Function at 0x140032410
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, qword [rdx]
movzx eax, word [rbx]
cmp eax, 0x5a4d
jne 0x1400326cb
movsxd rax, dword [rbx + 0x3c]
cmp dword [rbx + rax], 0x4550
jne 0x1400326cb
mov rsi, r8
mov rdi, rcx
movzx ecx, word [rbx + rax + 0x18]
cmp ecx, 0x10b
je 0x1400324fc
cmp ecx, 0x20b
jne 0x1400326cb
mov r12d, dword [rbx + rax + 0xac]
test r12, r12
je 0x1400326cb
mov r13d, dword [rbx + rax + 0xa8]
test r13d, r13d
je 0x1400326cb
mov r14, qword [rdi]
mov qword [rsp + 0x28], r12
mov rax, qword [r14 + 0x58]
sub rax, qword [r14 + 0x48]
cmp rax, r12
jae 0x1400324be
add r14, 0x48
lea rdx, [rsp + 0x28]
mov rcx, r14
call fcn.140033280
mov r14, qword [rdi]
lea r15, [r14 + 0x48]
add rbx, r13
jmp 0x1400324e5
movzx eax, byte [rbx]
mov byte [rdx], al
inc qword [r14 + 0x50]
inc rbx
dec r12
je 0x140032578
mov rdx, qword [r14 + 0x50]
cmp rdx, qword [r14 + 0x58]
jne 0x1400324d0
mov rcx, r15
mov r8, rbx
call fcn.140033000
jmp 0x1400324d9
mov r12d, dword [rbx + rax + 0x9c]
test r12, r12
je 0x1400326cb
mov r13d, dword [rbx + rax + 0x98]
test r13d, r13d
je 0x1400326cb
mov r14, qword [rdi]
mov qword [rsp + 0x28], r12
mov rax, qword [r14 + 0x58]
sub rax, qword [r14 + 0x48]
cmp rax, r12
jae 0x140032547
add r14, 0x48
lea rdx, [rsp + 0x28]
mov rcx, r14
call fcn.140033280
mov r14, qword [rdi]
lea r15, [r14 + 0x48]
add rbx, r13
jmp 0x140032561
movzx eax, byte [rbx]
mov byte [rdx], al
inc qword [r14 + 0x50]
inc rbx
dec r12
je 0x1400325cc
mov rdx, qword [r14 + 0x50]
cmp rdx, qword [r14 + 0x58]
jne 0x140032550
mov rcx, r15
mov r8, rbx
call fcn.140033000
jmp 0x140032559
mov rdi, qword [rdi]
cmp qword [rdi + 0x18], 0x10
mov rax, rdi
jb 0x140032588
mov rax, qword [rdi]
movabs rdx, 0xcbf29ce484222645
lea r14, [rdi + 0x48]
movzx r8d, byte [rax]
test r8b, r8b
je 0x14003261c
movabs rcx, 0x100000001b3
inc rax
nop dword [rax]
movzx r9d, r8b
xor r9, rdx
imul r9, rcx
movzx r8d, byte [rax]
inc rax
mov rdx, r9
test r8b, r8b
jne 0x1400325b0
jmp 0x14003261f
mov rdi, qword [rdi]
cmp qword [rdi + 0x18], 0x10
mov rax, rdi
jb 0x1400325dc
mov rax, qword [rdi]
movabs rdx, 0xcbf29ce484222645
lea r14, [rdi + 0x48]
movzx r8d, byte [rax]
test r8b, r8b
je 0x14003261c
movabs rcx, 0x100000001b3
inc rax
movzx r9d, r8b
xor r9, rdx
imul r9, rcx
movzx r8d, byte [rax]
inc rax
mov rdx, r9
test r8b, r8b
jne 0x140032600
jmp 0x14003261f
mov r9, rdx
mov qword [rsp + 0x20], r9
lea rdx, [rsp + 0x28]
lea r8, [rsp + 0x20]
mov rcx, rsi
call fcn.140032ef0
mov r15, qword [rsp + 0x28]
lea rbx, [r15 + 0x30]
cmp rbx, r14
je 0x1400326cb
mov rsi, qword [rdi + 0x48]
mov rdi, qword [rdi + 0x50]
sub rdi, rsi
mov rcx, qword [r15 + 0x30]
mov rax, qword [r15 + 0x40]
sub rax, rcx
cmp rax, rdi
jae 0x140032684
mov rcx, rbx
mov rdx, rdi
call fcn.140033350
mov rbx, qword [rbx]
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memmove
add rbx, rdi
jmp 0x1400326c7
mov rbx, qword [r15 + 0x38]
sub rbx, rcx
mov r14, rdi
sub r14, rbx
jbe 0x1400326b8
mov rdx, rsi
mov r8, rbx
call sub.VCRUNTIME140.dll_memmove
add rsi, rbx
mov rbx, qword [r15 + 0x38]
mov rcx, rbx
mov rdx, rsi
mov r8, r14
call sub.VCRUNTIME140.dll_memmove
add rbx, r14
jmp 0x1400326c7
lea rbx, [rcx + rdi]
mov rdx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memmove
mov qword [r15 + 0x38], rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400d2000
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret