Function at 0x140010e00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x14008d030]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov r13, rcx
mov qword [rsp + 0x58], rcx
xor r12d, r12d
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.140041270
mov dword [rsp + 0x60], 0x104
call fcn.140010200
mov rsi, rax
mov qword [rsp + 0x68], rax
lea rdx, str.QueryFullProcessImageNameW
lea rcx, [rsp + 0x30]
call fcn.140003230
nop
call fcn.140025990
lea r14, [rsi + 0x40]
mov qword [rsp + 0x28], r14
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x30]
call fcn.140003ea0
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.140003eb0
mov r8, rax
movabs rdx, 0xcbf29ce484222325
mov ecx, r12d
test rbx, rbx
je 0x140010ee4
movabs r9, 0x100000001b3
nop dword [rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rbx
jb 0x140010ed0
mov rcx, qword [rsi + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [rsi + 0x18]
mov rdi, qword [rax + rcx*8 + 8]
cmp rdi, qword [rsi + 8]
je 0x140010f58
mov r15, qword [rax + rcx*8]
lea rcx, [rdi + 0x10]
mov rbx, qword [rcx + 0x10]
call fcn.140004b00
mov r14, rax
mov rsi, qword [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.140004b00
cmp rsi, rbx
jne 0x140010f37
mov r8, rsi
mov rdx, r14
mov rcx, rax
call fcn.1400416b0
test eax, eax
je 0x140010f42
cmp rdi, r15
je 0x140010f4e
mov rdi, qword [rdi + 8]
jmp 0x140010f01
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x28]
jmp 0x140010f5b
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x28]
mov rdi, r12
test rdi, rdi
je 0x140010f6a
cmp rdi, qword [rsi + 8]
je 0x140010f6a
mov r12, qword [rdi + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rsp + 0x30]
call fcn.1400040b0
test r12, r12
je 0x140010f9d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x70]
xor edx, edx
call r12
jmp 0x140010faf
mov r8d, dword [rsp + 0x60]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movzx edx, byte [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140003290
nop
lea rcx, [rsp + 0x70]
call fcn.140004b50
mov rcx, rax
call fcn.1400032c0
mov r8, rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.14000ecc0
nop
mov rbx, qword [rsp + 0x40]
test rbx, rbx
jne 0x140011000
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.14000e470
jmp 0x14001109a
lea rcx, [rsp + 0x30]
call fcn.140004700
mov r9d, 0x5c
mov rdx, rbx
mov rcx, rax
call fcn.1400115e0
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14001104d
mov rbx, qword [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.140004700
mov r9d, 0x2f
mov rdx, rbx
mov rcx, rax
call fcn.1400115e0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140010fee
lea rcx, [rsp + 0x20]
call fcn.1400032c0
mov rcx, r13
call fcn.1400032d0
nop
mov qword [rsp + 0x68], rbx
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x68]
call fcn.140003610
mov rbx, qword [rax]
lea rcx, [rsp + 0x30]
call fcn.140004700
mov r8, rbx
mov rdx, rax
mov rcx, r13
call fcn.14000ecc0
nop
lea rcx, [rsp + 0x30]
call fcn.140003de0
mov rax, r13
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.14003ecb0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret