Function at 0x140020794
Capabilities:
Check os version
Extract resource via kernel32 functions
Map section object

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x14003e060]
xor rax, rsp
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0x130]
mov r14, rcx
xor ebx, ebx
and qword [rsp + 0x58], rbx
and qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], rax
mov rax, qword [rbp + 0x138]
xor ecx, ecx
mov qword [rsp + 0x70], rdx
xor r13d, r13d
xor edi, edi
xor esi, esi
mov qword [rbp - 0x80], rax
xor r12d, r12d
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rbp - 0x70]
mov dword [rbp - 0x70], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1400208a0
cmp dword [rbp - 0x6c], 6
jb 0x140020a4a
lea rcx, [0x140009820]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x1400208a0
lea rdx, [0x14000bb48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test rax, rax
je 0x14002089d
lea rdx, [0x14000bb60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
je 0x14002089d
and qword [rsp + 0x30], rsi
and dword [rsp + 0x28], esi
lea r8d, [rdi + 5]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, r14
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14002090b
xor esi, esi
mov r13d, esi
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x1400208b4
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
test r12, r12
je 0x1400208c2
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x1400208d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1400208de
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, r13d
mov rcx, qword [rbp + 0xc8]
xor rcx, rsp
call fcn.140028130
mov rbx, qword [rsp + 0x220]
add rsp, 0x1d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
and qword [rsp + 0x28], rdi
and dword [rsp + 0x20], edi
xor r9d, r9d
lea r8d, [r9 + 2]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor edx, edx
mov r12, rax
test rax, rax
je 0x140020ae5
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edx
lea r14d, [rdx + 1]
mov dword [rsp + 0x38], r14d
lea rax, [rsp + 0x60]
lea r8, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdx
or rdx, 0xffffffffffffffff
xor r9d, r9d
mov rcx, r12
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jns 0x14002098e
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r13d, edi
jmp 0x1400208a0
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
lea r9, [rbp - 0x78]
xor ecx, ecx
call r15
test eax, eax
js 0x140020976
mov r15, qword [rsp + 0x58]
and qword [rbp + 0xc0], rdi
lea r8, [0x14000bb40]
mov r9d, 3
mov qword [rbp + 0xb0], r8
lea rax, [rsp + 0x68]
or r15, r14
lea r8, [rbp + 0xb0]
lea ecx, [r9 + 0x2d]
mov rdx, r15
mov qword [rbp + 0xb8], r14
mov qword [rsp + 0x20], rax
call r13
mov ecx, eax
test eax, eax
js 0x140020978
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x140020978
mov r13d, edi
test rdi, rdi
mov rdx, rax
cmovne r15, rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140020ace
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, rax
test rax, rax
je 0x140020ace
cmp dword [rax], 0xfecdfecd
je 0x140020a8d
mov ecx, 0xb
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140020ace
xor edx, edx
mov rcx, r14
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x1400208e1
mov r14d, 1
lea r8, [0x14000bb40]
mov rcx, rax
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140020ace
jmp 0x140020a01
movups xmm0, xmmword [rax + 0x1c]
mov rax, qword [rsp + 0x70]
movdqu xmmword [rax], xmm0
cmp dword [rcx + 0x74], 0
jbe 0x140020acb
mov eax, dword [rcx + 0x74]
mov r15, qword [rsp + 0x78]
lea rdx, [0x1400094f0]
add rax, rcx
cmp word [rax], 0x2a
cmovne rdx, rax
test r15, r15
je 0x140020acb
mov rcx, qword [rbp - 0x80]
call fcn.1400273c0
mov dword [r15], eax
mov r13d, r14d
test rdi, rdi
je 0x1400208a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400208a0
mov r13d, edx
jmp 0x1400208a0