Function at 0x14008e6f4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x448]
sub rsp, 0x510
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1403f04b0]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov rsi, rdx
mov rdi, rcx
mov edx, 0x60
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
xor r12d, r12d
lea r13d, [r12 + 1]
mov eax, dword [rdx + rcx]
cmp dword [0x140410620], eax
jle 0x14008ecc7
lea rcx, [0x140410620]
call fcn.1402801b8
cmp dword [0x140410620], 0xffffffff
jne 0x14008ecc7
lea rdx, str.EXTRACTPROCESS
lea rcx, [rbp + 0x180]
call fcn.140048750
mov dword [rbp + 0x1a0], r12d
lea rdx, str.EXTRACTUSER
lea rcx, [rbp + 0x1a8]
call fcn.140048750
mov dword [rbp + 0x1c8], r13d
lea rdx, str.REGEXEXTRACT
lea rcx, [rbp + 0x1d0]
call fcn.140048750
mov dword [rbp + 0x1f0], 2
lea rdx, str.MULTIREGEXEXTRACT
lea rcx, [rbp + 0x1f8]
call fcn.140048750
mov dword [rbp + 0x218], 4
lea rdx, str.EXTRACTFILE
lea rcx, [rbp + 0x220]
call fcn.140048750
mov dword [rbp + 0x240], 5
lea rdx, str.EXTRACTFILEBACKTRACE
lea rcx, [rbp + 0x248]
call fcn.140048750
mov dword [rbp + 0x268], 6
lea rdx, str.FileExtensionExtract
lea rcx, [rbp + 0x120]
call fcn.140048750
nop
mov r8b, r13b
lea rdx, [rbp + 0x120]
lea rcx, [rbp - 0x60]
call fcn.140059288
movups xmm0, xmmword [rbp - 0x60]
movaps xmmword [rbp + 0x270], xmm0
movups xmm1, xmmword [rbp - 0x50]
movaps xmmword [rbp + 0x280], xmm1
movdqa xmm0, xmmword [0x140307960]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r12w
mov dword [rbp + 0x290], 3
lea rcx, [rbp - 0x60]
call fcn.1400492c0
nop
lea rcx, [rbp + 0x120]
call fcn.1400492c0
lea rdx, str.ExtractSocketAddress
lea rcx, [rbp + 0x140]
call fcn.140048750
nop
mov r8b, r13b
lea rdx, [rbp + 0x140]
lea rcx, [rbp - 0x40]
call fcn.140059288
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rbp + 0x298], xmm0
movups xmm1, xmmword [rbp - 0x30]
movups xmmword [rbp + 0x2a8], xmm1
movdqa xmm0, xmmword [0x140307960]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], r12w
mov dword [rbp + 0x2b8], 7
lea rcx, [rbp - 0x40]
call fcn.1400492c0
nop
lea rcx, [rbp + 0x140]
call fcn.1400492c0
lea rdx, str.ExtractSocketAddressPort
lea rcx, [rbp + 0x160]
call fcn.140048750
nop
mov r8b, r13b
lea rdx, [rbp + 0x160]
lea rcx, [rbp - 0x20]
call fcn.140059288
movups xmm0, xmmword [rbp - 0x20]
movaps xmmword [rbp + 0x2c0], xmm0
movups xmm1, xmmword [rbp - 0x10]
movaps xmmword [rbp + 0x2d0], xmm1
movdqa xmm0, xmmword [0x140307960]
movdqu xmmword [rbp - 0x10], xmm0
mov word [rbp - 0x20], r12w
mov dword [rbp + 0x2e0], 8
lea rcx, [rbp - 0x20]
call fcn.1400492c0
nop
lea rcx, [rbp + 0x160]
call fcn.1400492c0
lea rdx, str.ExtractSocketAddressWithDns
lea rcx, [rbp + 0xe0]
call fcn.140048750
nop
mov r8b, r13b
lea rdx, [rbp + 0xe0]
lea rcx, [rbp]
call fcn.140059288
movups xmm0, xmmword [rbp]
movups xmmword [rbp + 0x2e8], xmm0
movups xmm1, xmmword [rbp + 0x10]
movups xmmword [rbp + 0x2f8], xmm1
movdqa xmm0, xmmword [0x140307960]
movdqu xmmword [rbp + 0x10], xmm0
mov word [rbp], r12w
mov dword [rbp + 0x308], 9
lea rcx, [rbp]
call fcn.1400492c0
nop
lea rcx, [rbp + 0xe0]
call fcn.1400492c0
lea rdx, str.CanonizeFilePath
lea rcx, [rbp + 0x100]
call fcn.140048750
nop
mov r8b, r13b
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x20]
call fcn.140059288
movups xmm0, xmmword [rbp + 0x20]
movaps xmmword [rbp + 0x310], xmm0
movups xmm1, xmmword [rbp + 0x30]
movaps xmmword [rbp + 0x320], xmm1
movdqa xmm0, xmmword [0x140307960]
movdqu xmmword [rbp + 0x30], xmm0
mov word [rbp + 0x20], r12w
mov dword [rbp + 0x330], 0xa
lea rcx, [rbp + 0x20]
call fcn.1400492c0
nop
lea rcx, [rbp + 0x100]
call fcn.1400492c0
mov r8b, r13b
lea rdx, [0x1403f1a30]
lea rcx, [rbp + 0x40]
call fcn.140059288
movups xmm0, xmmword [rbp + 0x40]
movups xmmword [rbp + 0x338], xmm0
movups xmm1, xmmword [rbp + 0x50]
movups xmmword [rbp + 0x348], xmm1
movdqa xmm0, xmmword [0x140307960]
movdqu xmmword [rbp + 0x50], xmm0
mov word [rbp + 0x40], r12w
mov dword [rbp + 0x358], SafeArrayLock
lea rcx, [rbp + 0x40]
call fcn.1400492c0
mov r8b, r13b
lea rdx, [0x1403f1a50]
lea rcx, [rbp + 0x60]
call fcn.140059288
movups xmm0, xmmword [rbp + 0x60]
movaps xmmword [rbp + 0x360], xmm0
movups xmm1, xmmword [rbp + 0x70]
movaps xmmword [rbp + 0x370], xmm1
movdqa xmm0, xmmword [0x140307960]
movdqu xmmword [rbp + 0x70], xmm0
mov word [rbp + 0x60], r12w
mov dword [rbp + 0x380], SafeArrayLock
lea rcx, [rbp + 0x60]
call fcn.1400492c0
mov r8b, r13b
lea rdx, [0x1403f1a70]
lea rcx, [rbp + 0x80]
call fcn.140059288
movups xmm0, xmmword [rbp + 0x80]
movups xmmword [rbp + 0x388], xmm0
movups xmm1, xmmword [rbp + 0x90]
movups xmmword [rbp + 0x398], xmm1
movdqa xmm0, xmmword [0x140307960]
movdqu xmmword [rbp + 0x90], xmm0
mov word [rbp + 0x80], r12w
mov dword [rbp + 0x3a8], SafeArrayLock
lea rcx, [rbp + 0x80]
call fcn.1400492c0
mov r8b, r13b
lea rdx, [0x1403f1a90]
lea rcx, [rbp + 0xa0]
call fcn.140059288
movups xmm0, xmmword [rbp + 0xa0]
movaps xmmword [rbp + 0x3b0], xmm0
movups xmm1, xmmword [rbp + 0xb0]
movaps xmmword [rbp + 0x3c0], xmm1
movdqa xmm0, xmmword [0x140307960]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r12w
mov dword [rbp + 0x3d0], SafeArrayLock
lea rcx, [rbp + 0xa0]
call fcn.1400492c0
mov r8b, r13b
lea rdx, [0x1403f1ab0]
lea rcx, [rbp + 0xc0]
call fcn.140059288
movups xmm0, xmmword [rbp + 0xc0]
movups xmmword [rbp + 0x3d8], xmm0
movups xmm1, xmmword [rbp + 0xd0]
movups xmmword [rbp + 0x3e8], xmm1
movdqa xmm0, xmmword [0x140307960]
movdqu xmmword [rbp + 0xd0], xmm0
mov word [rbp + 0xc0], r12w
mov dword [rbp + 0x3f8], SafeArrayLock
lea rcx, [rbp + 0xc0]
call fcn.1400492c0
nop
lea rax, [rbp + 0x180]
mov qword [rbp - 0x80], rax
lea rax, [rbp + 0x400]
mov qword [rbp - 0x78], rax
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x80], xmm0
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x38]
call fcn.1400602d4
nop
lea rdx, [rsp + 0x38]
call fcn.1400914d4
nop
lea rcx, [rsp + 0x50]
call fcn.1400514ac
mov rax, qword [rsp + 0x40]
mov r14, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0x40]
mov qword [rax + 8], rax
mov qword [rsp + 0x48], r12
mov rcx, qword [rsp + 0x40]
cmp r14, rcx
je 0x14008ec8c
mov rbx, qword [r14]
lea rcx, [r14 + 0x10]
call fcn.1400492c0
mov rcx, r14
call fcn.14027abd8
mov r14, rbx
mov rcx, qword [rsp + 0x40]
cmp rbx, rcx
jne 0x14008ec6b
call fcn.14027abd8
nop
lea r9, [fcn.140049340]
mov edx, 0x28
lea r8d, [rdx - 0x18]
lea rcx, [rbp + 0x180]
call fcn.1402802f0
lea rcx, [0x1402af6a0]
call fcn.14027ab8c
nop
lea rcx, [0x140410620]
call fcn.140280158
lea rdx, [rsi + 8]
mov r8b, r13b
lea rcx, [rbp - 0x80]
call fcn.140059288
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae r8, qword [rbp - 0x80]
movabs rcx, 0xcbf29ce484222325
mov rdx, r12
mov rax, qword [rbp - 0x70]
lea r9, [rax + rax]
test r9, r9
je 0x14008ed1d
movzx eax, byte [rdx + r8]
xor rcx, rax
movabs r10, 0x100000001b3
imul rcx, r10
add rdx, r13
cmp rdx, r9
jb 0x14008ecff
mov rax, qword [0x140410660]
and rax, rcx
mov r11, rax
add r11, r11
mov r14, qword [0x140410648]
mov r11, qword [r14 + r11*8]
lea r15, [rax + rax]
mov rbx, qword [0x140410638]
cmp qword [r14 + r15*8], rbx
jne 0x14008ed4e
mov rax, rbx
jmp 0x14008ed56
mov rax, qword [r14 + r15*8 + 8]
mov rax, qword [rax]
cmp r11, rax
je 0x14008ed86
lea rdx, [r11 + 0x10]
lea r8, [rbp - 0x80]
call fcn.140057f40
test al, al
je 0x14008ed71
mov r11, qword [r11]
jmp 0x14008ed43
lea r8, [r11 + 0x10]
lea rdx, [rbp - 0x80]
call fcn.140057f40
test al, al
cmovne r11, rbx
jmp 0x14008ed89
mov r11, rbx
cmp r11, rbx
jne 0x14008ed97
mov r14b, r13b
mov ebx, dword [rsp + 0x28]
jmp 0x14008ed9e
mov ebx, dword [r11 + 0x30]
mov r14b, r12b
lea rcx, [rbp - 0x80]
call fcn.1400492c0
test r14b, r14b
je 0x14008edf8
mov rcx, rsi
call fcn.14004e790
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.14007951c
nop
mov r8, rax
lea rdx, str.Failed_mapping_the_TransformerTypeStr_to_enum
lea rcx, [rbp + 0xe0]
call fcn.140086a04
nop
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140086a5c
lea rdx, [0x1403d39e8]
lea rcx, [rbp - 0x80]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
nop
cmp ebx, 8
jg 0x14008f0b3
je 0x14008f050
test ebx, ebx
je 0x14008eff6
sub ebx, 1
je 0x14008ef9c
sub ebx, 1
je 0x14008ef6d
sub ebx, 1
je 0x14008ef13
sub ebx, 1
je 0x14008eee4
sub ebx, 1
je 0x14008eedd
sub ebx, 1
je 0x14008eea4
cmp ebx, 1
jne 0x14008f0ea
mov ecx, 0x108
call fcn.14027abe8
mov rbx, rax
mov qword [rsp + 0x28], rax
mov dword [rax + 8], r13d
mov dword [rax + 0xc], r13d
lea rax, vtable.std::_Ref_count_obj_class_sense::GenericETW::SocketAddressTransformer_.0
mov qword [rbx], rax
lea r14, [rbx + 0x10]
mov qword [rbp - 0x80], r14
test r14, r14
je 0x14008ee87
mov rdx, rsi
mov rcx, r14
call fcn.14009d848
nop
mov qword [rdi], r14
mov qword [rdi + 8], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x80]
call fcn.1400480e0
jmp 0x14008f249
mov byte [rsp + 0x20], r13b
lea r8, [rsp + 0x20]
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.140092c30
mov rcx, qword [rax]
mov qword [rdi], rcx
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov qword [rax], r12
mov qword [rax + 8], r12
lea rcx, [rbp - 0x80]
call fcn.1400480e0
jmp 0x14008f249
mov byte [rsp + 0x20], r12b
jmp 0x14008eea9
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.140092b7c
mov rcx, qword [rax]
mov qword [rdi], rcx
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov qword [rax], r12
mov qword [rax + 8], r12
lea rcx, [rbp - 0x80]
call fcn.1400480e0
jmp 0x14008f249
mov ecx, pe_nt_image_headers64
call fcn.14027abe8
mov rbx, rax
mov qword [rbp - 0x80], rax
mov dword [rax + 8], r13d
mov dword [rax + 0xc], r13d
lea rax, vtable.std::_Ref_count_obj_class_sense::GenericETW::FileExtensionExtractTransformer_.0
mov qword [rbx], rax
lea r14, [rbx + 0x10]
mov qword [rsp + 0x28], r14
test r14, r14
je 0x14008ef50
mov rdx, rsi
mov rcx, r14
call fcn.14009af90
nop
mov qword [rdi], r14
mov qword [rdi + 8], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x80]
call fcn.1400480e0
jmp 0x14008f249
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.140092ac8
mov rcx, qword [rax]
mov qword [rdi], rcx
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov qword [rax], r12
mov qword [rax + 8], r12
lea rcx, [rbp - 0x80]
call fcn.1400480e0
jmp 0x14008f249
mov ecx, 0xf0
call fcn.14027abe8
mov rbx, rax
mov qword [rbp - 0x80], rax
mov dword [rax + 8], r13d
mov dword [rax + 0xc], r13d
lea rax, vtable.std::_Ref_count_obj_class_sense::GenericETW::ExtractUserTransformer_.0
mov qword [rbx], rax
lea r14, [rbx + 0x10]
mov qword [rsp + 0x28], r14
test r14, r14
je 0x14008efd9
mov rdx, rsi
mov rcx, r14
call fcn.140097dc4
nop
mov qword [rdi], r14
mov qword [rdi + 8], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x80]
call fcn.1400480e0
jmp 0x14008f249
mov ecx, 0x110
call fcn.14027abe8
mov rbx, rax
mov qword [rbp - 0x80], rax
mov dword [rax + 8], r13d
mov dword [rax + 0xc], r13d
lea rax, vtable.std::_Ref_count_obj_class_sense::GenericETW::ExtractProcessTransformer_.0
mov qword [rbx], rax
lea r14, [rbx + 0x10]
mov qword [rsp + 0x28], r14
test r14, r14
je 0x14008f033
mov rdx, rsi
mov rcx, r14
call fcn.14009750c
nop
mov qword [rdi], r14
mov qword [rdi + 8], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x80]
call fcn.1400480e0
jmp 0x14008f249
mov ecx, 0x108
call fcn.14027abe8
mov rbx, rax
mov qword [rbp - 0x80], rax
mov dword [rax + 8], r13d
mov dword [rax + 0xc], r13d
lea rax, vtable.std::_Ref_count_obj_class_sense::GenericETW::SocketAddressTransformerPort_.0
mov qword [rbx], rax
lea r14, [rbx + 0x10]
mov qword [rsp + 0x28], r14
test r14, r14
je 0x14008f096
mov rdx, rsi
mov rcx, r14
call fcn.14009d848
lea rax, vtable.sense::GenericETW::SocketAddressTransformerPort.0
mov qword [r14], rax
mov qword [rdi], r14
mov qword [rdi + 8], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x80]
call fcn.1400480e0
jmp 0x14008f249
sub ebx, 9
je 0x14008f21f
sub ebx, 1
je 0x14008f1f3
sub ebx, 1
je 0x14008f1c7
sub ebx, 1
je 0x14008f198
sub ebx, 1
je 0x14008f169
sub ebx, 1
je 0x14008f13a
cmp ebx, 1
je 0x14008f10b
lea rdx, str.Failed_mapping_the_TransformerTypeStr_to_enum
lea rcx, [rbp - 0x80]
call fcn.140086afc
lea rdx, [0x1403d39e8]
lea rcx, [rbp - 0x80]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.140092f9c
mov rcx, qword [rax]
mov qword [rdi], rcx
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov qword [rax], r12
mov qword [rax + 8], r12
lea rcx, [rbp - 0x80]
call fcn.1400480e0
jmp 0x14008f249
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.140092f10
mov rcx, qword [rax]
mov qword [rdi], rcx
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov qword [rax], r12
mov qword [rax + 8], r12
lea rcx, [rbp - 0x80]
call fcn.1400480e0
jmp 0x14008f249
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.140092e84
mov rcx, qword [rax]
mov qword [rdi], rcx
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov qword [rax], r12
mov qword [rax + 8], r12
lea rcx, [rbp - 0x80]
call fcn.1400480e0
jmp 0x14008f249
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.140092df8
mov rcx, qword [rax]
mov qword [rdi], rcx
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov qword [rax], r12
mov qword [rax + 8], r12
lea rcx, [rbp - 0x80]
call fcn.1400480e0
jmp 0x14008f249
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.140092d6c
mov rcx, qword [rax]
mov qword [rdi], rcx
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov qword [rax], r12
mov qword [rax + 8], r12
lea rcx, [rbp - 0x80]
call fcn.1400480e0
jmp 0x14008f249
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.140092ce0
mov rcx, qword [rax]
mov qword [rdi], rcx
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov qword [rax], r12
mov qword [rax + 8], r12
lea rcx, [rbp - 0x80]
call fcn.1400480e0
jmp 0x14008f249
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.140093028
mov rcx, qword [rax]
mov qword [rdi], rcx
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov qword [rax], r12
mov qword [rax + 8], r12
lea rcx, [rbp - 0x80]
call fcn.1400480e0
mov rax, rdi
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.14027a710
mov rbx, qword [rsp + 0x560]
add rsp, 0x510
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret