Function at 0x1400477f0
Capabilities:
Extract resource via kernel32 functions
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1ffd0]
mov eax, 0x200d0
call fcn.1400daca0
sub rsp, rax
movzx edi, r9b
mov r14, r8
mov rsi, rcx
test r8, r8
je 0x140047ecb
cmp word [r8], 0
je 0x140047ecb
mov r15d, dword [0x140125ee4]
mov ebx, dword [0x1401271d8]
cmp r15d, ebx
jl 0x140047a3f
cmp r15d, 0xffff
jl 0x140047938
mov rcx, qword [rcx + 0x6b0]
test rcx, rcx
je 0x1400478cd
lea rdx, str.Too_many_includes.
cmp byte [0x140127cbc], 0
je 0x140047989
xor ebx, ebx
mov qword [rsp + 0x28], rbx
lea r8, [0x1400fcb50]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
lea rcx, [0x140127530]
call fcn.14000f6a0
mov ebx, eax
jmp 0x140047ecd
xor ebx, ebx
mov qword [rsp + 0x28], rbx
lea r9, [0x1400fcb50]
mov qword [rsp + 0x20], rcx
xor r8d, r8d
lea rcx, [0x140127530]
call fcn.140010690
mov ebx, eax
jmp 0x140047ecd
xor ebx, ebx
cmp byte [0x140127cbf], bl
je 0x14004790e
cmp byte [0x140127cbc], bl
jne 0x14004790e
mov eax, dword [rsi + 0x2d4]
lea r8, [0x1400fcb50]
movzx r9d, word [rsi + 0x2d0]
lea rdx, str.Too_many_includes.
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.14000f540
mov eax, ebx
jmp 0x140047ecd
mov qword [rsp + 0x28], rbx
lea r9, [0x1400fcb50]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.Too_many_includes.
mov rcx, rsi
call fcn.140010690
mov eax, ebx
jmp 0x140047ecd
test ebx, ebx
je 0x14004794d
add ebx, ebx
cmp ebx, 0xffff
jle 0x140047952
mov ebx, 0xffff
jmp 0x140047952
mov ebx, WSAAsyncSelect
mov rcx, qword [0x140125ef8]
movsxd rdx, ebx
shl rdx, 3
call fcn.1400c1590
mov rcx, rax
test rax, rax
jne 0x140047a29
mov rcx, qword [rsi + 0x6b0]
test rcx, rcx
je 0x1400479be
lea rdx, str.Out_of_memory.
jmp 0x14004786e
cmp byte [0x140127cbf], 0
je 0x1400478a4
mov eax, dword [rcx + 4]
lea r8, [0x1400fcb50]
movzx r9d, word [rcx + 2]
lea rcx, [0x140127530]
mov dword [rsp + 0x20], eax
call fcn.14000f540
xor ebx, ebx
mov eax, ebx
jmp 0x140047ecd
xor ebx, ebx
cmp byte [0x140127cbf], bl
je 0x1400479ff
cmp byte [0x140127cbc], bl
jne 0x1400479ff
mov eax, dword [rsi + 0x2d4]
lea r8, [0x1400fcb50]
movzx r9d, word [rsi + 0x2d0]
lea rdx, str.Out_of_memory.
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.14000f540
mov eax, ebx
jmp 0x140047ecd
mov qword [rsp + 0x28], rbx
lea r9, [0x1400fcb50]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.Out_of_memory.
mov rcx, rsi
call fcn.140010690
mov eax, ebx
jmp 0x140047ecd
mov r15d, dword [0x140125ee4]
mov qword [0x140125ef8], rax
mov dword [0x1401271d8], ebx
jmp 0x140047a46
mov rcx, qword [0x140125ef8]
movzx eax, word [r14]
xor ebx, ebx
test r15d, r15d
jne 0x140047a69
cmp ax, 0x2a
je 0x140047a6f
mov rax, qword [rsi + 0x750]
mov qword [rcx], rax
movsxd rdi, r15d
jmp 0x140047af4
cmp ax, 0x2a
jne 0x140047a96
mov r8d, 0x7fff
lea rcx, [rsp + 0x50]
mov rdx, r14
call fcn.1400d02a4
lea rcx, [rsp + 0x50]
mov word [rbp + 0xff4e], bx
call qword [sym.imp.USER32.dll_CharUpperW]
jmp 0x140047ab0
lea r9, [rbp + 0x20020]
mov edx, 0x8000
lea r8, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test dil, dil
jne 0x140047ae6
movsxd r12, r15d
mov rdi, rbx
test r15d, r15d
jle 0x140047ae6
mov rcx, qword [0x140125ef8]
lea rdx, [rsp + 0x50]
mov rcx, qword [rcx + rdi*8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140047dde
inc rdi
cmp rdi, r12
jl 0x140047ac0
mov rax, qword [0x140125ef8]
movsxd rdi, r15d
mov qword [rax + rdi*8], rbx
cmp word [r14], 0x2a
mov r13, r14
mov eax, dword [0x14011f198]
mov dword [rbp + 0x20020], eax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], ebx
mov byte [rsp + 0x3c], bl
jne 0x140047c13
cmp word [r14 + 2], bx
lea rdx, [r14 + 2]
je 0x140047c13
xor ecx, ecx
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r12, rax
test rax, rax
je 0x140047c13
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140047c07
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140047c07
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, 0x58
mov dword [rbp + 0x20020], 0xfde9
mov dword [rsp + 0x38], eax
lea r13, [rsp + 0x30]
call fcn.1400bade4
mov ecx, dword [0x140127f08]
mov rdi, rax
mov qword [rsp + 0x40], rax
lea rax, vtable.TextStream.0
mov qword [rdi], rax
mov qword [rdi + 8], rbx
mov dword [rdi + 0x10], ebx
mov dword [rdi + 0x14], 0xffffffff
mov qword [rdi + 0x30], rbx
mov qword [rdi + 0x38], rbx
cmp ecx, 0xffffffff
je 0x140047bdc
lea rdx, [rdi + 0x18]
mov dword [rdi + 0x14], ecx
call qword [sym.imp.KERNEL32.dll_GetCPInfo]
test eax, eax
jne 0x140047bdc
mov byte [rdi + 0x1e], bl
mov rcx, qword [rbp + 0x20018]
lea rax, vtable.TextMem.0
mov qword [rdi], rax
mov byte [rdi + 0x4c], 1
mov qword [rdi + 0x40], rbx
mov qword [rcx], rdi
mov dword [rdi + 0x48], ebx
mov byte [rdi + 0x4c], bl
mov qword [rdi + 0x50], rbx
movsxd rdi, r15d
jmp 0x140047c34
mov rcx, qword [rbp + 0x20018]
movsxd rdi, r15d
jmp 0x140047c34
mov ecx, 0x48
call fcn.1400bade4
mov rcx, rax
mov qword [rsp + 0x40], rax
call fcn.140007bc4
mov rcx, qword [rbp + 0x20018]
mov qword [rcx], rax
mov rcx, qword [rcx]
test rcx, rcx
je 0x140047dd6
mov r9d, dword [rbp + 0x20020]
mov r8d, 0x30c
mov rdx, r13
call fcn.14009a890
test al, al
je 0x140047dd6
mov rax, qword [0x140125ef8]
lea r12, [rdi*8]
cmp qword [r12 + rax], rbx
jne 0x140047cd6
cmp word [rsp + 0x50], bx
je 0x140047ccb
lea rax, [rsp + 0x50]
mov r14, 0xffffffffffffffff
inc r14
cmp word [rax + r14*2], bx
jne 0x140047c85
lea r13, [r14 + r14]
lea rcx, [r13 + 2]
call fcn.14009a150
mov rdi, rax
test rax, rax
je 0x140047ee8
test r14, r14
je 0x140047cbd
mov r8, r13
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400bcbb0
mov rax, qword [0x140125ef8]
mov word [rdi + r13], bx
jmp 0x140047cd2
lea rdi, [0x1400fcb50]
mov qword [r12 + rax], rdi
inc dword [0x140125ee4]
test r15d, r15d
jne 0x140047d4b
lea edx, [r15 + 2]
xor ecx, ecx
lea r8d, [r15 + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140047d13
xor r9d, r9d
lea rdx, [0x140105858]
xor r8d, r8d
mov rcx, rsi
call fcn.140047ef0
test eax, eax
je 0x140047ecb
mov rdx, qword [rsi + 0x798]
test rdx, rdx
je 0x140047d35
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call fcn.140047ef0
test eax, eax
je 0x140047ecb
mov rcx, qword [rsi + 0x758]
call fcn.140065b40
mov eax, 3
jmp 0x140047ecd
mov r14d, 0x5c
lea rcx, [rsp + 0x50]
mov edx, r14d
call fcn.1400bca4c
mov rsi, rax
lea rax, [rsp + 0x50]
cmp rsi, rax
jbe 0x140047dcc
mov word [rsi], bx
lea rdi, [rsp + 0x50]
movzx ecx, word [rsp + 0x50]
test cx, cx
je 0x140047dab
movzx eax, word [rsp + 0x52]
cmp ax, 0x3a
jne 0x140047dab
cmp word [rsp + 0x54], bx
jne 0x140047dab
mov word [rbp + 0x20020], cx
lea rdi, [rbp + 0x20020]
mov word [rbp + 0x20022], ax
mov dword [rbp + 0x20024], r14d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x140047dc8
cmp byte [0x140127cbc], bl
je 0x140047dc8
mov rcx, rdi
call fcn.140065bb0
mov word [rsi], r14w
mov eax, 3
jmp 0x140047ecd
cmp byte [rbp + 0x20030], bl
je 0x140047de8
mov eax, 1
jmp 0x140047ecd
lea rax, str.Include
mov qword [rsp + 0x20], r14
test r15d, r15d
lea r9, str.Script
lea r8, str._s_file___s__cannot_be_opened.
mov edx, 0x8040
cmovne r9, rax
lea rcx, [rbp + 0xff50]
call fcn.14009d690
mov rcx, qword [rsi + 0x6b0]
test rcx, rcx
je 0x140047e68
cmp byte [0x140127cbc], bl
lea rdx, [rbp + 0xff50]
jne 0x14004787d
cmp byte [0x140127cbf], bl
je 0x1400478a6
mov eax, dword [rcx + 4]
lea r8, [0x1400fcb50]
movzx r9d, word [rcx + 2]
lea rcx, [0x140127530]
mov dword [rsp + 0x20], eax
call fcn.14000f540
mov eax, ebx
jmp 0x140047ecd
cmp byte [0x140127cbf], bl
je 0x140047ea4
cmp byte [0x140127cbc], bl
jne 0x140047ea4
mov eax, dword [rsi + 0x2d4]
lea r8, [0x1400fcb50]
movzx r9d, word [rsi + 0x2d0]
lea rdx, [rbp + 0xff50]
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.14000f540
mov eax, ebx
jmp 0x140047ecd
mov qword [rsp + 0x28], rbx
lea r9, [0x1400fcb50]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rbp + 0xff50]
mov rcx, rsi
call fcn.140010690
mov eax, ebx
jmp 0x140047ecd
xor eax, eax
mov rbx, qword [rsp + 0x20110]
add rsp, 0x200d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400111f0
int3