Function at 0x1400a4838
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rcx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x30], rcx
lea rax, vtable.sense::GenericETW::Transformer.0
mov qword [rcx], rax
add rcx, 8
call fcn.1400863cc
nop
lea rax, vtable.sense::GenericETW::FileExtensionExtractTransformer.0
mov qword [rdi], rax
lea rsi, [rdi + 0xd0]
mov qword [rbp - 0x50], rsi
and qword [rsi], 0
and qword [rsi + 8], 0
and qword [rsi + 0x10], 0
mov rax, qword [rdi + 0x38]
cmp qword [rdi + 0x30], rax
sete al
mov rcx, qword [rbp + 0x38]
lea rdx, str.TransformerValues_should_not_be_empty
mov qword [rsp + 0x28], rdx
mov byte [rsp + 0x20], al
mov r9d, 0x80070057
lea r8, str.amcorewcd_sourcegenericetw_src_fileextensionextracttransformer.cpp
mov edx, Compress
call fcn.14007936c
mov r15, qword [rdi + 0x30]
mov rbx, qword [rdi + 0x38]
cmp r15, rbx
je 0x1400a4ab4
mov rdi, rsi
mov r8b, 1
mov rdx, r15
lea rcx, [rbp - 0x28]
call fcn.140062650
nop
lea r8, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r8, qword [rbp - 0x28]
movabs rcx, 0xcbf29ce484222325
xor edx, edx
mov r11, qword [rbp - 0x18]
lea r9, [r11 + r11]
test r9, r9
je 0x1400a494b
movzx eax, byte [rdx + r8]
xor rcx, rax
movabs r10, 0x100000001b3
imul rcx, r10
inc rdx
cmp rdx, r9
jb 0x1400a492d
and rcx, qword [0x1404a4490]
mov rax, rcx
add rax, rax
mov r13, qword [0x1404a4478]
mov rax, qword [r13 + rax*8]
add rcx, rcx
mov qword [rbp - 0x48], rcx
mov r14, qword [0x1404a4468]
cmp qword [r13 + rcx*8], r14
jne 0x1400a497e
mov rcx, r14
jmp 0x1400a4986
mov rcx, qword [r13 + rcx*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400a4a3d
lea rdx, [rax + 0x10]
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
mov r9, rdx
mov r12, qword [rdx + 0x18]
cmp r12, 8
jb 0x1400a49b1
mov r9, qword [rdx]
mov rsi, qword [rdx + 0x10]
cmp rsi, r11
jne 0x1400a49e4
mov r10, rsi
test rsi, rsi
je 0x1400a49de
sub r9, rcx
movzx edx, word [r9 + rcx]
movzx r8d, word [rcx]
cmp dx, r8w
jne 0x1400a49ed
add rcx, 2
sub r10, 1
jne 0x1400a49c5
xor ecx, ecx
test ecx, ecx
je 0x1400a49f6
mov rax, qword [rax]
mov rcx, qword [rbp - 0x48]
jmp 0x1400a4972
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400a49e0
lea rcx, [rax + 0x10]
cmp r12, 8
jb 0x1400a4a03
mov rcx, qword [rcx]
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
cmp r11, rsi
jne 0x1400a4a3d
test r11, r11
je 0x1400a4a37
sub rdx, rcx
movzx r8d, word [rdx + rcx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x1400a4a49
add rcx, 2
sub r11, 1
jne 0x1400a4a1e
xor ecx, ecx
test ecx, ecx
je 0x1400a4a40
mov rax, r14
cmp rax, r14
jne 0x1400a4a52
xor al, al
jmp 0x1400a4a5a
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400a4a39
mov ecx, dword [rax + 0x30]
mov dword [rbp - 0x50], ecx
mov al, 1
mov rcx, qword [rbp + 0x38]
lea rdx, str.ExtractPart_not_supported
mov qword [rsp + 0x28], rdx
mov byte [rsp + 0x20], al
mov r9d, 0x80070057
lea r8, str.amcorewcd_sourcegenericetw_src_fileextensionextracttransformer.cpp
mov edx, MsiGetActiveDatabase
call fcn.14006245c
nop
lea rcx, [rbp - 0x28]
call fcn.14004e0f0
lea rdx, [rbp - 0x50]
mov rcx, rdi
call fcn.14009f0bc
add r15, 0x20
cmp r15, rbx
jne 0x1400a48f6
mov rdi, qword [rbp - 0x40]
mov r15, qword [rdi + 0x30]
mov rbx, qword [rdi + 0x38]
sub rbx, r15
sar rbx, 5
cmp rbx, 1
jbe 0x1400a4af8
mov rcx, qword [rdi + 0x70]
cmp qword [rdi + 0x68], rcx
sete dl
mov rcx, qword [rbp + 0x38]
lea rax, str.TargetFieldNames_should_not_be_empty
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], dl
mov r9d, 0x80070057
lea r8, str.amcorewcd_sourcegenericetw_src_fileextensionextracttransformer.cpp
mov edx, 0x30
call fcn.14007936c
nop
mov rax, rdi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1402dfdb0
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret