Function at 0x140015d28
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x14002b010]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rdi, rdx
mov rbx, rcx
mov word [rsp + 0x30], r8w
xor r12d, r12d
mov r15b, r12b
add rcx, 0x18
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], r12
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
lea eax, [r12 + 1]
lock xadd dword [rsp + 0x48], eax
inc eax
cmp eax, 1
jne 0x140015da3
cmp dword [rsp + 0x4c], r12d
jne 0x14001613d
call qword [sym.imp.MSVCP140.dll__Thrd_id]
mov dword [rsp + 0x4c], eax
mov rcx, rbx
call fcn.140016534
mov r14, qword [rbx]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140015dbb
mov rdx, qword [rdi]
movabs r9, 0xcbf29ce484222325
mov rcx, r12
cmp qword [rdi + 0x10], r12
jbe 0x140015dec
movzx eax, byte [rcx + rdx]
xor r9, rax
movabs r8, 0x100000001b3
imul r9, r8
inc rcx
cmp rcx, qword [rdi + 0x10]
jb 0x140015dce
mov r8, rdi
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.140016b58
mov rsi, qword [rax + 8]
test rsi, rsi
jne 0x140015e09
mov rsi, qword [r14 + 8]
mov rcx, rbx
call fcn.140016534
mov rax, qword [rbx]
cmp rsi, qword [rax + 8]
jne 0x140015e39
mov rcx, rbx
call fcn.140016534
lea r9, [rsp + 0x30]
mov r8, rdi
lea rdx, [rbp - 0x80]
mov rcx, qword [rbx]
call fcn.14001667c
mov r15b, 1
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x140015e78
or eax, 0xffffffff
lock xadd dword [rsp + 0x48], eax
cmp eax, 1
jne 0x140015e64
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rsp + 0x4c], eax
jne 0x14001614a
mov dword [rsp + 0x4c], r12d
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [rsp + 0x48]
jmp 0x140015e3d
cmp dword [rsp + 0x4c], r12d
je 0x140015e8f
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rsp + 0x4c], eax
jne 0x140016130
test r15b, r15b
jne 0x140015f0f
lea rax, [0x140021690]
mov qword [rbp + 0x80], rax
lea rax, [0x1400232b8]
mov qword [rbp + 0x88], rax
mov rdx, rdi
lea rcx, [rbp + 0x90]
call fcn.14000aa88
mov word [rbp + 0xb0], r12w
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, str.Attempt_to_add_quarantined_event_to_quarantine.
mov ecx, 0x14036a0
mov r8d, 0xf
call fcn.14000ba94
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0x10
jb 0x14001610f
inc rdx
mov rcx, qword [rbp + 0x90]
call fcn.140001a70
jmp 0x14001610f
cmp word [rsp + 0x30], 0xa
je 0x14001610f
lea rcx, [rbp - 0x70]
call fcn.14000abc8
movzx edx, word [rsp + 0x30]
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int____ptr64]
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x68]
call fcn.14000a68c
lea rsi, [0x140021a60]
mov qword [rbp + 0xc0], rsi
movups xmm0, xmmword [rbp + 0x80]
movaps xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rbp + 0x90]
movaps xmmword [rbp + 0x120], xmm1
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], 0xf
mov byte [rbp + 0x80], r12b
mov r14d, 4
mov word [rbp + 0x130], r14w
or r9, 0xffffffffffffffff
lea r8, str.Reason
lea ebx, [r14 + 0x3d]
mov edx, ebx
lea rcx, [rbp + 0xc8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
nop
mov qword [rbp + 0x140], rsi
mov rdx, rdi
lea rcx, [rbp + 0x190]
call fcn.14000aa88
mov word [rbp + 0x1b0], r14w
or r9, 0xffffffffffffffff
lea r8, str.EventName
mov edx, ebx
lea rcx, [rbp + 0x148]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
nop
mov word [rsp + 0x38], 0xbf01
mov dword [rsp + 0x3a], 0x40101
mov word [rsp + 0x3e], 0x78
lea rax, [0x140021dd8]
mov qword [rsp + 0x58], rax
lea rax, [0x1400238e0]
mov qword [rsp + 0x60], rax
lea rax, str.EventQuarantined
mov qword [rsp + 0x68], rax
lea r9, [rbp + 0xc0]
lea r8, [rbp + 0x140]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.1400121cc
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0x10
jb 0x14001605f
inc rdx
mov rcx, qword [rbp + 0x190]
call fcn.140001a70
movdqa xmm0, xmmword [0x140024010]
movdqa xmmword [rbp + 0x1a0], xmm0
mov byte [rbp + 0x190], r12b
mov ebx, 0x1000
mov rax, qword [rbp + 0x128]
cmp rax, 0x10
jb 0x1400160b1
mov rcx, qword [rbp + 0x110]
mov rdx, rcx
inc rax
cmp rax, rbx
jb 0x1400160ab
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x1400160f8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movdqa xmm0, xmmword [0x140024010]
movdqa xmmword [rbp + 0x120], xmm0
mov byte [rbp + 0x110], r12b
mov rax, qword [rbp + 0x98]
cmp rax, 0x10
jb 0x140016105
mov rcx, qword [rbp + 0x80]
mov rdx, rcx
inc rax
cmp rax, rbx
jb 0x1400160ff
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x1400160ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp - 0x70]
call fcn.14000ab20
nop
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.14001e1c0
add rsp, 0x2d0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor edx, edx
mov ecx, 0x131f4c3
call fcn.140001d78
int3
xor edx, edx
mov ecx, 0x131f4c4
call fcn.140001d78
int3
xor edx, edx
mov ecx, 0x131f4c5
call fcn.140001d78
int3