Function at 0x1400051d0
Capabilities:
Encode data using xor
Hash data using fnv
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14001f080]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov rsi, rcx
lea r14, [rcx + 0x28]
mov qword [rbp - 0x50], r14
mov r12d, 1
mov dword [rbp - 0x48], r12d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
nop
movabs rcx, 0xcbf29ce484222325
mov r8, rcx
xor edx, edx
movabs r9, 0x100000001b3
movzx eax, byte [rbx + rdx]
xor r8, rax
imul r8, r9
add rdx, r12
cmp rdx, 8
jb 0x14000522f
xor edx, edx
movzx eax, byte [rbx + rdx + 8]
xor rcx, rax
imul rcx, r9
add rdx, r12
cmp rdx, 8
jb 0x140005245
xor rcx, r8
mov rdx, qword [rsi + 0x60]
and rdx, rcx
add rdx, rdx
mov r8, qword [rsi + 0x48]
mov rcx, qword [r8 + rdx*8 + 8]
cmp rcx, qword [rsi + 0x38]
jne 0x14000529e
xor ecx, ecx
test rcx, rcx
je 0x1400052eb
cmp qword [r8 + rdx*8 + 8], rcx
jne 0x1400052be
cmp qword [r8 + rdx*8], rcx
jne 0x1400052b3
mov rax, qword [rsi + 0x38]
mov qword [r8 + rdx*8], rax
jmp 0x1400052b7
cmp rcx, qword [r8 + rdx*8]
je 0x140005276
mov rcx, qword [rcx + 8]
mov rax, qword [rbx]
cmp rax, qword [rcx + 0x10]
jne 0x140005294
mov rax, qword [rbx + 8]
cmp rax, qword [rcx + 0x18]
jne 0x140005294
jmp 0x140005278
mov rax, qword [rcx + 8]
mov qword [r8 + rdx*8 + 8], rax
jmp 0x1400052cb
cmp qword [r8 + rdx*8], rcx
jne 0x1400052cb
mov rax, qword [rcx]
mov qword [r8 + rdx*8], rax
mov rdx, qword [rcx]
dec qword [rsi + 0x40]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x20
call fcn.14001269c
cmp qword [rsi + 0x40], 0
jne 0x1400053c7
mov edi, 0x12c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], rax
and qword [rbp - 0x28], rax
and dword [rbp - 0x20], eax
and qword [rbp - 0x18], rax
lea r8, str.SoftwareMicrosoftVisualStudioDiagnosticsHub
lea rcx, [rbp - 0x28]
call fcn.140003058
mov rbx, qword [rbp - 0x28]
test eax, eax
jne 0x14000538b
and dword [rbp - 0x40], eax
mov dword [rbp - 0x30], 4
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x38]
xor r8d, r8d
lea rdx, str.CollectorService.IdleShutdownInSeconds
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000538b
cmp dword [rbp - 0x38], 4
jne 0x14000538b
mov edi, dword [rbp - 0x40]
test edi, edi
jne 0x14000538b
lea r8, str.Service_idle_shutdown_has_been_disabled
lea rdx, str.D:_a_work1_s_sourcesBaseCollectionStandardCollector.ServiceStandardCollectorHost.cpp
mov rcx, qword [0x1400207a8]
call fcn.14000c63c
jmp 0x1400053b8
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x1400053b8
mov eax, edi
imul rdx, rax, 0xffffffffff676980
mov dword [rbp - 0x38], edx
sar rdx, 0x20
mov dword [rbp - 0x34], edx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_SetThreadpoolTimer]
nop
test rbx, rbx
je 0x1400053c7
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140012650
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret