Function at 0x140059a30
Capabilities:
Enumerate pe sections
Hash data via bcrypt
Parse pe header

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xa8
mov rax, qword [0x140325af8]
xor rax, rsp
mov qword [rbp + 7], rax
xor eax, eax
mov qword [rbp - 0x31], r8
mov qword [rbp - 9], rax
mov edi, eax
mov qword [rbp - 0x19], rax
mov r13d, eax
mov dword [rbp + 3], eax
mov rbx, r9
mov dword [rbp - 1], eax
mov r15, r8
mov dword [rbp - 0x11], eax
mov r14, rdx
mov eax, dword [rbp + 0x7f]
mov r12, rcx
mov qword [rbp - 0x29], rdx
mov qword [rbp - 0x21], rcx
sub eax, 1
je 0x140059ad1
sub eax, 1
je 0x140059ac8
sub eax, 1
je 0x140059abf
sub eax, 1
je 0x140059ab6
cmp eax, 1
je 0x140059aad
mov eax, 0xc000000d
jmp 0x14005a1ec
lea rdx, str.SHA512
jmp 0x140059ad8
lea rdx, str.SHA384
jmp 0x140059ad8
lea rdx, str.SHA256
jmp 0x140059ad8
lea rdx, [0x1402e1578]
jmp 0x140059ad8
lea rdx, str.SHA1
xor r9d, r9d
lea rcx, [rbp - 9]
xor r8d, r8d
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
mov esi, eax
test eax, eax
jns 0x140059b3a
call fcn.1400159c0
lea rcx, str._Error_0x_x_returned_by_BCryptOpenAlgorithmProvider___Hash
mov r9d, 0x389
mov dword [rsp + 0x38], esi
mov r10, qword [rax]
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommoncryptouser.cpp
mov qword [rsp + 0x30], rcx
lea rdx, str.GetFileHash64
lea rcx, str.MbCommonSigCRYPTUSR
mov qword [rsp + 0x28], rcx
mov rcx, rax
mov dword [rsp + 0x20], 2
call qword [r10 + 0x20]
jmp 0x14005a1bd
mov rcx, qword [rbp - 9]
lea rax, [rbp + 3]
mov dword [rsp + 0x28], edi
lea r8, [rbp - 0x11]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea rdx, str.ObjectLength
call qword [sym.imp.bcrypt.dll_BCryptGetProperty]
mov esi, eax
test eax, eax
jns 0x140059b7c
call fcn.1400159c0
lea rcx, str._Error_0x_x_returned_by_BCryptGetProperty_getting_object_length
mov r9d, 0x390
jmp 0x140059b00
mov ecx, dword [rbp - 0x11]
call fcn.1401ecd00
mov qword [rbp - 0x39], rax
mov rdi, rax
test rax, rax
jne 0x140059bd8
call fcn.1400159c0
lea rcx, str._memory_allocation_failed
mov r9d, 0x39a
mov qword [rsp + 0x30], rcx
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommoncryptouser.cpp
lea rcx, str.MbCommonSigCRYPTUSR
mov r10, qword [rax]
lea rdx, str.GetFileHash64
mov qword [rsp + 0x28], rcx
mov rcx, rax
mov dword [rsp + 0x20], 2
call qword [r10 + 0x20]
jmp 0x14005a1bd
mov rcx, qword [rbp - 9]
lea rax, [rbp + 3]
mov dword [rsp + 0x28], r13d
lea r8, [rbp - 1]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea rdx, str.HashDigestLength
call qword [sym.imp.bcrypt.dll_BCryptGetProperty]
mov esi, eax
test eax, eax
jns 0x140059c1e
call fcn.1400159c0
lea rcx, str._Error_0x_x_returned_by_BCryptGetProperty_getting_hash_length
mov r9d, 0x3a1
jmp 0x140059b00
mov eax, dword [rbp - 1]
cmp dword [r14], eax
jae 0x140059c81
mov esi, 0xc000000d
call fcn.1400159c0
mov ecx, dword [rbp - 1]
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommoncryptouser.cpp
mov dword [rsp + 0x40], ecx
lea rdx, str.GetFileHash64
mov ecx, dword [r14]
mov r9d, 0x3a9
mov r10, qword [rax]
mov dword [rsp + 0x38], ecx
lea rcx, str._Invalid_hash_size:__u__need__u
mov qword [rsp + 0x30], rcx
lea rcx, str.MbCommonSigCRYPTUSR
mov qword [rsp + 0x28], rcx
mov rcx, rax
mov dword [rsp + 0x20], 2
call qword [r10 + 0x20]
jmp 0x14005a1bd
test r12, r12
jne 0x140059ca7
mov esi, 0xc000000d
call fcn.1400159c0
lea rcx, str._Invalid_hash_buffer:__p
mov qword [rsp + 0x38], r13
mov r9d, 0x3b0
jmp 0x140059b04
mov r9d, dword [rbp - 0x11]
lea rdx, [rbp - 0x19]
mov rcx, qword [rbp - 9]
mov r8, rdi
mov dword [r14], eax
xor eax, eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.bcrypt.dll_BCryptCreateHash]
mov esi, eax
test eax, eax
jns 0x140059ceb
call fcn.1400159c0
lea rcx, str._Error_0x_x_returned_by_BCryptCreateHash
mov r9d, 0x3b9
jmp 0x140059b00
mov eax, 0x5a4d
lea rdi, str.MbCommonSigCRYPTUSR
cmp word [r15], ax
je 0x140059d39
call fcn.1400159c0
lea rcx, str.Not_A_Valid_Dos_Stub
mov r9d, 0x3c2
mov qword [rsp + 0x30], rcx
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommoncryptouser.cpp
mov qword [rsp + 0x28], rdi
lea rdx, str.GetFileHash64
mov r10, qword [rax]
mov rcx, rax
mov dword [rsp + 0x20], 5
call qword [r10 + 0x20]
movsxd r12, dword [r15 + 0x3c]
add r12, r15
cmp dword [r12], 0x4550
je 0x140059d8b
call fcn.1400159c0
lea rcx, str.Not_A_Valid_PE_Executable
mov r9d, 0x3c9
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 5
mov r10, qword [rax]
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommoncryptouser.cpp
lea rdx, str.GetFileHash64
mov rcx, rax
call qword [r10 + 0x20]
jmp 0x14005a1b9
mov rcx, qword [rbp - 0x19]
mov r8d, r12d
sub r8d, r15d
xor r9d, r9d
add r8d, 0x58
mov rdx, r15
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov esi, eax
test eax, eax
jns 0x140059df0
call fcn.1400159c0
mov r9d, 0x3da
mov r10, qword [rax]
lea rcx, str._Error_0x_x_returned_by_BCryptHashData
mov dword [rsp + 0x38], esi
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommoncryptouser.cpp
mov qword [rsp + 0x30], rcx
lea rdx, str.GetFileHash64
mov qword [rsp + 0x28], rdi
mov rcx, rax
mov dword [rsp + 0x20], 2
call qword [r10 + 0x20]
jmp 0x14005a1b9
mov rcx, qword [rbp - 0x19]
lea rdx, [r12 + 0x5c]
xor r9d, r9d
lea r8d, [r9 + 0x4c]
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov esi, eax
test eax, eax
jns 0x140059e19
call fcn.1400159c0
mov r9d, 0x3e7
jmp 0x140059db6
movzx r8d, word [r12 + 6]
lea rdx, [r12 + 0xb0]
mov r14d, dword [r12 + 0x54]
lea r9, [r12 + 0xb0]
mov dword [rbp - 0x41], r14d
test r8, r8
je 0x140059e71
movzx eax, word [r12 + 0x14]
lea rcx, [r12 + 0x28]
add rcx, rax
nop dword [rax + rax]
mov eax, dword [rcx + 4]
cmp eax, r14d
jae 0x140059e63
cmp dword [rcx], r13d
jbe 0x140059e63
test eax, eax
cmovne r14d, eax
add rcx, 0x28
sub r8, 1
jne 0x140059e50
mov dword [rbp - 0x41], r14d
mov rcx, qword [rbp - 0x19]
mov r8d, r15d
sub r8d, r9d
xor r9d, r9d
add r8d, r14d
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov esi, eax
test eax, eax
jns 0x140059e9d
call fcn.1400159c0
mov r9d, 0x402
jmp 0x140059db6
movzx eax, word [r12 + 6]
test ax, ax
je 0x14005a090
movzx ecx, word [r12 + 0x14]
xor edi, edi
movzx r15d, ax
mov eax, r15d
mul ecx
mov ecx, eax
mov rax, 0xffffffffffffffff
cmovo rcx, rax
call fcn.1401ecd00
mov r13, rax
test rax, rax
jne 0x140059f07
call fcn.1400159c0
lea rcx, str._Error_getting_memory
mov r9d, 0x417
mov qword [rsp + 0x30], rcx
lea rcx, str.MbCommonSigCRYPTUSR
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 2
jmp 0x140059d6e
xor r10d, r10d
mov r8d, r10d
cmp r10w, word [r12 + 6]
jae 0x140059f4e
mov r9, r13
nop dword [rax + rax]
movsxd rax, r8d
lea r9, [r9 + 8]
inc r8d
lea rdx, [rax + rax*4]
movzx eax, word [r12 + 0x14]
add rax, 0x18
add rax, r12
lea rax, [rax + rdx*8]
mov qword [r9 - 8], rax
movzx eax, word [r12 + 6]
cmp r8d, eax
jl 0x140059f20
test r15d, r15d
je 0x14005a085
nop word [rax + rax]
movzx edx, word [r12 + 6]
mov r8d, r10d
cmp r10w, dx
jae 0x140059fb4
mov rdx, r13
mov rcx, qword [rdx]
test rcx, rcx
je 0x140059f9d
cmp dword [rcx + 0x10], 0
je 0x140059f97
test rdi, rdi
jne 0x140059f8a
mov rdi, rcx
jmp 0x140059f9d
mov eax, dword [rcx + 0x14]
cmp dword [rdi + 0x14], eax
jbe 0x140059f9d
mov rdi, rcx
jmp 0x140059f9d
mov qword [rdx], r10
dec r15d
movzx eax, word [r12 + 6]
inc r8d
add rdx, 8
cmp r8d, eax
jl 0x140059f72
movzx edx, ax
jmp 0x140059fb7
movzx eax, dx
test rdi, rdi
je 0x14005a07c
mov r8d, dword [rdi + 0x14]
cmp r8d, r14d
jb 0x14005a043
mov r9d, dword [rdi + 0x10]
mov rdx, r10
movzx r10d, ax
mov r14d, r9d
test r10, r10
je 0x14005a011
nop dword [rax]
mov rax, qword [r13 + rdx*8]
test rax, rax
je 0x14005a009
cmp dword [rax + 0x10], 0
jbe 0x14005a009
cmp rax, rdi
je 0x14005a009
mov ecx, dword [rax + 0x14]
lea eax, [r9 + r8]
cmp eax, ecx
jbe 0x14005a009
sub ecx, r9d
sub ecx, r8d
add r14d, ecx
inc rdx
cmp rdx, r10
jl 0x140059fe0
mov rcx, qword [rbp - 0x19]
mov rdx, r8
add rdx, qword [rbp - 0x31]
xor r9d, r9d
mov r8d, r14d
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov esi, eax
test eax, eax
js 0x14005a0e9
add dword [rbp - 0x41], r14d
mov r14d, dword [rbp - 0x41]
xor r10d, r10d
movzx edx, word [r12 + 6]
movzx r9d, dx
mov r8d, r10d
mov rcx, r10
test r9d, r9d
je 0x14005a076
mov rdx, qword [r13 + rcx*8]
test rdx, rdx
je 0x14005a064
mov eax, dword [rdi + 0x14]
cmp dword [rdx + 0x14], eax
je 0x14005a071
inc r8d
inc rcx
cmp r8d, r9d
jl 0x14005a052
jmp 0x14005a076
mov qword [r13 + rcx*8], r10
mov rdi, r10
dec r15d
test r15d, r15d
jg 0x140059f60
mov r15, qword [rbp - 0x31]
lea rdi, str.MbCommonSigCRYPTUSR
cmp ebx, r14d
jbe 0x14005a14e
mov r8d, ebx
sub r8d, dword [r12 + 0xac]
sub r8d, r14d
cmp r8d, ebx
ja 0x14005a112
mov edx, r14d
mov ecx, ebx
sub rcx, rdx
mov eax, r8d
cmp rax, rcx
ja 0x14005a112
mov rcx, qword [rbp - 0x19]
add rdx, r15
xor r9d, r9d
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov esi, eax
test eax, eax
jns 0x14005a14e
call fcn.1400159c0
lea rcx, str._Error_0x_x_returned_by_BCryptHashData
mov r9d, 0x478
jmp 0x14005a17e
call fcn.1400159c0
lea rcx, str._Error_0x_x_returned_by_BCryptHashData
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rcx
mov r9d, 0x455
lea rcx, str.MbCommonSigCRYPTUSR
mov qword [rsp + 0x28], rcx
jmp 0x14005a18c
call fcn.1400159c0
lea rcx, str.Error_calculating_rest_of_data__
mov r9d, 0x471
mov qword [rsp + 0x30], rcx
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommoncryptouser.cpp
mov qword [rsp + 0x28], rdi
lea rdx, str.GetFileHash64
mov r10, qword [rax]
mov rcx, rax
mov dword [rsp + 0x20], 2
call qword [r10 + 0x20]
mov rax, qword [rbp - 0x29]
xor r9d, r9d
mov rdx, qword [rbp - 0x21]
mov rcx, qword [rbp - 0x19]
mov r8d, dword [rax]
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
mov esi, eax
test eax, eax
jns 0x14005a1ac
call fcn.1400159c0
lea rcx, str._Error_0x_x_returned_by_BCryptFinishHash
mov r9d, 0x483
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdi
mov r10, qword [rax]
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommoncryptouser.cpp
lea rdx, str.GetFileHash64
mov dword [rsp + 0x20], 2
mov rcx, rax
call qword [r10 + 0x20]
test r13, r13
je 0x14005a1b9
mov rcx, r13
call fcn.1401e539c
mov rdi, qword [rbp - 0x39]
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x14005a1ce
xor edx, edx
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x14005a1dd
call qword [sym.imp.bcrypt.dll_BCryptDestroyHash]
test rdi, rdi
je 0x14005a1ea
mov rcx, rdi
call fcn.1401e539c
mov eax, esi
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.1401d9c30
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret