Function at 0x1403738f0
Capabilities:
Allocate thread local storage
Encode data using xor
Get file size
Hash data using fnv

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rsi, r8
lea r9, [rcx + 8]
mov r8d, 4
mov rbx, rcx
call fcn.140373800
test eax, eax
je 0x140373930
cmp eax, 0x13
jne 0x140373921
test byte [rbx + 0x1a], 2
je 0x140373921
xor eax, eax
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
ret
test byte [rbx + 0x1a], 0x20
je 0x140373b20
mov rcx, qword [rbx + 8]
xor r8d, r8d
xor edx, edx
mov r9d, 1
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_LockFile]
test eax, eax
je 0x140373bd8
mov dword [rsi], 1
xor edx, edx
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [rbx + 0x24]
mov ebp, eax
lea edi, [rdx - 1]
mov rax, rbp
add rdi, 2
shl rdi, 6
cmp rbp, rdi
jl 0x140373b70
add rax, 0xffffffffffffff80
shr rax, 6
add eax, 1
mov dword [rbx + 0x24], eax
mov rcx, qword [rbx + 8]
xor r9d, r9d
mov r8d, 4
xor edx, edx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
test rax, rax
je 0x140373ba8
xor r9d, r9d
xor r8d, r8d
mov edx, 2
mov rcx, rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov rcx, rdi
mov qword [rbx + 0x48], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx + 0x48]
test rax, rax
je 0x140373ba8
mov edx, dword [rsi]
test edx, edx
jle 0x140373c90
mov eax, dword [0x1404e38c0]
test eax, eax
je 0x140373c38
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x140373ba8
movq xmm0, qword [rsp + 0x5c]
movq xmm1, qword [rsp + 0x6c]
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x3c]
mov eax, dword [rsp + 0x70]
mov r10, qword [rbx + 0x48]
movabs r8, 0x100000001b3
punpckldq xmm0, xmm1
mov dword [rsp + 0x38], eax
movabs rax, 0xcbf29ce484222325
movq qword [rsp + 0x30], xmm0
nop dword [rax + rax]
movzx ecx, byte [rdx]
add rdx, 1
xor rax, rcx
imul rax, r8
cmp rdx, r9
jne 0x140373a80
mov qword [r10 + 0x18], rax
mov rcx, rbx
lea rbp, [rbx + 0x100]
lea rdi, [0x1404e38d0]
call fcn.1403732a0
mov r8, rbp
xor edx, edx
mov rcx, rdi
mov byte [rbx + 0x10a], 0x72
mov rsi, qword [sym.imp.KERNEL32.dll_CreateMutexA]
call rsi
mov qword [rbx + 0xf0], rax
test rax, rax
je 0x140373ba8
mov byte [rbx + 0x10a], 0x77
mov r8, rbp
xor edx, edx
mov rcx, rdi
call rsi
mov qword [rbx + 0xf8], rax
test rax, rax
je 0x140373ba8
mov rax, qword [rbx + 0x48]
mov rdx, qword [0x14039cda0]
mov qword [rax + 8], 0
mov qword [rax], rdx
mov dword [rax + 0x10], 0
xor eax, eax
jmp 0x140373921
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx + 0xa8], eax
cmp eax, 0xffffffff
je 0x140373bc0
movsxd rax, dword [0x1404e37a0]
or dword [rbx + 0x18], 0x10000000
cmp eax, 0x3f
jg 0x140373d28
lea edx, [rax + 1]
mov ecx, dword [rbx + 0xa8]
mov dword [0x1404e37a0], edx
lea rdx, [0x1404e37c0]
mov dword [rdx + rax*4], ecx
jmp 0x14037393a
mov ecx, dword [rsi]
test ecx, ecx
jle 0x14037398d
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbx + 8]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, edi
jne 0x140373ba8
mov rcx, qword [rbx + 8]
mov rbp, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14037399b
nop dword [rax]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov rax, rsi
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140373b35
jmp 0x140373921
pxor xmm0, xmm0
lea rax, [rsp + 0x40]
mov rcx, qword [rbx + 8]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rax
mov r9d, 1
mov dword [rsp + 0x20], 0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_LockFileEx]
test eax, eax
je 0x140373c20
mov dword [rsi], 0
jmp 0x140373965
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140373921
jmp 0x140373965
lea rsi, [0x1404e3900]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov qword [0x1404e38d8], rsi
mov dword [0x1404e38d0], 0x18
mov dword [0x1404e38e0], 0
mov dword [0x1404e38c0], 1
jmp 0x140373a21
cmp dword [rax], 0xbeefc0de
jne 0x140373d3c
cmp dword [rax + 4], 0x8138002
jne 0x140373d32
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
lea edx, [rax - 0xb]
and edx, 0xfffffffd
je 0x140373cc2
test eax, eax
jne 0x140373921
mov rcx, rbx
lea rbp, [rbx + 0x100]
call fcn.1403732a0
mov r8, rbp
xor edx, edx
mov ecx, 0x100000
mov byte [rbx + 0x10a], 0x72
mov rdi, qword [sym.imp.KERNEL32.dll_OpenMutexA]
call rdi
mov qword [rbx + 0xf0], rax
test rax, rax
je 0x140373baf
mov byte [rbx + 0x10a], 0x77
mov r8, rbp
xor edx, edx
mov ecx, 0x100000
call rdi
mov qword [rbx + 0xf8], rax
test rax, rax
je 0x140373baf
xor eax, eax
jmp 0x140373921
mov eax, 0xffff87bb
jmp 0x140373921
mov eax, 0xffff87b6
jmp 0x140373921
mov eax, 0xffff87b7
jmp 0x140373921