Function at 0x1800168d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x180178b40]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x70], rdx
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
xorps xmm1, xmm1
movups xmmword [rbp], xmm1
movups xmmword [rbp + 0x10], xmm0
xor ebx, ebx
mov qword [rbp - 8], rbx
mov qword [rbp + 0x20], rbx
call fcn.18000b090
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], rbx
mov r8d, 0x28
lea rdx, str.RtlDosApplyFileIsolationRedirection_Ustr
lea rcx, [rbp - 0x68]
call fcn.18000b890
nop
call fcn.1800274b0
lea rax, [r15 + 0x40]
mov qword [rsp + 0x50], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rbp - 0x68]
mov rsi, qword [rbp - 0x68]
mov r13, qword [rbp - 0x50]
cmp r13, 0xf
cmova r8, rsi
movabs r14, 0xcbf29ce484222325
mov rdx, r14
mov ecx, ebx
movabs r9, 0x100000001b3
mov rdi, qword [rbp - 0x58]
test rdi, rdi
je 0x1800169c4
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rdi
jb 0x1800169b0
mov rcx, qword [r15 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r15 + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r12, qword [r15 + 8]
cmp rbx, r12
je 0x180016a2e
mov r15, qword [rax + rcx*8]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x180016a02
mov rdx, qword [rdx]
lea rcx, [rbp - 0x68]
cmp r13, 0xf
cmova rcx, rsi
cmp rdi, rax
jne 0x180016a1f
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180016a2a
cmp rbx, r15
je 0x180016a2e
mov rbx, qword [rbx + 8]
jmp 0x1800169f0
xor edi, edi
jmp 0x180016a32
xor edi, edi
mov ebx, edi
test rbx, rbx
cmove rbx, r12
mov rcx, qword [rsp + 0x50]
cmp rbx, r12
je 0x180016a4f
mov rbx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x180016a58
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, rdi
cmp r13, 0xf
jbe 0x180016a8f
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x180016a87
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180016e9e
mov rcx, rsi
call fcn.1800e5744
test rbx, rbx
jne 0x180016a9e
mov eax, 0xc0000138
jmp 0x180016eac
call fcn.18000b090
mov r15, rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x50], rax
cmp qword [rax + 0x18], 7
jbe 0x180016abf
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], rdi
mov r8d, 0x14
lea rdx, str.RtlInitUnicodeString
lea rcx, [rbp - 0x48]
call fcn.18000b890
nop
call fcn.1800274b0
lea rax, [r15 + 0x40]
mov qword [rsp + 0x60], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rbp - 0x48]
mov rsi, qword [rbp - 0x48]
mov r13, qword [rbp - 0x30]
cmp r13, 0xf
cmova r8, rsi
mov rdx, r14
mov rcx, rdi
mov rdi, qword [rbp - 0x38]
test rdi, rdi
je 0x180016b44
movabs r9, 0x100000001b3
nop dword [rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rdi
jb 0x180016b30
mov rcx, qword [r15 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r15 + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r12, qword [r15 + 8]
cmp rbx, r12
je 0x180016bae
mov r15, qword [rax + rcx*8]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x180016b82
mov rdx, qword [rdx]
lea rcx, [rbp - 0x48]
cmp r13, 0xf
cmova rcx, rsi
cmp rdi, rax
jne 0x180016b9f
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180016baa
cmp rbx, r15
je 0x180016bae
mov rbx, qword [rbx + 8]
jmp 0x180016b70
xor edi, edi
jmp 0x180016bb2
xor edi, edi
mov ebx, edi
test rbx, rbx
cmove rbx, r12
mov rcx, qword [rsp + 0x60]
cmp rbx, r12
je 0x180016bdf
mov rbx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x180016be6
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp + 0x28]
call rbx
jmp 0x180016be6
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
cmp r13, 0xf
jbe 0x180016c1d
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x180016c15
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180016e9e
mov rcx, rsi
call fcn.1800e5744
lea rax, [rbp + 0x40]
mov qword [rbp + 8], rax
mov dword [rbp], 0x1fe0000
mov rax, qword [rsp + 0x68]
cmp rax, 0xffffffffffffffff
je 0x180016c44
lea rdx, [rbp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
call fcn.18000b090
mov r13, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rdi
mov r8d, 0x28
lea rdx, str.RtlDosApplyFileIsolationRedirection_Ustr
lea rcx, [rsp + 0x78]
call fcn.18000b890
nop
call fcn.1800274b0
lea rcx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x78]
mov rsi, qword [rsp + 0x78]
mov r15, qword [rbp - 0x70]
cmp r15, 0xf
cmova rdx, rsi
mov rcx, rdi
mov rdi, qword [rbp - 0x78]
test rdi, rdi
je 0x180016cc7
movabs r15, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r14, rax
imul r14, r15
inc rcx
cmp rcx, rdi
jb 0x180016cb0
mov r15, qword [rbp - 0x70]
mov rcx, qword [r13 + 0x30]
and rcx, r14
add rcx, rcx
mov rax, qword [r13 + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r12, qword [r13 + 8]
cmp rbx, r12
je 0x180016d2f
mov r14, qword [rax + rcx*8]
nop word [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x180016d02
mov rdx, qword [rdx]
lea rcx, [rsp + 0x78]
cmp r15, 0xf
cmova rcx, rsi
cmp rdi, rax
jne 0x180016d20
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180016d2b
cmp rbx, r14
je 0x180016d2f
mov rbx, qword [rbx + 8]
jmp 0x180016cf0
xor edi, edi
jmp 0x180016d33
xor edi, edi
mov ebx, edi
test rbx, rbx
cmove rbx, r12
lea rcx, [r13 + 0x40]
cmp rbx, r12
je 0x180016d89
mov rbx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x180016d8f
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea rax, [rbp - 8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rbp]
xor r8d, r8d
lea rdx, [rbp + 0x28]
mov ecx, 1
call rbx
mov edi, eax
jmp 0x180016d94
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, 0xc0000138
cmp r15, 0xf
jbe 0x180016dcb
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x180016dc3
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180016e9e
mov rcx, rsi
call fcn.1800e5744
mov rdx, qword [rbp + 0x20]
test rdx, rdx
je 0x180016de4
cmp qword [rsp + 0x68], 0xffffffffffffffff
je 0x180016de4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
jne 0x180016e18
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x17], dil
je 0x180016e01
mov eax, 0xc015001d
jmp 0x180016eac
mov rdx, qword [rbp - 8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x70]
call fcn.180008900
jmp 0x180016eaa
cmp qword [rbp + 0x18], 0
je 0x180016eaa
call fcn.18000b090
mov rbx, rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
mov r8d, 0x14
lea rdx, str.RtlFreeUnicodeString
lea rcx, [rbp - 0x28]
call fcn.18000b890
nop
lea r8, [rsp + 0x58]
lea rdx, [rbp - 0x28]
mov rcx, rbx
call fcn.180016ee0
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x180016eaa
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180016ea5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180016ea5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800e5744
mov eax, edi
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.1800e5bd0
mov rbx, qword [rsp + 0x390]
add rsp, 0x350
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret