296f94
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], di
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1402140e2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1402140dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14021482a
call fcn.140296f94
lea rcx, [rsp + 0x50]
call fcn.1402139d0
mov rbx, rax
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], di
mov rdx, qword [0x1403ce600]
mov r8, r15
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140214110
lea rcx, [rsp + 0x70]
call fcn.14002b640
nop
lea rdx, [rsp + 0x70]
lea rcx, [r13 + 0x10]
call fcn.14004b2e0
cmp rax, rbx
je 0x140214153
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x140214147
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.14002b640
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140214194
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14021418f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140214830
call fcn.140296f94
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], di
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1402141e7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1402141e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140214836
call fcn.140296f94
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], di
mov r8d, 1
lea rdx, [0x14034effc]
lea rcx, [rsp + 0x50]
call fcn.14002b640
nop
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], di
mov rdx, qword [0x1403ce608]
mov r8, r15
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140214230
lea rcx, [rsp + 0x70]
call fcn.14002b640
nop
lea rdx, [rsp + 0x70]
lea rcx, [r13 + 0x10]
call fcn.14004b2e0
lea rcx, [rsp + 0x50]
cmp rax, rcx
je 0x14021427d
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rcx, rax
call fcn.14002b640
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1402142be
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1402142b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14021483c
call fcn.140296f94
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], di
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140214311
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14021430c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140214842
call fcn.140296f94
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], di
mov r8d, 3
lea rdx, [0x1403263c0]
lea rcx, [rsp + 0x50]
call fcn.14002b640
nop
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], di
mov rdx, qword [str.UPDATER_VERSION]
inc r15
cmp word [rdx + r15*2], 0
jne 0x140214354
mov r8, r15
lea rcx, [rsp + 0x70]
call fcn.14002b640
nop
lea rdx, [rsp + 0x70]
lea rcx, [r13 + 0x10]
call fcn.14004b2e0
lea rcx, [rsp + 0x50]
cmp rax, rcx
je 0x1402143a4
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rcx, rax
call fcn.14002b640
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1402143e5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1402143e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140214848
call fcn.140296f94
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], di
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140214438
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140214433
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140214812
call fcn.140296f94
mov rbx, qword [str.FILE_EXISTS]
lea rcx, [rsp + 0x48]
call fcn.1402136b0
nop
mov rcx, qword [rax]
mov qword [rax], rdi
mov qword [rsp + 0x40], rcx
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, r13
call fcn.1402148f0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14021447b
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [str.FVER]
lea rcx, [rsp + 0x48]
call fcn.140213700
nop
mov rcx, qword [rax]
mov qword [rax], rdi
mov qword [rsp + 0x40], rcx
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, r13
call fcn.1402148f0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1402144be
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [0x1403ce698]
lea rcx, [rsp + 0x48]
call fcn.140213660
nop
mov rcx, qword [rax]
mov qword [rax], rdi
mov qword [rsp + 0x40], rcx
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, r13
call fcn.1402148f0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140214501
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [0x1403ce6b8]
lea rcx, [rsp + 0x48]
call fcn.140213930
nop
mov rcx, qword [rax]
mov qword [rax], rdi
mov qword [rsp + 0x40], rcx
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, r13
call fcn.1402148f0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140214544
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [str.REG32]
lea rcx, [rsp + 0x48]
call fcn.140213930
nop
mov rcx, qword [rax]
mov qword [rax], rdi
mov qword [rsp + 0x40], rcx
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, r13
call fcn.1402148f0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140214587
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [str.REG64]
lea rcx, [rsp + 0x48]
call fcn.1402138e0
nop
mov rcx, qword [rax]
mov qword [rax], rdi
mov qword [rsp + 0x40], rcx
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, r13
call fcn.1402148f0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1402145ca
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [str.REGISTRY]
lea rcx, [rsp + 0x48]
call fcn.140213980
nop
mov rcx, qword [rax]
mov qword [rax], rdi
mov qword [rsp + 0x40], rcx
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, r13
call fcn.1402148f0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14021460d
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [0x1403ce6d8]
lea rcx, [rsp + 0x48]
call fcn.140213840
nop
mov rcx, qword [rax]
mov qword [rax], rdi
mov qword [rsp + 0x40], rcx
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, r13
call fcn.1402148f0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140214650
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [str.RGO32]
lea rcx, [rsp + 0x48]
call fcn.140213840
nop
mov rcx, qword [rax]
mov qword [rax], rdi
mov qword [rsp + 0x40], rcx
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, r13
call fcn.1402148f0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140214693
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [str.RGO64]
lea rcx, [rsp + 0x48]
call fcn.1402137f0
nop
mov rcx, qword [rax]
mov qword [rax], rdi
mov qword [rsp + 0x40], rcx
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, r13
call fcn.1402148f0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1402146d6
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [str.OREGISTRY]
lea rcx, [rsp + 0x48]
call fcn.140213890
nop
mov rcx, qword [rax]
mov qword [rax], rdi
mov qword [rsp + 0x40], rcx
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, r13
call fcn.1402148f0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140214719
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [0x1403ce700]
lea rcx, [rsp + 0x48]
call fcn.140213750
nop
mov rcx, qword [rax]
mov qword [rax], rdi
mov qword [rsp + 0x40], rcx
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, r13
call fcn.1402148f0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14021475c
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [0x1403ce708]
lea rcx, [rsp + 0x48]
call fcn.1402137a0
nop
mov rcx, qword [rax]
mov qword [rax], rdi
mov qword [rsp + 0x40], rcx
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, r13
call fcn.1402148f0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14021479f
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [str.DATE]
lea rcx, [rsp + 0x48]
call fcn.140213610
nop
mov r8, qword [rax]
mov qword [rax], rdi
mov qword [rsp + 0x40], r8
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, r13
call fcn.1402148f0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1402147e2
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140296f70
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1402ba3ec
nop
call fcn.1402ba3ec
nop
call fcn.1402ba3ec
nop
call fcn.1402ba3ec
nop
call fcn.1402ba3ec
nop
call fcn.1402ba3ec
nop
call fcn.1402ba3ec
nop
call fcn.1402ba3ec
nop
call fcn.1402ba3ec
nop
call fcn.1402ba3ec
int3