Function at 0x14000b310
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x210
mov rax, qword [0x140050088]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov rdi, rcx
mov rbp, r8
xor ecx, ecx
mov r14d, edx
mov edx, 0x3e8
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x14000b3ac
mov rdx, rax
mov qword [rsp + 0x238], rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rbx
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x14000b3a4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
movzx ecx, byte [rax + 4]
movzx edx, byte [rax + 5]
shl edx, 8
or edx, ecx
movzx ecx, byte [rax + 3]
movzx eax, byte [rax + 2]
shl edx, 8
or edx, ecx
shl edx, 8
or edx, eax
mov dword [rdi + 0x1c], edx
mov rsi, qword [rsp + 0x238]
mov rcx, rdi
call fcn.140001ff0
mov ebx, eax
lea ecx, [rax - 0x7149]
cmp ecx, 1
ja 0x14000b3fd
cmp byte [rdi], 0
jne 0x14000b3fd
lea r9, [0x140043508]
mov edx, 0xc8
lea r8, str.You_must_run_under_administrator_to_uninstall__s.
lea rcx, [rsp + 0x70]
call fcn.1400010a0
mov r9d, 0x10
lea r8, [0x140043508]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
test ebx, ebx
jne 0x14000b4ab
call fcn.14000b8a0
test al, al
je 0x14000b4b2
lea r9, [0x140043508]
mov edx, 0xc8
lea r8, str._s_will_be_uninstalled_from_your_system._Are_you_sure_
lea rcx, [rsp + 0x70]
call fcn.1400010a0
lea r9d, [rbx + 0x44]
xor ecx, ecx
lea r8, [0x140043508]
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x14000b5a2
call fcn.14000b9c0
test al, al
jne 0x14000b5a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Could_not_use_TEMP_directory_for_uninstall._Please__ensure_TEMP_directory_exists__has_valid_path_and_try_again.
mov edx, 0xc8
lea rcx, [rsp + 0x70]
mov ebx, eax
call fcn.1400010a0
mov r9d, 0x10
lea r8, [0x140043508]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov r9d, ebx
mov rcx, rdi
mov qword [rsp + 0x20], rax
lea r8d, [rax + 1]
call fcn.1400021a0
mov eax, ebx
jmp 0x14000b5a4
xor eax, eax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x58], rbp
mov word [rsp + 0x40], ax
call fcn.14000b5d0
movzx ebx, word [rsp + 0x40]
mov r8d, ebx
mov edx, ebx
shr r8d, 4
mov ecx, ebx
shr edx, 3
and r8d, 1
mov dword [rsp + 0x38], r8d
and edx, 1
mov dword [rsp + 0x30], edx
lea r8, str._0d_d_d_d_d
shr ecx, 2
mov eax, ebx
and ecx, 1
shr eax, 1
mov dword [rsp + 0x28], ecx
mov r9d, ebx
and eax, 1
lea rcx, [rsp + 0x60]
and r9d, 1
mov dword [rsp + 0x20], eax
mov edx, 6
call fcn.1400010a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r8d, r8d
mov rcx, rdi
mov r9d, eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.1400021a0
test bl, 1
jne 0x14000b563
mov r9d, 0x40
lea rdx, str.Application_could_not_be_uninstalled_because_Task_Scheduler_is_not_working_properly._Please__restart_your_OS_and_try_again.
jmp 0x14000b58e
test bl, 2
je 0x14000b581
test bl, 4
je 0x14000b581
test bl, 0x10
je 0x14000b581
mov r9d, 0x40
lea rdx, str.Application_was_successfully_uninstalled._Please__restart_your_browser_now.
jmp 0x14000b58e
mov r9d, 0x30
lea rdx, str.Please__restart_your_OS_to_complete_the_uninstall_process.
lea r8, [0x140043508]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
call fcn.14000bcc0
xor eax, eax
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.1400164d0
mov rbx, qword [rsp + 0x240]
add rsp, 0x210
pop r14
pop rdi
pop rbp
ret