Function at 0x1400398a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1ffc0]
mov eax, 0x200c0
call fcn.1400ecec0
sub rsp, rax
xor ebx, ebx
movzx r14d, r9b
mov qword [rsp + 0x30], rbx
mov rsi, r8
mov dword [rsp + 0x38], ebx
mov r12, rdx
mov byte [rsp + 0x3c], bl
mov r13, rcx
test r8, r8
je 0x140039b6b
cmp word [r8], bx
je 0x140039b6b
mov r8d, dword [0x140128ad8]
mov edi, dword [0x140128af4]
cmp r8d, edi
jl 0x14003999a
cmp r8d, 0xffff
jl 0x140039933
lea r8, [0x1400ef7e4]
lea rdx, str.Too_many_includes.
call fcn.14005fed0
jmp 0x140039b6d
test edi, edi
je 0x140039948
add edi, edi
cmp edi, 0xffff
jle 0x14003994d
mov edi, 0xffff
jmp 0x14003994d
mov edi, WSAAsyncSelect
mov rcx, qword [0x140128ad0]
movsxd rdx, edi
shl rdx, 3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov rcx, rax
test rax, rax
jne 0x140039984
lea r8, [0x1400ef7e4]
mov rcx, r13
lea rdx, str.Out_of_memory.
call fcn.14005fed0
jmp 0x140039b6d
mov r8d, dword [0x140128ad8]
mov qword [0x140128ad0], rax
mov dword [0x140128af4], edi
jmp 0x1400399a1
mov rcx, qword [0x140128ad0]
mov rdi, qword [rbp + 0x20018]
movsxd r15, r8d
test rdi, rdi
je 0x140039a5f
mov rbx, 0xffffffffffffffff
test r8d, r8d
jne 0x1400399c6
mov qword [rcx + r15*8], rsi
jmp 0x140039a21
cmp word [rdi], 0
je 0x140039a16
mov rcx, rbx
nop
cmp word [rdi + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1400399d0
lea rcx, [rcx*2 + 2]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, qword [0x140128ad0]
mov rdx, rax
mov qword [rcx + r15*8], rax
test rax, rax
je 0x140039969
movzx eax, word [rdi]
lea rdi, [rdi + 2]
mov word [rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x140039a01
jmp 0x140039a21
mov rax, qword [0x14012bb88]
mov qword [rcx + r15*8], rax
mov qword [rsp + 0x30], rsi
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x140039a26
add ebx, ebx
lea rdx, [rsp + 0x30]
mov r9d, 0x4b0
mov dword [rsp + 0x38], ebx
mov r8d, reloc.WSOCK32.dll_ioctlsocket
mov rcx, r12
call fcn.1400cb1e0
inc dword [0x140128ad8]
mov eax, 3
jmp 0x140039b6d
test r8d, r8d
jne 0x140039a70
mov rax, qword [r13 + 0xbb0]
mov qword [rcx], rax
jmp 0x140039acd
lea r9, [rbp + 0x20000]
mov edx, 0x8000
lea r8, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test r14b, r14b
jne 0x140039ac6
test r15d, r15d
jle 0x140039ac6
mov rdi, rbx
nop word [rax + rax]
mov rcx, qword [0x140128ad0]
lea rdx, [rsp + 0x40]
mov rcx, qword [rcx + rdi*8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140039d2c
inc rdi
cmp rdi, r15
jl 0x140039aa0
mov r8d, dword [0x140128ad8]
mov rcx, qword [0x140127b10]
test rcx, rcx
je 0x140039d04
test r8d, r8d
jne 0x140039d04
mov rdx, qword [0x140128a08]
test rdx, rdx
jne 0x140039b49
mov rdx, rcx
mov rcx, qword [0x140127b08]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x38], eax
test eax, eax
je 0x140039b52
mov rdx, qword [0x140127b10]
mov rcx, qword [0x140127b08]
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140039b52
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140039b52
mov rdx, qword [0x140128a08]
test rdx, rdx
je 0x140039ba5
mov rcx, qword [0x140127b10]
test rcx, rcx
jne 0x140039b8e
mov dword [rsp + 0x38], ebx
xorps xmm3, xmm3
mov qword [rsp + 0x20], rbx
mov r8, rsi
lea rcx, str.Could_not_extract_script_from_EXE.
xor edx, edx
call fcn.1400d58f0
xor eax, eax
lea r11, [rsp + 0x200c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, dword [rcx + 4]
mov dword [rsp + 0x38], eax
test eax, eax
je 0x140039b52
mov eax, dword [rcx]
add rax, qword [rdx]
mov qword [rsp + 0x30], rax
je 0x140039b52
cmp dword [rax], 0x4034b50
jne 0x140039c6c
call fcn.140005b80
test al, al
je 0x140039b6b
lea rdx, [0x140125af0]
mov rax, qword [rdx]
lea ecx, [rbx + 1]
inc ebx
lea rdx, [rdx + 8]
mov word [rax], cx
cmp ebx, 0xa
jl 0x140039bc1
mov r8d, dword [rsp + 0x38]
lea r9, [0x140125af0]
mov rcx, qword [rsp + 0x30]
lea rdx, [rbp + 0x20000]
call fcn.1400d23f0
mov ebx, eax
test eax, eax
je 0x140039c6c
lea esi, [rbx + 2]
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, qword [rbp + 0x20000]
mov r8d, ebx
mov rdx, rdi
mov qword [rsp + 0x30], rax
mov rcx, rax
mov byte [rsp + 0x3c], 1
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x30]
mov r8d, ebx
xor edx, edx
mov rcx, rdi
mov word [rbx + rax], 0
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov dword [rsp + 0x38], esi
call fcn.140005b80
test al, al
je 0x140039b6b
mov rcx, qword [0x140127b38]
call fcn.1400301e0
mov rcx, qword [0x140127b30]
call fcn.1400301e0
mov r9d, 0xfde9
lea rdx, [rsp + 0x30]
mov r8d, reloc.WSOCK32.dll_ioctlsocket
mov rcx, r12
call fcn.1400cb1e0
test r15d, r15d
jle 0x140039cf4
lea rax, [rsp + 0x40]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rax + rbx*2 + 2], 0
lea rbx, [rbx + 1]
jne 0x140039ca0
lea rcx, [rbx*2 + 2]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, qword [0x140128ad0]
mov r8, rax
mov qword [rcx + r15*8], rax
test rax, rax
je 0x140039969
lea rcx, [rsp + 0x40]
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [r8], ax
lea r8, [r8 + 2]
test ax, ax
jne 0x140039ce0
inc dword [0x140128ad8]
mov eax, 3
jmp 0x140039b6d
mov r9d, dword [0x140127a9c]
mov r8d, 0x30c
mov rdx, rsi
mov rcx, r12
call fcn.1400cb1e0
test al, al
jne 0x140039c85
cmp byte [rbp + 0x20010], bl
je 0x140039d36
mov eax, 1
jmp 0x140039b6d
lea rax, str.Include
mov qword [rsp + 0x20], rsi
test r15d, r15d
lea r9, str.Script
lea r8, str._s_file___s__cannot_be_opened.
mov edx, 0x8040
cmovg r9, rax
lea rcx, [rbp + 0xff40]
call fcn.1400ce300
lea r8, [0x1400ef7e4]
mov rcx, r13
lea rdx, [rbp + 0xff40]
call fcn.14005fed0
jmp 0x140039b6d