Function at 0x140049510
Capabilities:
Extract resource via kernel32 functions
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1ffd0]
mov eax, 0x200d0
call fcn.1400e19f0
sub rsp, rax
movzx edi, r9b
mov r12, r8
mov rsi, rcx
test r8, r8
je 0x140049bb0
cmp word [r8], 0
je 0x140049bb0
mov r15d, dword [0x140130368]
mov ebx, dword [0x1401316f0]
cmp r15d, ebx
jl 0x140049714
cmp r15d, 0xffff
jl 0x140049620
mov rcx, qword [rcx + 0x6a8]
movzx eax, byte [0x14013214c]
test rcx, rcx
je 0x1400495be
test al, al
je 0x1400495be
xor ebx, ebx
lea r8, [0x140104c70]
mov qword [rsp + 0x28], rbx
lea rdx, str.Too_many_includes.
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov rcx, rsi
call fcn.14000fec0
mov ebx, eax
jmp 0x140049bb2
xor ebx, ebx
cmp byte [0x14013214f], bl
je 0x1400495fb
test al, al
jne 0x1400495fb
mov eax, dword [rsi + 0x2cc]
lea r8, [0x140104c70]
movzx r9d, word [rsi + 0x2c8]
lea rdx, str.Too_many_includes.
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.14000fd70
mov eax, ebx
jmp 0x140049bb2
lea r9, [0x140104c70]
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea rdx, str.Too_many_includes.
mov rcx, rsi
call fcn.140010e80
mov eax, ebx
jmp 0x140049bb2
test ebx, ebx
je 0x140049635
add ebx, ebx
cmp ebx, 0xffff
jle 0x14004963a
mov ebx, 0xffff
jmp 0x14004963a
mov ebx, WSAAsyncSelect
mov rcx, qword [0x140130360]
movsxd rdx, ebx
shl rdx, 3
call fcn.1400c83dc
mov rcx, rax
test rax, rax
jne 0x1400496fe
mov rcx, qword [rsi + 0x6a8]
movzx eax, byte [0x14013214c]
test rcx, rcx
je 0x14004969c
test al, al
je 0x14004969c
xor ebx, ebx
lea r8, [0x140104c70]
mov qword [rsp + 0x28], rbx
lea rdx, str.Out_of_memory.
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov rcx, rsi
call fcn.14000fec0
mov ebx, eax
jmp 0x140049bb2
xor ebx, ebx
cmp byte [0x14013214f], bl
je 0x1400496d9
test al, al
jne 0x1400496d9
mov eax, dword [rsi + 0x2cc]
lea r8, [0x140104c70]
movzx r9d, word [rsi + 0x2c8]
lea rdx, str.Out_of_memory.
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.14000fd70
mov eax, ebx
jmp 0x140049bb2
lea r9, [0x140104c70]
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea rdx, str.Out_of_memory.
mov rcx, rsi
call fcn.140010e80
mov eax, ebx
jmp 0x140049bb2
mov r15d, dword [0x140130368]
mov qword [0x140130360], rax
mov dword [0x1401316f0], ebx
jmp 0x14004971b
mov rcx, qword [0x140130360]
movzx eax, word [r12]
xor ebx, ebx
mov r14, 0xffffffffffffffff
test r15d, r15d
jne 0x140049746
cmp ax, 0x2a
je 0x14004974c
mov rax, qword [rsi + 0x750]
mov qword [rcx], rax
movsxd rdi, r15d
jmp 0x1400497e3
cmp ax, 0x2a
jne 0x140049773
mov r8d, 0x7fff
lea rcx, [rsp + 0x50]
mov rdx, r12
call fcn.1400d6d74
lea rcx, [rsp + 0x50]
mov word [rbp + 0xff4e], bx
call qword [sym.imp.USER32.dll_CharUpperW]
jmp 0x14004978d
lea r9, [rbp + 0x20020]
mov edx, 0x8000
lea r8, [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test dil, dil
jne 0x1400497d5
movsxd r13, r15d
mov rdi, rbx
test r15d, r15d
jle 0x1400497d5
nop dword [rax]
mov rcx, qword [0x140130360]
lea r8, [rsp + 0x50]
mov r9d, r14d
mov dword [rsp + 0x20], 1
mov edx, r14d
mov rcx, qword [rcx + rdi*8]
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
je 0x140049adc
inc rdi
cmp rdi, r13
jl 0x1400497a0
mov rax, qword [0x140130360]
movsxd rdi, r15d
mov qword [rax + rdi*8], rbx
cmp word [r12], 0x2a
mov eax, dword [0x1401293a8]
mov dword [rbp + 0x20020], eax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], ebx
mov byte [rsp + 0x44], bl
jne 0x14004990e
cmp word [r12 + 2], bx
lea rdx, [r12 + 2]
je 0x14004990e
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r13, rax
test rax, rax
je 0x14004990e
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140049902
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140049902
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, 0x58
mov dword [rbp + 0x20020], 0xfde9
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], rax
