Function at 0x1400442f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x1401807c0]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], rdx
mov rsi, rcx
xor ebx, ebx
mov dword [rbp - 0x60], ebx
mov dword [rbp - 0x5c], ebx
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8d, 1
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.wevtapi.dll_EvtRender]
test eax, eax
jne 0x140044990
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140044990
mov edi, dword [rbp - 0x60]
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140044990
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov r9d, edi
mov r8d, 1
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.wevtapi.dll_EvtRender]
test eax, eax
jne 0x1400443cc
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140044990
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rbx
mov r8, 0xffffffffffffffff
inc r8
cmp word [r14 + r8*2], bx
jne 0x1400443e2
mov rdx, r14
lea rcx, [rbp - 0x58]
call fcn.140006350
nop
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], rbx
mov r8d, Ordinal_27
lea rdx, str._TimeCreated_SystemTime
lea rcx, [rbp + 8]
call fcn.140006350
nop
lea r11, [rbp + 8]
cmp qword [rbp + 0x20], 7
cmova r11, qword [rbp + 8]
lea r14, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova r14, qword [rbp - 0x58]
mov rdi, qword [rbp + 0x18]
mov r15, qword [rbp - 0x48]
cmp rdi, r15
ja 0x1400444d5
mov rax, r15
sub rax, rdi
test rdi, rdi
jne 0x14004445f
mov rcx, rbx
jmp 0x1400444dc
lea rsi, [r14 + 2]
lea rsi, [rsi + rax*2]
mov rcx, r14
movzx r10d, word [r11]
nop
mov rax, rsi
sub rax, rcx
sar rax, 1
mov rdx, rbx
je 0x14004449a
cmp word [rcx], r10w
je 0x140044497
cmp rax, 1
je 0x14004449a
dec rax
add rcx, 2
cmp word [rcx], r10w
jne 0x140044484
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x1400444d5
mov r8, rdi
mov rdx, r11
test rdi, rdi
je 0x1400444c7
mov r9, rcx
sub r9, r11
movzx eax, word [rdx + r9]
cmp ax, word [rdx]
jne 0x1400444cf
add rdx, 2
sub r8, 1
jne 0x1400444b3
sub rcx, r14
sar rcx, 1
jmp 0x1400444dc
add rcx, 2
jmp 0x140044470
mov rcx, 0xffffffffffffffff
cmp rcx, 0xffffffffffffffff
je 0x140044971
add rdi, rcx
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rcx, qword [rbp - 0x58]
mov qword [rsp + 0x20], 1
lea r9, [0x140157570]
mov r8, rdi
mov rdx, r15
call fcn.1400228f0
mov r8, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe0], xmm1
cmp r15, rdi
jb 0x1400449d1
sub r8, rdi
sub r15, rdi
cmp r15, r8
cmovb r8, r15
lea rax, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rax, qword [rbp - 0x58]
lea rdx, [rax + rdi*2]
lea rcx, [rbp + 0xd0]
call fcn.140006350
nop
lea rcx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 7
cmova rcx, qword [rbp + 0xd0]
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x2e]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x32]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x36]
lea r8, [rbp - 0x38]
lea rdx, str._04d__02d__02dT_02d:_02d:_02d
call fcn.1400a8ea0
cmp eax, 6
jne 0x140044965
mov word [rbp - 0x2a], bx
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x140044965
mov rdx, qword [rsp + 0x40]
lea rcx, [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
js 0x140044965
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rbx
mov qword [rbp], rbx
mov r8d, reloc.WLDAP32.dll_Ordinal_22
lea rdx, str._EventID_507__EventID_
lea rcx, [rbp - 0x18]
call fcn.140006350
nop
lea r11, [rbp - 0x18]
cmp qword [rbp], 7
cmova r11, qword [rbp - 0x18]
lea rsi, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rsi, qword [rbp - 0x58]
mov rdi, qword [rbp - 8]
mov rax, qword [rbp - 0x48]
cmp rdi, rax
ja 0x14004495b
sub rax, rdi
test rdi, rdi
je 0x1400446d8
lea r14, [rax + 1]
lea r14, [rsi + r14*2]
mov rcx, rsi
movzx r10d, word [r11]
nop word [rax + rax]
mov rax, r14
sub rax, rcx
sar rax, 1
mov rdx, rbx
je 0x14004468a
cmp word [rcx], r10w
je 0x140044687
cmp rax, 1
je 0x14004468a
dec rax
add rcx, 2
cmp word [rcx], r10w
jne 0x140044674
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x14004495b
mov r8, rdi
mov rdx, r11
test rdi, rdi
je 0x1400446c8
mov r9, rcx
sub r9, r11
nop word [rax + rax]
movzx eax, word [rdx + r9]
cmp ax, word [rdx]
jne 0x1400449b6
add rdx, 2
sub r8, 1
jne 0x1400446b0
sub rcx, rsi
sar rcx, 1
cmp rcx, 0xffffffffffffffff
je 0x14004495b
mov rdx, qword [rbp - 0x68]
lea rcx, [rsp + 0x58]
call fcn.1400a9ef0
mov rdi, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], rax
lea rcx, [rbp + 0x50]
call fcn.14003e900
nop
mov r8, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140044734
mov r8, qword [rdi]
mov r9, qword [rdi + 0x10]
add r9, r8
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x50]
call fcn.14003ee40
nop
lea rax, vtable.std::wstring_convert_class_std::codecvt_utf8_utf16_wchar_t__1114111__0___wchar_t__class_std::allocator_wchar_t___class_std::allocator_char__.0
mov qword [rbp + 0x50], rax
lea rcx, [rbp + 0x90]
call fcn.140004ab0
lea rcx, [rbp + 0x70]
call fcn.140004b20
mov rcx, qword [rbp + 0x68]
test rcx, rcx
je 0x14004478f
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x14004478f
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
nop
lea rcx, [rsp + 0x58]
call fcn.140004b20
lea r8, [rbp + 0x28]
mov rdi, qword [rbp + 0x28]
mov rsi, qword [rbp + 0x40]
cmp rsi, 7
cmova r8, rdi
movabs rdx, 0xcbf29ce484222325
mov r10, qword [rbp + 0x38]
lea r9, [r10 + r10]
mov rcx, rbx
test r9, r9
je 0x1400447e5
movabs r11, 0x100000001b3
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r11
inc rcx
cmp rcx, r9
jb 0x1400447d1
mov r15, qword [rsp + 0x48]
mov rcx, qword [r15 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r15 + 0x18]
mov r9, qword [rax + rcx*8 + 8]
mov r14, qword [r15 + 8]
cmp r9, r14
je 0x14004485d
mov r11, qword [rax + rcx*8]
nop word [rax + rax]
lea rax, [r9 + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140044822
mov rax, qword [rax]
lea r8, [rbp + 0x28]
cmp rsi, 7
cmova r8, rdi
cmp r10, rcx
jne 0x1400449bf
mov rdx, r10
test r10, r10
je 0x14004485a
sub r8, rax
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x1400449bf
add rax, 2
sub rdx, 1
jne 0x140044842
mov rbx, r9
test rbx, rbx
cmove rbx, r14
cmp rbx, r14
jne 0x140044951
call fcn.140002420
mov rbx, rax
mov rdx, qword [rbp - 0x68]
lea rcx, [rsp + 0x78]
call fcn.1400a9ef0
nop
mov qword [rbp + 0x50], rbx
mov dword [rbp + 0x58], 3
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x14015ff90]
movdqa xmmword [rbp + 0x70], xmm1
mov byte [rbp + 0x60], 0
mov rdx, rax
lea rcx, [rbp + 0x80]
call fcn.140004250
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.FAT_Drive_Modified
lea rcx, [rbp - 0x38]
call fcn.140001c50
nop
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0xf
cmova rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
lea rcx, [rbp + 0x60]
call fcn.140004b80
nop
lea rcx, [rbp - 0x38]
call fcn.140004b20
nop
lea r9, [rbp + 0x60]
lea r8, [rbp + 0x80]
mov edx, dword [rbp + 0x58]
mov rcx, qword [rbp + 0x50]
call fcn.1400025b0
lea rcx, [rbp + 0x80]
call fcn.140004b20
lea rcx, [rbp + 0x60]
call fcn.140004b20
nop
lea rcx, [rsp + 0x78]
call fcn.140004b20
inc dword [0x1401b00f8]
lea r8, [rbp + 0x28]
lea rdx, [rbp - 0x38]
mov rcx, r15
call fcn.140044e60
nop
lea rcx, [rbp + 0x28]
call fcn.140004ab0
nop
lea rcx, [rbp - 0x18]
call fcn.140004ab0
nop
lea rcx, [rbp + 0xd0]
call fcn.140004ab0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
lea rcx, [rbp + 8]
call fcn.140004ab0
nop
lea rcx, [rbp - 0x58]
call fcn.140004ab0
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.14011ab50
mov rbx, qword [rsp + 0x248]
add rsp, 0x200
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
add rcx, 2
jmp 0x140044660
cmp r9, r11
je 0x14004485d
mov r9, qword [r9 + 8]
jmp 0x140044810
call fcn.14000a9f0
int3