Function at 0x140152ce0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1e0]
mov eax, 0x2e0
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rbx, rdx
mov rdi, rcx
mov word [rsp + 0x38], r8w
xor r12d, r12d
mov r15b, r12b
add rcx, 0x18
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], r12
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
lea eax, [r12 + 1]
lock xadd dword [rsp + 0x50], eax
inc eax
cmp eax, 1
jne 0x140152d61
cmp dword [rsp + 0x54], r12d
jne 0x140153138
call qword [sym.imp.MSVCP140.dll__Thrd_id]
mov dword [rsp + 0x54], eax
mov rcx, qword [rdi]
test rcx, rcx
je 0x14015312b
call fcn.14015357c
mov rsi, qword [rdi]
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140152d82
mov rdx, qword [rbx]
movabs r9, 0xcbf29ce484222325
mov rcx, r12
cmp qword [rbx + 0x10], r12
jbe 0x140152db3
movzx eax, byte [rcx + rdx]
xor r9, rax
movabs r8, 0x100000001b3
imul r9, r8
inc rcx
cmp rcx, qword [rbx + 0x10]
jb 0x140152d95
mov r8, rbx
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.140153c70
mov r14, qword [rax + 8]
test r14, r14
jne 0x140152dcf
mov r14, qword [rsi + 8]
test rsi, rsi
je 0x14015312b
mov rcx, rsi
call fcn.14015357c
mov rcx, qword [rdi]
cmp r14, qword [rcx + 8]
jne 0x140152e0e
test rcx, rcx
je 0x14015312b
call fcn.14015357c
lea r9, [rsp + 0x38]
mov r8, rbx
lea rdx, [rbp - 0x70]
mov rcx, qword [rdi]
call fcn.140153650
mov r15b, 1
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x140152e49
or eax, 0xffffffff
lock xadd dword [rsp + 0x50], eax
cmp eax, 1
jne 0x140152e39
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rsp + 0x54], eax
jne 0x140153145
mov dword [rsp + 0x54], r12d
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
jmp 0x140152e0e
cmp dword [rsp + 0x54], r12d
je 0x140152e60
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rsp + 0x54], eax
jne 0x14015311e
test r15b, r15b
jne 0x140152ef2
lea rax, [0x14027e5c8]
mov qword [rbp + 0x90], rax
lea rax, [0x1402fc018]
mov qword [rbp + 0x98], rax
mov rdx, rbx
lea rcx, [rbp + 0xa0]
call fcn.14002a574
mov word [rbp + 0xc0], r12w
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, str.Attempt_to_add_quarantined_event_to_quarantine.
mov edx, 0x65e
mov ecx, 0x14036a0
mov r8d, 0xf
call fcn.1400b4bc8
lea rcx, [rbp + 0xa0]
call fcn.14000fd30
nop
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.14024c6d0
add rsp, 0x2e0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp word [rsp + 0x38], 0xa
je 0x140152ed1
lea rcx, [rbp - 0x60]
call fcn.1400508f8
movzx edx, word [rsp + 0x38]
lea rcx, [rbp - 0x60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int____ptr64]
lea rdx, [rbp + 0x90]
lea rcx, [rbp - 0x58]
call fcn.140050b0c
nop
lea rsi, [0x14027e9f0]
mov qword [rbp + 0xd0], rsi
movups xmm0, xmmword [rbp + 0x90]
movaps xmmword [rbp + 0x120], xmm0
movups xmm1, xmmword [rbp + 0xa0]
movaps xmmword [rbp + 0x130], xmm1
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], 0xf
mov byte [rbp + 0x90], r12b
mov r14d, 4
mov word [rbp + 0x140], r14w
or r9, 0xffffffffffffffff
lea r8, [0x1402fc650]
lea edi, [r14 + 0x3d]
mov edx, edi
lea rcx, [rbp + 0xd8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov qword [rbp + 0x150], rsi
mov rdx, rbx
lea rcx, [rbp + 0x1a0]
call fcn.14002a574
mov word [rbp + 0x1c0], r14w
or r9, 0xffffffffffffffff
lea r8, str.EventName
mov edx, edi
lea rcx, [rbp + 0x158]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
nop
mov byte [rsp + 0x30], r12b
mov word [rsp + 0x40], 0x178
mov word [rsp + 0x58], r14w
mov byte [rsp + 0x5a], 1
mov byte [rsp + 0x45], r12b
mov byte [rsp + 0x47], r12b
mov word [rsp + 0x42], 0x1bf
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x46]
lea rdx, [rsp + 0x42]
lea rcx, [rsp + 0x60]
call fcn.14014f2c8
lea rcx, [0x14027d608]
mov qword [rsp + 0x68], rcx
lea rax, [0x1402fc960]
mov qword [rsp + 0x70], rax
lea rax, str.EventQuarantined
mov qword [rsp + 0x78], rax
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x150]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x68]
call fcn.1401538b4
lea rcx, [rbp + 0x1a0]
call fcn.14000fd30
mov ebx, 0x1000
mov rax, qword [rbp + 0x138]
cmp rax, 0x10
jb 0x1401530b2
mov rcx, qword [rbp + 0x120]
mov rdx, rcx
inc rax
cmp rax, rbx
jb 0x1401530ac
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x1401530f9
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movdqa xmm0, xmmword [0x14031bbf0]
movdqa xmmword [rbp + 0x130], xmm0
mov byte [rbp + 0x120], r12b
mov rax, qword [rbp + 0xa8]
cmp rax, 0x10
jb 0x140153106
mov rcx, qword [rbp + 0x90]
mov rdx, rcx
inc rax
cmp rax, rbx
jb 0x140153100
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140153100
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp + 0x28]
call fcn.140050878
lea rcx, [rbp + 0x28]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x140152ed1
xor edx, edx
mov ecx, 0x131f4c3
call fcn.1400b3928
int3
xor edx, edx
mov ecx, 0x131f486
call fcn.1400b3928
int3
xor edx, edx
mov ecx, 0x131f4c4
call fcn.1400b3928
int3
xor edx, edx
mov ecx, 0x131f4c5
call fcn.1400b3928
int3