Function at 0x140048180
Capabilities:
Extract resource via kernel32 functions
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1ffd0]
mov eax, 0x200d0
call fcn.1400de6f0
sub rsp, rax
movzx edi, r9b
mov r12, r8
mov rsi, rcx
test r8, r8
je 0x140048935
cmp word [r8], 0
je 0x140048935
mov r15d, dword [0x14012b018]
mov ebx, dword [0x14012c3a0]
cmp r15d, ebx
jl 0x14004843e
cmp r15d, 0xffff
jl 0x1400482ed
mov rcx, qword [rcx + 0x6b8]
movzx eax, byte [0x14012ce0c]
test rcx, rcx
je 0x140048278
test al, al
je 0x140048278
mov rax, qword [0x1401241d8]
cmp dword [rax + 0x60], 0
jne 0x14004824d
cmp dword [rsi + 0x718], 0
jne 0x14004824d
cmp byte [0x140126ada], 0
jne 0x14004824d
xor ebx, ebx
lea r9, [0x140100be0]
mov qword [rsp + 0x28], rbx
lea rdx, str.Too_many_includes.
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rsi
call fcn.140010370
mov ebx, eax
jmp 0x140048937
xor ebx, ebx
lea r8, [0x140100be0]
mov r9, rcx
mov qword [rsp + 0x28], rbx
lea rdx, str.Too_many_includes.
mov dword [rsp + 0x20], ebx
mov rcx, rsi
call fcn.14000efc0
mov ebx, eax
jmp 0x140048937
xor ebx, ebx
cmp byte [0x14012ce0f], bl
je 0x1400482c3
test al, al
jne 0x1400482c3
test rcx, rcx
je 0x140048295
movzx r9d, word [rcx + 2]
mov eax, dword [rcx + 4]
jmp 0x1400482a2
mov r9d, dword [rsi + 0x2d8]
mov eax, dword [rsi + 0x2dc]
lea r8, [0x140100be0]
mov dword [rsp + 0x20], eax
lea rdx, str.Too_many_includes.
mov rcx, rsi
call fcn.14000f360
mov eax, ebx
jmp 0x140048937
mov qword [rsp + 0x28], rbx
lea r9, [0x140100be0]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.Too_many_includes.
mov rcx, rsi
call fcn.140010370
mov eax, ebx
jmp 0x140048937
test ebx, ebx
je 0x140048302
add ebx, ebx
cmp ebx, 0xffff
jle 0x140048307
mov ebx, 0xffff
jmp 0x140048307
mov ebx, WSAAsyncSelect
mov rcx, qword [0x14012b010]
movsxd rdx, ebx
shl rdx, 3
call fcn.1400c50d4
mov rcx, rax
test rax, rax
jne 0x140048428
mov rcx, qword [rsi + 0x6b8]
movzx eax, byte [0x14012ce0c]
test rcx, rcx
je 0x1400483b3
test al, al
je 0x1400483b3
mov rax, qword [0x1401241d8]
cmp dword [rax + 0x60], 0
jne 0x140048388
cmp dword [rsi + 0x718], 0
jne 0x140048388
cmp byte [0x140126ada], 0
jne 0x140048388
xor ebx, ebx
lea r9, [0x140100be0]
mov qword [rsp + 0x28], rbx
lea rdx, str.Out_of_memory.
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rsi
call fcn.140010370
mov ebx, eax
jmp 0x140048937
xor ebx, ebx
lea r8, [0x140100be0]
mov r9, rcx
mov qword [rsp + 0x28], rbx
lea rdx, str.Out_of_memory.
mov dword [rsp + 0x20], ebx
mov rcx, rsi
call fcn.14000efc0
mov ebx, eax
jmp 0x140048937
xor ebx, ebx
cmp byte [0x14012ce0f], bl
je 0x1400483fe
test al, al
jne 0x1400483fe
test rcx, rcx
je 0x1400483d0
movzx r9d, word [rcx + 2]
mov eax, dword [rcx + 4]
jmp 0x1400483dd
mov r9d, dword [rsi + 0x2d8]
mov eax, dword [rsi + 0x2dc]
lea r8, [0x140100be0]
mov dword [rsp + 0x20], eax
lea rdx, str.Out_of_memory.
mov rcx, rsi
call fcn.14000f360
mov eax, ebx
jmp 0x140048937
mov qword [rsp + 0x28], rbx
lea r9, [0x140100be0]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.Out_of_memory.
mov rcx, rsi
call fcn.140010370
mov eax, ebx
jmp 0x140048937
mov r15d, dword [0x14012b018]
mov qword [0x14012b010], rax
mov dword [0x14012c3a0], ebx
jmp 0x140048445
mov rcx, qword [0x14012b010]
movzx eax, word [r12]
xor ebx, ebx
lea r14, [rbx - 1]
test r15d, r15d
jne 0x14004846d
cmp ax, 0x2a
je 0x140048473
mov rax, qword [rsi + 0x760]
mov qword [rcx], rax
movsxd rdi, r15d
jmp 0x140048513
cmp ax, 0x2a
jne 0x14004849a
mov r8d, 0x7fff
lea rcx, [rsp + 0x50]
mov rdx, r12
call fcn.1400d3a74
lea rcx, [rsp + 0x50]
mov word [rbp + 0xff4e], bx
call qword [sym.imp.USER32.dll_CharUpperW]
jmp 0x1400484b4
lea r9, [rbp + 0x20020]
mov edx, 0x8000
lea r8, [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test dil, dil
jne 0x140048505
movsxd r13, r15d
mov rdi, rbx
test r15d, r15d
jle 0x140048505
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [0x14012b010]
lea r8, [rsp + 0x50]
mov r9d, r14d
mov dword [rsp + 0x20], 1
mov edx, r14d
mov rcx, qword [rcx + rdi*8]
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
je 0x140048809
inc rdi
cmp rdi, r13
jl 0x1400484d0
mov rax, qword [0x14012b010]
movsxd rdi, r15d
mov qword [rax + rdi*8], rbx
cmp word [r12], 0x2a
mov eax, dword [0x1401241e8]
mov dword [rbp + 0x20020], eax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], ebx
mov byte [rsp + 0x44], bl
jne 0x14004863c
cmp word [r12 + 2], bx
lea rdx, [r12 + 2]
je 0x14004863c
xor ecx, ecx
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r13, rax
test rax, rax
je 0x14004863c
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140048630
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140048630
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, 0x58
mov dword [rbp + 0x20020], 0xfde9
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], rax
call fcn.1400be294
mov ecx, dword [0x14012d060]
mov rdi, rax
mov qword [rsp + 0x48], rax
lea rax, vtable.TextStream.0
mov qword [rdi], rax
mov qword [rdi + 8], rbx
mov dword [rdi + 0x10], ebx
mov dword [rdi + 0x14], 0xffffffff
mov qword [rdi + 0x30], rbx
mov qword [rdi + 0x38], rbx
cmp ecx, 0xffffffff
je 0x140048605
lea rdx, [rdi + 0x18]
mov dword [rdi + 0x14], ecx
call qword [sym.imp.KERNEL32.dll_GetCPInfo]
test eax, eax
jne 0x140048605
mov byte [rdi + 0x1e], bl
mov rcx, qword [rbp + 0x20018]
lea rax, vtable.TextMem.0
mov qword [rdi], rax
mov byte [rdi + 0x4c], 1
mov qword [rdi + 0x40], rbx
mov qword [rcx], rdi
mov dword [rdi + 0x48], ebx
mov byte [rdi + 0x4c], bl
mov qword [rdi + 0x50], rbx
movsxd rdi, r15d
jmp 0x14004865d
mov rcx, qword [rbp + 0x20018]
movsxd rdi, r15d
jmp 0x14004865d
mov ecx, 0x48
call fcn.1400be294
mov rcx, rax
mov qword [rsp + 0x48], rax
call fcn.140007b64
mov rcx, qword [rbp + 0x20018]
mov qword [rcx], rax
mov rcx, qword [rcx]
test rcx, rcx
je 0x140048801
mov r9d, dword [rbp + 0x20020]
mov r8d, 0x30c
mov rdx, qword [rsp + 0x30]
call fcn.14009de50
test al, al
je 0x140048801
mov rax, qword [0x14012b010]
lea r12, [rdi*8]
cmp qword [r12 + rax], rbx
jne 0x140048701
cmp word [rsp + 0x50], bx
je 0x1400486f6
lea rax, [rsp + 0x50]
nop dword [rax]
inc r14
cmp word [rax + r14*2], bx
jne 0x1400486b0
lea r13, [r14 + r14]
lea rcx, [r13 + 2]
call fcn.14009d6e0
mov rdi, rax
test rax, rax
je 0x140048952
test r14, r14
je 0x1400486e8
mov r8, r13
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400e20f0
mov rax, qword [0x14012b010]
mov word [rdi + r13], bx
jmp 0x1400486fd
lea rdi, [0x140100be0]
mov qword [r12 + rax], rdi
inc dword [0x14012b018]
test r15d, r15d
jne 0x140048776
lea edx, [r15 + 2]
xor ecx, ecx
lea r8d, [r15 + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14004873e
xor r9d, r9d
lea rdx, [0x140109878]
xor r8d, r8d
mov rcx, rsi
call fcn.140048960
test eax, eax
je 0x140048935
mov rdx, qword [rsi + 0x7a8]
test rdx, rdx
je 0x140048760
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call fcn.140048960
test eax, eax
je 0x140048935
mov rcx, qword [rsi + 0x768]
call fcn.1400678b0
mov eax, 3
jmp 0x140048937
mov r14d, 0x5c
lea rcx, [rsp + 0x50]
mov edx, r14d
call fcn.1400bff14
mov rsi, rax
lea rax, [rsp + 0x50]
cmp rsi, rax
jbe 0x1400487f7
mov word [rsi], bx
lea rdi, [rsp + 0x50]
movzx ecx, word [rsp + 0x50]
test cx, cx
je 0x1400487d6
movzx eax, word [rsp + 0x52]
cmp ax, 0x3a
jne 0x1400487d6
cmp word [rsp + 0x54], bx
jne 0x1400487d6
mov word [rbp + 0x20020], cx
lea rdi, [rbp + 0x20020]
mov word [rbp + 0x20022], ax
mov dword [rbp + 0x20024], r14d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x1400487f3
cmp byte [0x14012ce0c], bl
je 0x1400487f3
mov rcx, rdi
call fcn.140067920
mov word [rsi], r14w
mov eax, 3
jmp 0x140048937
cmp byte [rbp + 0x20030], bl
je 0x140048813
mov eax, 1
jmp 0x140048937
lea rax, str.Include
mov qword [rsp + 0x20], r12
test r15d, r15d
lea r9, str.Script
lea r8, str._s_file___s__cannot_be_opened.
mov edx, 0x8040
cmovne r9, rax
lea rcx, [rbp + 0xff50]
call fcn.1400a0ee0
mov rcx, qword [rsi + 0x6b8]
movzx eax, byte [0x14012ce0c]
test rcx, rcx
je 0x1400488c8
test al, al
je 0x1400488c8
mov rax, qword [0x1401241d8]
cmp dword [rax + 0x60], ebx
jne 0x1400488a2
cmp dword [rsi + 0x718], ebx
jne 0x1400488a2
cmp byte [0x140126ada], bl
jne 0x1400488a2
mov qword [rsp + 0x28], rbx
lea r9, [0x140100be0]
mov qword [rsp + 0x20], rcx
lea rdx, [rbp + 0xff50]
mov rcx, rsi
xor r8d, r8d
call fcn.140010370
mov ebx, eax
jmp 0x140048937
mov r9, rcx
mov qword [rsp + 0x28], rbx
mov rcx, rsi
mov dword [rsp + 0x20], ebx
lea r8, [0x140100be0]
lea rdx, [rbp + 0xff50]
call fcn.14000efc0
mov ebx, eax
jmp 0x140048937
cmp byte [0x14012ce0f], bl
je 0x14004890e
test al, al
jne 0x14004890e
test rcx, rcx
je 0x1400488e3
movzx r9d, word [rcx + 2]
mov eax, dword [rcx + 4]
jmp 0x1400488f0
mov r9d, dword [rsi + 0x2d8]
mov eax, dword [rsi + 0x2dc]
lea r8, [0x140100be0]
mov dword [rsp + 0x20], eax
lea rdx, [rbp + 0xff50]
mov rcx, rsi
call fcn.14000f360
mov eax, ebx
jmp 0x140048937
mov qword [rsp + 0x28], rbx
lea r9, [0x140100be0]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rbp + 0xff50]
mov rcx, rsi
call fcn.140010370
mov eax, ebx
jmp 0x140048937
xor eax, eax
mov rbx, qword [rsp + 0x20110]
add rsp, 0x200d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140010e40
int3