Function at 0x14002d310
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rdi, rdx
mov r14, rcx
lea r13, vtable.TextStream.0
mov qword [rbp - 0x29], r13
xor r15d, r15d
mov qword [rbp - 0x21], r15
mov dword [rbp - 0x19], r15d
mov dword [rbp - 0x15], 0xffffffff
xorps xmm0, xmm0
movdqa xmmword [rbp + 7], xmm0
mov ecx, dword [0x140119a48]
cmp ecx, 0xffffffff
je 0x14002d384
mov dword [rbp - 0x15], ecx
lea rdx, [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_GetCPInfo]
movzx ecx, byte [rbp - 0xb]
test eax, eax
cmove ecx, r15d
mov byte [rbp - 0xb], cl
lea r12, vtable.TextMem.0
mov qword [rbp - 0x29], r12
mov qword [rbp + 0x17], r15
mov dword [rbp + 0x1f], r15d
mov byte [rbp + 0x23], r15b
mov qword [rbp + 0x27], r15
mov qword [rbp - 0x41], r15
mov dword [rbp - 0x39], r15d
mov byte [rbp - 0x35], 0
mov r8d, 0xa
lea rdx, str.E4847ED08866458F8DD35F94B37001C0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x14002d508
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rbp - 0x39], eax
test eax, eax
je 0x14002d508
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14002d508
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rbp - 0x41], rax
test rax, rax
je 0x14002d508
cmp dword [rax], 0x4034b50
jne 0x14002d4cb
call fcn.140005440
test al, al
je 0x14002d521
mov edx, r15d
lea r8, [0x140113950]
nop
lea ecx, [rdx + 1]
mov rax, qword [r8]
mov word [rax], cx
inc edx
lea r8, [r8 + 8]
cmp edx, 0xa
jl 0x14002d430
lea r9, [0x140113950]
mov r8d, dword [rbp - 0x39]
lea rdx, [rbp - 0x49]
mov rcx, qword [rbp - 0x41]
call fcn.1400c32a0
mov ebx, eax
test eax, eax
je 0x14002d4cb
lea esi, [rbx + 2]
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp - 0x41], rax
mov byte [rbp - 0x35], 1
mov r8d, ebx
mov rdi, qword [rbp - 0x49]
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbp - 0x41]
mov word [rbx + rax], 0
mov r8d, ebx
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov dword [rbp - 0x39], esi
call fcn.140005440
test al, al
je 0x14002d521
mov rcx, qword [0x1401157c0]
call fcn.1400271d0
mov rcx, qword [0x1401157b8]
call fcn.1400271d0
mov r9d, 0xfde9
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x29]
call fcn.1400bc2c0
mov rax, qword [r14 + 0xbb0]
mov qword [0x140116728], rax
inc dword [0x140116724]
lea rdx, [rbp - 0x29]
mov rcx, r14
call fcn.14002d5a0
mov ebx, eax
jmp 0x14002d524
mov qword [rsp + 0x20], r15
xorps xmm3, xmm3
mov r8, rdi
xor edx, edx
lea rcx, str.Could_not_extract_script_from_EXE.
call fcn.1400c6790
mov ebx, r15d
mov qword [rbp - 0x29], r12
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x14002d555
cmp byte [rbp + 0x23], 0
je 0x14002d551
mov r8d, dword [rbp + 0x1f]
test r8, r8
je 0x14002d54b
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbp + 0x17], r15
mov qword [rbp - 0x29], r13
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x14002d579
xor edx, edx
mov r8d, 0x2000
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, ebx
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret