Function at 0x14002c810
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
mov r14d, 2
lea rdx, [rbp + 0x20]
lea rcx, [rbx + 0x38]
call fcn.14002ccc8
neg al
sbb r15b, r15b
and r15b, byte [rbp + 0x20]
je 0x14002cbf2
movzx ecx, r15b
cmp ecx, 8
ja 0x14002c8b8
je 0x14002c834
cmp ecx, 1
je 0x14002c990
cmp ecx, r14d
je 0x14002c938
cmp ecx, 3
je 0x14002cb35
cmp ecx, 4
je 0x14002c91a
jbe 0x14002cc82
cmp ecx, 6
jbe 0x14002cb35
cmp ecx, 7
jne 0x14002cc82
cmp dword [rbx + 0x160], 1
je 0x14002cb35
movsxd rcx, dword [rbx + 0x5c]
xor edi, edi
mov rax, qword [rbx + 0x50]
mov word [rax + rcx*2], di
mov rsi, qword [rbx + 0x50]
jmp 0x14002c90d
sub ecx, 9
je 0x14002cb2c
sub ecx, r14d
je 0x14002caa8
sub ecx, 1
je 0x14002ca96
sub ecx, 1
je 0x14002c8e1
sub ecx, 1
jne 0x14002ca7b
cmp dword [rbx + 0x160], 1
je 0x14002cb35
jmp 0x14002c834
movzx ecx, ax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_iswspace]
nop dword [rax + rax]
test eax, eax
je 0x14002cc18
add rsi, r14
movzx eax, word [rsi]
test ax, ax
jne 0x14002c8f3
jmp 0x14002cb35
or r8, 0xffffffffffffffff
add dword [rbx + 0x24], r8d
add dword [rbx + 0x2c], 0xffffffff
jne 0x14002cb35
mov dword [rbx + 0x160], r14d
jmp 0x14002cb35
movsxd rcx, dword [rbx + 0x5c]
xor edi, edi
mov rax, qword [rbx + 0x50]
or r8, 0xffffffffffffffff
mov word [rax + rcx*2], di
mov rdx, qword [rbx + 0x50]
test rdx, rdx
je 0x14002c91e
mov rcx, r8
inc rcx
cmp word [rdx + rcx*2], di
jne 0x14002c956
mov esi, 0x811c9dc5
test rcx, rcx
je 0x14002c97d
movzx eax, word [rdx + rdi*2]
inc rdi
xor eax, esi
imul esi, eax, 0x1000193
cmp rdi, rcx
jne 0x14002c969
movsxd rcx, dword [rbx + 0x24]
mov rax, qword [rbx + 0x18]
cmp esi, dword [rax + rcx*4]
jne 0x14002cb76
jmp 0x14002c91e
mov eax, dword [rbx + 0x160]
xor edi, edi
test eax, eax
jne 0x14002c9a8
mov dword [rbx + 0x160], 1
jmp 0x14002c9b1
cmp eax, r14d
je 0x14002cc63
inc dword [rbx + 0x2c]
movsxd rcx, dword [rbx + 0x5c]
or r8, 0xffffffffffffffff
mov rax, qword [rbx + 0x50]
mov word [rax + rcx*2], di
mov rcx, r8
mov r9, qword [rbx + 0x50]
inc rcx
cmp word [r9 + rcx*2], di
jne 0x14002c9cb
mov esi, 0x811c9dc5
mov rdx, rdi
test rcx, rcx
je 0x14002c9f7
movzx eax, word [r9 + rdx*2]
inc rdx
xor eax, esi
imul esi, eax, 0x1000193
cmp rdx, rcx
jne 0x14002c9e2
mov ecx, dword [rbx + 0x24]
mov edx, dword [rbx + 0x20]
lea eax, [rcx + 2]
cmp eax, edx
jbe 0x14002ca65
mov r14, qword [rbx + 0x18]
lea eax, [rdx + 0x10]
cmp eax, edx
jb 0x14002cc37
mov ecx, eax
mov eax, 4
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.1400067c4
mov qword [rbx + 0x18], rax
mov eax, dword [rbx + 0x20]
test eax, eax
je 0x14002ca4c
mov rdx, qword [rbx + 0x18]
mov r8d, edi
inc edi
mov eax, dword [r14 + r8*4]
mov dword [rdx + r8*4], eax
mov eax, dword [rbx + 0x20]
cmp edi, eax
jb 0x14002ca34
cmp r14, rbx
je 0x14002ca5c
mov rcx, r14
call fcn.14000681c
mov eax, dword [rbx + 0x20]
mov ecx, dword [rbx + 0x24]
add eax, 0x10
mov dword [rbx + 0x20], eax
lea eax, [rcx + 1]
movsxd rcx, ecx
mov dword [rbx + 0x24], eax
mov rax, qword [rbx + 0x18]
mov dword [rax + rcx*4 + 4], esi
jmp 0x14002cb35
cmp ecx, 1
jne 0x14002cc82
cmp dword [rbx + 0x160], r14d
jne 0x14002cb95
jmp 0x14002cb35
cmp dword [rbx + 0x160], 1
jne 0x14002cbb4
jmp 0x14002cb35
cmp dword [rbx + 0x160], 1
jne 0x14002cca1
movsxd rcx, dword [rbx + 0x5c]
xor edi, edi
mov rax, qword [rbx + 0x50]
mov word [rax + rcx*2], di
mov rsi, qword [rbx + 0x50]
cmp word [rsi], 0x67
jne 0x14002cada
cmp word [rsi + 2], 0x74
jne 0x14002cada
cmp word [rsi + 4], di
je 0x14002cb35
cmp word [rsi], 0x6c
jne 0x14002caed
cmp word [rsi + 2], 0x74
jne 0x14002caed
cmp word [rsi + 4], di
je 0x14002cb35
lea rdx, [0x140080d38]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
je 0x14002cb35
lea rdx, str.apos
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
je 0x14002cb35
lea rdx, str.quot
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x14002cbd3
jmp 0x14002cb35
cmp dword [rbx + 0x160], 1
jne 0x14002cb57
lea r11, [rsp + 0x60]
mov byte [rbx + 0x28], r15b
mov rbx, qword [r11 + 0x28]
mov al, r15b
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov edx, 0x3aa0
lea rcx, [rbp - 0x40]
call fcn.1400017f8
lea rdx, [0x14009ee38]
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
mov edx, 0x3aa0
lea rcx, [rbp - 0x40]
call fcn.1400017f8
lea rdx, [0x14009ee38]
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
mov edx, 0x3aa0
lea rcx, [rbp - 0x40]
call fcn.1400017f8
lea rdx, [0x14009ee38]
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
mov edx, 0x3aa0
lea rcx, [rbp - 0x40]
call fcn.1400017f8
lea rdx, [0x14009ee38]
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
mov edx, 0x3aa0
lea rcx, [rbp - 0x40]
call fcn.1400017f8
lea rdx, [0x14009ee38]
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
mov edx, 0x3aa0
mov dword [rbx + 0x160], r14d
lea rcx, [rbp - 0x40]
call fcn.1400017f8
lea rdx, [0x14009ee38]
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
mov edx, 0x3aa0
lea rcx, [rbp - 0x40]
call fcn.1400017f8
lea rdx, [0x14009ee38]
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
mov r9d, SysAllocStringByteLen
lea r8, str.onecoreinternal_adminincetweventlogwmistack.h
mov edx, 0xe
lea rcx, [rbp - 0x40]
call fcn.14002cfbc
lea rdx, [0x14009ee38]
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
mov edx, 0x3aa0
lea rcx, [rbp - 0x40]
call fcn.1400017f8
lea rdx, [0x14009ee38]
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
mov edx, 0x3aa0
lea rcx, [rbp - 0x40]
call fcn.1400017f8
lea rdx, [0x14009ee38]
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
mov edx, 0x3aa0
lea rcx, [rbp - 0x40]
call fcn.1400017f8
lea rdx, [0x14009ee38]
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3