Function at 0x140011fb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x140064008]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rbx, rdx
mov rdi, rcx
mov word [rsp + 0x38], r8w
xor r12d, r12d
mov r15b, r12b
add rcx, 0x18
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], r12
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
lea eax, [r12 + 1]
lock xadd dword [rsp + 0x50], eax
inc eax
cmp eax, 1
jne 0x14001202b
cmp dword [rsp + 0x54], r12d
jne 0x14001243f
call qword [sym.imp.MSVCP140.dll__Thrd_id]
mov dword [rsp + 0x54], eax
mov rcx, qword [rdi]
test rcx, rcx
je 0x140012432
call fcn.140012a94
mov rsi, qword [rdi]
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14001204c
mov rdx, qword [rbx]
movabs r9, 0xcbf29ce484222325
mov rcx, r12
cmp qword [rbx + 0x10], r12
jbe 0x14001207d
movzx eax, byte [rcx + rdx]
xor r9, rax
movabs r8, 0x100000001b3
imul r9, r8
inc rcx
cmp rcx, qword [rbx + 0x10]
jb 0x14001205f
mov r8, rbx
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.14001337c
mov r14, qword [rax + 8]
test r14, r14
jne 0x14001209a
mov r14, qword [rsi + 8]
test rsi, rsi
je 0x140012432
mov rcx, rsi
call fcn.140012a94
mov rcx, qword [rdi]
cmp r14, qword [rcx + 8]
jne 0x1400120d9
test rcx, rcx
je 0x140012432
call fcn.140012a94
lea r9, [rsp + 0x38]
mov r8, rbx
lea rdx, [rbp - 0x78]
mov rcx, qword [rdi]
call fcn.140012c3c
mov r15b, 1
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x140012114
or eax, 0xffffffff
lock xadd dword [rsp + 0x50], eax
cmp eax, 1
jne 0x140012104
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rsp + 0x54], eax
jne 0x14001244c
mov dword [rsp + 0x54], r12d
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
jmp 0x1400120d9
cmp dword [rsp + 0x54], r12d
je 0x14001212b
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rsp + 0x54], eax
jne 0x140012425
test r15b, r15b
jne 0x1400121ee
lea rax, [0x140033748]
mov qword [rbp + 0x90], rax
lea rax, [0x140037578]
mov qword [rbp + 0x98], rax
mov rdx, rbx
lea rcx, [rbp + 0xa0]
call fcn.140003980
mov word [rbp + 0xc0], r12w
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, str.Attempt_to_add_quarantined_event_to_quarantine.
mov ecx, 0x14036a0
mov r8d, 0xf
call fcn.140006874
mov rax, qword [rbp + 0xb8]
cmp rax, 0x10
jb 0x1400121cd
mov rcx, qword [rbp + 0xa0]
mov rdx, rcx
inc rax
mov ebx, 0x1000
cmp rax, rbx
jb 0x1400121c6
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x1400121c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.14002f880
add rsp, 0x2e0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp word [rsp + 0x38], 0xa
je 0x1400121cd
lea rcx, [rbp - 0x60]
call fcn.1400127c4
movzx edx, word [rsp + 0x38]
lea rcx, [rbp - 0x60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int____ptr64]
lea rdx, [rbp + 0x90]
lea rcx, [rbp - 0x58]
call fcn.140004350
lea rsi, [0x140033b80]
mov qword [rbp + 0xd0], rsi
movups xmm0, xmmword [rbp + 0x90]
movaps xmmword [rbp + 0x120], xmm0
movups xmm1, xmmword [rbp + 0xa0]
movaps xmmword [rbp + 0x130], xmm1
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], 0xf
mov byte [rbp + 0x90], r12b
mov r14d, 4
mov word [rbp + 0x140], r14w
or r9, 0xffffffffffffffff
lea r8, str.Reason
lea edi, [r14 + 0x3d]
mov edx, edi
lea rcx, [rbp + 0xd8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
nop
mov qword [rbp + 0x150], rsi
mov rdx, rbx
lea rcx, [rbp + 0x1a0]
call fcn.140003980
mov word [rbp + 0x1c0], r14w
or r9, 0xffffffffffffffff
lea r8, str.EventName
mov edx, edi
lea rcx, [rbp + 0x158]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
nop
mov byte [rsp + 0x30], r12b
mov word [rsp + 0x40], 0xbf01
mov dword [rsp + 0x42], 0x40101
mov word [rsp + 0x46], 0x78
lea rax, [0x1400340d0]
mov qword [rsp + 0x60], rax
lea rax, [0x140037c20]
mov qword [rsp + 0x68], rax
lea rax, str.EventQuarantined
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x150]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140012e94
mov ebx, 0x1000
mov rax, qword [rbp + 0x1b8]
cmp rax, 0x10
jb 0x14001236c
mov rcx, qword [rbp + 0x1a0]
mov rdx, rcx
inc rax
cmp rax, rbx
jb 0x140012366
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x140012400
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movdqa xmm0, xmmword [0x14005b8f0]
movdqa xmmword [rbp + 0x1b0], xmm0
mov byte [rbp + 0x1a0], r12b
mov rax, qword [rbp + 0x138]
cmp rax, 0x10
jb 0x1400123b9
mov rcx, qword [rbp + 0x120]
mov rdx, rcx
inc rax
cmp rax, rbx
jb 0x1400123b3
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x140012400
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movdqa xmm0, xmmword [0x14005b8f0]
movdqa xmmword [rbp + 0x130], xmm0
mov byte [rbp + 0x120], r12b
mov rax, qword [rbp + 0xa8]
cmp rax, 0x10
jb 0x14001240d
mov rcx, qword [rbp + 0x90]
mov rdx, rcx
inc rax
cmp rax, rbx
jb 0x140012407
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140012407
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp + 0x28]
call fcn.14001274c
lea rcx, [rbp + 0x28]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x1400121cd
xor edx, edx
mov ecx, 0x131f4c3
call fcn.140006298
int3
xor edx, edx
mov ecx, 0x131f486
call fcn.140006298
int3
xor edx, edx
mov ecx, 0x131f4c4
call fcn.140006298
int3
xor edx, edx
mov ecx, 0x131f4c5
call fcn.140006298
int3