Function at 0x14002aed0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rsi
push rdi
push r12
push r14
mov eax, 0x200c8
call fcn.1400e0af0
sub rsp, rax
movzx edi, r9b
mov rsi, r8
mov r14, rdx
mov r12, rcx
test r8, r8
je 0x14002b2a6
cmp word [r8], 0
je 0x14002b2a6
mov qword [rsp + 0x200f0], rbx
mov ebx, dword [0x14012c418]
mov qword [rsp + 0x200f8], rbp
movsxd rbp, dword [0x14012c41c]
cmp ebp, ebx
jl 0x14002afa5
cmp ebp, 0xffff
jl 0x14002af46
lea r8, [0x1400f1514]
lea rdx, str.Too_many_includes.
call fcn.14004e5e0
jmp 0x14002b1c7
test ebx, ebx
je 0x14002af5b
add ebx, ebx
cmp ebx, 0xffff
jle 0x14002af60
mov ebx, 0xffff
jmp 0x14002af60
mov ebx, WSAAsyncSelect
mov rcx, qword [0x14012c410]
movsxd rdx, ebx
shl rdx, 3
call fcn.1400d7018
mov r11, rax
test rax, rax
jne 0x14002af96
lea r8, [0x1400f1514]
lea rdx, str.Out_of_memory.
mov rcx, r12
call fcn.14004e5e0
jmp 0x14002b1c7
mov qword [0x14012c410], rax
mov dword [0x14012c418], ebx
jmp 0x14002afac
mov r11, qword [0x14012c410]
mov qword [rsp + 0x200c0], r15
xor r15d, r15d
test ebp, ebp
jne 0x14002afd1
cmp word [rsi], 0x2a
je 0x14002afd7
mov rax, qword [r12 + 0xb80]
mov qword [r11], rax
jmp 0x14002b061
cmp word [rsi], 0x2a
jne 0x14002b000
lea rcx, [rsp + 0x40]
mov r8d, 0x7fff
mov rdx, rsi
call fcn.1400da5c4
lea rcx, [rsp + 0x40]
mov word [rsp + 0x1003e], r15w
call qword [sym.imp.USER32.dll_CharUpperW]
jmp 0x14002b01b
lea r9, [rsp + 0x20100]
lea r8, [rsp + 0x40]
mov edx, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test dil, dil
jne 0x14002b056
mov rbx, r15
test ebp, ebp
jle 0x14002b056
nop word [rax + rax]
mov rcx, qword [0x14012c410]
lea rdx, [rsp + 0x40]
mov rcx, qword [rcx + rbx*8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14002b0fb
inc rbx
cmp rbx, rbp
jl 0x14002b030
mov rax, qword [0x14012c410]
mov qword [rax + rbp*8], r15
cmp word [rsi], 0x2a
mov edi, dword [0x14012aaa4]
mov qword [rsp + 0x20108], r13
mov r13, rsi
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x38], r15d
mov byte [rsp + 0x3c], r15b
jne 0x14002b105
cmp word [rsi + 2], r15w
lea rdx, [rsi + 2]
je 0x14002b105
xor ecx, ecx
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x14002b105
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14002b124
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14002b124
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, 0x58
lea r13, [rsp + 0x30]
mov dword [rsp + 0x38], eax
mov edi, 0xfde9
call fcn.1400d7728
test rax, rax
je 0x14002b11e
mov rcx, rax
call fcn.1400284c0
jmp 0x14002b121
mov eax, 1
jmp 0x14002b1bf
mov ecx, 0x48
call fcn.1400d7728
test rax, rax
je 0x14002b11e
mov rcx, rax
call fcn.1400058e0
jmp 0x14002b121
mov rax, r15
mov qword [r14], rax
mov rbx, qword [r14]
test rbx, rbx
je 0x14002b24c
mov dword [rsp + 0x20100], 0x30c
mov rax, qword [rbx]
lea r8, [rsp + 0x20100]
mov rdx, r13
mov rcx, rbx
mov dword [rbx + 0xc], r15d
call qword [rax + reloc.WSOCK32.dll_htonl]
test al, al
je 0x14002b24c
lea rdx, [rsp + 0x20100]
mov r8d, edi
mov rcx, rbx
call fcn.1400b6b50
test al, al
je 0x14002b24c
mov rax, qword [0x14012c410]
cmp qword [rax + rbp*8], r15
jne 0x14002b1e5
lea rcx, [rsp + 0x40]
or rdx, 0xffffffffffffffff
call fcn.1400b5ff0
mov rcx, qword [0x14012c410]
mov qword [rcx + rbp*8], rax
test rax, rax
jne 0x14002b1e5
lea r8, [0x1400f1514]
lea rdx, str.Out_of_memory.
mov rcx, r12
call fcn.14004e5e0
mov r13, qword [rsp + 0x20108]
mov r15, qword [rsp + 0x200c0]
mov rbx, qword [rsp + 0x200f0]
mov rbp, qword [rsp + 0x200f8]
add rsp, 0x200c8
pop r14
pop r12
pop rdi
pop rsi
ret
inc dword [0x14012c41c]
test ebp, ebp
jne 0x14002b242
lea edx, [rbp + 2]
lea r8d, [rbp + 0xa]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14002b21c
lea rdx, [0x1400f8a60]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
call fcn.14002b2c0
test eax, eax
je 0x14002b23b
mov rdx, qword [r12 + 0xbc8]
test rdx, rdx
je 0x14002b242
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
call fcn.14002b2c0
test eax, eax
jne 0x14002b242
xor eax, eax
jmp 0x14002b1b7
mov eax, 3
jmp 0x14002b1b7
cmp byte [rsp + 0x20110], r15b
je 0x14002b260
mov eax, 1
jmp 0x14002b1b7
lea rax, str.Include
test ebp, ebp
lea r9, str.Script
lea r8, str._s_file___s__cannot_be_opened.
lea rcx, [rsp + 0x10040]
mov edx, 0x8040
cmovne r9, rax
mov qword [rsp + 0x20], rsi
call fcn.1400b9320
lea r8, [0x1400f1514]
lea rdx, [rsp + 0x10040]
jmp 0x14002b1af
xor eax, eax
add rsp, 0x200c8
pop r14
pop r12
pop rdi
pop rsi
ret