Function at 0x1400485e0
Capabilities:
Extract resource via kernel32 functions
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1ffd0]
mov eax, 0x200d0
call fcn.1400def50
sub rsp, rax
movzx edi, r9b
mov r12, r8
mov rsi, rcx
test r8, r8
je 0x140048d99
cmp word [r8], 0
je 0x140048d99
mov r15d, dword [0x14012c028]
mov ebx, dword [0x14012d3b0]
cmp r15d, ebx
jl 0x14004889e
cmp r15d, 0xffff
jl 0x14004874d
mov rcx, qword [rcx + 0x6b8]
movzx eax, byte [0x14012de1c]
test rcx, rcx
je 0x1400486d8
test al, al
je 0x1400486d8
mov rax, qword [0x1401251d8]
cmp dword [rax + 0x60], 0
jne 0x1400486ad
cmp dword [rsi + 0x718], 0
jne 0x1400486ad
cmp byte [0x140127ada], 0
jne 0x1400486ad
xor ebx, ebx
lea r9, [0x140101bd0]
mov qword [rsp + 0x28], rbx
lea rdx, str.Too_many_includes.
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rsi
call fcn.140010340
mov ebx, eax
jmp 0x140048d9b
xor ebx, ebx
lea r8, [0x140101bd0]
mov r9, rcx
mov qword [rsp + 0x28], rbx
lea rdx, str.Too_many_includes.
mov dword [rsp + 0x20], ebx
mov rcx, rsi
call fcn.14000ef80
mov ebx, eax
jmp 0x140048d9b
xor ebx, ebx
cmp byte [0x14012de1f], bl
je 0x140048723
test al, al
jne 0x140048723
test rcx, rcx
je 0x1400486f5
movzx r9d, word [rcx + 2]
mov eax, dword [rcx + 4]
jmp 0x140048702
mov r9d, dword [rsi + 0x2d8]
mov eax, dword [rsi + 0x2dc]
lea r8, [0x140101bd0]
mov dword [rsp + 0x20], eax
lea rdx, str.Too_many_includes.
mov rcx, rsi
call fcn.14000f320
mov eax, ebx
jmp 0x140048d9b
mov qword [rsp + 0x28], rbx
lea r9, [0x140101bd0]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.Too_many_includes.
mov rcx, rsi
call fcn.140010340
mov eax, ebx
jmp 0x140048d9b
test ebx, ebx
je 0x140048762
add ebx, ebx
cmp ebx, 0xffff
jle 0x140048767
mov ebx, 0xffff
jmp 0x140048767
mov ebx, WSAAsyncSelect
mov rcx, qword [0x14012c020]
movsxd rdx, ebx
shl rdx, 3
call fcn.1400c592c
mov rcx, rax
test rax, rax
jne 0x140048888
mov rcx, qword [rsi + 0x6b8]
movzx eax, byte [0x14012de1c]
test rcx, rcx
je 0x140048813
test al, al
je 0x140048813
mov rax, qword [0x1401251d8]
cmp dword [rax + 0x60], 0
jne 0x1400487e8
cmp dword [rsi + 0x718], 0
jne 0x1400487e8
cmp byte [0x140127ada], 0
jne 0x1400487e8
xor ebx, ebx
lea r9, [0x140101bd0]
mov qword [rsp + 0x28], rbx
lea rdx, str.Out_of_memory.
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rsi
call fcn.140010340
mov ebx, eax
jmp 0x140048d9b
xor ebx, ebx
lea r8, [0x140101bd0]
mov r9, rcx
mov qword [rsp + 0x28], rbx
lea rdx, str.Out_of_memory.
mov dword [rsp + 0x20], ebx
mov rcx, rsi
call fcn.14000ef80
mov ebx, eax
jmp 0x140048d9b
xor ebx, ebx
cmp byte [0x14012de1f], bl
je 0x14004885e
test al, al
jne 0x14004885e
test rcx, rcx
je 0x140048830
movzx r9d, word [rcx + 2]
mov eax, dword [rcx + 4]
jmp 0x14004883d
mov r9d, dword [rsi + 0x2d8]
mov eax, dword [rsi + 0x2dc]
lea r8, [0x140101bd0]
mov dword [rsp + 0x20], eax
lea rdx, str.Out_of_memory.
mov rcx, rsi
call fcn.14000f320
mov eax, ebx
jmp 0x140048d9b
mov qword [rsp + 0x28], rbx
lea r9, [0x140101bd0]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.Out_of_memory.
mov rcx, rsi
call fcn.140010340
mov eax, ebx
jmp 0x140048d9b
mov r15d, dword [0x14012c028]
mov qword [0x14012c020], rax
mov dword [0x14012d3b0], ebx
jmp 0x1400488a5
mov rcx, qword [0x14012c020]
movzx eax, word [r12]
xor ebx, ebx
mov r14, 0xffffffffffffffff
test r15d, r15d
jne 0x1400488d0
cmp ax, 0x2a
je 0x1400488d6
mov rax, qword [rsi + 0x760]
mov qword [rcx], rax
movsxd rdi, r15d
jmp 0x140048973
cmp ax, 0x2a
jne 0x1400488fd
mov r8d, 0x7fff
lea rcx, [rsp + 0x50]
mov rdx, r12
call fcn.1400d42d4
lea rcx, [rsp + 0x50]
mov word [rbp + 0xff4e], bx
call qword [sym.imp.USER32.dll_CharUpperW]
jmp 0x140048917
lea r9, [rbp + 0x20020]
mov edx, 0x8000
lea r8, [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test dil, dil
jne 0x140048965
movsxd r13, r15d
mov rdi, rbx
test r15d, r15d
jle 0x140048965
nop word [rax + rax]
mov rcx, qword [0x14012c020]
lea r8, [rsp + 0x50]
mov r9d, r14d
mov dword [rsp + 0x20], 1
mov edx, r14d
mov rcx, qword [rcx + rdi*8]
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
je 0x140048c6d
inc rdi
cmp rdi, r13
jl 0x140048930
mov rax, qword [0x14012c020]
movsxd rdi, r15d
mov qword [rax + rdi*8], rbx
cmp word [r12], 0x2a
mov eax, dword [0x1401251e8]
mov dword [rbp + 0x20020], eax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], ebx
mov byte [rsp + 0x44], bl
jne 0x140048a9e
cmp word [r12 + 2], bx
lea rdx, [r12 + 2]
je 0x140048a9e
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r13, rax
test rax, rax
je 0x140048a9e
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140048a92
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140048a92
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, 0x58
mov dword [rbp + 0x20020], 0xfde9
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], rax
call fcn.1400bf9b4
mov ecx, dword [0x14012e070]
mov rdi, rax
mov qword [rsp + 0x48], rax
lea rax, vtable.TextStream.0
mov qword [rdi], rax
mov qword [rdi + 8], rbx
mov dword [rdi + 0x10], ebx
mov dword [rdi + 0x14], 0xffffffff
mov qword [rdi + 0x30], rbx
mov qword [rdi + 0x38], rbx
cmp ecx, 0xffffffff
je 0x140048a67
lea rdx, [rdi + 0x18]
mov dword [rdi + 0x14], ecx
call qword [sym.imp.KERNEL32.dll_GetCPInfo]
test eax, eax
jne 0x140048a67
mov byte [rdi + 0x1e], bl
mov rcx, qword [rbp + 0x20018]
lea rax, vtable.TextMem.0
mov qword [rdi], rax
mov byte [rdi + 0x4c], 1
mov qword [rdi + 0x40], rbx
mov qword [rcx], rdi
mov dword [rdi + 0x48], ebx
mov byte [rdi + 0x4c], bl
mov qword [rdi + 0x50], rbx
movsxd rdi, r15d
jmp 0x140048abf
mov rcx, qword [rbp + 0x20018]
movsxd rdi, r15d
jmp 0x140048abf
mov ecx, 0x48
call fcn.1400bf9b4
mov rcx, rax
mov qword [rsp + 0x48], rax
call fcn.140007bf4
mov rcx, qword [rbp + 0x20018]
mov qword [rcx], rax
mov rcx, qword [rcx]
test rcx, rcx
je 0x140048c65
mov r9d, dword [rbp + 0x20020]
mov r8d, 0x30c
mov rdx, qword [rsp + 0x30]
call fcn.14009f250
test al, al
je 0x140048c65
mov rax, qword [0x14012c020]
lea r13, [rdi*8]
cmp qword [rax + r13], rbx
jne 0x140048b62
cmp word [rsp + 0x50], bx
je 0x140048b57
lea rax, [rsp + 0x50]
nop dword [rax + rax]
inc r14
cmp word [rax + r14*2], bx
jne 0x140048b10
lea r12, [r14 + r14]
lea rcx, [r12 + 2]
call fcn.14009ea40
mov rdi, rax
test rax, rax
je 0x140048db6
test r14, r14
je 0x140048b49
mov r8, r12
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400e2970
mov rax, qword [0x14012c020]
mov word [r12 + rdi], bx
jmp 0x140048b5e
lea rdi, [0x140101bd0]
mov qword [rax + r13], rdi
inc dword [0x14012c028]
test r15d, r15d
jne 0x140048bda
mov edx, 2
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140048ba2
xor r9d, r9d
lea rdx, [0x14010a868]
xor r8d, r8d
mov rcx, rsi
call fcn.140048dc0
test eax, eax
je 0x140048d99
mov rdx, qword [rsi + 0x7a8]
test rdx, rdx
je 0x140048bc4
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call fcn.140048dc0
test eax, eax
je 0x140048d99
mov rcx, qword [rsi + 0x768]
call fcn.1400680c0
mov eax, 3
jmp 0x140048d9b
mov r14d, 0x5c
lea rcx, [rsp + 0x50]
mov edx, r14d
call fcn.1400c1758
mov rsi, rax
lea rax, [rsp + 0x50]
cmp rsi, rax
jbe 0x140048c5b
mov word [rsi], bx
lea rdi, [rsp + 0x50]
movzx ecx, word [rsp + 0x50]
test cx, cx
je 0x140048c3a
movzx eax, word [rsp + 0x52]
cmp ax, 0x3a
jne 0x140048c3a
cmp word [rsp + 0x54], bx
jne 0x140048c3a
mov word [rbp + 0x20020], cx
lea rdi, [rbp + 0x20020]
mov word [rbp + 0x20022], ax
mov dword [rbp + 0x20024], r14d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x140048c57
cmp byte [0x14012de1c], bl
je 0x140048c57
mov rcx, rdi
call fcn.140068130
mov word [rsi], r14w
mov eax, 3
jmp 0x140048d9b
cmp byte [rbp + 0x20030], bl
je 0x140048c77
mov eax, 1
jmp 0x140048d9b
lea rax, str.Include
mov qword [rsp + 0x20], r12
test r15d, r15d
lea r9, str.Script
lea r8, str._s_file___s__cannot_be_opened.
mov edx, 0x8040
cmovne r9, rax
lea rcx, [rbp + 0xff50]
call fcn.1400a2630
mov rcx, qword [rsi + 0x6b8]
movzx eax, byte [0x14012de1c]
test rcx, rcx
je 0x140048d2c
test al, al
je 0x140048d2c
mov rax, qword [0x1401251d8]
cmp dword [rax + 0x60], ebx
jne 0x140048d06
cmp dword [rsi + 0x718], ebx
jne 0x140048d06
cmp byte [0x140127ada], bl
jne 0x140048d06
mov qword [rsp + 0x28], rbx
lea r9, [0x140101bd0]
mov qword [rsp + 0x20], rcx
lea rdx, [rbp + 0xff50]
mov rcx, rsi
xor r8d, r8d
call fcn.140010340
mov ebx, eax
jmp 0x140048d9b
mov r9, rcx
mov qword [rsp + 0x28], rbx
mov rcx, rsi
mov dword [rsp + 0x20], ebx
lea r8, [0x140101bd0]
lea rdx, [rbp + 0xff50]
call fcn.14000ef80
mov ebx, eax
jmp 0x140048d9b
cmp byte [0x14012de1f], bl
je 0x140048d72
test al, al
jne 0x140048d72
test rcx, rcx
je 0x140048d47
movzx r9d, word [rcx + 2]
mov eax, dword [rcx + 4]
jmp 0x140048d54
mov r9d, dword [rsi + 0x2d8]
mov eax, dword [rsi + 0x2dc]
lea r8, [0x140101bd0]
mov dword [rsp + 0x20], eax
lea rdx, [rbp + 0xff50]
mov rcx, rsi
call fcn.14000f320
mov eax, ebx
jmp 0x140048d9b
mov qword [rsp + 0x28], rbx
lea r9, [0x140101bd0]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rbp + 0xff50]
mov rcx, rsi
call fcn.140010340
mov eax, ebx
jmp 0x140048d9b
xor eax, eax
mov rbx, qword [rsp + 0x20110]
add rsp, 0x200d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140010e30
int3