Function at 0x140039d80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1ffc0]
mov eax, 0x200c0
call fcn.1401119a0
sub rsp, rax
xor ebx, ebx
movzx r14d, r9b
mov qword [rsp + 0x30], rbx
mov rsi, r8
mov dword [rsp + 0x38], ebx
mov r12, rdx
mov byte [rsp + 0x3c], bl
mov r13, rcx
test r8, r8
je 0x14003a04b
cmp word [r8], bx
je 0x14003a04b
mov r8d, dword [0x1401617d8]
mov edi, dword [0x1401617f4]
cmp r8d, edi
jl 0x140039e79
cmp r8d, 0xffff
jl 0x140039e13
lea r8, [0x14012046c]
lea rdx, str.Too_many_includes.
call fcn.140063260
jmp 0x14003a04d
test edi, edi
je 0x140039e28
add edi, edi
cmp edi, 0xffff
jle 0x140039e2d
mov edi, 0xffff
jmp 0x140039e2d
mov edi, WSAAsyncSelect
mov rcx, qword [0x1401617d0]
movsxd rdx, edi
shl rdx, 3
call fcn.1400f75dc
mov rcx, rax
test rax, rax
jne 0x140039e63
lea r8, [0x14012046c]
mov rcx, r13
lea rdx, str.Out_of_memory.
call fcn.140063260
jmp 0x14003a04d
mov r8d, dword [0x1401617d8]
mov qword [0x1401617d0], rax
mov dword [0x1401617f4], edi
jmp 0x140039e80
mov rcx, qword [0x1401617d0]
mov rdi, qword [rbp + 0x20018]
movsxd r15, r8d
test rdi, rdi
je 0x140039f3e
mov rbx, 0xffffffffffffffff
test r8d, r8d
jne 0x140039ea5
mov qword [rcx + r15*8], rsi
jmp 0x140039f00
cmp word [rdi], 0
je 0x140039ef5
mov rcx, rbx
nop
cmp word [rdi + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x140039eb0
lea rcx, [rcx*2 + 2]
call fcn.1400f75c0
mov rcx, qword [0x1401617d0]
mov rdx, rax
mov qword [rcx + r15*8], rax
test rax, rax
je 0x140039e48
movzx eax, word [rdi]
lea rdi, [rdi + 2]
mov word [rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x140039ee0
jmp 0x140039f00
mov rax, qword [0x140164888]
mov qword [rcx + r15*8], rax
mov qword [rsp + 0x30], rsi
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x140039f05
add ebx, ebx
lea rdx, [rsp + 0x30]
mov r9d, 0x4b0
mov dword [rsp + 0x38], ebx
mov r8d, reloc.WSOCK32.dll_ioctlsocket
mov rcx, r12
call fcn.1400cde20
inc dword [0x1401617d8]
mov eax, 3
jmp 0x14003a04d
test r8d, r8d
jne 0x140039f4f
mov rax, qword [r13 + 0xbb0]
mov qword [rcx], rax
jmp 0x140039fad
lea r9, [rbp + 0x20000]
mov edx, 0x8000
lea r8, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test r14b, r14b
jne 0x140039fa6
test r15d, r15d
jle 0x140039fa6
mov rdi, rbx
nop word [rax + rax]
mov rcx, qword [0x1401617d0]
lea rdx, [rsp + 0x40]
mov rcx, qword [rcx + rdi*8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14003a1fc
inc rdi
cmp rdi, r15
jl 0x140039f80
mov r8d, dword [0x1401617d8]
mov rcx, qword [0x140160810]
test rcx, rcx
je 0x14003a1d4
test r8d, r8d
jne 0x14003a1d4
mov rdx, qword [0x140161708]
test rdx, rdx
jne 0x14003a029
mov rdx, rcx
mov rcx, qword [0x140160808]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x38], eax
test eax, eax
je 0x14003a032
mov rdx, qword [0x140160810]
mov rcx, qword [0x140160808]
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14003a032
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14003a032
mov rdx, qword [0x140161708]
test rdx, rdx
je 0x14003a085
mov rcx, qword [0x140160810]
test rcx, rcx
jne 0x14003a06e
mov dword [rsp + 0x38], ebx
xorps xmm3, xmm3
mov qword [rsp + 0x20], rbx
mov r8, rsi
lea rcx, str.Could_not_extract_script_from_EXE.
xor edx, edx
call fcn.1400d8410
xor eax, eax
lea r11, [rsp + 0x200c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, dword [rcx + 4]
mov dword [rsp + 0x38], eax
test eax, eax
je 0x14003a032
mov eax, dword [rcx]
add rax, qword [rdx]
mov qword [rsp + 0x30], rax
je 0x14003a032
cmp dword [rax], 0x4034b50
jne 0x14003a14a
call fcn.140005b50
test al, al
je 0x14003a04b
lea rdx, [0x14015d500]
mov rax, qword [rdx]
lea ecx, [rbx + 1]
inc ebx
lea rdx, [rdx + 8]
mov word [rax], cx
cmp ebx, 0xa
jl 0x14003a0a1
mov r8d, dword [rsp + 0x38]
lea r9, [0x14015d500]
mov rcx, qword [rsp + 0x30]
lea rdx, [rbp + 0x20000]
call fcn.1400d4f50
mov ebx, eax
test eax, eax
je 0x14003a14a
lea esi, [rbx + 2]
mov ecx, esi
call fcn.1400f75c0
mov rdi, qword [rbp + 0x20000]
mov r8d, ebx
mov rdx, rdi
mov qword [rsp + 0x30], rax
mov rcx, rax
mov byte [rsp + 0x3c], 1
call fcn.1400f1320
mov rax, qword [rsp + 0x30]
mov r8d, ebx
xor edx, edx
mov rcx, rdi
mov word [rbx + rax], 0
call fcn.1400f1130
mov rcx, rdi
call fcn.1400f75c8
mov dword [rsp + 0x38], esi
call fcn.140005b50
test al, al
je 0x14003a04b
mov rcx, qword [0x140160838]
call fcn.140030420
mov rcx, qword [0x140160830]
call fcn.140030420
mov r9d, 0xfde9
lea rdx, [rsp + 0x30]
mov r8d, reloc.WSOCK32.dll_ioctlsocket
mov rcx, r12
call fcn.1400cde20
test r15d, r15d
jle 0x14003a1c4
lea rax, [rsp + 0x40]
mov rbx, 0xffffffffffffffff
cmp word [rax + rbx*2 + 2], 0
lea rbx, [rbx + 1]
jne 0x14003a174
lea rcx, [rbx*2 + 2]
call fcn.1400f75c0
mov rcx, qword [0x1401617d0]
mov r8, rax
mov qword [rcx + r15*8], rax
test rax, rax
je 0x140039e48
lea rcx, [rsp + 0x40]
nop dword [rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [r8], ax
lea r8, [r8 + 2]
test ax, ax
jne 0x14003a1b0
inc dword [0x1401617d8]
mov eax, 3
jmp 0x14003a04d
mov r9d, dword [0x14016079c]
mov r8d, 0x30c
mov rdx, rsi
mov rcx, r12
call fcn.1400cde20
test al, al
jne 0x14003a163
cmp byte [rbp + 0x20010], bl
je 0x14003a206
mov eax, 1
jmp 0x14003a04d
lea rax, str.Include
mov qword [rsp + 0x20], rsi
test r15d, r15d
lea r9, str.Script
lea r8, str._s_file___s__cannot_be_opened.
mov edx, 0x8040
cmovg r9, rax
lea rcx, [rbp + 0xff40]
call fcn.1400d08d0
lea r8, [0x14012046c]
mov rcx, r13
lea rdx, [rbp + 0xff40]
call fcn.140063260
jmp 0x14003a04d