Function at 0x140004400
Capabilities:
Hash data with crc32
Parse pe header

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x14002d010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x30], r9d
mov edi, r8d
mov dword [rsp + 0x24], edi
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rcx
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x70], rax
xor r14d, r14d
mov ebx, r14d
mov qword [rsp + 0x58], rbx
mov qword [rax], r14
mov qword [rsp + 0x78], r14
mov edx, r8d
lea rcx, [rsp + 0x78]
call fcn.140004760
nop
mov r8, qword [rsp + 0x78]
mov qword [rsp + 0x38], r8
test r8, r8
je 0x140004711
mov edx, r14d
mov dword [rsp + 0x20], edx
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 0x60]
mov qword [rsp + 0x28], rcx
test rcx, rcx
je 0x14000470e
mov rax, qword [rcx + 0x18]
add rax, 0x20
mov qword [rsp + 0x50], rax
mov r15, qword [rax]
mov r9d, 0x5a4d
nop dword [rax]
lea rax, [r15]
cmp edx, edi
je 0x1400045d0
mov r15, qword [r15]
mov r14, qword [rax + 0x20]
cmp r14, qword [rcx + 0x10]
je 0x1400045c5
mov eax, edx
lea rcx, [rax + rax*2]
lea rax, [r8 + rcx*8]
mov qword [rsp + 0x48], rax
cmp word [r14], r9w
jne 0x1400045c0
movsxd rbp, dword [r14 + 0x3c]
add rbp, r14
cmp dword [rbp], 0x4550
jne 0x1400045c0
mov esi, ebx
movzx r12d, word [rbp + 6]
test r12d, r12d
je 0x1400045c0
movzx r13d, word [rbp + 0x14]
nop
mov eax, esi
lea rcx, [rax + rax*4]
lea rdi, [rcx*8]
add rdi, r13
add rdi, rbp
mov r11, 0xffffffffffffffff
nop dword [rax + rax]
inc r11
cmp byte [rdi + r11 + 0x18], bl
jne 0x140004540
dec r11
cmp r11, 0xffffffffffffffff
je 0x1400045a2
lea rcx, [r11 - 1]
lea rdx, [rdi + 0x18]
call fcn.1400037c0
mov r10d, eax
movzx edx, byte [r11 + rdi + 0x18]
lea eax, [rdx - 0x41]
mov ecx, ebx
cmp al, 0x19
mov eax, 0x20
cmovbe ecx, eax
or dl, cl
movsx eax, dl
xor rax, r10
movzx ecx, al
shr r10d, 8
lea rax, [0x140029720]
xor r10d, dword [rax + rcx*4]
not r10d
cmp r10d, 0xa21c1ea3
je 0x140004631
inc esi
cmp esi, r12d
jb 0x140004520
mov edx, dword [rsp + 0x20]
mov r9d, 0x5a4d
mov r8, qword [rsp + 0x38]
mov edi, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x28]
cmp r15, qword [rsp + 0x50]
jne 0x1400044c0
mov ebp, ebx
test edi, edi
mov rbx, qword [rsp + 0x58]
mov r15, qword [rsp + 0x60]
je 0x14000470e
lea rsi, [r8 + 0x10]
xor r14d, r14d
mov r12d, dword [rsp + 0x30]
mov r13, qword [rsp + 0x68]
nop word [rax + rax]
mov rax, qword [rsi - 8]
test rax, rax
je 0x1400046e8
mov ecx, dword [rsi]
test ecx, ecx
je 0x1400046e8
mov rbx, rax
test r12d, r12d
je 0x140004658
test bl, 0xf
je 0x140004658
add rbx, 0x10
and rbx, 0xfffffffffffffff0
add ecx, 0xfffffff0
jmp 0x140004662
mov rcx, qword [rsp + 0x48]
mov qword [rcx], r14
mov eax, dword [rdi + 0x24]
add rax, r14
mov qword [rcx + 8], rax
mov eax, dword [rdi + 0x28]
mov dword [rcx + 0x10], eax
mov edx, dword [rsp + 0x20]
inc edx
mov dword [rsp + 0x20], edx
jmp 0x1400045b1
mov eax, 0xffffffff
sub eax, r15d
add ecx, eax
mov edi, ecx
add rdi, rbx
cmp r15, 2
jne 0x1400046a4
movzx eax, word [r13]
test r12d, r12d
je 0x140004690
cmp rbx, rdi
jae 0x1400046dc
nop dword [rax]
cmp ax, word [rbx]
je 0x1400046df
add rbx, 0x10
cmp rbx, rdi
jb 0x140004680
jmp 0x1400046dc
cmp rbx, rdi
jae 0x1400046dc
cmp ax, word [rbx]
je 0x1400046df
inc rbx
cmp rbx, rdi
jb 0x140004695
jmp 0x1400046dc
cmp rbx, rdi
jae 0x1400046dc
nop dword [rax]
mov r8, r15
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
cmp rax, r15
je 0x1400046df
mov eax, 1
test r12d, r12d
mov ecx, 0x10
cmovne eax, ecx
add rbx, rax
cmp rbx, rdi
jb 0x1400046b0
mov rbx, r14
test rbx, rbx
jne 0x1400046f7
mov edi, dword [rsp + 0x24]
inc ebp
add rsi, 0x18
cmp ebp, edi
jae 0x14000470e
jmp 0x140004600
mov eax, ebp
lea rcx, [rax + rax*2]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + rcx*8]
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov r14, rbx
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140004720
call fcn.140004e9c
mov rax, r14
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140004e40
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret