Function at 0x140027f20
Capabilities:
Encode data using xor
Get system information on windows
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov edi, r8d
mov rcx, qword [rcx]
mov esi, edx
test rcx, rcx
je 0x1400108d7
jle 0x1400108d0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], 0
mov rcx, qword [rbx + 0x10]
mov qword [rbx + 0x10], 0
test rcx, rcx
je 0x1400108fc
lea rax, vtable.blackbone::Native.0
mov edx, 0x20
mov qword [rcx], rax
call fcn.14003e760
mov dword [rbx + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
jne 0x140010915
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x140010922
mov r8d, esi
xor edx, edx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, qword [rbx]
mov rdi, rax
cmp rax, rcx
je 0x14001093b
test rcx, rcx
jle 0x140010938
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rdi
cmp dword [0x1400905cc], 0xa
jb 0x140010977
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
jne 0x140010977
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, qword [rbx]
mov rdi, rax
cmp rax, rcx
je 0x140010977
test rcx, rcx
jle 0x140010974
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rdi
mov rdi, qword [rbx]
test rdi, rdi
jg 0x1400109ac
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rdi, rax
je 0x1400109ac
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp rdi, rax
je 0x1400109ac
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
mov rcx, rbx
mov dword [rbx + 8], esi
add rsp, 0x20
pop rdi
pop rsi
pop rbx
jmp 0x140027f20
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x14008d030]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r12, rcx
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
movups xmmword [rbp + 0xf], xmm0
movups xmmword [rbp + 0x1f], xmm0
lea rcx, [rbp - 1]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rbp - 1], r14w
jne 0x140027ffc
lea ecx, [r14 + 0x20]
call fcn.14003e768
mov rbx, rax
mov qword [rbp - 0x49], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rax, qword [r12]
lea r15, vtable.blackbone::Native.0
mov qword [rbx], r15
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], r14
movups xmmword [rbp - 0x31], xmm0
movups xmmword [rbp - 0x21], xmm0
movups xmmword [rbp - 0x11], xmm0
lea rcx, [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rbp - 0x2d]
mov dword [rbx + 0x18], eax
mov word [rbx + 0x14], 0x101
mov dword [rbx + 0x10], r14d
mov byte [rbx + 0x16], 1
lea rax, vtable.blackbone::x86Native.0
mov qword [rbx], rax
lea rsi, [r12 + 0x10]
mov rcx, qword [rsi]
mov qword [rsi], rbx
test rcx, rcx
je 0x1400280d7
mov qword [rcx], r15
jmp 0x1400280cd
mov dword [rbp - 0x39], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
lea rdi, [r12 + 0x10]
mov ecx, 0x20
cmp dword [rbp - 0x39], 1
jne 0x140028076
call fcn.14003e768
mov rbx, rax
mov qword [rbp - 0x49], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
xor r8d, r8d
mov rdx, qword [r12]
mov rcx, rax
call fcn.140029640
lea rax, vtable.blackbone::NativeWow64.0
mov qword [rbx], rax
mov rcx, qword [rdi]
mov qword [rdi], rbx
test rcx, rcx
je 0x140028071
lea r15, vtable.blackbone::Native.0
mov qword [rcx], r15
mov edx, 0x20
call fcn.14003e760
mov rsi, rdi
jmp 0x1400280d7
call fcn.14003e768
mov qword [rbp - 0x49], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
xor r8d, r8d
mov rdx, qword [r12]
mov rcx, rax
call fcn.140029640
lea rcx, [rbp - 0x49]
mov rsi, rdi
cmp rdi, rcx
je 0x1400280bb
mov rcx, qword [rdi]
mov qword [rdi], rax
test rcx, rcx
je 0x1400280d7
lea r15, vtable.blackbone::Native.0
mov qword [rcx], r15
jmp 0x1400280cd
test rax, rax
je 0x1400280d7
lea r15, vtable.blackbone::Native.0
mov qword [rax], r15
mov rcx, rax
mov edx, 0x20
call fcn.14003e760
mov rax, qword [rsi]
cmp byte [rax + 0x15], r14b
jne 0x1400280eb
mov byte [r12 + 0x18], 1
jmp 0x140028247
mov dword [rbp - 0x39], r14d
mov dword [rbp - 0x35], r14d
call fcn.140010200
mov rsi, rax
mov qword [rbp - 0x41], rax
lea rdx, str.GetProcessDEPPolicy
lea rcx, [rbp - 0x31]
call fcn.140003230
nop
call fcn.140025990
lea r15, [rsi + 0x40]
mov qword [rbp - 0x49], r15
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rbp - 0x31]
call fcn.140003ea0
mov rbx, rax
lea rcx, [rbp - 0x31]
call fcn.140003eb0
mov r8, rax
movabs rcx, 0xcbf29ce484222325
mov rdx, r14
test rbx, rbx
je 0x140028174
movabs r9, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
xor rcx, rax
imul rcx, r9
inc rdx
cmp rdx, rbx
jb 0x140028160
mov rdx, qword [rsi + 0x30]
and rdx, rcx
mov r13, qword [rsi + 0x18]
mov rax, rdx
add rax, rax
mov rdi, qword [r13 + rax*8 + 8]
cmp rdi, qword [rsi + 8]
je 0x1400281f1
add rdx, rdx
mov r13, qword [r13 + rdx*8]
nop dword [rax + rax]
lea rcx, [rdi + 0x10]
mov rbx, qword [rcx + 0x10]
call fcn.140004b00
mov r15, rax
mov rsi, qword [rbp - 0x21]
lea rcx, [rbp - 0x31]
call fcn.140004b00
cmp rsi, rbx
jne 0x1400281d4
mov r8, rsi
mov rdx, r15
mov rcx, rax
call fcn.1400416b0
test eax, eax
je 0x1400281df
cmp rdi, r13
je 0x1400281e9
mov rdi, qword [rdi + 8]
jmp 0x1400281a0
mov rsi, qword [rbp - 0x41]
mov r15, qword [rbp - 0x49]
jmp 0x1400281f4
mov rsi, qword [rbp - 0x41]
mov r15, qword [rbp - 0x49]
mov rdi, r14
test rdi, rdi
je 0x140028224
cmp rdi, qword [rsi + 8]
je 0x140028224
mov rbx, qword [rdi + 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14002822e
lea r8, [rbp - 0x35]
lea rdx, [rbp - 0x39]
mov rcx, qword [r12]
call rbx
mov r14d, eax
jmp 0x14002822e
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x31]
call fcn.1400040b0
test r14d, r14d
je 0x140028247
movzx eax, byte [rbp - 0x39]
and al, 1
mov byte [r12 + 0x18], al
xor eax, eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14003ecb0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret