Function at 0x140047ee0
Capabilities:
Extract resource via kernel32 functions
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1ffd0]
mov eax, 0x200d0
call fcn.1400ddcd0
sub rsp, rax
movzx edi, r9b
mov r12, r8
mov rsi, rcx
test r8, r8
je 0x140048655
cmp word [r8], 0
je 0x140048655
mov r15d, dword [0x14012b018]
mov ebx, dword [0x14012c3a0]
cmp r15d, ebx
jl 0x14004816d
cmp r15d, 0xffff
jl 0x140048030
mov r9, qword [rcx + 0x6b8]
movzx eax, byte [0x14012ce0c]
test r9, r9
je 0x140047fcf
test al, al
je 0x140047fcf
mov rax, qword [0x1401241d8]
cmp dword [rax + 0x60], 0
jne 0x140047faa
cmp dword [rcx + 0x718], 0
jne 0x140047faa
cmp byte [0x140126ada], 0
jne 0x140047faa
xor ebx, ebx
lea rdx, str.Too_many_includes.
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], r9
lea r9, [0x140100be0]
call fcn.140010320
mov ebx, eax
jmp 0x140048657
xor ebx, ebx
lea r8, [0x140100be0]
mov qword [rsp + 0x28], rbx
lea rdx, str.Too_many_includes.
mov dword [rsp + 0x20], ebx
call fcn.14000ef70
mov ebx, eax
jmp 0x140048657
xor ebx, ebx
cmp byte [0x14012ce0f], bl
je 0x140048009
test al, al
jne 0x140048009
mov eax, dword [rcx + 0x2dc]
lea r8, [0x140100be0]
movzx r9d, word [rcx + 0x2d8]
lea rdx, str.Too_many_includes.
mov dword [rsp + 0x20], eax
call fcn.14000f310
mov eax, ebx
jmp 0x140048657
mov qword [rsp + 0x28], rbx
lea r9, [0x140100be0]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.Too_many_includes.
call fcn.140010320
mov eax, ebx
jmp 0x140048657
test ebx, ebx
je 0x140048045
add ebx, ebx
cmp ebx, 0xffff
jle 0x14004804a
mov ebx, 0xffff
jmp 0x14004804a
mov ebx, WSAAsyncSelect
mov rcx, qword [0x14012b010]
movsxd rdx, ebx
shl rdx, 3
call fcn.1400c46b4
mov rcx, rax
test rax, rax
jne 0x140048157
mov r9, qword [rsi + 0x6b8]
movzx eax, byte [0x14012ce0c]
test r9, r9
je 0x1400480f0
test al, al
je 0x1400480f0
mov rax, qword [0x1401241d8]
cmp dword [rax + 0x60], ecx
jne 0x1400480c8
cmp dword [rsi + 0x718], ecx
jne 0x1400480c8
cmp byte [0x140126ada], cl
jne 0x1400480c8
xor ebx, ebx
lea rdx, str.Out_of_memory.
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], r9
mov rcx, rsi
lea r9, [0x140100be0]
call fcn.140010320
mov ebx, eax
jmp 0x140048657
xor ebx, ebx
lea r8, [0x140100be0]
mov qword [rsp + 0x28], rbx
lea rdx, str.Out_of_memory.
mov rcx, rsi
mov dword [rsp + 0x20], ebx
call fcn.14000ef70
mov ebx, eax
jmp 0x140048657
xor ebx, ebx
cmp byte [0x14012ce0f], bl
je 0x14004812d
test al, al
jne 0x14004812d
mov eax, dword [rsi + 0x2dc]
lea r8, [0x140100be0]
movzx r9d, word [rsi + 0x2d8]
lea rdx, str.Out_of_memory.
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.14000f310
mov eax, ebx
jmp 0x140048657
mov qword [rsp + 0x28], rbx
lea r9, [0x140100be0]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.Out_of_memory.
mov rcx, rsi
call fcn.140010320
mov eax, ebx
jmp 0x140048657
mov r15d, dword [0x14012b018]
mov qword [0x14012b010], rax
mov dword [0x14012c3a0], ebx
jmp 0x140048174
mov rcx, qword [0x14012b010]
movzx eax, word [r12]
xor ebx, ebx
lea r14, [rbx - 1]
test r15d, r15d
jne 0x14004819c
cmp ax, 0x2a
je 0x1400481a2
mov rax, qword [rsi + 0x760]
mov qword [rcx], rax
movsxd rdi, r15d
jmp 0x140048243
cmp ax, 0x2a
jne 0x1400481c9
mov r8d, 0x7fff
lea rcx, [rsp + 0x50]
mov rdx, r12
call fcn.1400d3054
lea rcx, [rsp + 0x50]
mov word [rbp + 0xff4e], bx
call qword [sym.imp.USER32.dll_CharUpperW]
jmp 0x1400481e3
lea r9, [rbp + 0x20020]
mov edx, 0x8000
lea r8, [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test dil, dil
jne 0x140048235
movsxd r13, r15d
mov rdi, rbx
test r15d, r15d
jle 0x140048235
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [0x14012b010]
lea r8, [rsp + 0x50]
mov r9d, r14d
mov dword [rsp + 0x20], 1
mov edx, r14d
mov rcx, qword [rcx + rdi*8]
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
je 0x14004853a
inc rdi
cmp rdi, r13
jl 0x140048200
mov rax, qword [0x14012b010]
movsxd rdi, r15d
mov qword [rax + rdi*8], rbx
cmp word [r12], 0x2a
mov eax, dword [0x1401241e8]
mov dword [rbp + 0x20020], eax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], ebx
mov byte [rsp + 0x44], bl
jne 0x14004836c
cmp word [r12 + 2], bx
lea rdx, [r12 + 2]
je 0x14004836c
xor ecx, ecx
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r13, rax
test rax, rax
je 0x14004836c
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140048360
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140048360
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, 0x58
mov dword [rbp + 0x20020], 0xfde9
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], rax
call fcn.1400bd874
mov ecx, dword [0x14012d060]
mov rdi, rax
mov qword [rsp + 0x48], rax
lea rax, vtable.TextStream.0
mov qword [rdi], rax
mov qword [rdi + 8], rbx
mov dword [rdi + 0x10], ebx
mov dword [rdi + 0x14], 0xffffffff
mov qword [rdi + 0x30], rbx
mov qword [rdi + 0x38], rbx
cmp ecx, 0xffffffff
je 0x140048335
lea rdx, [rdi + 0x18]
mov dword [rdi + 0x14], ecx
call qword [sym.imp.KERNEL32.dll_GetCPInfo]
test eax, eax
jne 0x140048335
mov byte [rdi + 0x1e], bl
mov rcx, qword [rbp + 0x20018]
lea rax, vtable.TextMem.0
mov qword [rdi], rax
mov byte [rdi + 0x4c], 1
mov qword [rdi + 0x40], rbx
mov qword [rcx], rdi
mov dword [rdi + 0x48], ebx
mov byte [rdi + 0x4c], bl
mov qword [rdi + 0x50], rbx
movsxd rdi, r15d
jmp 0x14004838d
mov rcx, qword [rbp + 0x20018]
movsxd rdi, r15d
jmp 0x14004838d
mov ecx, 0x48
call fcn.1400bd874
mov rcx, rax
mov qword [rsp + 0x48], rax
call fcn.140007b64
mov rcx, qword [rbp + 0x20018]
mov qword [rcx], rax
mov rcx, qword [rcx]
test rcx, rcx
je 0x140048532
mov r9d, dword [rbp + 0x20020]
mov r8d, 0x30c
mov rdx, qword [rsp + 0x30]
call fcn.14009d450
test al, al
je 0x140048532
mov rax, qword [0x14012b010]
lea r13, [rdi*8]
cmp qword [rax + r13], rbx
jne 0x140048432
cmp word [rsp + 0x50], bx
je 0x140048427
lea rax, [rsp + 0x50]
nop dword [rax]
inc r14
cmp word [rax + r14*2], bx
jne 0x1400483e0
lea r12, [r14 + r14]
lea rcx, [r12 + 2]
call fcn.14009cce0
mov rdi, rax
test rax, rax
je 0x140048672
test r14, r14
je 0x140048419
mov r8, r12
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400e16d0
mov rax, qword [0x14012b010]
mov word [r12 + rdi], bx
jmp 0x14004842e
lea rdi, [0x140100be0]
mov qword [rax + r13], rdi
inc dword [0x14012b018]
test r15d, r15d
jne 0x1400484a7
lea edx, [r15 + 2]
xor ecx, ecx
lea r8d, [r15 + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14004846f
xor r9d, r9d
lea rdx, [0x140109818]
xor r8d, r8d
mov rcx, rsi
call fcn.140048680
test eax, eax
je 0x140048655
mov rdx, qword [rsi + 0x7a8]
test rdx, rdx
je 0x140048491
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call fcn.140048680
test eax, eax
je 0x140048655
mov rcx, qword [rsi + 0x768]
call fcn.140066ef0
mov eax, 3
jmp 0x140048657
mov r14d, 0x5c
lea rcx, [rsp + 0x50]
mov edx, r14d
call fcn.1400bf4f4
mov rsi, rax
lea rax, [rsp + 0x50]
cmp rsi, rax
jbe 0x140048528
mov word [rsi], bx
lea rdi, [rsp + 0x50]
movzx ecx, word [rsp + 0x50]
test cx, cx
je 0x140048507
movzx eax, word [rsp + 0x52]
cmp ax, 0x3a
jne 0x140048507
cmp word [rsp + 0x54], bx
jne 0x140048507
mov word [rbp + 0x20020], cx
lea rdi, [rbp + 0x20020]
mov word [rbp + 0x20022], ax
mov dword [rbp + 0x20024], r14d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x140048524
cmp byte [0x14012ce0c], bl
je 0x140048524
mov rcx, rdi
call fcn.140066f60
mov word [rsi], r14w
mov eax, 3
jmp 0x140048657
cmp byte [rbp + 0x20030], bl
je 0x140048544
mov eax, 1
jmp 0x140048657
lea rax, str.Include
mov qword [rsp + 0x20], r12
test r15d, r15d
lea r9, str.Script
lea r8, str._s_file___s__cannot_be_opened.
mov edx, 0x8040
cmovne r9, rax
lea rcx, [rbp + 0xff50]
call fcn.1400a04e0
mov r9, qword [rsi + 0x6b8]
movzx eax, byte [0x14012ce0c]
test r9, r9
je 0x1400485f6
test al, al
je 0x1400485f6
mov rax, qword [0x1401241d8]
cmp dword [rax + 0x60], ebx
jne 0x1400485d3
cmp dword [rsi + 0x718], ebx
jne 0x1400485d3
cmp byte [0x140126ada], bl
jne 0x1400485d3
mov qword [rsp + 0x28], rbx
lea rdx, [rbp + 0xff50]
mov qword [rsp + 0x20], r9
xor r8d, r8d
lea r9, [0x140100be0]
mov rcx, rsi
call fcn.140010320
mov ebx, eax
jmp 0x140048657
mov qword [rsp + 0x28], rbx
lea r8, [0x140100be0]
lea rdx, [rbp + 0xff50]
mov dword [rsp + 0x20], ebx
mov rcx, rsi
call fcn.14000ef70
mov ebx, eax
jmp 0x140048657
cmp byte [0x14012ce0f], bl
je 0x14004862e
test al, al
jne 0x14004862e
mov eax, dword [rsi + 0x2dc]
lea r8, [0x140100be0]
movzx r9d, word [rsi + 0x2d8]
lea rdx, [rbp + 0xff50]
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.14000f310
mov eax, ebx
jmp 0x140048657
mov qword [rsp + 0x28], rbx
lea r9, [0x140100be0]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [rbp + 0xff50]
mov rcx, rsi
call fcn.140010320
mov eax, ebx
jmp 0x140048657
xor eax, eax
mov rbx, qword [rsp + 0x20110]
add rsp, 0x200d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140010d90
int3