Function at 0x14002d8b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rdi, rdx
mov r14, rcx
lea r13, vtable.TextStream.0
mov qword [rbp - 0x29], r13
xor r15d, r15d
mov qword [rbp - 0x21], r15
mov dword [rbp - 0x19], r15d
mov dword [rbp - 0x15], 0xffffffff
xorps xmm0, xmm0
movdqa xmmword [rbp + 7], xmm0
mov ecx, dword [0x14014e738]
cmp ecx, 0xffffffff
je 0x14002d924
mov dword [rbp - 0x15], ecx
lea rdx, [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_GetCPInfo]
movzx ecx, byte [rbp - 0xb]
test eax, eax
cmove ecx, r15d
mov byte [rbp - 0xb], cl
lea r12, vtable.TextMem.0
mov qword [rbp - 0x29], r12
mov qword [rbp + 0x17], r15
mov dword [rbp + 0x1f], r15d
mov byte [rbp + 0x23], r15b
mov qword [rbp + 0x27], r15
mov qword [rbp - 0x41], r15
mov dword [rbp - 0x39], r15d
mov byte [rbp - 0x35], 0
mov r8d, 0xa
lea rdx, str.E4847ED08866458F8DD35F94B37001C0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x14002daa6
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rbp - 0x39], eax
test eax, eax
je 0x14002daa6
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14002daa6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rbp - 0x41], rax
test rax, rax
je 0x14002daa6
cmp dword [rax], 0x4034b50
jne 0x14002da69
call fcn.140005480
test al, al
je 0x14002dabf
mov edx, r15d
lea r8, [0x140147370]
nop
lea ecx, [rdx + 1]
mov rax, qword [r8]
mov word [rax], cx
inc edx
lea r8, [r8 + 8]
cmp edx, 0xa
jl 0x14002d9d0
lea r9, [0x140147370]
mov r8d, dword [rbp - 0x39]
lea rdx, [rbp - 0x49]
mov rcx, qword [rbp - 0x41]
call fcn.1400c5b30
mov ebx, eax
test eax, eax
je 0x14002da69
lea esi, [rbx + 2]
mov ecx, esi
call fcn.1400e5e30
mov qword [rbp - 0x41], rax
mov byte [rbp - 0x35], 1
mov r8d, ebx
mov rdi, qword [rbp - 0x49]
mov rdx, rdi
mov rcx, rax
call fcn.1400e1c80
mov rax, qword [rbp - 0x41]
mov word [rbx + rax], 0
mov r8d, ebx
xor edx, edx
mov rcx, rdi
call fcn.1400e1940
mov rcx, rdi
call fcn.1400e89fc
mov dword [rbp - 0x39], esi
call fcn.140005480
test al, al
je 0x14002dabf
mov rcx, qword [0x14014a4b0]
call fcn.1400275b0
mov rcx, qword [0x14014a4a8]
call fcn.1400275b0
mov r9d, 0xfde9
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x29]
call fcn.1400bec10
mov rax, qword [r14 + 0xbb0]
mov qword [0x14014b418], rax
inc dword [0x14014b414]
lea rdx, [rbp - 0x29]
mov rcx, r14
call fcn.14002db40
mov ebx, eax
jmp 0x14002dac2
mov qword [rsp + 0x20], r15
xorps xmm3, xmm3
mov r8, rdi
xor edx, edx
lea rcx, str.Could_not_extract_script_from_EXE.
call fcn.1400c8ff0
mov ebx, r15d
mov qword [rbp - 0x29], r12
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x14002daf2
cmp byte [rbp + 0x23], 0
je 0x14002daee
mov r8d, dword [rbp + 0x1f]
test r8, r8
je 0x14002dae9
xor edx, edx
call fcn.1400e1940
mov rcx, qword [rbp + 0x17]
call fcn.1400e89fc
mov qword [rbp + 0x17], r15
mov qword [rbp - 0x29], r13
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x14002db15
xor edx, edx
mov r8d, 0x2000
call fcn.1400e1940
mov rcx, qword [rbp + 0xf]
call fcn.1400e89fc
mov eax, ebx
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret