Function at 0x140016b81
Capabilities:
Hash data with crc32
Map section object

Disassembly:
jmp 0x140036590
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf18
lea rbp, [rsp + 0x50]
mov rdi, rsp
mov ecx, 0x3c6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xf38]
mov rax, qword [0x140064bf8]
xor rax, rbp
mov qword [rbp + 0xeb8], rax
lea rcx, [0x14006d245]
call fcn.140016276
mov dword [rbp + 4], 0
mov dword [rbp + 0x24], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x88], 0
mov rax, qword [rbp + 0xee0]
mov qword [rbp + 0xc8], rax
mov qword [rbp + 0x108], 0
mov byte [rbp + 0x124], 0
mov byte [rbp + 0x125], 0
mov byte [rbp + 0x126], 0
mov byte [rbp + 0x127], 0
mov byte [rbp + 0x128], 0
mov byte [rbp + 0x129], 1
mov eax, 0x1c
mov word [rbp + 0x148], ax
mov eax, 0x1e
mov word [rbp + 0x14a], ax
lea rax, str.ArisuTsuberuku
mov qword [rbp + 0x150], rax
mov dword [rbp + 0x178], 0x30
mov qword [rbp + 0x180], 0
mov qword [rbp + 0x188], 0
mov dword [rbp + 0x190], 0
mov qword [rbp + 0x198], 0
mov qword [rbp + 0x1a0], 0
lea rax, [rbp + 0xa24]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov edx, 0x834
lea rcx, [rbp + 0x1d0]
call fcn.140016c2b
mov rax, qword [rbp + 0xc8]
cmp dword [rax + 0x68], 0
je 0x1400366f9
mov rax, qword [rbp + 0xc8]
add rax, 0x68a
mov r9d, 0x104
mov r8, rax
mov edx, 0x104
lea rcx, [rbp + 0x1dc]
call fcn.140016bd1
lea rdx, str.AkagiCompletionEvent
lea rcx, [rbp + 0x7fa]
call fcn.14001616d
mov rax, qword [rbp + 0xc8]
mov eax, dword [rax + 0x60]
mov dword [rbp + 0x1d8], eax
call fcn.1400168b1
mov eax, dword [rax + 0x2c0]
mov dword [rbp + 0x1d4], eax
lea r9, [rbp + 0x44]
mov r8d, 0x208
lea rdx, [rbp + 0x5f0]
xor ecx, ecx
call fcn.140016992
lea r9, [rbp + 0x44]
mov r8d, 0x208
lea rdx, [rbp + 0x3e6]
xor ecx, ecx
call fcn.140016c76
mov r8d, 0x834
lea rdx, [rbp + 0x1d0]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
mov dword [rbp + 0x1d0], eax
xor edx, edx
lea rcx, [rbp + 0x148]
call qword [sym.imp.ntdll.dll_RtlCreateBoundaryDescriptor]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x140036797
jmp 0x140036995
lea r8, [rbp + 0xa24]
mov dl, 1
lea rcx, [rbp + 0x124]
call fcn.140016a96
mov qword [rbp + 0x108], rax
cmp qword [rbp + 0x108], 0
jne 0x1400367c2
jmp 0x140036995
mov rdx, qword [rbp + 0x108]
lea rcx, [rbp + 0x68]
call qword [sym.imp.ntdll.dll_RtlAddSIDToBoundaryDescriptor]
test eax, eax
jge 0x1400367dc
jmp 0x140036995
mov rax, qword [rbp + 0xc8]
add rax, 0x40
mov r9, qword [rbp + 0x68]
lea r8, [rbp + 0x178]
mov edx, 0x2000000
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtCreatePrivateNamespace]
test eax, eax
jge 0x140036809
jmp 0x140036995
mov dword [rbp + 0x190], 0x40
mov rax, qword [rbp + 0xc8]
mov rax, qword [rax + 0x40]
mov qword [rbp + 0x180], rax
lea rax, [rbp + 0x148]
mov qword [rbp + 0x188], rax
lea rdx, str.AkagiCompletionEvent
lea rcx, [rbp + 0x148]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, qword [rbp + 0xc8]
add rax, 0x50
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 0x178]
mov edx, 0x1f0003
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtCreateEvent]
test eax, eax
jge 0x140036878
jmp 0x140036995
mov qword [rbp + 0xe8], 0x1000
mov qword [rbp + 0xa8], 0x1000
lea rdx, str.AkagiSharedSection
lea rcx, [rbp + 0x148]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, qword [rbp + 0xc8]
add rax, 0x48
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 4
lea r9, [rbp + 0xe8]
lea r8, [rbp + 0x178]
mov edx, 7
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtCreateSection]
test eax, eax
jl 0x14003698b
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], 0x100000
mov dword [rsp + 0x38], 2
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x1000
xor r9d, r9d
lea r8, [rbp + 0x88]
mov rdx, 0xffffffffffffffff
mov rax, qword [rbp + 0xc8]
mov rcx, qword [rax + 0x48]
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jl 0x14003698b
mov edx, 0x1000
mov rcx, qword [rbp + 0x88]
call fcn.140016c2b
mov r8d, 0x834
lea rdx, [rbp + 0x1d0]
mov rcx, qword [rbp + 0x88]
call fcn.140016a32
mov rdx, qword [rbp + 0x88]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov dword [rbp + 0x24], 1
cmp dword [rbp + 4], 0
jne 0x140036778
cmp qword [rbp + 0x108], 0
je 0x1400369ab
mov rcx, qword [rbp + 0x108]
call fcn.140016032
cmp qword [rbp + 0x68], 0
je 0x1400369bc
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ntdll.dll_RtlDeleteBoundaryDescriptor]
cmp dword [rbp + 0x24], 0
jne 0x1400369f2
mov rax, qword [rbp + 0xc8]
cmp qword [rax + 0x40], 0
je 0x1400369f2
mov rax, qword [rbp + 0xc8]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.ntdll.dll_NtDeletePrivateNamespace]
mov rax, qword [rbp + 0xc8]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [rbp + 0x24]
mov edi, eax
lea rcx, [rbp - 0x50]
lea rdx, reloc.Cabinet.dll_FCICreate
call fcn.140016b90
mov eax, edi
mov rcx, qword [rbp + 0xeb8]
xor rcx, rbp
call fcn.14001633e
lea rsp, [rbp + 0xec8]
pop rdi
pop rbp
ret