call fcn.1400c2444
mov ecx, dword [0x1401323a0]
mov rdi, rax
mov qword [rsp + 0x48], rax
lea rax, vtable.TextStream.0
mov qword [rdi], rax
mov qword [rdi + 8], rbx
mov dword [rdi + 0x10], ebx
mov dword [rdi + 0x14], 0xffffffff
mov qword [rdi + 0x30], rbx
mov qword [rdi + 0x38], rbx
cmp ecx, 0xffffffff
je 0x1400498d7
lea rdx, [rdi + 0x18]
mov dword [rdi + 0x14], ecx
call qword [sym.imp.KERNEL32.dll_GetCPInfo]
test eax, eax
jne 0x1400498d7
mov byte [rdi + 0x1e], bl
mov rcx, qword [rbp + 0x20018]
lea rax, vtable.TextMem.0
mov qword [rdi], rax
mov byte [rdi + 0x4c], 1
mov qword [rdi + 0x40], rbx
mov qword [rcx], rdi
mov dword [rdi + 0x48], ebx
mov byte [rdi + 0x4c], bl
mov qword [rdi + 0x50], rbx
movsxd rdi, r15d
jmp 0x14004992f
mov rcx, qword [rbp + 0x20018]
movsxd rdi, r15d
jmp 0x14004992f
mov ecx, 0x48
call fcn.1400c2444
mov rcx, rax
mov qword [rsp + 0x48], rax
call fcn.140007bc0
mov rcx, qword [rbp + 0x20018]
mov qword [rcx], rax
mov rcx, qword [rcx]
test rcx, rcx
je 0x140049ad4
mov r9d, dword [rbp + 0x20020]
mov r8d, 0x30c
mov rdx, qword [rsp + 0x30]
call fcn.1400a1920
test al, al
je 0x140049ad4
mov rax, qword [0x140130360]
lea r12, [rdi*8]
cmp qword [r12 + rax], rbx
jne 0x1400499d1
cmp word [rsp + 0x50], bx
je 0x1400499c6
lea rax, [rsp + 0x50]
nop dword [rax + rax]
inc r14
cmp word [rax + r14*2], bx
jne 0x140049980
lea r13, [r14 + r14]
lea rcx, [r13 + 2]
call fcn.1400a1110
mov rdi, rax
test rax, rax
je 0x140049bcd
test r14, r14
je 0x1400499b8
mov r8, r13
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400e5b10
mov rax, qword [0x140130360]
mov word [rdi + r13], bx
jmp 0x1400499cd
lea rdi, [0x140104c70]
mov qword [r12 + rax], rdi
inc dword [0x140130368]
test r15d, r15d
jne 0x140049a49
mov edx, 2
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140049a11
xor r9d, r9d
lea rdx, [0x14010db18]
xor r8d, r8d
mov rcx, rsi
call fcn.140049be0
test eax, eax
je 0x140049bb0
mov rdx, qword [rsi + 0x798]
test rdx, rdx
je 0x140049a33
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call fcn.140049be0
test eax, eax
je 0x140049bb0
mov rcx, qword [rsi + 0x758]
call fcn.140067860
mov eax, 3
jmp 0x140049bb2
mov r14d, 0x5c
lea rcx, [rsp + 0x50]
mov edx, r14d
call fcn.1400c4208
mov rsi, rax
lea rax, [rsp + 0x50]
cmp rsi, rax
jbe 0x140049aca
mov word [rsi], bx
lea rdi, [rsp + 0x50]
movzx ecx, word [rsp + 0x50]
test cx, cx
je 0x140049aa9
movzx eax, word [rsp + 0x52]
cmp ax, 0x3a
jne 0x140049aa9
cmp word [rsp + 0x54], bx
jne 0x140049aa9
mov word [rbp + 0x20020], cx
lea rdi, [rbp + 0x20020]
mov word [rbp + 0x20022], ax
mov dword [rbp + 0x20024], r14d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x140049ac6
cmp byte [0x14013214c], bl
je 0x140049ac6
mov rcx, rdi
call fcn.1400678d0
mov word [rsi], r14w
mov eax, 3
jmp 0x140049bb2
cmp byte [rbp + 0x20030], bl
je 0x140049ae6
mov eax, 1
jmp 0x140049bb2
lea rax, str.Include
mov qword [rsp + 0x20], r12
test r15d, r15d
lea r9, str.Script
lea r8, str._s_file___s__cannot_be_opened.
mov edx, 0x8040
cmovne r9, rax
lea rcx, [rbp + 0xff50]
call fcn.1400a4cd0
mov rcx, qword [rsi + 0x6a8]
movzx eax, byte [0x14013214c]
test rcx, rcx
je 0x140049b56
test al, al
je 0x140049b56
mov qword [rsp + 0x28], rbx
lea r8, [0x140104c70]
mov qword [rsp + 0x20], rcx
lea rdx, [rbp + 0xff50]
mov rcx, rsi
xor r9d, r9d
call fcn.14000fec0
mov ebx, eax
jmp 0x140049bb2
cmp byte [0x14013214f], bl
je 0x140049b8e
test al, al
jne 0x140049b8e
mov eax, dword [rsi + 0x2cc]
lea r8, [0x140104c70]
movzx r9d, word [rsi + 0x2c8]
lea rdx, [rbp + 0xff50]
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.14000fd70
mov eax, ebx
jmp 0x140049bb2
lea r9, [0x140104c70]
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea rdx, [rbp + 0xff50]
mov rcx, rsi
call fcn.140010e80
mov eax, ebx
jmp 0x140049bb2
xor eax, eax
mov rbx, qword [rsp + 0x20110]
add rsp, 0x200d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400116e0
int3