Function at 0x34f44
Capabilities:
Enumerate pe sections
Hash data with md5
Parse pe header
Read file on windows
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x000a7100]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor r14d, r14d
mov qword [rsp + 0xc8], rdx
mov rsi, rcx
mov ebx, 0xc0000001
mov qword [r11 - 0x108], r14
mov qword [r11 - 0x100], r14
mov r12d, r14d
mov ebp, r14d
cmp rcx, r14
je 0x35386
cmp rcx, 0xffffffffffffffff
je 0x35386
lea rdx, [r11 - 0x108]
call fcn.00034ee4
mov r15d, 0xc0000000
mov ecx, eax
mov ebx, eax
and ecx, r15d
cmp ecx, r15d
je 0x35386
mov r13d, 0x1000
cmp qword [rsp + 0xa0], r13
jl 0x35386
mov r8d, 0x6c616e41
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
mov qword [rsp + 0xb0], rax
cmp rax, r14
je 0x35386
mov r8, r13
xor edx, edx
mov rcx, rax
call fcn.00091d10
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xb8]
mov dword [rsp + 0x30], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
and eax, r15d
cmp eax, r15d
je 0x35378
cmp qword [rsp + 0xc0], r14
je 0x35378
lea rax, [rsp + 0xa0]
mov ebx, 0xc0000001
cmp rax, r14
je 0x3511d
lea rax, [rsp + 0xa0]
cmp rax, r14
je 0x3511d
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x3511d
movsxd rcx, dword [rdi + 0x3c]
add rcx, rdi
cmp dword [rcx], 0x4550
jne 0x3511d
movzx eax, word [rcx + 6]
cmp ax, r14w
je 0x3511d
movzx edx, word [rcx + 0x18]
cmp edx, 0x10b
je 0x350e9
cmp edx, 0x20b
jne 0x3511d
movzx r8d, ax
movzx eax, word [rcx + 0x14]
lea rdx, [rax + rcx + 0x18]
jmp 0x350e1
cmp r8d, r14d
jbe 0x35107
add rdx, 0x28
cmp dword [rdx + 0x10], r14d
je 0x350d8
jmp 0x35107
movzx r8d, ax
movzx eax, word [rcx + 0x14]
lea rdx, [rax + rcx + 0x18]
jmp 0x35101
cmp r8d, r14d
jbe 0x35107
add rdx, 0x28
cmp dword [rdx + 0x10], r14d
je 0x350f8
cmp dword [rdx + 0x10], r14d
jbe 0x3511d
cmp dword [rdx + 0x14], r14d
je 0x3511d
mov ebp, dword [rdx + 0x14]
mov r12d, dword [rdx + 0x10]
mov ebx, r14d
mov eax, ebx
and eax, r15d
cmp eax, r15d
je 0x35378
mov r8d, 0xaaaaaaab
mov eax, r8d
mul ebp
mov eax, r8d
mov r8d, 0x6c616e41
shr edx, 1
lea ecx, [rbp + rdx]
mul r12d
mov eax, 0xcccccccd
shr edx, 1
mov qword [rsp + 0xa8], rcx
xor ecx, ecx
mul edx
mov r12d, edx
shr r12d, 4
mov edx, r12d
mov r13d, r12d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbp, rax
mov qword [rsp + 0xd0], rax
cmp rax, r14
je 0x35378
mov r8, r13
xor edx, edx
mov rcx, rax
call fcn.00091d10
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xb8]
mov dword [rsp + 0x30], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
mov dword [rsp + 0xa0], eax
and eax, r15d
cmp eax, r15d
je 0x3536a
mov rsi, qword [rsp + 0xc0]
cmp rsi, r14
je 0x3536a
xor edx, edx
lea rcx, [rsp + 0xe0]
lea r8d, [rdx + 0x58]
call fcn.00091d10
lea rcx, [rsp + 0xe0]
mov r8d, esi
mov rdx, rbp
mov dword [rsp + 0xf4], r14d
mov dword [rsp + 0xf0], r14d
mov dword [rsp + 0xe0], 0x67452301
mov dword [rsp + 0xe4], 0xefcdab89
mov dword [rsp + 0xe8], 0x98badcfe
mov dword [rsp + 0xec], 0x10325476
call fcn.000179cc
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x140]
call fcn.00017a88
movzx eax, byte [rsp + 0x14e]
movzx r11d, byte [rsp + 0x14f]
movzx ecx, byte [rsp + 0x14d]
movzx edx, byte [rsp + 0x14c]
movzx r8d, byte [rsp + 0x14b]
movzx r10d, byte [rsp + 0x14a]
movzx ebx, byte [rsp + 0x149]
movzx edi, byte [rsp + 0x148]
movzx esi, byte [rsp + 0x147]
movzx ebp, byte [rsp + 0x146]
movzx r12d, byte [rsp + 0x145]
movzx r13d, byte [rsp + 0x144]
movzx r14d, byte [rsp + 0x143]
movzx r15d, byte [rsp + 0x142]
movzx r9d, byte [rsp + 0x140]
mov dword [rsp + 0x90], r11d
mov dword [rsp + 0x88], eax
movzx eax, byte [rsp + 0x141]
mov dword [rsp + 0x80], ecx
mov rcx, qword [rsp + 0xc8]
mov dword [rsp + 0x78], edx
mov dword [rsp + 0x70], r8d
mov dword [rsp + 0x68], r10d
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r14d
lea r8, [0x00095c40]
mov edx, 0x40
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], eax
call fcn.00014458
mov ebx, dword [rsp + 0xa0]
mov rdi, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xd0]
mov edx, 0x6c616e41
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, 0x6c616e41
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.000916b0
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret