Function at 0x14005de87
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2d8
movaps xmmword [rsp + 0x2c0], xmm6
mov r14, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x2b8], rax
movabs r15, 0xaaaaaaaaaaaaaaaa
lea r13, [rsp + 0xb0]
mov qword [r13 + 0x10], r15
movaps xmm6, xmmword [0x1402ae190]
movaps xmmword [r13], xmm6
lea rax, str.msedge.dll
lea r8, [rsp + 0xa0]
mov qword [r8], rax
mov qword [r8 + 8], 0xa
mov rdx, r13
call fcn.14000cf90
mov qword [rsp + 0x90], r15
movaps xmmword [rsp + 0x80], xmm6
xor eax, eax
mov dword [rsp + 0x2b3], eax
mov dword [rsp + 0x2b0], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005e006
mov rsi, rax
mov ecx, 0x40
call fcn.140112048
mov rbx, rax
movups xmm0, xmmword [0x1402b6c36]
movups xmmword [rax], xmm0
movups xmm0, xmmword [0x1402b6c46]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [0x1402b6c56]
movups xmmword [rax + 0x20], xmm0
movzx eax, word [0x1402b6c66]
mov word [rbx + 0x30], ax
mov word [rbx + 0x32], 0
movabs rax, 0x8aaaaaaaaaa0000
lea r8, [rsp + 0x290]
mov qword [r8 + 0x10], rax
movups xmm0, xmmword [0x1402b6c6a]
movaps xmmword [r8], xmm0
mov rcx, rsi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14005e0c8
mov rbp, rax
mov rcx, rsi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14005e182
mov rdi, rax
mov rcx, rsi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x14005e23c
mov ebp, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
test rax, rax
je 0x14005e302
mov r12d, ebp
cmp ebp, 0x17
jae 0x14005e3c3
lea rsi, [rsp + 0x150]
mov byte [rsi + 0x17], bpl
jmp 0x14005e3f4
mov ecx, 2
call fcn.1400f34e0
test al, al
je 0x14005e078
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_setup_etw_manifest_helper.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x56
mov r9d, 2
call fcn.14019f9e0
lea rcx, [rsp + 0x160]
lea rdx, str.Failed_to_get_etw_manifest_from_resource:
mov r8d, 0x2a
call fcn.1400ff874
lea rdx, str.GetModuleHandle_returned_null.
mov r8d, 0x1e
mov rcx, rax
call fcn.1400ff874
mov rcx, rsi
call fcn.140183e60
mov rcx, qword [0x140314b50]
test rcx, rcx
jne 0x14005e0b3
mov dword [rsp + 0x20], 1
lea rcx, str.Microsoft.Setup.Install.EtwManifestStatus
mov edx, 1
mov r8d, 0xd
mov r9d, 0xe
call fcn.1400c4840
mov rcx, rax
mov qword [0x140314b50], rax
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x28]
xor edi, edi
xor r12d, r12d
jmp 0x14005e4d2
mov ecx, 2
call fcn.1400f34e0
test al, al
je 0x14005e13a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_setup_etw_manifest_helper.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x62
mov r9d, 2
call fcn.14019f9e0
lea rcx, [rsp + 0x160]
lea rdx, str.Failed_to_get_etw_manifest_from_resource:
mov r8d, 0x2a
call fcn.1400ff874
lea rdx, str.FindResource_returned_null.
mov r8d, 0x1b
mov rcx, rax
call fcn.1400ff874
mov rcx, rsi
call fcn.140183e60
mov rcx, qword [0x140314b50]
test rcx, rcx
jne 0x14005e175
mov dword [rsp + 0x20], 1
lea rcx, str.Microsoft.Setup.Install.EtwManifestStatus
mov edx, 1
mov r8d, 0xd
mov r9d, 0xe
call fcn.1400c4840
mov rcx, rax
mov qword [0x140314b50], rax
mov rax, qword [rcx]
mov edx, 2
jmp 0x14005e2f1
mov ecx, 2
call fcn.1400f34e0
test al, al
je 0x14005e1f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_setup_etw_manifest_helper.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x6a
mov r9d, 2
call fcn.14019f9e0
lea rcx, [rsp + 0x160]
lea rdx, str.Failed_to_get_etw_manifest_from_resource:
mov r8d, 0x2a
call fcn.1400ff874
lea rdx, str.LoadResource_returned_null.
mov r8d, 0x1b
mov rcx, rax
call fcn.1400ff874
mov rcx, rsi
call fcn.140183e60
mov rcx, qword [0x140314b50]
test rcx, rcx
jne 0x14005e22f
mov dword [rsp + 0x20], 1
lea rcx, str.Microsoft.Setup.Install.EtwManifestStatus
mov edx, 1
mov r8d, 0xd
mov r9d, 0xe
call fcn.1400c4840
mov rcx, rax
mov qword [0x140314b50], rax
mov rax, qword [rcx]
mov edx, 3
jmp 0x14005e2f1
mov ecx, 2
call fcn.1400f34e0
test al, al
je 0x14005e2ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_setup_etw_manifest_helper.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x72
mov r9d, 2
call fcn.14019f9e0
lea rcx, [rsp + 0x160]
lea rdx, str.Failed_to_get_etw_manifest_from_resource:
mov r8d, 0x2a
call fcn.1400ff874
lea rdx, str.SizeofResource_is_0.
mov r8d, 0x14
mov rcx, rax
call fcn.1400ff874
mov rcx, rsi
call fcn.140183e60
mov rcx, qword [0x140314b50]
test rcx, rcx
jne 0x14005e2e9
mov dword [rsp + 0x20], 1
lea rcx, str.Microsoft.Setup.Install.EtwManifestStatus
mov edx, 1
mov r8d, 0xd
mov r9d, 0xe
call fcn.1400c4840
mov rcx, rax
mov qword [0x140314b50], rax
mov rax, qword [rcx]
mov edx, 4
call qword [rax + 0x28]
xor r12d, r12d
xor esi, esi
xor edi, edi
xor ebp, ebp
jmp 0x14005e44c
mov ecx, 2
call fcn.1400f34e0
test al, al
je 0x14005e374
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_setup_etw_manifest_helper.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0x7a
mov r9d, 2
call fcn.14019f9e0
lea rcx, [rsp + 0x160]
lea rdx, str.Failed_to_get_etw_manifest_from_resource:
mov r8d, 0x2a
call fcn.1400ff874
lea rdx, str.LockResource_returned_null.
mov r8d, 0x1b
mov rcx, rax
call fcn.1400ff874
mov rcx, rsi
call fcn.140183e60
mov rcx, qword [0x140314b50]
test rcx, rcx
jne 0x14005e3af
mov dword [rsp + 0x20], 1
lea rcx, str.Microsoft.Setup.Install.EtwManifestStatus
mov edx, 1
mov r8d, 0xd
mov r9d, 0xe
call fcn.1400c4840
mov rcx, rax
mov qword [0x140314b50], rax
mov rax, qword [rcx]
mov edx, 5
call qword [rax + 0x28]
xor r12d, r12d
xor esi, esi
xor edi, edi
jmp 0x14005e43b
lea rdi, [r12 + 0x10]
and rdi, 0xfffffffffffffff0
mov rcx, rdi
call fcn.140112048
mov rsi, rax
mov qword [rsp + 0x150], rax
bts rdi, 0x3f
mov qword [rsp + 0x160], rdi
mov qword [rsp + 0x158], r12
mov rcx, rsi
mov rdx, r15
mov r8, r12
call fcn.1401178b0
mov byte [rsi + r12], 0
mov r12, qword [rsp + 0x150]
mov rsi, qword [rsp + 0x158]
mov eax, dword [rsp + 0x163]
mov dword [rsp + 0x2b3], eax
mov eax, dword [rsp + 0x160]
mov dword [rsp + 0x2b0], eax
mov dil, byte [rsp + 0x167]
test r15, r15
setne bpl
movabs r15, 0xaaaaaaaaaaaaaaaa
cmp byte [rsp + 0x2a7], 0
jns 0x14005e463
mov rcx, qword [rsp + 0x290]
call fcn.140112038
mov rcx, rbx
call fcn.140112038
test bpl, bpl
je 0x14005e4d2
test dil, dil
movzx eax, dil
cmovs rax, rsi
test rax, rax
je 0x14005e4d2
mov qword [rsp + 0x140], r15
movaps xmmword [rsp + 0x130], xmm6
test dil, dil
js 0x14005e72a
mov qword [rsp + 0x130], r12
mov qword [rsp + 0x138], rsi
mov eax, dword [rsp + 0x2b0]
mov ecx, dword [rsp + 0x2b3]
mov dword [rsp + 0x140], eax
mov dword [rsp + 0x143], ecx
mov byte [rsp + 0x147], dil
jmp 0x14005e73d
xor eax, eax
mov byte [rsp + 0x97], al
mov byte [rsp + 0x80], al
test dil, dil
jns 0x14005e4ef
mov rcx, r12
call fcn.140112038
movzx edi, byte [rsp + 0x97]
mov rsi, rdi
test dil, dil
jns 0x14005e507
mov rsi, qword [rsp + 0x88]
test rsi, rsi
je 0x14005e55d
lea rdx, [rsp + 0x290]
mov qword [rdx + 0x10], r15
movaps xmmword [rdx], xmm6
lea rax, str.msedge.EtwManifest.man
lea r8, [rsp + 0x70]
mov qword [r8], rax
mov qword [r8 + 8], 0x16
mov rcx, r14
call fcn.14000cf90
cmp rsi, 0x7fffffff
ja 0x14005eb1f
test dil, dil
jns 0x14005e5fd
mov rdx, qword [rsp + 0x80]
jmp 0x14005e605
mov ecx, 2
call fcn.1400f34e0
test al, al
je 0x14005e5b0
lea rdx, str..._.._chrome_installer_setup_etw_manifest_helper.cc
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8d, 0xac
mov r9d, 2
call fcn.14019a740
lea rcx, [rsp + 0x160]
lea rdx, str.Failed_to_retrieve_etw_manifest_from_resource.
mov r8d, 0x2e
call fcn.1400ff874
mov rcx, rsi
call fcn.140001d00
mov rcx, qword [0x140314b50]
test rcx, rcx
jne 0x14005e5eb
mov dword [rsp + 0x20], 1
lea rcx, str.Microsoft.Setup.Install.EtwManifestStatus
mov edx, 1
mov r8d, 0xd
mov r9d, 0xe
call fcn.1400c4840
mov rcx, rax
mov qword [0x140314b50], rax
mov rax, qword [rcx]
mov edx, 6
call qword [rax + 0x28]
xor esi, esi
jmp 0x14005eacd
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x290]
mov r8d, esi
call fcn.14019f760
cmp eax, esi
sete sil
jne 0x14005e6a4
lea rcx, str..._.._chrome_installer_setup_etw_manifest_helper.cc
mov edx, 0x34
call fcn.1400c7bd0
test eax, eax
jle 0x14005e857
lea rdx, str..._.._chrome_installer_setup_etw_manifest_helper.cc
lea rcx, [rsp + 0x150]
mov r8d, 0xb9
mov r9d, 0xffffffff
call fcn.14019a740
lea rcx, [rsp + 0x160]
lea rdx, str.Successfully_wrote_etw_manifest_string_to
mov r8d, 0x2a
call fcn.1400ff874
mov rdi, rax
cmp byte [rsp + 0x2a7], 0
js 0x14005e7fd
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x60], rax
movaps xmm0, xmmword [rsp + 0x290]
movaps xmmword [rsp + 0x50], xmm0
jmp 0x14005e817
mov ecx, 2
call fcn.1400f34e0
test al, al
je 0x14005ea7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_setup_etw_manifest_helper.cc
lea rcx, [rsp + 0x150]
mov r8d, 0xbe
mov r9d, 2
call fcn.14019f9e0
lea rcx, [rsp + 0x160]
lea rdx, str.Error_writing_etw_manifest_string_to
mov r8d, 0x25
call fcn.1400ff874
mov rdi, rax
cmp byte [rsp + 0x2a7], 0
js 0x14005ea20
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x290]
movaps xmmword [rsp + 0x30], xmm0
jmp 0x14005ea3a
lea rcx, [rsp + 0x130]
mov rdx, r12
mov r8, rsi
call fcn.1400c9140
lea rbx, [rsp + 0x110]
mov qword [rbx + 0x10], r15
movaps xmmword [rbx], xmm6
lea rsi, [rsp + 0x150]
mov rcx, rsi
call fcn.14005ddbc
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x100]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
mov rcx, rbx
call fcn.1400c2fb0
cmp byte [rsi + 0x17], 0
jns 0x14005e798
mov rcx, qword [rsp + 0x150]
call fcn.140112038
mov qword [rsp + 0xf0], r15
movaps xmmword [rsp + 0xe0], xmm6
mov qword [rsp + 0x160], r15
movaps xmmword [rsp + 0x150], xmm6
lea rsi, [rsp + 0x290]
mov rcx, rsi
call fcn.1401d3416
lea rdx, str._Etw
mov rcx, rsi
call fcn.1400ebece
cmp byte [rax + 0x17], 0
js 0x14005e89c
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x160], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x150], xmm0
jmp 0x14005e8b0
mov rdx, qword [rsp + 0x290]
mov r8, qword [rsp + 0x298]
lea rcx, [rsp + 0x50]
call fcn.1400e6dd4
lea rbx, [rsp + 0x130]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1401d5e8d
mov rcx, rdi
mov rdx, rbx
call fcn.1401834e0
cmp byte [rbx + 0x17], 0
jns 0x14005e84a
mov rcx, qword [rsp + 0x130]
call fcn.140112038
lea rcx, [rsp + 0x150]
call fcn.140001d00
mov rcx, qword [0x140314b50]
test rcx, rcx
jne 0x14005e892
mov dword [rsp + 0x20], 1
lea rcx, str.Microsoft.Setup.Install.EtwManifestStatus
mov edx, 1
mov r8d, 0xd
mov r9d, 0xe
call fcn.1400c4840
mov rcx, rax
mov qword [0x140314b50], rax
mov rax, qword [rcx]
xor edx, edx
jmp 0x14005eabd
mov rdx, qword [rax]
mov r8, qword [rax + 8]
lea rcx, [rsp + 0x150]
call fcn.1400e6dd4
cmp byte [rsp + 0x2a7], 0
jns 0x14005e8c7
mov rcx, qword [rsp + 0x290]
call fcn.140112038
movaps xmm0, xmmword [rsp + 0x150]
movaps xmmword [rsp + 0x290], xmm0
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x2a0], rax
movzx eax, byte [rsp + 0x2a7]
test al, al
cmovs rsi, qword [rsp + 0x290]
lea rdx, [rsp + 0xd0]
mov qword [rdx], rsi
cmovs rax, qword [rsp + 0x298]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0xe0]
mov rcx, rsi
call fcn.1400c2fb0
cmp byte [rsp + 0x2a7], 0
jns 0x14005e939
mov rcx, qword [rsp + 0x290]
call fcn.140112038
mov qword [rsp + 0x160], r15
movaps xmmword [rsp + 0x150], xmm6
cmp byte [rsp + 0xc7], 0
jns 0x14005e95b
mov r13, qword [rsp + 0xb0]
cmp byte [rsp + 0xf7], 0
jns 0x14005e96d
mov rsi, qword [rsp + 0xe0]
cmp byte [rsp + 0x127], 0
jns 0x14005e97f
mov rbx, qword [rsp + 0x110]
cmp byte [rsp + 0x147], 0
jns 0x14005e993
mov rdx, qword [rsp + 0x130]
jmp 0x14005e99b
lea rdx, [rsp + 0x130]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rsi
lea rsi, [rsp + 0x150]
mov rcx, rsi
mov r8, rbx
mov r9, r13
call fcn.1400baf00
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x90], rax
movaps xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x80], xmm0
cmp byte [rsp + 0xf7], 0
jns 0x14005e9e9
mov rcx, qword [rsp + 0xe0]
call fcn.140112038
cmp byte [rsp + 0x127], 0
jns 0x14005ea00
mov rcx, qword [rsp + 0x110]
call fcn.140112038
cmp byte [rsp + 0x147], 0
jns 0x14005e4e2
mov rcx, qword [rsp + 0x130]
call fcn.140112038
jmp 0x14005e4e2
mov rdx, qword [rsp + 0x290]
mov r8, qword [rsp + 0x298]
lea rcx, [rsp + 0x30]
call fcn.1400e6dd4
lea rbx, [rsp + 0x130]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1401d5e8d
mov rcx, rdi
mov rdx, rbx
call fcn.1401834e0
cmp byte [rbx + 0x17], 0
jns 0x14005ea6d
mov rcx, qword [rsp + 0x130]
call fcn.140112038
lea rcx, [rsp + 0x150]
call fcn.140183e60
mov rcx, qword [0x140314b50]
test rcx, rcx
jne 0x14005eab5
mov dword [rsp + 0x20], 1
lea rcx, str.Microsoft.Setup.Install.EtwManifestStatus
mov edx, 1
mov r8d, 0xd
mov r9d, 0xe
call fcn.1400c4840
mov rcx, rax
mov qword [0x140314b50], rax
mov rax, qword [rcx]
mov edx, 7
call qword [rax + 0x28]
lea rcx, [rsp + 0x290]
call fcn.1400e1350
cmp byte [rsp + 0x97], 0
jns 0x14005eae4
mov rcx, qword [rsp + 0x80]
call fcn.140112038
lea rcx, [rsp + 0xb0]
call fcn.1400e1350
mov rcx, qword [rsp + 0x2b8]
xor rcx, rsp
call fcn.140115e50
mov eax, esi
movaps xmm6, xmmword [rsp + 0x2c0]
add rsp, 0x2d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
int3