Function at 0x140040500
Capabilities:
Encode data using xor
Get file system object information
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x330]
sub rsp, 0x430
mov rax, qword [0x1400f40c0]
xor rax, rsp
mov qword [rbp + 0x328], rax
mov rsi, rdx
mov rdi, rcx
xor r13d, r13d
lea r15, [rcx + 0xe90]
lea rcx, [rsp + 0x40]
call fcn.140011320
lea rdx, [rsp + 0x40]
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x58]
cmp r14, 0xf
cmova rdx, rbx
movabs r9, 0xcbf29ce484222325
mov ecx, r13d
mov r8, qword [rsp + 0x50]
test r8, r8
je 0x140040595
movabs r10, 0x100000001b3
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x140040582
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.140051040
mov r12, qword [rax + 8]
cmp r14, 0xf
jbe 0x1400405e2
lea rdx, [r14 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400405da
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140040a5d
mov rcx, rbx
call fcn.1400937a0
mov rdx, rsi
test r12, r12
je 0x140040653
lea rcx, [rsp + 0x40]
call fcn.140011320
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.14004f420
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x30]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140040a24
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040a1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140040a57
jmp 0x140040a1f
lea rcx, [rbp + 0x308]
call fcn.140011320
nop
mov qword [rbp + 0x2f8], r13
lea rbx, [0x1400f4d20]
mov qword [rbp + 0x300], rbx
lea r8, [rbp + 0x308]
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.14004f140
mov rcx, qword [rax]
mov qword [rcx + 0x30], r13
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rbp + 0x2f8]
mov rdx, rsi
lea rcx, [rbp + 0x2c8]
call fcn.1400140d0
mov rax, qword [rbp + 0x2c8]
test eax, eax
je 0x1400406d1
mov dword [rbp + 0x2f8], r13d
mov qword [rbp + 0x300], rbx
mov ebx, 0x10
cmp eax, 1
cmova ebx, r13d
lea r14d, [rbx + 0x100]
xor edx, edx
mov r8d, 0x2b8
lea rcx, [rbp]
call fcn.1400c3ff0
mov rdx, rsi
lea rcx, [rbp + 0x2d0]
call fcn.14000fd10
nop
mov edx, r13d
mov r10, qword [rbp + 0x2e0]
mov r8, qword [rbp + 0x2e8]
mov r9, qword [rbp + 0x2d0]
test r10, r10
je 0x14004077c
mov rcx, r13
nop word [rax + rax]
lea rax, [rbp + 0x2d0]
cmp r8, 7
seta r11b
cmova rax, r9
cmp word [rax + rcx*2], 0x2f
jne 0x140040773
lea rax, [rbp + 0x2d0]
test r11b, r11b
cmovne rax, r9
mov word [rax + rcx*2], 0x5c
mov r8, qword [rbp + 0x2e8]
mov r10, qword [rbp + 0x2e0]
mov r9, qword [rbp + 0x2d0]
inc edx
mov ecx, edx
cmp rcx, r10
jb 0x140040730
lea rcx, [rbp + 0x2d0]
cmp r8, 7
cmova rcx, r9
mov dword [rsp + 0x20], r14d
mov r9d, 0x2b8
lea r8, [rbp]
mov edx, ebx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp qword [rbp], 0
jne 0x1400407b1
mov rbx, r13
jmp 0x140040987
lea rbx, [rdi + 0xe60]
mov r8d, dword [rbp + 8]
mov rdx, qword [rdi + 0xe68]
mov rcx, qword [rbx]
call fcn.140092d90
mov rdx, qword [rdi + 0xe68]
cmp rax, rdx
je 0x140040820
sub rax, qword [rbx]
sar rax, 2
shl rax, 5
add rax, qword [rdi + 0xe78]
mov r8, rax
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.14004f140
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x30]
lea r8, [rbp + 0x308]
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.14004f140
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
jmp 0x14004096c
cmp rdx, qword [rbx + 0x10]
je 0x140040832
mov eax, dword [rbp + 8]
mov dword [rdx], eax
add qword [rbx + 8], 4
jmp 0x14004083e
lea r8, [rbp + 8]
mov rcx, rbx
call fcn.140051560
lea rcx, [rdi + 0xe78]
mov rax, qword [rdi + 0xe80]
cmp rax, qword [rdi + 0xe88]
je 0x14004086e
lea rdx, [rbp + 0x308]
mov rcx, rax
call fcn.1400102b0
add qword [rdi + 0xe80], 0x20
jmp 0x14004087d
lea r8, [rbp + 0x308]
mov rdx, rax
call fcn.140012910
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
lea rdx, [rsp + 0x70]
mov rcx, qword [rbp]
call qword [sym.imp.USER32.dll_GetIconInfo]
mov rcx, qword [rbp - 0x78]
test rcx, rcx
jne 0x1400408a9
mov rbx, r13
jmp 0x140040987
lea r8, [rbp - 0x70]
mov edx, 0x68
call qword [sym.imp.GDI32.dll_GetObjectA]
movzx ebx, word [rbp - 0x5e]
shr ebx, 3
imul ebx, dword [rbp - 0x68]
imul ebx, dword [rbp - 0x6c]
test ebx, ebx
jne 0x1400408d3
mov rbx, r13
jmp 0x140040987
movsxd rcx, ebx
call fcn.1400a93bc
mov rsi, rax
test rax, rax
je 0x14004096c
mov r8, rax
mov edx, ebx
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.GDI32.dll_GetBitmapBits]
mov byte [rbp + 0x2c0], 0
mov ecx, dword [rbp - 0x68]
mov dword [rbp + 0x2f0], ecx
mov ecx, dword [rbp - 0x6c]
mov dword [rbp + 0x2c8], ecx
mov qword [rsp + 0x60], rsi
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x140040a63
mov rax, qword [rcx]
lea rdx, [rbp + 0x2c0]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x2f0]
lea r8, [rbp + 0x2c8]
lea rdx, [rsp + 0x60]
call qword [rax + 0x10]
mov rbx, rax
lea r8, [rbp + 0x308]
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.14004f140
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov rcx, rsi
call fcn.1400a1884
lea r8, [rbp + 0x308]
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.14004f140
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x30]
mov rdx, qword [rbp + 0x2e8]
cmp rdx, 7
jbe 0x1400409cd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400409c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140040a69
call fcn.1400937a0
mov qword [rbp + 0x2e0], r13
mov qword [rbp + 0x2e8], 7
mov word [rbp + 0x2d0], r13w
mov rdx, qword [rbp + 0x320]
cmp rdx, 0xf
jbe 0x140040a24
inc rdx
mov rcx, qword [rbp + 0x308]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040a1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140040a51
call fcn.1400937a0
mov rax, rbx
mov rcx, qword [rbp + 0x328]
xor rcx, rsp
call fcn.140093780
mov rbx, qword [rsp + 0x480]
add rsp, 0x430
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400a1c3c
int3
call fcn.1400a1c3c
int3
call fcn.1400a1c3c
nop
call fcn.140092214
nop
call fcn.1400a1c3c
int3