Function at 0x1400019e0
Capabilities:
Access pe header
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rbp, rcx
lea rdi, [rsp + 0x50]
xor eax, eax
mov r15, r8
mov rsi, rdx
mov ecx, 0x18
rep stosb byte [rdi], al
lea rdi, [rsp + 0x30]
mov ecx, 0x18
rep stosb byte [rdi], al
lea rdi, [rsp + 0x20]
mov ecx, 0x10
rep stosb byte [rdi], al
mov rax, qword gs:[0x30]
xor ebx, ebx
mov qword [r8], rbx
mov r8, rdx
mov edx, 8
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r14, rax
test rax, rax
je 0x140001c14
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
test esi, esi
je 0x140001a8d
mov eax, 0xf62e6ce0
mov edx, esi
mov rcx, r14
nop word [rax + rax]
xor byte [rcx], al
lea rcx, [rcx + 1]
rol eax, 1
add edx, 0xffffffff
jne 0x140001a80
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x20]
mov qword [rsp + 0x38], rsi
lea r8, [rsp + 0x70]
movups xmm0, xmmword [rsp + 0x30]
mov dword [rsp + 0x40], ebx
lea rdx, [rsp + 0x30]
movsd xmm1, qword [rsp + 0x40]
mov ecx, 1
movaps xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [rsp + 0x50]
movsd qword [rsp + 0x80], xmm1
movsd xmm1, qword [rsp + 0x60]
movaps xmmword [rsp + 0x30], xmm0
movsd qword [rsp + 0x40], xmm1
call qword [sym.imp.msdelta.dll_ApplyDeltaB]
test eax, eax
je 0x140001be4
mov rsi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x20]
cmp byte [rsp + 0xd0], bl
je 0x140001b93
lea edi, [rsi + 1]
mov edx, ebx
shr edi, 1
je 0x140001b29
mov r8, rbp
nop
movzx eax, word [r8]
lea r8, [r8 + 2]
add edx, eax
mov ecx, edx
movzx edx, dx
shr ecx, 0x10
add edx, ecx
add edi, 0xffffffff
jne 0x140001b10
mov edi, edx
mov rcx, rbp
shr edi, 0x10
add di, dx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r8, rax
test rax, rax
je 0x140001b63
movzx eax, word [rax + 0x58]
cmp di, ax
adc ax, bx
sub di, ax
movzx eax, word [r8 + 0x5a]
mov r8d, dword [r8 + 0x58]
cmp di, ax
adc ax, bx
sub di, ax
jmp 0x140001b69
mov r8d, esi
movzx edi, bx
movzx r9d, di
add r9d, esi
cmp r9d, r8d
je 0x140001b9f
lea rdx, str.____Error_data_checksum_mismatch__Header_sum_0x_lx__calculated_sum_0x_lx_r_n
mov ecx, 1
call fcn.140012590
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.msdelta.dll_DeltaFree]
jmp 0x140001bf8
lea rcx, str.___Checksum_verification_skipped_r_n
call fcn.140001980
mov rax, qword gs:[0x30]
mov r8, rsi
mov edx, 8
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x140001bd7
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [r15], rsi
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.msdelta.dll_DeltaFree]
jmp 0x140001bf8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_while_decompressing_resource
call fcn.1400134b0
mov rax, qword gs:[0x30]
mov r8, r14
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea r11, [rsp + 0x90]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret