Function at 0x140048140
Capabilities:
Extract resource via kernel32 functions
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1ffd0]
mov eax, 0x200d0
call fcn.1400de970
sub rsp, rax
movzx edi, r9b
mov r12, r8
mov rsi, rcx
test r8, r8
je 0x1400488f5
cmp word [r8], 0
je 0x1400488f5
mov r15d, dword [0x14012b018]
mov ebx, dword [0x14012c3a0]
cmp r15d, ebx
jl 0x1400483fe
cmp r15d, 0xffff
jl 0x1400482ad
mov rcx, qword [rcx + 0x6b8]
movzx eax, byte [0x14012ce0c]
test rcx, rcx
je 0x140048238
test al, al
je 0x140048238
mov rax, qword [0x1401241d8]
cmp dword [rax + 0x60], 0
jne 0x14004820d
cmp dword [rsi + 0x718], 0
jne 0x14004820d
cmp byte [0x140126ada], 0
jne 0x14004820d
xor ebx, ebx
lea r9, [0x140100be0]
mov qword [rsp + 0x28], rbx
lea rdx, [0x1401097e8]
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rsi
call fcn.140010330
mov ebx, eax
jmp 0x1400488f7
xor ebx, ebx
lea r8, [0x140100be0]
mov r9, rcx
mov qword [rsp + 0x28], rbx
lea rdx, [0x1401097e8]
mov dword [rsp + 0x20], ebx
mov rcx, rsi
call fcn.14000ef80
mov ebx, eax
jmp 0x1400488f7
xor ebx, ebx
cmp byte [0x14012ce0f], bl
je 0x140048283
test al, al
jne 0x140048283
test rcx, rcx
je 0x140048255
movzx r9d, word [rcx + 2]
mov eax, dword [rcx + 4]
jmp 0x140048262
mov r9d, dword [rsi + 0x2d8]
mov eax, dword [rsi + 0x2dc]
lea r8, [0x140100be0]
mov dword [rsp + 0x20], eax
lea rdx, [0x1401097e8]
mov rcx, rsi
call fcn.14000f320
mov eax, ebx
jmp 0x1400488f7
mov qword [rsp + 0x28], rbx
lea r9, [0x140100be0]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x1401097e8]
mov rcx, rsi
call fcn.140010330
mov eax, ebx
jmp 0x1400488f7
test ebx, ebx
je 0x1400482c2
add ebx, ebx
cmp ebx, 0xffff
jle 0x1400482c7
mov ebx, 0xffff
jmp 0x1400482c7
mov ebx, WSAAsyncSelect
mov rcx, qword [0x14012b010]
movsxd rdx, ebx
shl rdx, 3
call fcn.1400c5354
mov rcx, rax
test rax, rax
jne 0x1400483e8
mov rcx, qword [rsi + 0x6b8]
movzx eax, byte [0x14012ce0c]
test rcx, rcx
je 0x140048373
test al, al
je 0x140048373
mov rax, qword [0x1401241d8]
cmp dword [rax + 0x60], 0
jne 0x140048348
cmp dword [rsi + 0x718], 0
jne 0x140048348
cmp byte [0x140126ada], 0
jne 0x140048348
xor ebx, ebx
lea r9, [0x140100be0]
mov qword [rsp + 0x28], rbx
lea rdx, [0x1401049c0]
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rsi
call fcn.140010330
mov ebx, eax
jmp 0x1400488f7
xor ebx, ebx
lea r8, [0x140100be0]
mov r9, rcx
mov qword [rsp + 0x28], rbx
lea rdx, [0x1401049c0]
mov dword [rsp + 0x20], ebx
mov rcx, rsi
call fcn.14000ef80
mov ebx, eax
jmp 0x1400488f7
xor ebx, ebx
cmp byte [0x14012ce0f], bl
je 0x1400483be
test al, al
jne 0x1400483be
test rcx, rcx
je 0x140048390
movzx r9d, word [rcx + 2]
mov eax, dword [rcx + 4]
jmp 0x14004839d
mov r9d, dword [rsi + 0x2d8]
mov eax, dword [rsi + 0x2dc]
lea r8, [0x140100be0]
mov dword [rsp + 0x20], eax
lea rdx, [0x1401049c0]
mov rcx, rsi
call fcn.14000f320
mov eax, ebx
jmp 0x1400488f7
mov qword [rsp + 0x28], rbx
lea r9, [0x140100be0]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x1401049c0]
mov rcx, rsi
call fcn.140010330
mov eax, ebx
jmp 0x1400488f7
mov r15d, dword [0x14012b018]
mov qword [0x14012b010], rax
mov dword [0x14012c3a0], ebx
jmp 0x140048405
mov rcx, qword [0x14012b010]
movzx eax, word [r12]
xor ebx, ebx
lea r14, [rbx - 1]
test r15d, r15d
jne 0x14004842d
cmp ax, 0x2a
je 0x140048433
mov rax, qword [rsi + 0x760]
mov qword [rcx], rax
movsxd rdi, r15d
jmp 0x1400484d3
cmp ax, 0x2a
jne 0x14004845a
mov r8d, 0x7fff
lea rcx, [rsp + 0x50]
mov rdx, r12
call fcn.1400d3cf4
lea rcx, [rsp + 0x50]
mov word [rbp + 0xff4e], bx
call qword [sym.imp.USER32.dll_CharUpperW]
jmp 0x140048474
lea r9, [rbp + 0x20020]
mov edx, 0x8000
lea r8, [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test dil, dil
jne 0x1400484c5
movsxd r13, r15d
mov rdi, rbx
test r15d, r15d
jle 0x1400484c5
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [0x14012b010]
lea r8, [rsp + 0x50]
mov r9d, r14d
mov dword [rsp + 0x20], 1
mov edx, r14d
mov rcx, qword [rcx + rdi*8]
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
je 0x1400487c9
inc rdi
cmp rdi, r13
jl 0x140048490
mov rax, qword [0x14012b010]
movsxd rdi, r15d
mov qword [rax + rdi*8], rbx
cmp word [r12], 0x2a
mov eax, dword [0x1401241e8]
mov dword [rbp + 0x20020], eax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], ebx
mov byte [rsp + 0x44], bl
jne 0x1400485fc
cmp word [r12 + 2], bx
lea rdx, [r12 + 2]
je 0x1400485fc
xor ecx, ecx
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r13, rax
test rax, rax
je 0x1400485fc
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400485f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1400485f0
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, 0x58
mov dword [rbp + 0x20020], 0xfde9
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], rax
call fcn.1400be514
mov ecx, dword [0x14012d060]
mov rdi, rax
mov qword [rsp + 0x48], rax
lea rax, vtable.TextStream.0
mov qword [rdi], rax
mov qword [rdi + 8], rbx
mov dword [rdi + 0x10], ebx
mov dword [rdi + 0x14], 0xffffffff
mov qword [rdi + 0x30], rbx
mov qword [rdi + 0x38], rbx
cmp ecx, 0xffffffff
je 0x1400485c5
lea rdx, [rdi + 0x18]
mov dword [rdi + 0x14], ecx
call qword [sym.imp.KERNEL32.dll_GetCPInfo]
test eax, eax
jne 0x1400485c5
mov byte [rdi + 0x1e], bl
mov rcx, qword [rbp + 0x20018]
lea rax, vtable.TextMem.0
mov qword [rdi], rax
mov byte [rdi + 0x4c], 1
mov qword [rdi + 0x40], rbx
mov qword [rcx], rdi
mov dword [rdi + 0x48], ebx
mov byte [rdi + 0x4c], bl
mov qword [rdi + 0x50], rbx
movsxd rdi, r15d
jmp 0x14004861d
mov rcx, qword [rbp + 0x20018]
movsxd rdi, r15d
jmp 0x14004861d
mov ecx, 0x48
call fcn.1400be514
mov rcx, rax
mov qword [rsp + 0x48], rax
call fcn.140007b24
mov rcx, qword [rbp + 0x20018]
mov qword [rcx], rax
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400487c1
mov r9d, dword [rbp + 0x20020]
mov r8d, 0x30c
mov rdx, qword [rsp + 0x30]
call fcn.14009e0d0
test al, al
je 0x1400487c1
mov rax, qword [0x14012b010]
lea r12, [rdi*8]
cmp qword [r12 + rax], rbx
jne 0x1400486c1
cmp word [rsp + 0x50], bx
je 0x1400486b6
lea rax, [rsp + 0x50]
nop dword [rax]
inc r14
cmp word [rax + r14*2], bx
jne 0x140048670
lea r13, [r14 + r14]
lea rcx, [r13 + 2]
call fcn.14009d960
mov rdi, rax
test rax, rax
je 0x140048912
test r14, r14
je 0x1400486a8
mov r8, r13
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400e2370
mov rax, qword [0x14012b010]
mov word [rdi + r13], bx
jmp 0x1400486bd
lea rdi, [0x140100be0]
mov qword [r12 + rax], rdi
inc dword [0x14012b018]
test r15d, r15d
jne 0x140048736
lea edx, [r15 + 2]
xor ecx, ecx
lea r8d, [r15 + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400486fe
xor r9d, r9d
lea rdx, [0x140109878]
xor r8d, r8d
mov rcx, rsi
call fcn.140048920
test eax, eax
je 0x1400488f5
mov rdx, qword [rsi + 0x7a8]
test rdx, rdx
je 0x140048720
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call fcn.140048920
test eax, eax
je 0x1400488f5
mov rcx, qword [rsi + 0x768]
call fcn.140067870
mov eax, 3
jmp 0x1400488f7
mov r14d, 0x5c
lea rcx, [rsp + 0x50]
mov edx, r14d
call fcn.1400c0194
mov rsi, rax
lea rax, [rsp + 0x50]
cmp rsi, rax
jbe 0x1400487b7
mov word [rsi], bx
lea rdi, [rsp + 0x50]
movzx ecx, word [rsp + 0x50]
test cx, cx
je 0x140048796
movzx eax, word [rsp + 0x52]
cmp ax, 0x3a
jne 0x140048796
cmp word [rsp + 0x54], bx
jne 0x140048796
mov word [rbp + 0x20020], cx
lea rdi, [rbp + 0x20020]
mov word [rbp + 0x20022], ax
mov dword [rbp + 0x20024], r14d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x1400487b3
cmp byte [0x14012ce0c], bl
je 0x1400487b3
mov rcx, rdi
call fcn.1400678e0
mov word [rsi], r14w
mov eax, 3
jmp 0x1400488f7
cmp byte [rbp + 0x20030], bl
je 0x1400487d3
mov eax, 1
jmp 0x1400488f7
lea rax, [0x140109810]
mov qword [rsp + 0x20], r12
test r15d, r15d
lea r9, [0x140109828]
lea r8, [0x140109838]
mov edx, 0x8040
cmovne r9, rax
lea rcx, [rbp + 0xff50]
call fcn.1400a1160
mov rcx, qword [rsi + 0x6b8]
movzx eax, byte [0x14012ce0c]
test rcx, rcx
je 0x140048888
test al, al
je 0x140048888
mov rax, qword [0x1401241d8]
cmp dword [rax + 0x60], ebx
jne 0x140048862
cmp dword [rsi + 0x718], ebx
jne 0x140048862
cmp byte [0x140126ada], bl
jne 0x140048862
mov qword [rsp + 0x28], rbx
lea r9, [0x140100be0]
mov qword [rsp + 0x20], rcx
lea rdx, [rbp + 0xff50]
mov rcx, rsi
xor r8d, r8d
call fcn.140010330
mov ebx, eax
jmp 0x1400488f7
mov r9, rcx
mov qword [rsp + 0x28], rbx
mov rcx, rsi
mov dword [rsp + 0x20], ebx
lea r8, [0x140100be0]
lea rdx, [rbp + 0xff50]
call fcn.14000ef80
mov ebx, eax
jmp 0x1400488f7
cmp byte [0x14012ce0f], bl
je 0x1400488ce
test al, al
jne 0x1400488ce
test rcx, rcx
je 0x1400488a3
movzx r9d, word [rcx + 2]
mov eax, dword [rcx + 4]
jmp 0x1400488b0
mov r9d, dword [rsi + 0x2d8]
mov eax, dword [rsi + 0x2dc]
lea r8, [0x140100be0]
mov dword [rsp + 0x20], eax
lea rdx, [rbp + 0xff50]
mov rcx, rsi
call fcn.14000f320
mov eax, ebx
jmp 0x1400488f7
mov qword [rsp + 0x28], rbx
lea r9, [0x140100be0]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rbp + 0xff50]
mov rcx, rsi
call fcn.140010330
mov eax, ebx
jmp 0x1400488f7
xor eax, eax
mov rbx, qword [rsp + 0x20110]
add rsp, 0x200d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140010e00
int3