Function at 0x14002a910
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x200c0
call fcn.1400eb380
sub rsp, rax
movzx edi, r9b
mov r14, r8
mov r13, rdx
mov rbp, rcx
test r8, r8
je 0x14002ad9f
cmp word [r8], 0
je 0x14002ad9f
mov esi, dword [0x1401351b0]
mov ebx, dword [0x1401351cc]
cmp esi, ebx
jl 0x14002a9d4
cmp esi, 0xffff
jl 0x14002a986
lea r8, [0x1400fb87c]
lea rdx, str.Too_many_includes.
call fcn.1400515e0
jmp 0x14002ada1
test ebx, ebx
je 0x14002a99b
add ebx, ebx
cmp ebx, 0xffff
jle 0x14002a9a0
mov ebx, 0xffff
jmp 0x14002a9a0
mov ebx, WSAAsyncSelect
mov rcx, qword [0x1401351a8]
movsxd rdx, ebx
shl rdx, 3
call fcn.1400d29bc
mov rcx, rax
test rax, rax
je 0x14002ac94
mov esi, dword [0x1401351b0]
mov qword [0x1401351a8], rax
mov dword [0x1401351cc], ebx
jmp 0x14002a9db
mov rcx, qword [0x1401351a8]
movzx eax, word [r14]
xor ebx, ebx
test esi, esi
jne 0x14002a9fa
cmp ax, 0x2a
je 0x14002aa00
mov rax, qword [rbp + 0xb80]
mov qword [rcx], rax
jmp 0x14002aa86
cmp ax, 0x2a
jne 0x14002aa28
mov r8d, 0x7fff
lea rcx, [rsp + 0x40]
mov rdx, r14
call fcn.1400de184
lea rcx, [rsp + 0x40]
mov word [rsp + 0x1003e], bx
call qword [sym.imp.USER32.dll_CharUpperW]
jmp 0x14002aa43
lea r9, [rsp + 0x20100]
mov edx, 0x8000
lea r8, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test dil, dil
jne 0x14002aa78
movsxd rdi, esi
test esi, esi
jle 0x14002aa78
nop
mov rcx, qword [0x1401351a8]
lea rdx, [rsp + 0x40]
mov rcx, qword [rcx + rbx*8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14002ad4d
inc rbx
cmp rbx, rdi
jl 0x14002aa50
xor ebx, ebx
mov rax, qword [0x1401351a8]
movsxd rcx, esi
mov qword [rax + rcx*8], rbx
cmp word [r14], 0x2a
mov r15, r14
mov r12d, dword [0x140134274]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], ebx
mov rbx, 0xffffffffffffffff
mov byte [rsp + 0x3c], 0
jne 0x14002ab92
cmp word [r14 + 2], 0
lea rdx, [r14 + 2]
je 0x14002ab92
xor ecx, ecx
lea r8d, [rbx + 0xb]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x14002ab92
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14002abfa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14002abfa
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [rbx + 0x59]
mov dword [rsp + 0x38], eax
lea r15, [rsp + 0x30]
mov r12d, 0xfde9
call fcn.1400c9e74
mov qword [rsp + 0x20100], rax
mov rdi, rax
mov ecx, dword [0x140137468]
lea rax, vtable.TextStream.0
xor edx, edx
mov qword [rdi], rax
mov qword [rdi + 8], rdx
mov dword [rdi + 0x10], edx
mov dword [rdi + 0x14], 0xffffffff
mov qword [rdi + 0x30], rdx
mov qword [rdi + 0x38], rdx
cmp ecx, 0xffffffff
je 0x14002ab73
lea rdx, [rdi + 0x18]
mov dword [rdi + 0x14], ecx
call qword [sym.imp.KERNEL32.dll_GetCPInfo]
xor edx, edx
test eax, eax
jne 0x14002ab73
mov byte [rdi + 0x1e], al
lea rax, vtable.TextMem.0
mov qword [rdi], rax
mov byte [rdi + 0x4c], 1
mov qword [rdi + 0x40], rdx
mov dword [rdi + 0x48], edx
mov byte [rdi + 0x4c], 0
mov qword [rdi + 0x50], rdx
jmp 0x14002abf6
mov ecx, 0x48
call fcn.1400c9e74
mov qword [rsp + 0x20100], rax
mov rdi, rax
mov ecx, dword [0x140137468]
lea rax, vtable.TextStream.0
mov qword [rdi], rax
xor eax, eax
mov qword [rdi + 8], rax
mov dword [rdi + 0x10], eax
mov dword [rdi + 0x14], 0xffffffff
mov qword [rdi + 0x30], rax
mov qword [rdi + 0x38], rax
cmp ecx, 0xffffffff
je 0x14002abe8
lea rdx, [rdi + 0x18]
mov dword [rdi + 0x14], ecx
call qword [sym.imp.KERNEL32.dll_GetCPInfo]
test eax, eax
jne 0x14002abe8
mov byte [rdi + 0x1e], al
lea rax, vtable.TextFile.0
mov qword [rdi + 0x40], rbx
mov qword [rdi], rax
mov qword [r13], rdi
mov rcx, qword [r13]
test rcx, rcx
je 0x14002ad43
mov r9d, r12d
mov r8d, 0x30c
mov rdx, r15
call fcn.1400a9c60
test al, al
je 0x14002ad43
movsxd rax, esi
lea r14, [rax*8]
mov rax, qword [0x1401351a8]
cmp qword [r14 + rax], 0
jne 0x14002ace3
cmp word [rsp + 0x40], 0
je 0x14002acd8
lea rax, [rsp + 0x40]
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14002ac50
lea r15, [rbx + rbx]
lea rcx, [r15 + 2]
call fcn.1400a96d0
mov rdi, rax
test rax, rax
jne 0x14002acaf
lea r8, [rsp + 0x40]
lea rdx, str.Out_of_memory.
lea rcx, [0x140136640]
call fcn.1400515e0
mov rax, qword [0x1401351a8]
xor ecx, ecx
mov qword [r14 + rax], rcx
lea r8, [0x1400fb87c]
mov rcx, rbp
lea rdx, str.Out_of_memory.
call fcn.1400515e0
jmp 0x14002ada1
test rbx, rbx
je 0x14002acc4
mov r8, r15
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400cfd20
mov rax, qword [0x1401351a8]
xor ecx, ecx
mov word [r15 + rdi], cx
mov qword [r14 + rax], rdi
jmp 0x14002ace3
lea r8, [0x1400fb87c]
mov qword [r14 + rax], r8
inc dword [0x1401351b0]
test esi, esi
jne 0x14002ad3c
lea edx, [rsi + 2]
xor ecx, ecx
lea r8d, [rsi + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14002ad1e
xor r9d, r9d
lea rdx, [0x1401136c0]
xor r8d, r8d
mov rcx, rbp
call fcn.14002add0
test eax, eax
je 0x14002ad9f
mov rdx, qword [rbp + 0xbc8]
test rdx, rdx
je 0x14002ad3c
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
call fcn.14002add0
test eax, eax
je 0x14002ad9f
mov eax, 3
jmp 0x14002ada1
cmp byte [rsp + 0x20110], 0
je 0x14002ad54
mov eax, 1
jmp 0x14002ada1
lea rax, str.Include
mov qword [rsp + 0x20], r14
test esi, esi
lea r9, str.Script
lea r8, str._s_file___s__cannot_be_opened.
mov edx, 0x8040
cmovne r9, rax
lea rcx, [rsp + 0x10040]
call fcn.1400acf50
lea r8, [0x1400fb87c]
mov rcx, rbp
lea rdx, [rsp + 0x10040]
call fcn.1400515e0
jmp 0x14002ada1
xor eax, eax
lea r11, [rsp + 0x200c0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret