Function at 0x140017bd0
Capabilities:
Encode data using xor
Get disk information
Get hostname
Get session user name
Hash data using fnv

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
lea rbp, [rax - 0x418]
sub rsp, 0x500
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x14003ae50]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
mov r12d, edx
xor r13d, r13d
mov word [rbp + 0x1e0], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x1e2]
call fcn.140018cd0
mov word [rbp - 0x58], r13w
xor eax, eax
mov qword [rbp - 0x56], rax
mov qword [rbp - 0x4e], rax
mov qword [rbp - 0x46], rax
mov dword [rbp - 0x3e], eax
mov word [rbp - 0x3a], ax
mov word [rbp - 0x30], r13w
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x2e]
call fcn.140018cd0
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
mov r8d, 0x208
lea rdx, [rbp + 0x1e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov dword [rsp + 0x44], 0xf
lea rdx, [rsp + 0x44]
lea rcx, [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x44], 0x100
lea rdx, [rsp + 0x44]
lea rcx, [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov qword [rbp - 0x68], 7
mov qword [rbp - 0x70], r13
mov word [rbp - 0x80], r13w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x58]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x80]
call fcn.1400039a0
nop
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r13
mov word [rsp + 0x58], r13w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x30]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x58]
call fcn.1400039a0
mov r11d, 0x811c9dc5
mov edi, r11d
mov r8d, r13d
movabs rsi, 0xcccccccccccccccd
mov rax, rsi
mov rbx, qword [rbp - 0x70]
mul rbx
shr rdx, 3
inc rdx
mov r10, qword [rbp - 0x68]
mov r9, qword [rbp - 0x80]
test rbx, rbx
je 0x140017d93
nop word [rax + rax]
lea rcx, [rbp - 0x80]
cmp r10, 8
cmovae rcx, r9
movzx ecx, word [rcx + r8*2]
imul rdi, rdi, 0x1000193
xor rdi, rcx
add r8, rdx
cmp r8, rbx
jb 0x140017d70
mov rcx, r13
mov rax, rsi
mov r8, qword [rsp + 0x68]
mul r8
shr rdx, 3
inc rdx
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x58]
test r8, r8
je 0x140017de3
nop word [rax + rax]
lea rax, [rsp + 0x58]
cmp rsi, 8
cmovae rax, rbx
movzx eax, word [rax + rcx*2]
imul r11, r11, 0x1000193
xor r11, rax
add rcx, rdx
cmp rcx, r8
jb 0x140017dc0
xor edi, r11d
xor edi, dword [0x140038ed8]
xor edi, dword [rsp + 0x40]
xor edi, r12d
mov dword [rsp + 0x40], edi
cmp rsi, 8
jb 0x140017e11
mov rcx, rbx
call fcn.1400187b4
mov edi, dword [rsp + 0x40]
mov r10, qword [rbp - 0x68]
mov r9, qword [rbp - 0x80]
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r13
mov word [rsp + 0x58], r13w
cmp r10, 8
jb 0x140017e39
mov rcx, r9
call fcn.1400187b4
mov eax, dword [rsp + 0x40]
jmp 0x140017e3b
mov eax, edi
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.1400194d0
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rbp
ret