Function at 0x1400335b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r12
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1400c7070]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, rcx
mov r15, r8
add rcx, 0x48
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
mov edx, dword [r14 + 8]
lea r8, str.RunXml
test eax, eax
je 0x14003391d
mov qword [rsp + 0x88], rbx
lea rcx, str._i:__s_Begin_execute._n
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r13
call fcn.14005cb30
lea rcx, str.HMODULE_AdditionalDll
call sym.Installer.exe_Get
xor r13d, r13d
mov rbx, rax
mov ebp, r13d
test rax, rax
je 0x1400336e6
movzx ecx, word [r14 + 0x70]
lea r8, [0x1400a9828]
mov eax, 0x63c0
sub cx, ax
movzx edx, cx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x1400336e6
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rsi
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
cmp byte [rdi], 0x3c
lea esi, [rax + 1]
je 0x14003369a
nop word [rax + rax]
inc rdi
dec esi
cmp byte [rdi], 0x3c
jne 0x140033690
movsxd rbx, esi
mov edx, 2
mov rcx, rbx
call fcn.140069790
mov r9d, esi
mov dword [rsp + 0x28], esi
mov r8, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [rbp + rbx*2 - 2], r13w
cmp eax, esi
je 0x1400336e6
mov rcx, rbp
call fcn.140069370
xor edx, edx
mov rcx, r14
call fcn.140033ad0
mov ebx, eax
jmp 0x140033700
mov rdx, rbp
mov rcx, r14
call fcn.140033ad0
mov ebx, eax
test rbp, rbp
je 0x140033700
mov rcx, rbp
call fcn.140069370
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
test ebx, ebx
jne 0x1400338be
mov rdi, qword [r14 + 0x78]
lea rdx, [rsp + 0x30]
mov rcx, rdi
mov dword [rsp + 0x30], 1
call fcn.1400347a0
mov rbx, qword [rax]
test rbx, rbx
je 0x14003381d
nop word [rax + rax]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x40]
call qword [0x1400926f0]
mov rcx, qword [rbx]
test al, al
mov rdx, qword [rcx + 0x10]
mov rcx, rbx
mov rax, rdx
je 0x1400337b8
call qword [0x1400926f0]
mov edx, eax
lea rcx, str._MainThread__Executing_command__i._n
call fcn.14005cb30
mov rax, qword [rbx]
mov r8, r15
mov rdx, 0xffffffffffffffff
mov rcx, rbx
mov rax, qword [rax + 0x20]
call qword [0x1400926f0]
mov rdx, qword [rbx]
test eax, eax
je 0x1400337cf
mov rax, qword [rdx + 0x10]
mov rcx, rbx
call qword [0x1400926f0]
mov edx, dword [r14 + 0x70]
lea rcx, str._RunXml:__d__Command__i_failed._n
mov r8d, eax
call fcn.14005cb30
jmp 0x14003382d
call qword [0x1400926f0]
mov edx, eax
lea rcx, str._MainThread__Command__i_not_required._n
call fcn.14005cb30
mov rdx, qword [rbx]
mov rax, qword [rdx + 0x18]
mov rcx, rbx
call qword [0x1400926f0]
mov dword [rsp + 0x34], eax
test eax, eax
je 0x140033814
lea rdx, [rsp + 0x34]
mov rcx, rdi
call fcn.1400347a0
mov rbx, qword [rax]
test rbx, rbx
jne 0x140033740
mov r8d, dword [rsp + 0x34]
lea rcx, str._RunXml:__d__Next_command__i_not_found__ending._n
mov edx, dword [r14 + 0x70]
call fcn.14005cb30
jmp 0x14003382d
lea rcx, str._RunXml:__d__Reached_end_command._n
jmp 0x140033824
lea rcx, str._RunXml:__d__Entry_command_with_index_1_not_found__ending._n
mov edx, dword [r14 + 0x70]
call fcn.14005cb30
mov qword [r14 + 0x78], r13
mov rax, qword [rdi]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400338b4
nop dword [rax]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x140033859
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [0x1400926f0]
mov qword [rbx + 0x28], r13
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], r13b
je 0x140033888
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], r13b
jne 0x140033883
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x140033883
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], r13b
je 0x140033870
mov rbx, rax
jmp 0x1400338af
mov rcx, qword [rax]
mov rbx, rax
cmp byte [rcx + 0x19], r13b
jne 0x1400338af
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rcx]
mov rbx, rcx
mov rcx, rax
cmp byte [rax + 0x19], r13b
je 0x1400338a0
cmp rbx, qword [rdi]
jne 0x140033840
mov rcx, rdi
call fcn.140033540
jmp 0x1400338ce
mov edx, dword [r14 + 0x70]
lea rcx, str.Error_parsing_commands_xml_id:__d_n
call fcn.14005cb30
mov rax, qword [r14]
mov rcx, r14
mov byte [r14 + 0x10], 1
mov rax, qword [rax + 0x18]
call qword [0x1400926f0]
mov edx, dword [r14 + 8]
lea r8, str.RunXml
mov r9d, eax
lea rcx, str._i:__s_End_execute._Next_command__i._n
call fcn.14005cb30
lea rcx, [r14 + 0x48]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r13, qword [rsp + 0x40]
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x88]
jmp 0x14003392e
lea rcx, str._i:__s_Error:_Multiple_threads_attempting_execution._n
call fcn.14005cb30
mov eax, 0x54f
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400625f0
add rsp, 0x60
pop r15
pop r14
pop r12
ret