Function at 0x14008db60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2d0
mov rax, qword [0x1401c73e8]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov rsi, rdx
mov r14, rcx
mov qword [rsp + 0xa0], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x1e8], xmm0
movdqu xmmword [rsp + 0x1c8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x1d8], xmm1
xor r12d, r12d
mov qword [r11 - 0x110], r12
mov qword [r11 - 0x108], 0x100
movups xmmword [r11 - 0x78], xmm0
movups xmmword [r11 - 0x48], xmm0
lea rax, [r11 - 0x130]
mov qword [r11 - 0x78], rax
mov qword [r11 - 0x70], r12
movdqa xmmword [r11 - 0x68], xmm0
movdqa xmmword [r11 - 0x58], xmm1
mov qword [r11 - 0x48], 0x200
mov dword [r11 - 0x40], 0x144
mov byte [r11 - 0x3c], r12b
mov qword [r11 - 0x100], r12
mov qword [r11 - 0xf0], r12
mov qword [r11 - 0xe8], 7
mov word [r11 - 0x100], r12w
movups xmmword [rsp + 0x260], xmm0
movups xmmword [rsp + 0x270], xmm0
movups xmmword [rsp + 0x220], xmm0
mov word [r11 - 0xca], r12w
movdqa xmmword [rsp + 0x230], xmm0
movdqa xmmword [rsp + 0x240], xmm1
movdqa xmmword [rsp + 0x250], xmm0
mov qword [r11 - 0x98], r12
mov qword [r11 - 0x90], 0x400
mov dword [r11 - 0x88], r12d
mov qword [r11 - 0x80], r12
lea ecx, [r12 + 1]
call fcn.140122570
mov qword [rsp + 0x230], rax
mov qword [rsp + 0x238], rax
lea rcx, [rsp + 0x220]
call fcn.140037e40
xorps xmm0, xmm0
movups xmmword [rsp + 0x220], xmm0
mov eax, 3
mov word [rsp + 0x22e], ax
add r14, 8
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xb8], r12
mov qword [rsp + 0xc0], 7
lea r8d, [r12 + 4]
lea r13, str.name
mov rdx, r13
lea rcx, [rsp + 0xa8]
call fcn.140028220
lea rdx, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 8
cmovae rdx, qword [rsp + 0xa8]
movabs rbx, 0xcbf29ce484222325
mov r9, rbx
mov rax, qword [rsp + 0xb8]
lea r8, [rax + rax]
mov ecx, r12d
movabs rdi, 0x100000001b3
test r8, r8
je 0x14008dd55
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, rdi
inc rcx
cmp rcx, r8
jb 0x14008dd42
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.14007ce20
mov r15, qword [rax + 8]
test r15, r15
jne 0x14008dd77
mov r15, qword [r14 + 8]
lea rcx, [rsp + 0xa8]
call fcn.1400285b0
lea rcx, [rsp + 0x80]
cmp r15, qword [r14 + 8]
je 0x14008dd9d
lea rdx, [r15 + 0x30]
call fcn.140025cc0
jmp 0x14008ddd2
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x98], 7
mov word [rsp + 0x80], r12w
xor r8d, r8d
lea rdx, [0x140194f20]
call fcn.140028220
nop
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 7
mov r8d, 4
mov rdx, r13
lea rcx, [rsp + 0x30]
call fcn.140028220
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
mov r9, rbx
mov rax, qword [rsp + 0x40]
lea r8, [rax + rax]
mov rcx, r12
test r8, r8
je 0x14008de33
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, rdi
inc rcx
cmp rcx, r8
jb 0x14008de20
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xa8]
mov rcx, r14
call fcn.14007ce20
mov r15, qword [rax + 8]
test r15, r15
jne 0x14008de55
mov r15, qword [r14 + 8]
lea rcx, [rsp + 0x30]
call fcn.1400285b0
lea rcx, [rsp + 0x60]
cmp r15, qword [r14 + 8]
je 0x14008de75
lea rdx, [r15 + 0x30]
call fcn.140025cc0
jmp 0x14008de97
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
xor r8d, r8d
lea rdx, [0x140194f20]
call fcn.140028220
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8d, dword [rsp + 0x90]
lea rcx, [rsp + 0x50]
call fcn.14008e480
mov r8, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov eax, 0x405
mov word [rsp + 0x2e], ax
mov rax, qword [rsp + 0x28]
movabs rcx, 0xffff000000000000
and rax, rcx
or rax, r13
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x220]
call fcn.14008e5c0
lea rcx, [rsp + 0x20]
call fcn.140037e40
lea rcx, [rsp + 0x50]
call fcn.140037e40
lea rcx, [rsp + 0x60]
call fcn.1400285b0
nop
lea rcx, [rsp + 0x80]
call fcn.1400285b0
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 7
mov r8d, SafeArrayDestroy
lea r13, str.parent_process
mov rdx, r13
lea rcx, [rsp + 0x30]
call fcn.140028220
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
mov r9, rbx
mov rax, qword [rsp + 0x40]
lea r8, [rax + rax]
mov rcx, r12
test r8, r8
je 0x14008df94
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, rdi
inc rcx
cmp rcx, r8
jb 0x14008df81
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xa8]
mov rcx, r14
call fcn.14007ce20
mov r15, qword [rax + 8]
test r15, r15
jne 0x14008dfb6
mov r15, qword [r14 + 8]
lea rcx, [rsp + 0x30]
call fcn.1400285b0
lea rcx, [rsp + 0x80]
cmp r15, qword [r14 + 8]
je 0x14008dfd9
lea rdx, [r15 + 0x30]
call fcn.140025cc0
jmp 0x14008e00e
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x98], 7
mov word [rsp + 0x80], r12w
xor r8d, r8d
lea rdx, [0x140194f20]
call fcn.140028220
nop
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 7
mov r8d, SafeArrayDestroy
mov rdx, r13
lea rcx, [rsp + 0x30]
call fcn.140028220
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
lea r8, [rax + rax]
mov rcx, r12
test r8, r8
je 0x14008e073
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor rbx, rax
imul rbx, rdi
inc rcx
cmp rcx, r8
jb 0x14008e060
mov r9, rbx
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.14007ce20
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x14008e095
mov rbx, qword [r14 + 8]
lea rcx, [rsp + 0x30]
call fcn.1400285b0
lea rcx, [rsp + 0x60]
cmp rbx, qword [r14 + 8]
je 0x14008e0b5
lea rdx, [rbx + 0x30]
call fcn.140025cc0
jmp 0x14008e0d7
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
xor r8d, r8d
lea rdx, [0x140194f20]
call fcn.140028220
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8d, dword [rsp + 0x90]
lea rcx, [rsp + 0x50]
call fcn.14008e480
mov r8, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov ebx, 0x405
mov word [rsp + 0x2e], bx
mov rax, qword [rsp + 0x28]
movabs rdi, 0xffff000000000000
and rax, rdi
or rax, r13
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], SafeArrayUnlock
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x220]
call fcn.14008e5c0
lea rcx, [rsp + 0x20]
call fcn.140037e40
lea rcx, [rsp + 0x50]
call fcn.140037e40
lea rcx, [rsp + 0x60]
call fcn.1400285b0
nop
lea rcx, [rsp + 0x80]
call fcn.1400285b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x5e], bx
mov rax, qword [rsp + 0x58]
and rax, rdi
lea rcx, str.Uninstall_Event
or rax, rcx
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], reloc.OLEAUT32.dll_SafeArrayDestroy
movups xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x2e], bx
mov rax, qword [rsp + 0x28]
and rax, rdi
lea rcx, str._event_name
or rax, rcx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_VariantChangeType
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x220]
call fcn.14008e5c0
lea rcx, [rsp + 0x20]
call fcn.140037e40
lea rcx, [rsp + 0x50]
call fcn.140037e40
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x220]
call fcn.14008e6a0
test al, al
jne 0x14008e2c6
mov qword [rsi], r12
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 7
mov word [rsi], r12w
xor r8d, r8d
lea rdx, [0x140194f20]
mov rcx, rsi
call fcn.140028220
nop
mov edx, 1
mov rcx, qword [rsp + 0x238]
call fcn.140122560
mov rcx, qword [rsp + 0x250]
call fcn.140129840
mov edx, 1
mov rcx, qword [rsp + 0x248]
call fcn.140122560
lea rcx, [rsp + 0x220]
call fcn.140037e40
nop
lea rcx, [rsp + 0x1f8]
call fcn.1400285b0
nop
mov rcx, qword [rsp + 0x298]
call fcn.140129840
mov edx, 1
mov rcx, qword [rsp + 0x290]
call fcn.140122560
nop
mov rcx, qword [rsp + 0x1d8]
call fcn.140129840
mov edx, 1
mov rcx, qword [rsp + 0x1d0]
call fcn.140122560
mov rax, rsi
jmp 0x14008e453
mov rcx, qword [rsp + 0x1e0]
lea rax, [rcx + 2]
cmp rax, qword [rsp + 0x1e8]
jbe 0x14008e2f6
mov edx, 1
lea rcx, [rsp + 0x1c8]
call fcn.14008f710
mov rcx, qword [rsp + 0x1e0]
lea rax, [rcx + 2]
mov qword [rsp + 0x1e0], rax
mov word [rcx], r12w
sub qword [rsp + 0x1e0], 2
mov rdx, qword [rsp + 0x1d8]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x14008e320
lea rcx, [rsp + 0x1f8]
call fcn.140028220
nop
mov edx, 1
mov rcx, qword [rsp + 0x238]
call fcn.140122560
mov rcx, qword [rsp + 0x250]
call fcn.140129840
mov edx, 1
mov rcx, qword [rsp + 0x248]
call fcn.140122560
lea rcx, [rsp + 0x220]
call fcn.140037e40
nop
movups xmm0, xmmword [rsp + 0x1f8]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rsp + 0x208]
movups xmmword [rsi + 0x10], xmm1
mov qword [rsp + 0x208], r12
mov qword [rsp + 0x210], 7
mov word [rsp + 0x1f8], r12w
lea rcx, [rsp + 0x1f8]
call fcn.1400285b0
nop
mov rcx, qword [rsp + 0x298]
call fcn.140129840
mov edx, 1
mov rcx, qword [rsp + 0x290]
call fcn.140122560
nop
mov rcx, qword [rsp + 0x1d8]
call fcn.140129840
mov edx, 1
mov rcx, qword [rsp + 0x1d0]
call fcn.140122560
mov rax, rsi
jmp 0x14008e453
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.140122510
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret