Function at 0x465640
Capabilities:
Allocate or change rwx memory
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x200b0
call fcn.004ebaf0
mov eax, dword [0x526b24]
xor eax, esp
mov dword [esp + 0x200ac], eax
mov eax, dword [esp + 0x200b4]
push ebx
mov ebx, dword [esp + 0x200bc]
mov dword [esp + 0x14], eax
push ebp
mov ebp, ecx
mov dword [esp + 8], ebp
push esi
mov esi, dword [esp + 0x200d0]
mov dword [esp + 0x28], esi
push edi
test ebx, ebx
je 0x465f80
cmp word [ebx], 0
je 0x465f80
mov eax, dword [0x62271c]
mov edx, dword fs:[0x2c]
lea edi, [eax*4]
mov eax, dword [edi + edx]
cmp byte [eax + 0x2198], 0
jne 0x4656bc
call fcn.004ebad3
mov edx, dword fs:[0x2c]
mov eax, dword [edi + edx]
cmp byte [eax + 0x2198], 0
jne 0x4656d4
call fcn.004ebad3
mov edx, dword fs:[0x2c]
mov ecx, dword [edi + edx]
mov eax, dword [ecx + 0x944]
cmp eax, dword [ecx + 0x99c]
jl 0x46581a
cmp byte [ecx + 0x2198], 0
jne 0x4656fe
call fcn.004ebad3
mov edx, dword fs:[0x2c]
mov eax, dword [edi + edx]
cmp dword [eax + 0x944], 0xffff
jl 0x465723
push 0x4f5b70
push str.Too_many_includes.
mov ecx, ebp
call fcn.0046cf30
jmp 0x465f82
cmp byte [eax + 0x2198], 0
jne 0x465738
call fcn.004ebad3
mov edx, dword fs:[0x2c]
mov eax, dword [edi + edx]
cmp dword [eax + 0x99c], 0
je 0x465773
cmp byte [eax + 0x2198], 0
jne 0x465759
call fcn.004ebad3
mov edx, dword fs:[0x2c]
mov eax, dword [edi + edx]
mov esi, dword [eax + 0x99c]
add esi, esi
cmp esi, 0xffff
jle 0x465778
mov esi, 0xffff
jmp 0x465778
mov esi, 0x64
cmp byte [eax + 0x2198], 0
lea ecx, [esi*4]
jne 0x46579b
call fcn.004ebad3
mov edx, dword fs:[0x2c]
lea ecx, [esi*4]
mov eax, dword [edi + edx]
push ecx
push dword [eax + 0x938]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
add esp, 8
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x4657cc
push 0x4f5b70
push str.Out_of_memory.
mov ecx, ebp
call fcn.0046cf30
jmp 0x465f82
mov edx, dword fs:[0x2c]
mov eax, dword [edi + edx]
cmp byte [eax + 0x2198], 0
jne 0x4657eb
call fcn.004ebad3
mov edx, dword fs:[0x2c]
mov eax, dword [edi + edx]
mov ecx, dword [esp + 0x1c]
cmp byte [eax + 0x2198], 0
mov dword [eax + 0x938], ecx
jne 0x46580d
call fcn.004ebad3
mov edx, dword fs:[0x2c]
mov ecx, dword [edi + edx]
mov dword [ecx + 0x99c], esi
mov esi, dword [esp + 0x2c]
cmp byte [ecx + 0x2198], 0
jne 0x46582f
call fcn.004ebad3
mov edx, dword fs:[0x2c]
mov eax, dword [edi + edx]
mov ebp, dword [eax + 0x944]
test esi, esi
je 0x465994
test ebp, ebp
jne 0x465869
cmp byte [eax + 0x2198], 0
jne 0x465859
call fcn.004ebad3
mov edx, dword fs:[0x2c]
mov eax, dword [edi + edx]
mov eax, dword [eax + 0x938]
mov dword [eax], ebx
jmp 0x4658fe
cmp word [esi], 0
je 0x4658b9
cmp byte [eax + 0x2198], 0
jne 0x465884
call fcn.004ebad3
mov edx, dword fs:[0x2c]
mov eax, dword [edi + edx]
push 0xffffffffffffffff
push esi
mov ecx, dword [eax + 0x260]
call fcn.004df790
mov esi, eax
mov eax, dword fs:[0x2c]
mov ecx, dword [edi + eax]
cmp byte [ecx + 0x2198], 0
jne 0x4658b4
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov eax, dword [edi + eax]
jmp 0x4658f5
cmp byte [eax + 0x2198], 0
jne 0x4658ce
call fcn.004ebad3
mov edx, dword fs:[0x2c]
mov ecx, dword [edi + edx]
cmp byte [ecx + 0x2198], 0
mov eax, dword [ecx + 0x298]
mov esi, dword [eax + 0x6c4]
jne 0x4658f2
call fcn.004ebad3
mov edx, dword fs:[0x2c]
mov eax, dword [edi + edx]
mov eax, dword [eax + 0x938]
mov dword [eax + ebp*4], esi
mov byte [esp + 0x38], 0
lea ecx, [ebx + 2]
mov dword [esp + 0x30], ebx
nop word [eax + eax]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x465910
sub ebx, ecx
sar ebx, 1
lea eax, [ebx + ebx]
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x34], eax
mov eax, dword [ebx]
test eax, eax
jne 0x46594f
push 0x44
call fcn.004ebb43
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
je 0x46594b
mov ecx, eax
call fcn.0044ef10
jmp 0x46594d
xor eax, eax
mov dword [ebx], eax
push 0x4b0
push 0xc
lea ecx, [esp + 0x38]
push ecx
mov ecx, eax
call fcn.004e1370
mov ecx, dword fs:[0x2c]
mov eax, dword [edi + ecx]
cmp byte [eax + 0x2198], 0
jne 0x465981
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [edi + ecx]
inc dword [eax + 0x944]
mov eax, 3
jmp 0x465f82
movzx ecx, word [ebx]
test ebp, ebp
jne 0x4659cf
cmp ecx, 0x2a
je 0x4659d4
cmp byte [eax + 0x2198], 0
mov ecx, dword [esp + 0x10]
mov esi, dword [ecx + 0x6b4]
jne 0x4659bf
call fcn.004ebad3
mov edx, dword fs:[0x2c]
mov eax, dword [edi + edx]
mov eax, dword [eax + 0x938]
mov dword [eax], esi
jmp 0x465a92
cmp ecx, 0x2a
jne 0x4659f4
push 0x8000
lea eax, [esp + 0x40]
push ebx
push eax
call fcn.004e6a80
add esp, 0xc
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
jmp 0x465a0a
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x40]
push eax
push 0x8000
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp byte [esp + 0x200cc], 0
jne 0x465a63
xor esi, esi
test ebp, ebp
jle 0x465a63
nop word [eax + eax]
mov ecx, dword fs:[0x2c]
mov eax, dword [edi + ecx]
cmp byte [eax + 0x2198], 0
jne 0x465a3f
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
lea eax, [esp + 0x3c]
push eax
mov eax, dword [edi + ecx]
mov eax, dword [eax + 0x938]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x465f36
inc esi
cmp esi, ebp
jl 0x465a20
mov ecx, dword fs:[0x2c]
mov eax, dword [edi + ecx]
cmp byte [eax + 0x2198], 0
jne 0x465a82
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [edi + ecx]
mov eax, dword [eax + 0x938]
mov dword [eax + ebp*4], 0
mov ecx, dword fs:[0x2c]
mov dword [esp + 0x1c], ebx
mov eax, dword [edi + ecx]
cmp byte [eax + 0x2198], 0
jne 0x465ab5
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [edi + ecx]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
mov eax, dword [eax + 0x218]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
test ebp, ebp
jne 0x465afd
mov esi, dword [0x527690]
mov dword [esp + 0x28], esi
test esi, esi
jne 0x465bca
cmp word [ebx], 0x2a
jne 0x465d86
cmp word [ebx + 2], 0
lea eax, [ebx + 2]
je 0x465d86
push 4
push 0x4ff14c
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
mov ecx, 0xa
push 4
lea eax, [ebx + 2]
mov esi, 0x4ff158
push 0x4ff14c
push eax
cmovne esi, ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0x18
neg eax
sbb eax, eax
and eax, 0xfffffff8
add eax, 0xa
push esi
add eax, ebx
push eax
push dword [0x5276ac]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
mov dword [esp + 0x28], esi
test esi, esi
jne 0x465bca
push 4
lea eax, [ebx + 2]
push 0x4ff14c
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
mov ecx, 0xa
mov eax, 0x4ff158
cmovne eax, ecx
push 4
mov dword [esp + 0x34], eax
lea eax, [ebx + 2]
push 0x4ff14c
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0x18
neg eax
sbb eax, eax
and eax, 0xfffffff8
push dword [esp + 0x24]
add eax, 0xa
add eax, ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [esp + 0x18], eax
test eax, eax
je 0x465d86
push esi
push esi
jmp 0x465bd1
push esi
push dword [0x5276ac]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x465d7e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], eax
test eax, eax
je 0x465d7e
cmp dword [esp + 0x18], 0
push esi
je 0x465c02
push 0
jmp 0x465c08
push dword [0x5276ac]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x34], esi
cmp dword [eax], 0x4034b50
jne 0x465d2b
cmp dword [0x527690], 0
je 0x465c3a
call fcn.00414b10
test al, al
je 0x465f80
push 0x5230d8
push esi
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x30]
call fcn.004e3250
add esp, 0x10
mov dword [esp + 0x14], eax
test eax, eax
je 0x465d5e
add eax, 2
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push dword [esp + 0x18]
mov dword [esp + 0x38], eax
push dword [esp + 0x20]
mov byte [esp + 0x44], 1
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x40]
xor edx, edx
mov ecx, dword [esp + 0x24]
add esp, 0x10
mov word [eax + ecx], dx
mov eax, dword [esp + 0x14]
test eax, eax
je 0x465ca5
push eax
push edx
push dword [esp + 0x20]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [esp + 0x18]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [esp + 0x18]
add esp, 4
add eax, 2
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x10]
mov dword [eax + 0x734], 3
cmp dword [0x527690], 0
je 0x465ce1
call fcn.00414b10
test al, al
je 0x465f80
push dword [0x527694]
call fcn.0044d150
push dword [0x527698]
call fcn.0044d150
mov eax, dword [esp + 0x30]
add esp, 8
cmp eax, dword [0x527690]
jne 0x465d2b
lea eax, [esp + 0x14]
push eax
push 0x40
push esi
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test esi, esi
je 0x465d2b
push esi
push 0
push dword [esp + 0x2c]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x30]
mov dword [esp + 0x2c], 0xfde9
push 0x44
mov dword [esp + 0x20], eax
call fcn.004ebb43
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
je 0x465d72
mov ecx, eax
call fcn.0044ef10
mov ecx, dword [esp + 0x20]
mov esi, eax
mov dword [ecx], eax
jmp 0x465db8
mov ecx, dword [esp + 0x10]
push ebx
push str.Could_not_extract_script_from_EXE.
call fcn.0046cf30
jmp 0x465f82
mov ecx, dword [esp + 0x20]
xor eax, eax
mov esi, eax
mov dword [ecx], eax
jmp 0x465db8
mov ecx, dword [esp + 0x20]
mov esi, dword [ecx]
jmp 0x465db8
push 0x38
call fcn.004ebb43
mov esi, eax
add esp, 4
mov dword [esp + 0x28], esi
test esi, esi
je 0x465db0
mov ecx, esi
call fcn.0044ef50
mov dword [esi], vtable.TextFile.0
mov dword [esi + 0x34], 0xffffffff
jmp 0x465db2
xor esi, esi
mov ecx, dword [esp + 0x20]
mov dword [ecx], esi
test esi, esi
je 0x465f2c
push dword [esp + 0x2c]
mov ecx, esi
push 0x30c
push dword [esp + 0x24]
call fcn.004e1370
test al, al
je 0x465f2c
test ebp, ebp
je 0x465f15
lea eax, [esp + 0x3c]
push 0x5c
push eax
call sub.VCRUNTIME140.dll_wcsrchr
mov esi, eax
add esp, 8
lea eax, [esp + 0x3c]
cmp esi, eax
jbe 0x465e17
xor eax, eax
mov word [esi], ax
lea eax, [esp + 0x3c]
push eax
call fcn.0049ffd0
mov eax, 0x5c
add esp, 4
mov word [esi], ax
mov ebx, dword [esp + 0x10]
mov ecx, dword fs:[0x2c]
mov eax, dword [edi + ecx]
cmp byte [eax + 0x2198], 0
jne 0x465e3a
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov edx, dword [edi + ecx]
mov eax, dword [edx + 0x938]
cmp dword [eax + ebp*4], 0
jne 0x465ea5
cmp byte [edx + 0x2198], 0
jne 0x465e5e
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [edi + ecx]
lea ecx, [esp + 0x3c]
push 0xffffffffffffffff
push ecx
mov ecx, dword [eax + 0x260]
call fcn.004df790
mov esi, eax
mov eax, dword fs:[0x2c]
mov ecx, dword [edi + eax]
cmp byte [ecx + 0x2198], 0
jne 0x465e92
call fcn.004ebad3
mov eax, dword fs:[0x2c]
mov eax, dword [edi + eax]
mov eax, dword [eax + 0x938]
mov dword [eax + ebp*4], esi
mov ecx, dword fs:[0x2c]
mov eax, dword [edi + ecx]
cmp byte [eax + 0x2198], 0
jne 0x465ebd
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [edi + ecx]
inc dword [eax + 0x944]
test ebp, ebp
jne 0x465f0e
push 0xa
push 2
push dword [0x5276ac]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x465ef4
push ebp
push ebp
push 0x4ff20c
mov ecx, ebx
call fcn.00465140
test eax, eax
je 0x465f80
mov eax, dword [ebx + 0x6e4]
test eax, eax
je 0x465f0e
push 0
push 0
push eax
mov ecx, ebx
call fcn.00465140
test eax, eax
je 0x465f80
mov eax, 3
jmp 0x465f82
mov ebx, dword [esp + 0x10]
push dword [ebx + 0x6b8]
call fcn.0049ffd0
add esp, 4
jmp 0x465e1b
cmp byte [esp + 0x200d0], 0
je 0x465f3d
mov eax, 1
jmp 0x465f82
push ebx
mov ecx, str.Script
test ebp, ebp
mov eax, str.Include
cmove eax, ecx
push eax
push str._s_file___s__cannot_be_opened.
lea eax, [esp + 0x10048]
push 0x8040
push eax
call fcn.004e6440
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10050]
add esp, 0x14
push 0x4f5b70
push eax
call fcn.0046cf30
jmp 0x465f82
xor eax, eax
mov ecx, dword [esp + 0x200bc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ebadf
add esp, 0x200b0
ret 0x14