Function at 0x140016140
Capabilities:
Enumerate pe sections
Hash data using djb2
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1070
call fcn.14002e3e0
sub rsp, rax
mov rax, qword [0x140038010]
xor rax, rsp
mov qword [rsp + 0x1060], rax
mov r13, r9
mov qword [rsp + 0x38], r9
mov rsi, r8
mov r14, rdx
mov r12, rcx
mov qword [rsp + 0x40], rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
test r9, r9
je 0x1400164cb
mov r9d, dword [rsp + 0x10c0]
test r9d, r9d
je 0x14001641d
mov rbp, qword [rcx + 0x10]
test rbp, rbp
je 0x140016276
mov rax, qword [rcx + 0x48]
mov rbx, qword [rax + 0x48]
mov rdi, qword [rax + 0x58]
lea ecx, [r15 + 0x48]
call fcn.14002d4d0
mov rcx, qword [r12 + 0x48]
mov rdx, qword [rcx + 0x60]
mov qword [rax], rdx
mov rcx, qword [r12 + 0x48]
mov rdx, qword [rcx + 0x68]
mov qword [rax + 8], rdx
mov rcx, qword [r12 + 0x48]
mov rdx, qword [rcx + 0x70]
mov qword [rax + 0x10], rdx
mov rcx, qword [r12 + 0x48]
mov rdx, qword [rcx + 0x78]
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rbp
mov qword [rax + 0x28], r13
mov qword [rax + 0x30], 0x1000
lea rcx, [rsp + 0x60]
mov qword [rax + 0x38], rcx
mov qword [rax + 0x40], r15
mov qword [rsp + 0x28], 0x48
mov qword [rsp + 0x20], rax
mov r9, qword [r12 + 0x70]
mov r8, qword [r12]
mov rdx, qword [r12 + 0x40]
mov rcx, qword [r12 + 0x48]
call rbx
mov rax, qword [r12 + 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [r12 + 0x50]
mov qword [rsp + 0x20], rax
mov r9, qword [r12 + 0x60]
mov r8, qword [r12 + 8]
mov rdx, qword [r12 + 0x40]
mov rcx, qword [r12 + 0x48]
call rdi
mov r9d, dword [rsp + 0x10c0]
mov eax, 0x5a4d
cmp word [rsp + 0x60], ax
jne 0x1400164cb
movsxd rax, dword [rsp + 0x9c]
lea r8, [rsp + 0x60]
add r8, rax
mov qword [rsp + 0x48], r8
cmp dword [r8], 0x4550
jne 0x1400164cb
movzx edi, word [r8 + 0x14]
add rdi, 0x18
add rdi, r8
mov r13, r15
cmp r15w, word [r8 + 6]
jae 0x1400164cb
mov r12, 0xffffffffffffffff
nop dword [rax]
test rdi, rdi
je 0x1400163e0
mov eax, 0x1505
movsx ecx, byte [rdi]
lea rdx, [rdi + 1]
test ecx, ecx
je 0x140016300
nop dword [rax]
imul eax, eax, 0x21
add eax, ecx
movsx ecx, byte [rdx]
lea rdx, [rdx + 1]
test ecx, ecx
jne 0x1400162f0
cmp eax, r9d
jne 0x1400163e0
cmp dword [rdi + 0xc], 0
je 0x1400164cb
mov eax, dword [rdi + 8]
test eax, eax
je 0x1400164cb
mov ebx, eax
mov ecx, eax
call fcn.140001310
mov rbp, rax
mov r8d, ebx
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x50], rbp
or dword [rsp + 0x30], 2
mov ecx, dword [rdi + 8]
mov r8d, dword [rdi + 0xc]
add r8, qword [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov r9, rbp
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x10]
mov rcx, rax
call fcn.140016670
mov rax, r12
nop dword [rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x140016370
mov ebx, dword [rdi + 8]
sub rbx, rax
mov r10, r15
je 0x1400163d3
movzx r11d, byte [rsi]
nop dword [rax + rax]
mov rdx, rsi
mov rax, r14
test r11b, r11b
je 0x1400163c6
movzx r8d, r11b
mov r9, rbp
sub r9, r14
add r9, r10
cmp r8b, 0x78
jne 0x1400163b7
movzx ecx, byte [rax]
cmp byte [r9 + rax], cl
jne 0x1400163cb
inc rdx
inc rax
movzx r8d, byte [rdx]
test r8b, r8b
jne 0x1400163a8
cmp byte [rdx], 0
je 0x140016402
inc r10
cmp r10, rbx
jb 0x140016390
mov rcx, rbp
call fcn.14002d764
mov r8, qword [rsp + 0x48]
add rdi, 0x28
inc r13
movzx eax, word [r8 + 6]
cmp r13, rax
jae 0x1400164cb
mov r9d, dword [rsp + 0x10c0]
jmp 0x1400162d0
mov ebx, dword [rdi + 0xc]
add rbx, r10
add rbx, qword [rsp + 0x38]
mov rcx, rbp
call fcn.14002d764
mov rax, rbx
jmp 0x1400164cd
mov ebx, 0x32
mov ecx, ebx
call fcn.140001310
mov rdi, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
mov word [rdi + 0x30], ax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x20], rbx
mov r9, rdi
mov r8, r13
mov rdx, qword [r12 + 0x10]
mov rcx, r12
call fcn.140016670
mov r12, 0xffffffffffffffff
inc r12
cmp byte [rsi + r12], 0
jne 0x140016464
sub rbx, r12
je 0x1400164c3
movzx r10d, byte [rsi]
nop word [rax + rax]
mov rdx, rsi
mov rcx, r14
test r10b, r10b
je 0x1400164b6
movzx r8d, r10b
mov r9, rdi
sub r9, r14
add r9, r15
cmp r8b, 0x78
jne 0x1400164a7
movzx eax, byte [rcx]
cmp byte [r9 + rcx], al
jne 0x1400164bb
inc rdx
inc rcx
movzx r8d, byte [rdx]
test r8b, r8b
jne 0x140016498
cmp byte [rdx], 0
je 0x1400164fe
inc r15
cmp r15, rbx
jb 0x140016480
mov rcx, rdi
call fcn.14002d764
xor eax, eax
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.14002d4b0
lea r11, [rsp + 0x1070]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rbx, [r15 + r13]
mov rcx, rdi
call fcn.14002d764
mov rax, rbx
jmp 0x1400164cd