Function at 0x140090640
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x201c0
call fcn.1401354c0
sub rsp, rax
lea rdi, [rsp + 0x30]
mov ecx, 0x8064
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x201d0]
mov rax, qword [0x14031eae8]
xor rax, rsp
mov qword [rsp + 0x201b0], rax
cmp qword [rsp + 0x201e0], 0
je 0x1400906a7
mov rax, qword [rsp + 0x201e0]
movzx eax, word [rax]
test eax, eax
jne 0x1400906ae
xor eax, eax
jmp 0x140090c85
mov eax, dword [0x140324500]
cmp dword [0x140324504], eax
jl 0x140090778
cmp dword [0x140324504], 0xffff
jl 0x1400906ec
lea r8, [0x140283e24]
lea rdx, str.Too_many_includes.
mov rcx, qword [rsp + 0x201d0]
call fcn.140021a00
jmp 0x140090c85
cmp dword [0x140324500], 0
je 0x140090715
mov eax, dword [0x140324500]
shl eax, 1
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xffff
jle 0x140090713
mov dword [rsp + 0x30], 0xffff
jmp 0x14009071d
mov dword [rsp + 0x30], WSAAsyncSelect
movsxd rax, dword [rsp + 0x30]
shl rax, 3
mov rdx, rax
mov rcx, qword [0x140323198]
call fcn.1401a7e00
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140090762
lea r8, [0x140283e64]
lea rdx, [0x140285ab0]
mov rcx, qword [rsp + 0x201d0]
call fcn.140021a00
jmp 0x140090c85
mov rax, qword [rsp + 0x38]
mov qword [0x140323198], rax
mov eax, dword [rsp + 0x30]
mov dword [0x140324500], eax
mov eax, dword [0x140324504]
mov dword [rsp + 0x10054], eax
cmp dword [rsp + 0x10054], 0
jne 0x1400907c6
mov rax, qword [rsp + 0x201e0]
movzx eax, word [rax]
cmp eax, 0x2a
je 0x1400907c6
movsxd rax, dword [rsp + 0x10054]
mov rcx, qword [0x140323198]
mov rdx, qword [rsp + 0x201d0]
mov rdx, qword [rdx + 0x750]
mov qword [rcx + rax*8], rdx
jmp 0x140090899
mov rax, qword [rsp + 0x201e0]
movzx eax, word [rax]
cmp eax, 0x2a
jne 0x1400907fb
mov r8d, 0x8000
mov rdx, qword [rsp + 0x201e0]
lea rcx, [rsp + 0x50]
call fcn.1400ff430
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_CharUpperW]
jmp 0x14009081b
lea r9, [rsp + 0x10068]
lea r8, [rsp + 0x50]
mov edx, 0x8000
mov rcx, qword [rsp + 0x201e0]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
movzx eax, byte [rsp + 0x201e8]
test eax, eax
jne 0x140090882
mov dword [rsp + 0x10074], 0
jmp 0x140090844
mov eax, dword [rsp + 0x10074]
inc eax
mov dword [rsp + 0x10074], eax
mov eax, dword [rsp + 0x10054]
cmp dword [rsp + 0x10074], eax
jge 0x140090882
movsxd rax, dword [rsp + 0x10074]
lea rdx, [rsp + 0x50]
mov rcx, qword [0x140323198]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140090880
mov eax, 1
jmp 0x140090c85
jmp 0x140090834
movsxd rax, dword [rsp + 0x10054]
mov rcx, qword [0x140323198]
mov qword [rcx + rax*8], 0
mov rax, qword [rsp + 0x201e0]
mov qword [rsp + 0x10078], rax
mov eax, dword [0x140319820]
mov dword [rsp + 0x10080], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x10098]
call fcn.1400724c0
mov rax, qword [rsp + 0x201e0]
movzx eax, word [rax]
cmp eax, 0x2a
jne 0x140090a18
mov eax, 2
imul rax, rax, 1
mov rcx, qword [rsp + 0x201e0]
movzx eax, word [rcx + rax]
test eax, eax
je 0x140090a18
mov rax, qword [rsp + 0x201e0]
add rax, 2
mov r8d, 0xa
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x100b8], rax
cmp qword [rsp + 0x100b8], 0
je 0x140090a18
mov rdx, qword [rsp + 0x100b8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x100c0], rax
cmp qword [rsp + 0x100c0], 0
je 0x140090a16
mov rcx, qword [rsp + 0x100c0]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x10098], rax
cmp qword [rsp + 0x10098], 0
je 0x140090a16
mov rdx, qword [rsp + 0x100b8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x100a0], eax
lea rcx, [rsp + 0x10098]
call fcn.1400751c0
mov qword [rsp + 0x10078], rax
mov dword [rsp + 0x10080], 0xfde9
mov ecx, 0x58
call fcn.140135540
mov qword [rsp + 0x20180], rax
cmp qword [rsp + 0x20180], 0
je 0x1400909e7
mov rcx, qword [rsp + 0x20180]
call fcn.1400731c0
mov qword [rsp + 0x20198], rax
jmp 0x1400909f3
mov qword [rsp + 0x20198], 0
mov rax, qword [rsp + 0x20198]
mov qword [rsp + 0x20178], rax
mov rax, qword [rsp + 0x201d8]
mov rcx, qword [rsp + 0x20178]
mov qword [rax], rcx
jmp 0x140090a7b
mov ecx, 0x48
call fcn.140135540
mov qword [rsp + 0x20190], rax
cmp qword [rsp + 0x20190], 0
je 0x140090a4c
mov rcx, qword [rsp + 0x20190]
call fcn.1400137b0
mov qword [rsp + 0x201a0], rax
jmp 0x140090a58
mov qword [rsp + 0x201a0], 0
mov rax, qword [rsp + 0x201a0]
mov qword [rsp + 0x20188], rax
mov rax, qword [rsp + 0x201d8]
mov rcx, qword [rsp + 0x20188]
mov qword [rax], rcx
mov rax, qword [rsp + 0x201d8]
cmp qword [rax], 0
je 0x140090aba
mov r9d, dword [rsp + 0x10080]
mov r8d, 0x30c
mov rdx, qword [rsp + 0x10078]
mov rax, qword [rsp + 0x201d8]
mov rcx, qword [rax]
call fcn.1400f4d40
movzx eax, al
test eax, eax
jne 0x140090b49
movzx eax, byte [rsp + 0x201f0]
test eax, eax
je 0x140090ad0
mov eax, 1
jmp 0x140090c85
cmp dword [rsp + 0x10054], 0
je 0x140090aeb
lea rax, [0x140285ad0]
mov qword [rsp + 0x201a8], rax
jmp 0x140090afa
lea rax, str.Script
mov qword [rsp + 0x201a8], rax
mov rax, qword [rsp + 0x201e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x201a8]
lea r8, str._s_file___s__cannot_be_opened.
mov edx, 0x8040
lea rcx, [rsp + 0x100e0]
call fcn.1400feb20
lea r8, [0x140283e8c]
lea rdx, [rsp + 0x100e0]
mov rcx, qword [rsp + 0x201d0]
call fcn.140021a00
jmp 0x140090c85
movsxd rax, dword [rsp + 0x10054]
mov rcx, qword [0x140323198]
cmp qword [rcx + rax*8], 0
jne 0x140090b83
mov rdx, 0xffffffffffffffff
lea rcx, [rsp + 0x50]
call fcn.1400f2bd0
movsxd rcx, dword [rsp + 0x10054]
mov rdx, qword [0x140323198]
mov qword [rdx + rcx*8], rax
mov eax, dword [0x140324504]
inc eax
mov dword [0x140324504], eax
cmp dword [rsp + 0x10054], 0
jne 0x140090c14
mov r8d, 0xa
mov edx, 2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140090bd8
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140285b38]
mov rcx, qword [rsp + 0x201d0]
call fcn.140090040
test eax, eax
jne 0x140090bd8
xor eax, eax
jmp 0x140090c85
mov rax, qword [rsp + 0x201d0]
cmp qword [rax + 0x798], 0
je 0x140090c14
xor r9d, r9d
xor r8d, r8d
mov rax, qword [rsp + 0x201d0]
mov rdx, qword [rax + 0x798]
mov rcx, qword [rsp + 0x201d0]
call fcn.140090040
test eax, eax
jne 0x140090c14
xor eax, eax
jmp 0x140090c85
cmp dword [rsp + 0x10054], 0
je 0x140090c6c
mov dx, 0x5c
lea rcx, [rsp + 0x50]
call fcn.14000cc80
mov qword [rsp + 0x20168], rax
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x20168], rax
jbe 0x140090c6a
xor eax, eax
mov rcx, qword [rsp + 0x20168]
mov word [rcx], ax
lea rcx, [rsp + 0x50]
call fcn.1400a9e90
mov eax, 0x5c
mov rcx, qword [rsp + 0x20168]
mov word [rcx], ax
jmp 0x140090c80
mov rax, qword [rsp + 0x201d0]
mov rcx, qword [rax + 0x758]
call fcn.1400a9e90
mov eax, 3
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WSOCK32.dll_connect
call fcn.140134a00
mov rax, rdi
mov rcx, qword [rsp + 0x201b0]
xor rcx, rsp
call fcn.140135520
add rsp, 0x201c0
pop rdi
ret