Function at 0x180001520
Capabilities:
Access pe header
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xa0
mov rsi, rcx
lea rdi, [rbp - 0x29]
xor eax, eax
mov rbx, rdx
xor r12d, r12d
mov r13, r8
mov qword [r8], r12
mov r14d, r12d
mov r8, rbx
lea edx, [rax + 0x18]
mov ecx, edx
rep stosb byte [rdi], al
mov ecx, edx
lea rdi, [rbp - 0x41]
rep stosb byte [rdi], al
lea ecx, [rax + 0x10]
lea rdi, [rbp - 0x51]
rep stosb byte [rdi], al
mov rax, qword gs:[0x30]
lea edx, [r12 + 8]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r15, rax
test rax, rax
je 0x180001740
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.1800091a0
lea edi, [r12 + 1]
test ebx, ebx
je 0x1800015cb
mov eax, 0x20757775
mov edx, ebx
mov rcx, r15
xor byte [rcx], al
add rcx, rdi
rol eax, 1
add edx, 0xffffffff
jne 0x1800015bf
mov qword [rbp - 0x41], r15
lea r9, [rbp - 0x51]
mov qword [rbp - 0x39], rbx
lea r8, [rbp - 0x11]
movups xmm0, xmmword [rbp - 0x41]
mov dword [rbp - 0x31], r12d
lea rdx, [rbp + 0xf]
movsd xmm1, qword [rbp - 0x31]
mov rcx, rdi
movaps xmmword [rbp - 0x11], xmm0
movups xmm0, xmmword [rbp - 0x29]
movsd qword [rbp - 1], xmm1
movsd xmm1, qword [rbp - 0x19]
movaps xmmword [rbp + 0xf], xmm0
movsd qword [rbp + 0x1f], xmm1
call qword [sym.imp.msdelta.dll_ApplyDeltaB]
test eax, eax
je 0x18000170d
mov rsi, qword [rbp - 0x49]
xor r9d, r9d
mov r12, qword [rbp - 0x51]
mov edx, r9d
lea edi, [rsi + 1]
shr edi, 1
je 0x180001649
mov r8, r12
movzx eax, word [r8]
lea r8, [r8 + 2]
add edx, eax
mov ecx, edx
movzx edx, dx
shr ecx, 0x10
add edx, ecx
add edi, 0xffffffff
jne 0x180001630
mov edi, edx
mov rcx, r12
shr edi, 0x10
add di, dx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
xor edx, edx
mov rcx, rax
test rax, rax
je 0x180001683
movzx eax, word [rax + 0x58]
mov ebx, dword [rcx + 0x58]
cmp di, ax
adc ax, dx
sub di, ax
movzx eax, word [rcx + 0x5a]
cmp di, ax
adc ax, dx
sub di, ax
jmp 0x180001688
mov ebx, esi
movzx edi, dx
movzx edi, di
add edi, esi
cmp byte [rbp + 0x7f], dl
je 0x1800016b3
cmp edi, ebx
je 0x1800016c8
mov r9d, edi
lea rdx, str.____Error_data_checksum_mismatch__Header_sum_0x_lx__calculated_sum_0x_lx_r_n
mov r8d, ebx
mov ecx, 1
call fcn.180007cf4
cmp edi, ebx
jne 0x180001701
jmp 0x1800016c8
cmp edi, ebx
je 0x1800016c8
mov r8d, edi
lea rcx, str.___Data_checksum_mismatch__header_sum_0x_lx__calculated_sum_0x_lx__trying_to_continue_r_n
mov edx, ebx
call fcn.180001418
mov rax, qword gs:[0x30]
mov r8, rsi
mov edx, 8
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r14, rax
test rax, rax
je 0x180001701
mov r8, rsi
mov rdx, r12
mov rcx, rax
call fcn.1800091a0
mov qword [r13], rsi
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.msdelta.dll_DeltaFree]
jmp 0x180001724
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.____Error_decompressing_resource__GetLastError__lu_r_n
mov ecx, edi
mov r8d, eax
call fcn.180007cf4
mov rax, qword gs:[0x30]
mov r8, r15
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea r11, [rsp + 0xa0]
mov rax, r14
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret