Function at 0x14003b800
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1ffc0]
mov eax, 0x200c0
call fcn.1400f7000
sub rsp, rax
xor eax, eax
movzx r12d, r9b
mov qword [rsp + 0x30], rax
mov rsi, r8
mov dword [rsp + 0x38], eax
mov r13, rdx
mov byte [rsp + 0x3c], al
mov r15, rcx
test r8, r8
je 0x14003bae4
cmp word [r8], ax
je 0x14003bae4
mov r8d, dword [0x140133b58]
mov ebx, dword [0x140134ee0]
cmp r8d, ebx
jl 0x14003b8fa
cmp r8d, 0xffff
jl 0x14003b893
lea r8, [0x1400f97e4]
lea rdx, str.Too_many_includes.
call fcn.140064aa0
jmp 0x14003bae6
test ebx, ebx
je 0x14003b8a8
add ebx, ebx
cmp ebx, 0xffff
jle 0x14003b8ad
mov ebx, 0xffff
jmp 0x14003b8ad
mov ebx, WSAAsyncSelect
mov rcx, qword [0x140133b50]
movsxd rdx, ebx
shl rdx, 3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov rcx, rax
test rax, rax
jne 0x14003b8e4
lea r8, [0x1400f97e4]
mov rcx, r15
lea rdx, str.Out_of_memory.
call fcn.140064aa0
jmp 0x14003bae6
mov r8d, dword [0x140133b58]
mov qword [0x140133b50], rax
mov dword [0x140134ee0], ebx
jmp 0x14003b901
mov rcx, qword [0x140133b50]
mov rdi, qword [rbp + 0x20018]
mov ebx, 3
movsxd r14, r8d
test rdi, rdi
je 0x14003b9ce
mov rbx, 0xffffffffffffffff
test r8d, r8d
jne 0x14003b92b
mov qword [rcx + r14*8], rsi
jmp 0x14003b990
cmp word [rdi], 0
je 0x14003b985
mov rcx, rbx
cmp word [rdi + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14003b934
lea rcx, [rcx*2 + 2]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, qword [0x140133b50]
mov rdx, rax
mov qword [rcx + r14*8], rax
test rax, rax
je 0x14003b8c9
nop word [rax + rax]
movzx eax, word [rdi]
lea rdi, [rdi + 2]
mov word [rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x14003b970
jmp 0x14003b990
mov rax, qword [0x140136c28]
mov qword [rcx + r14*8], rax
mov qword [rsp + 0x30], rsi
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x14003b995
add ebx, ebx
lea rdx, [rsp + 0x30]
mov r9d, 0x4b0
mov dword [rsp + 0x38], ebx
mov r8d, reloc.WSOCK32.dll_ioctlsocket
mov rcx, r13
call fcn.1400d3360
inc dword [0x140133b58]
mov eax, 3
jmp 0x14003bae6
test r8d, r8d
jne 0x14003b9df
mov rax, qword [r15 + 0xbb0]
mov qword [rcx], rax
jmp 0x14003ba42
lea r9, [rbp + 0x20000]
mov edx, 0x8000
lea r8, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test r12b, r12b
jne 0x14003ba3b
test r14d, r14d
jle 0x14003ba3b
xor ebx, ebx
nop word [rax + rax]
mov rcx, qword [0x140133b50]
lea rdx, [rsp + 0x40]
mov rcx, qword [rcx + rbx*8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14003bcfb
inc rbx
cmp rbx, r14
jl 0x14003ba10
mov ebx, 3
mov r8d, dword [0x140133b58]
mov rcx, qword [0x140132b68]
test rcx, rcx
je 0x14003bcd3
test r8d, r8d
jne 0x14003bcd3
mov rdx, qword [0x140133a80]
test rdx, rdx
jne 0x14003babe
mov rdx, rcx
mov rcx, qword [0x140132b60]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x38], eax
test eax, eax
je 0x14003bac7
mov rdx, qword [0x140132b68]
mov rcx, qword [0x140132b60]
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14003bac7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14003bac7
mov rdx, qword [0x140133a80]
test rdx, rdx
je 0x14003bb1e
mov rcx, qword [0x140132b68]
test rcx, rcx
jne 0x14003bb07
mov dword [rsp + 0x38], ecx
xorps xmm3, xmm3
mov qword [rsp + 0x20], 0
mov r8, rsi
lea rcx, str.Could_not_extract_script_from_EXE.
xor edx, edx
call fcn.1400def40
xor eax, eax
lea r11, [rsp + 0x200c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, dword [rcx + 4]
mov dword [rsp + 0x38], eax
test eax, eax
je 0x14003bac7
mov eax, dword [rcx]
add rax, qword [rdx]
mov qword [rsp + 0x30], rax
je 0x14003bac7
cmp dword [rax], 0x4034b50
jne 0x14003bc40
call fcn.140005c60
test al, al
je 0x14003bae4
mov rax, qword [0x140130b30]
lea r9, [0x140130b30]
lea rdx, [rbp + 0x20000]
mov word [rax], 1
mov rax, qword [0x140130b38]
mov word [rax], 2
mov rax, qword [0x140130b40]
mov word [rax], bx
mov rax, qword [0x140130b48]
mov word [rax], 4
mov rax, qword [0x140130b50]
mov word [rax], 5
mov rax, qword [0x140130b58]
mov word [rax], 6
mov rax, qword [0x140130b60]
mov word [rax], 7
mov rax, qword [0x140130b68]
mov word [rax], 8
mov rax, qword [0x140130b70]
mov word [rax], 9
mov rax, qword [0x140130b78]
mov word [rax], 0xa
mov r8d, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.1400db840
mov ebx, eax
test eax, eax
je 0x14003bc40
lea esi, [rbx + 2]
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, qword [rbp + 0x20000]
mov r8d, ebx
mov rdx, rdi
mov qword [rsp + 0x30], rax
mov rcx, rax
mov byte [rsp + 0x3c], 1
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x30]
mov r8d, ebx
xor edx, edx
mov rcx, rdi
mov word [rbx + rax], 0
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov dword [rsp + 0x38], esi
call fcn.140005c60
test al, al
je 0x14003bae4
mov rcx, qword [0x140132b90]
call fcn.1400320a0
mov rcx, qword [0x140132b88]
call fcn.1400320a0
mov r9d, 0xfde9
lea rdx, [rsp + 0x30]
mov r8d, reloc.WSOCK32.dll_ioctlsocket
mov rcx, r13
call fcn.1400d3360
test r14d, r14d
jle 0x14003bcc3
lea rax, [rsp + 0x40]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rax + rbx*2 + 2], 0
lea rbx, [rbx + 1]
jne 0x14003bc70
lea rcx, [rbx*2 + 2]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, qword [0x140133b50]
mov qword [rcx + r14*8], rax
test rax, rax
je 0x14003b8c9
lea rdx, [rsp + 0x40]
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rdx]
lea rdx, [rdx + 2]
mov word [rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14003bcb0
inc dword [0x140133b58]
mov eax, 3
jmp 0x14003bae6
mov r9d, dword [0x140132b00]
mov r8d, 0x30c
mov rdx, rsi
mov rcx, r13
call fcn.1400d3360
test al, al
jne 0x14003bc59
cmp byte [rbp + 0x20010], al
je 0x14003bd05
mov eax, 1
jmp 0x14003bae6
lea rax, str.Include
mov qword [rsp + 0x20], rsi
test r14d, r14d
lea r9, str.Script
lea r8, str._s_file___s__cannot_be_opened.
mov edx, 0x8040
cmovg r9, rax
lea rcx, [rbp + 0xff40]
call fcn.1400d6690
lea r8, [0x1400f97e4]
mov rcx, r15
lea rdx, [rbp + 0xff40]
call fcn.140064aa0
jmp 0x14003bae6