Function at 0x14017b568
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp + 0x17], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rdi, rdx
mov rsi, rcx
add rcx, 0x48
mov qword [rbp - 0x49], rcx
xor r15d, r15d
mov dword [rbp - 0x41], r15d
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
lea eax, [r15 + 1]
lock xadd dword [rbp - 0x41], eax
cmp qword [rsi + 0x78], r15
jne 0x14017b5f0
mov dword [rbp + 0x67], r15d
mov word [rbp + 0x6b], r15w
mov qword [rdi], r15
mov rax, qword [rbp + 0x67]
mov qword [rdi + 8], rax
mov byte [rdi + 0x10], r15b
mov eax, dword [rbp - 0x41]
test eax, eax
je 0x14017b7ba
or eax, 0xffffffff
lock xadd dword [rbp - 0x41], eax
mov rcx, qword [rbp - 0x49]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
jmp 0x14017b5ce
mov r8, qword [rsi + 0x70]
mov rax, qword [r8]
mov qword [rbp + 0x77], rax
mov rbx, rax
cmp rax, r8
je 0x14017b633
mov rcx, qword [rax]
mov qword [rbp + 0x77], rcx
cmp rcx, r8
je 0x14017b633
mov rdx, rcx
mov rbx, rdx
mov rdx, qword [rcx + 0x18]
cmp qword [rax + 0x18], rdx
cmovae rbx, rax
mov rcx, qword [rcx]
mov rdx, rcx
mov qword [rbp + 0x77], rcx
mov rax, rbx
cmp rcx, r8
jne 0x14017b612
lea r14, [rbx + 0x10]
movabs rcx, 0xcbf29ce484222325
mov rdx, r15
movzx eax, byte [rdx + r14]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x14017b644
mov rdx, qword [rsi + 0xd8]
and rdx, rcx
add rdx, rdx
mov r9, qword [rsi + 0xc0]
mov rcx, qword [r9 + rdx*8]
mov r8, qword [rsi + 0xb0]
cmp qword [r9 + rdx*8], r8
jne 0x14017b68d
mov rax, r8
jmp 0x14017b695
mov rax, qword [r9 + rdx*8 + 8]
mov rax, qword [rax]
cmp rcx, rax
je 0x14017b6a7
mov eax, dword [r14]
cmp dword [rcx + 0x10], eax
je 0x14017b6aa
mov rcx, qword [rcx]
jmp 0x14017b682
mov rcx, r8
cmp rcx, r8
je 0x14017b6ec
mov dword [rbp + 0x7f], r15d
mov word [rbp + 0x83], r15w
mov qword [rdi], r15
mov rax, qword [rbp + 0x7f]
mov qword [rdi + 8], rax
mov byte [rdi + 0x10], r15b
mov eax, dword [rbp - 0x41]
test eax, eax
je 0x14017b7ba
or eax, 0xffffffff
lock xadd dword [rbp - 0x41], eax
mov rcx, qword [rbp - 0x49]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
jmp 0x14017b6ca
mov r9b, byte [rbp + 0x67]
mov r8, r14
lea rdx, [rbp + 0x1f]
lea rcx, [rsi + 0xa8]
call fcn.14017be44
lea rax, [0x1402b5a00]
mov qword [rbp - 9], rax
lea rax, str.ImpactingBytes
mov qword [rbp - 1], rax
mov rax, qword [rbx + 0x18]
mov qword [rbp + 7], rax
mov word [rbp + 0xf], r15w
movzx eax, word [rbx + 0x14]
lea rcx, [0x1402b59d8]
mov qword [rbp - 0x39], rcx
lea rcx, str.RuleVersion
mov qword [rbp - 0x31], rcx
mov word [rbp - 0x29], ax
mov word [rbp - 0x27], r15w
mov eax, dword [r14]
lea rcx, vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
mov qword [rbp - 0x21], rcx
lea rcx, str.RuleId
mov qword [rbp - 0x19], rcx
mov dword [rbp - 0x11], eax
mov word [rbp - 0xd], r15w
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
call fcn.14017bff8
mov rax, qword [rbx + 0x18]
mov qword [rdi], rax
mov rax, qword [r14]
mov qword [rdi + 8], rax
mov byte [rdi + 0x10], 1
mov eax, dword [rbp - 0x41]
test eax, eax
je 0x14017b7ba
or eax, 0xffffffff
lock xadd dword [rbp - 0x41], eax
mov rcx, qword [rbp - 0x49]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
jmp 0x14017b79c
mov rax, rdi
mov rbx, qword [rsp + 0xf8]
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret