Function at 0x14006ec00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
movaps xmmword [rsp + 0x190], xmm6
mov rax, qword [0x140214ba0]
xor rax, rsp
mov qword [rsp + 0x188], rax
mov rbx, rcx
lea rsi, str.Engine
mov qword [rsp + 0x38], rsi
lea r12, str.Initialization
mov qword [rsp + 0x40], r12
mov byte [rsp + 0x48], 1
test byte [0x140226980], 1
je 0x14006ec70
mov r9, rsi
mov r8, r12
lea rdx, [0x1401ebe30]
call fcn.14006be70
nop
lea rax, [0x1401e7634]
mov qword [rsp + 0x28], rax
lea rax, [0x1401e7638]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140037a40
test al, al
jne 0x14006ed4e
lea rcx, [0x140226720]
call sub.KERNEL32.dll_AcquireSRWLockShared
mov rax, qword [0x140226708]
test rax, rax
je 0x14006eccd
lock inc dword [rax + 8]
movups xmm6, xmmword [0x140226700]
movups xmmword [rsp + 0x60], xmm6
lea rcx, [0x140226720]
call sub.KERNEL32.dll_ReleaseSRWLockShared
nop
movq rcx, xmm6
mov rax, qword [rcx]
lea rdx, str.Failed_to_initialize_the_script_host
call qword [rax + VariantCopy]
nop
psrldq xmm6, 8
movq rcx, xmm6
test rcx, rcx
je 0x14006f3a2
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14006f3a2
mov rbx, qword [rsp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14006f3a2
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor bl, bl
jmp 0x14006f81c
lea rdx, [0x1401d367e]
mov ecx, 8
call fcn.14014ff60
xor r14d, r14d
test rax, rax
je 0x14006ed73
lea rcx, vtable.NInstaller::CExternalObject.0
mov qword [rax], rcx
jmp 0x14006ed76
mov rax, r14
mov r8, rax
lea rdx, str.external
mov rcx, rbx
call fcn.140037bf0
test al, al
jne 0x14006ee2d
lea rcx, [0x140226720]
call sub.KERNEL32.dll_AcquireSRWLockShared
mov rax, qword [0x140226708]
test rax, rax
je 0x14006edac
lock inc dword [rax + 8]
movups xmm6, xmmword [0x140226700]
movups xmmword [rsp + 0x70], xmm6
lea rcx, [0x140226720]
call sub.KERNEL32.dll_ReleaseSRWLockShared
nop
movq rcx, xmm6
mov rax, qword [rcx]
lea rdx, str.Failed_to_import_external_object
call qword [rax + VariantCopy]
nop
psrldq xmm6, 8
movq rcx, xmm6
test rcx, rcx
je 0x14006f3a2
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14006f3a2
mov rbx, qword [rsp + 0x78]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14006f3a2
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor bl, bl
jmp 0x14006f81c
lea rdx, [0x1401d367e]
mov ecx, 0x40
call fcn.14014ff60
test rax, rax
je 0x14006ee75
lea rcx, vtable.NInstaller::CCabParser.0
mov qword [rax], rcx
lea rcx, vtable.NInstaller::CCabParser.1.0
mov qword [rax + 8], rcx
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r14
mov qword [rax + 0x20], r14
mov qword [rax + 0x28], r14
mov qword [rax + 0x30], r14
mov dword [rax + 0x38], 0xffffd8f1
jmp 0x14006ee78
mov rax, r14
lea r8, [rax + 8]
test rax, rax
cmove r8, r14
lea rdx, str.TPackageParser
mov rcx, rbx
call fcn.14006e620
test al, al
jne 0x14006ef40
lea rcx, [0x140226720]
call sub.KERNEL32.dll_AcquireSRWLockShared
mov rax, qword [0x140226708]
test rax, rax
je 0x14006eeb6
lock inc dword [rax + 8]
movups xmm6, xmmword [0x140226700]
movups xmmword [rsp + 0x80], xmm6
lea rcx, [0x140226720]
call sub.KERNEL32.dll_ReleaseSRWLockShared
nop
movq rcx, xmm6
mov rax, qword [rcx]
lea rdx, str.Failed_to_import_cab_parser
call qword [rax + VariantCopy]
nop
psrldq xmm6, 8
movq rcx, xmm6
test rcx, rcx
je 0x14006f3a2
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14006f3a2
mov rbx, qword [rsp + 0x88]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14006f3a2
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor bl, bl
jmp 0x14006f81c
lea rdx, [0x1401d367e]
mov ecx, 0x68
call fcn.14014ff60
test rax, rax
je 0x14006ef60
mov rcx, rax
call fcn.140071e30
jmp 0x14006ef63
mov rax, r14
mov r8, rax
lea rdx, str.Thread
mov rcx, rbx
call fcn.14006e620
test al, al
jne 0x14006f023
lea rcx, [0x140226720]
call sub.KERNEL32.dll_AcquireSRWLockShared
mov rax, qword [0x140226708]
test rax, rax
je 0x14006ef99
lock inc dword [rax + 8]
movups xmm6, xmmword [0x140226700]
movups xmmword [rsp + 0x90], xmm6
lea rcx, [0x140226720]
call sub.KERNEL32.dll_ReleaseSRWLockShared
nop
movq rcx, xmm6
mov rax, qword [rcx]
lea rdx, str.Failed_to_import_thread_type
call qword [rax + VariantCopy]
nop
psrldq xmm6, 8
movq rcx, xmm6
test rcx, rcx
je 0x14006f3a2
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14006f3a2
mov rbx, qword [rsp + 0x98]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14006f3a2
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor bl, bl
jmp 0x14006f81c
lea rdx, [0x1401d367e]
mov ecx, 0x28
call fcn.14014ff60
test rax, rax
je 0x14006f043
mov rcx, rax
call fcn.140071a50
jmp 0x14006f046
mov rax, r14
mov r8, rax
lea rdx, str.Logger
mov rcx, rbx
call fcn.14006e620
test al, al
jne 0x14006f106
lea rcx, [0x140226720]
call sub.KERNEL32.dll_AcquireSRWLockShared
mov rax, qword [0x140226708]
test rax, rax
je 0x14006f07c
lock inc dword [rax + 8]
movups xmm6, xmmword [0x140226700]
movups xmmword [rsp + 0xa0], xmm6
lea rcx, [0x140226720]
call sub.KERNEL32.dll_ReleaseSRWLockShared
nop
movq rcx, xmm6
mov rax, qword [rcx]
lea rdx, str.Failed_to_import_logger_type
call qword [rax + VariantCopy]
nop
psrldq xmm6, 8
movq rcx, xmm6
test rcx, rcx
je 0x14006f3a2
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14006f3a2
mov rbx, qword [rsp + 0xa8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14006f3a2
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor bl, bl
jmp 0x14006f81c
lea rdx, [0x1401d367e]
mov ecx, 8
call fcn.14014ff60
test rax, rax
je 0x14006f128
lea rcx, vtable.NInstaller::CScriptSignatureChecker.0
mov qword [rax], rcx
jmp 0x14006f12b
mov rax, r14
mov r8, rax
lea rdx, [0x1401ec138]
mov rcx, rbx
call fcn.14006e620
test al, al
jne 0x14006f1eb
lea rcx, [0x140226720]
call sub.KERNEL32.dll_AcquireSRWLockShared
mov rax, qword [0x140226708]
test rax, rax
je 0x14006f161
lock inc dword [rax + 8]
movups xmm6, xmmword [0x140226700]
movups xmmword [rsp + 0xb0], xmm6
lea rcx, [0x140226720]
call sub.KERNEL32.dll_ReleaseSRWLockShared
nop
movq rcx, xmm6
mov rax, qword [rcx]
lea rdx, str.Failed_to_import_signature_checker
call qword [rax + VariantCopy]
nop
psrldq xmm6, 8
movq rcx, xmm6
test rcx, rcx
je 0x14006f3a2
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14006f3a2
mov rbx, qword [rsp + 0xb8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14006f3a2
mov rcx, qword [rsp + 0xb8]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor bl, bl
jmp 0x14006f81c
lea rdx, [0x1401d367e]
mov ecx, 8
call fcn.14014ff60
test rax, rax
je 0x14006f20d
lea rcx, vtable.NInstaller::CScriptServiceProtection.0
mov qword [rax], rcx
jmp 0x14006f210
mov rax, r14
mov r8, rax
lea rdx, [0x1401ec150]
mov rcx, rbx
call fcn.14006e620
test al, al
jne 0x14006f2d0
lea rcx, [0x140226720]
call sub.KERNEL32.dll_AcquireSRWLockShared
mov rax, qword [0x140226708]
test rax, rax
je 0x14006f246
lock inc dword [rax + 8]
movups xmm6, xmmword [0x140226700]
movups xmmword [rsp + 0xc0], xmm6
lea rcx, [0x140226720]
call sub.KERNEL32.dll_ReleaseSRWLockShared
nop
movq rcx, xmm6
mov rax, qword [rcx]
lea rdx, str.Failed_to_import_service_protection
call qword [rax + VariantCopy]
nop
psrldq xmm6, 8
movq rcx, xmm6
test rcx, rcx
je 0x14006f3a2
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14006f3a2
mov rbx, qword [rsp + 0xc8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14006f3a2
mov rcx, qword [rsp + 0xc8]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor bl, bl
jmp 0x14006f81c
lea rdx, [0x1401d367e]
mov ecx, 8
call fcn.14014ff60
test rax, rax
je 0x14006f2f2
lea rcx, vtable.NInstaller::CScriptGlobalEnv.0
mov qword [rax], rcx
jmp 0x14006f2f5
mov rax, r14
mov r8, rax
lea rdx, [0x1401ec1c0]
mov rcx, rbx
call fcn.14006e620
test al, al
jne 0x14006f3a9
lea rcx, [0x140226720]
call sub.KERNEL32.dll_AcquireSRWLockShared
mov rax, qword [0x140226708]
test rax, rax
je 0x14006f32b
lock inc dword [rax + 8]
movups xmm6, xmmword [0x140226700]
movups xmmword [rsp + 0xd0], xmm6
lea rcx, [0x140226720]
call sub.KERNEL32.dll_ReleaseSRWLockShared
nop
movq rcx, xmm6
mov rax, qword [rcx]
lea rdx, str.Failed_to_import_global_env
call qword [rax + VariantCopy]
nop
psrldq xmm6, 8
movq rcx, xmm6
test rcx, rcx
je 0x14006f3a2
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14006f3a2
mov rbx, qword [rsp + 0xd8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14006f3a2
mov rcx, qword [rsp + 0xd8]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor bl, bl
jmp 0x14006f81c
mov eax, dword [0x140226980]
test al, 1
je 0x14006f3cb
mov r9, rsi
mov r8, r12
lea rdx, [0x1401ebe20]
call fcn.14006be70
mov eax, dword [0x140226980]
mov byte [rsp + 0x48], r14b
lea r15, str.Initialize_script
mov qword [rsp + 0x110], r15
mov qword [rsp + 0x118], r12
mov byte [rsp + 0x120], 1
test al, 1
je 0x14006f406
mov r9, r15
mov r8, r12
lea rdx, [0x1401ebe30]
call fcn.14006be70
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x128], xmm0
movups xmmword [rsp + 0x138], xmm0
lea r13, vtable.NInstaller::CScriptResLoader.0
mov qword [rsp + 0x128], r13
movdqu xmmword [rsp + 0x130], xmm0
mov qword [rsp + 0x140], r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
movzx r9d, r14w
lea r8, str.initialize
lea rdx, str.ASSETS
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
je 0x14006f75d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14006f75d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x14006f75d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x14006f75d
mov qword [rsp + 0x130], rdi
mov qword [rsp + 0x140], r14
mov eax, eax
mov qword [rsp + 0x138], rax
lea rax, vtable.NInstaller::CException.0
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x160], r14
movdqa xmm0, xmmword [0x1401efbc0]
movdqu xmmword [rsp + 0x170], xmm0
mov byte [rsp + 0x160], 0
mov dword [rsp + 0x180], r14d
mov rax, qword [rbx]
test rax, rax
je 0x14006f5a6
xorps xmm0, xmm0
movups xmmword [rsp + 0x148], xmm0
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x128]
mov rax, qword [rsp + 0x128]
call qword [rax + VariantCopy]
mov r9, rax
lea r8, [rsp + 0x128]
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x20]
call fcn.14006dad0
mov r8d, dword [rsp + 0x148]
test r8d, r8d
jne 0x14006f57a
mov rcx, qword [rsp + 0x150]
test rcx, rcx
je 0x14006f573
call fcn.1401568b0
mov bl, 1
jmp 0x14006f6fc
mov rax, qword [rsp + 0x158]
mov rbx, qword [rsp + 0x150]
mov rdx, rbx
lea rcx, [rsp + 0x158]
call qword [rax]
test rbx, rbx
je 0x14006f5c4
mov rcx, rbx
call fcn.1401568b0
jmp 0x14006f5c4
mov rax, qword [vtable.NInstaller::CException.0]
mov r8d, 1
lea rdx, str.Object_is_not_initialized_or_loader_is_null
lea rcx, [rsp + 0x158]
call rax
lea rcx, [0x140226720]
call sub.KERNEL32.dll_AcquireSRWLockShared
mov rax, qword [0x140226708]
test rax, rax
je 0x14006f5e0
lock inc dword [rax + 8]
movups xmm6, xmmword [0x140226700]
movups xmmword [rsp + 0xe0], xmm6
lea rcx, [0x140226720]
call sub.KERNEL32.dll_ReleaseSRWLockShared
nop
movq rcx, xmm6
mov rax, qword [rcx]
lea rdx, str.Failed_to_load_root_script:_n___
call qword [rax + VariantCopy]
nop
mov edi, 0xffffffff
psrldq xmm6, 8
movq rcx, xmm6
test rcx, rcx
je 0x14006f659
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14006f659
mov rbx, qword [rsp + 0xe8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14006f659
mov rcx, qword [rsp + 0xe8]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
lea rcx, [0x140226720]
call sub.KERNEL32.dll_AcquireSRWLockShared
mov rax, qword [0x140226708]
test rax, rax
je 0x14006f675
lock inc dword [rax + 8]
movups xmm6, xmmword [0x140226700]
movups xmmword [rsp + 0xf0], xmm6
lea rcx, [0x140226720]
call sub.KERNEL32.dll_ReleaseSRWLockShared
nop
lea rdx, [rsp + 0x160]
cmp qword [rsp + 0x178], 0x10
cmovae rdx, qword [rsp + 0x160]
movq rcx, xmm6
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
psrldq xmm6, 8
movq rcx, xmm6
test rcx, rcx
je 0x14006f6fa
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14006f6fa
mov rbx, qword [rsp + 0xf8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14006f6fa
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor bl, bl
mov rdx, qword [rsp + 0x178]
cmp rdx, 0x10
jb 0x14006f73f
inc rdx
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f73a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f873
call fcn.14014f900
movdqa xmm0, xmmword [0x1401efbc0]
movdqu xmmword [rsp + 0x170], xmm0
mov byte [rsp + 0x160], 0
jmp 0x14006f7f2
lea rcx, [0x140226720]
call sub.KERNEL32.dll_AcquireSRWLockShared
mov rax, qword [0x140226708]
test rax, rax
je 0x14006f779
lock inc dword [rax + 8]
movups xmm6, xmmword [0x140226700]
movups xmmword [rsp + 0x100], xmm6
lea rcx, [0x140226720]
call sub.KERNEL32.dll_ReleaseSRWLockShared
nop
movq rcx, xmm6
mov rax, qword [rcx]
lea rdx, str.Failed_to_init_initialize_loader
call qword [rax + VariantCopy]
nop
psrldq xmm6, 8
movq rcx, xmm6
test rcx, rcx
je 0x14006f7f0
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14006f7f0
mov rbx, qword [rsp + 0x108]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14006f7f0
mov rcx, qword [rsp + 0x108]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor bl, bl
mov qword [rsp + 0x128], r13
test byte [0x140226980], 1
je 0x14006f815
mov r9, r15
mov r8, r12
lea rdx, [0x1401ebe20]
call fcn.14006be70
lea rsi, str.Engine
cmp byte [rsp + 0x48], 0
je 0x14006f83e
test byte [0x140226980], 1
je 0x14006f83e
mov r9, rsi
mov r8, r12
lea rdx, [0x1401ebe20]
call fcn.14006be70
movzx eax, bl
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.14014f8e0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140156b00
nop
int3