Function at 0x14000c830
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x140012738]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor ebx, ebx
lea r9, [rsp + 0x20]
mov r14, rdx
mov dword [rsp + 0x20], ebx
mov r15, rcx
xor r8d, r8d
xor edx, edx
mov ebp, ebx
lea esi, [rbx + 0xb]
mov ecx, esi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
je 0x14000c885
xor eax, eax
jmp 0x14000c98d
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x6e556353
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x14000c87e
mov r8d, dword [rsp + 0x20]
xor r9d, r9d
mov rdx, rax
mov ecx, esi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
js 0x14000c97f
mov esi, ebx
cmp dword [rdi], ebx
jbe 0x14000c97c
mov eax, esi
mov edx, 2
imul rcx, rax, 0x128
lea rax, [rdi + 8]
add rax, rcx
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x14000c8dd
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
lea rcx, [rsp + 0x58]
call fcn.14000c9f0
mov rcx, rax
mov rdx, r15
call sub.ntoskrnl.exe_strstr
test rax, rax
jne 0x14000c96b
inc esi
cmp esi, dword [rdi]
jb 0x14000c8c3
jmp 0x14000c97c
mov rbp, qword [rsp + 0x40]
test r14, r14
je 0x14000c97c
mov eax, dword [rsp + 0x48]
mov dword [r14], eax
mov rbx, rbp
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rbx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14000dd80
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x170
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000c9b4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r8, rcx
test edx, edx
jne 0x14000c9be
xor eax, eax
ret
movzx eax, byte [rcx]
xor eax, 0x4b9ace2f
imul ecx, eax, 0x1000193
cmp edx, 1
jbe 0x14000c9eb
inc r8
dec edx
movzx eax, byte [r8]
inc r8
xor eax, ecx
imul ecx, eax, 0x1000193
sub rdx, 1
jne 0x14000c9d6
mov eax, ecx
ret

Function at 0x14000caa8
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov esi, r8d
mov ebx, ecx
mov edx, r8d
mov rcx, rdi
call fcn.14000c9b4
xor ebx, eax
test esi, esi
je 0x14000caee
mov ecx, esi
imul ebx, ebx, 0x41c64e6d
add ebx, 0x3039
mov eax, ebx
shr eax, 0x10
xor byte [rdi], al
inc rdi
sub rcx, 1
jne 0x14000cad2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret