Function at 0x1400147e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x14002e028]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rbx, rdx
mov rdi, rcx
mov word [rsp + 0x38], r8w
xor r12d, r12d
mov r15b, r12b
add rcx, 0x18
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], r12
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
lea eax, [r12 + 1]
lock xadd dword [rsp + 0x50], eax
inc eax
cmp eax, 1
jne 0x14001485b
cmp dword [rsp + 0x54], r12d
jne 0x140014c6f
call qword [sym.imp.MSVCP140.dll__Thrd_id]
mov dword [rsp + 0x54], eax
mov rcx, qword [rdi]
test rcx, rcx
je 0x140014c62
call fcn.140015160
mov rsi, qword [rdi]
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14001487c
mov rdx, qword [rbx]
movabs r9, 0xcbf29ce484222325
mov rcx, r12
cmp qword [rbx + 0x10], r12
jbe 0x1400148ad
movzx eax, byte [rcx + rdx]
xor r9, rax
movabs r8, 0x100000001b3
imul r9, r8
inc rcx
cmp rcx, qword [rbx + 0x10]
jb 0x14001488f
mov r8, rbx
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.140015910
mov r14, qword [rax + 8]
test r14, r14
jne 0x1400148ca
mov r14, qword [rsi + 8]
test rsi, rsi
je 0x140014c62
mov rcx, rsi
call fcn.140015160
mov rcx, qword [rdi]
cmp r14, qword [rcx + 8]
jne 0x140014909
test rcx, rcx
je 0x140014c62
call fcn.140015160
lea r9, [rsp + 0x38]
mov r8, rbx
lea rdx, [rbp - 0x78]
mov rcx, qword [rdi]
call fcn.1400151d0
mov r15b, 1
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x140014944
or eax, 0xffffffff
lock xadd dword [rsp + 0x50], eax
cmp eax, 1
jne 0x140014934
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rsp + 0x54], eax
jne 0x140014c7c
mov dword [rsp + 0x54], r12d
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
jmp 0x140014909
cmp dword [rsp + 0x54], r12d
je 0x14001495b
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rsp + 0x54], eax
jne 0x140014c55
test r15b, r15b
jne 0x140014a1e
lea rax, [0x140024590]
mov qword [rbp + 0x90], rax
lea rax, [0x140026490]
mov qword [rbp + 0x98], rax
mov rdx, rbx
lea rcx, [rbp + 0xa0]
call fcn.140007b38
mov word [rbp + 0xc0], r12w
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, str.Attempt_to_add_quarantined_event_to_quarantine.
mov ecx, 0x14036a0
mov r8d, 0xf
call fcn.1400090d8
mov rax, qword [rbp + 0xb8]
cmp rax, 0x10
jb 0x1400149fd
mov rcx, qword [rbp + 0xa0]
mov rdx, rcx
inc rax
mov ebx, 0x1000
cmp rax, rbx
jb 0x1400149f6
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x1400149f6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.140020f80
add rsp, 0x2e0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp word [rsp + 0x38], 0xa
je 0x1400149fd
lea rcx, [rbp - 0x60]
call fcn.140007cfc
movzx edx, word [rsp + 0x38]
lea rcx, [rbp - 0x60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int____ptr64]
lea rdx, [rbp + 0x90]
lea rcx, [rbp - 0x58]
call fcn.140006ac0
lea rsi, [0x1400249e0]
mov qword [rbp + 0xd0], rsi
movups xmm0, xmmword [rbp + 0x90]
movaps xmmword [rbp + 0x120], xmm0
movups xmm1, xmmword [rbp + 0xa0]
movaps xmmword [rbp + 0x130], xmm1
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], 0xf
mov byte [rbp + 0x90], r12b
mov r14d, 4
mov word [rbp + 0x140], r14w
or r9, 0xffffffffffffffff
lea r8, str.Reason
lea edi, [r14 + 0x3d]
mov edx, edi
lea rcx, [rbp + 0xd8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
nop
mov qword [rbp + 0x150], rsi
mov rdx, rbx
lea rcx, [rbp + 0x1a0]
call fcn.140007b38
mov word [rbp + 0x1c0], r14w
or r9, 0xffffffffffffffff
lea r8, str.EventName
mov edx, edi
lea rcx, [rbp + 0x158]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
nop
mov byte [rsp + 0x30], r12b
mov word [rsp + 0x40], 0xbf01
mov dword [rsp + 0x42], 0x40101
mov word [rsp + 0x46], 0x78
lea rax, [0x140024ed8]
mov qword [rsp + 0x60], rax
lea rax, [0x140026b00]
mov qword [rsp + 0x68], rax
lea rax, str.EventQuarantined
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x150]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140015428
mov ebx, 0x1000
mov rax, qword [rbp + 0x1b8]
cmp rax, 0x10
jb 0x140014b9c
mov rcx, qword [rbp + 0x1a0]
mov rdx, rcx
inc rax
cmp rax, rbx
jb 0x140014b96
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x140014c30
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movdqa xmm0, xmmword [0x1400272d0]
movdqa xmmword [rbp + 0x1b0], xmm0
mov byte [rbp + 0x1a0], r12b
mov rax, qword [rbp + 0x138]
cmp rax, 0x10
jb 0x140014be9
mov rcx, qword [rbp + 0x120]
mov rdx, rcx
inc rax
cmp rax, rbx
jb 0x140014be3
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x140014c30
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movdqa xmm0, xmmword [0x1400272d0]
movdqa xmmword [rbp + 0x130], xmm0
mov byte [rbp + 0x120], r12b
mov rax, qword [rbp + 0xa8]
cmp rax, 0x10
jb 0x140014c3d
mov rcx, qword [rbp + 0x90]
mov rdx, rcx
inc rax
cmp rax, rbx
jb 0x140014c37
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140014c37
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp + 0x28]
call fcn.140007c84
lea rcx, [rbp + 0x28]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x1400149fd
xor edx, edx
mov ecx, 0x131f4c3
call fcn.140001f08
int3
xor edx, edx
mov ecx, 0x131f486
call fcn.140001f08
int3
xor edx, edx
mov ecx, 0x131f4c4
call fcn.140001f08
int3
xor edx, edx
mov ecx, 0x131f4c5
call fcn.140001f08
int3