Function at 0x1401ef730
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push r14
lea rbp, [rsp - 0x20a8]
mov eax, 0x21a8
call fcn.1403cb200
sub rsp, rax
xorps xmm1, xmm1
mov dword [rsp + 0x20], 0x2376646e
xor eax, eax
mov dword [rsp + 0x24], 0x77697177
xorps xmm0, xmm0
mov word [rbp + 0x18], ax
xor r14d, r14d
mov dword [rbp + 0x80], eax
mov ecx, r14d
mov word [rsp + 0x28], 0x28
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x20], xmm1
movups xmmword [rbp + 0x30], xmm1
movups xmmword [rbp + 0x40], xmm1
movups xmmword [rbp + 0x50], xmm1
movups xmmword [rbp + 0x60], xmm1
movups xmmword [rbp + 0x70], xmm1
movsxd rax, ecx
xor byte [rsp + rax + 0x20], cl
inc ecx
cmp ecx, 9
jb 0x1401ef7a0
lea rcx, [rbp - 0x18]
mov byte [rsp + 0x29], r14b
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x1401ef7c0
lea r8, [rsp + 0x20]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1401ef7e0
lea r8, [rbp + 0x20c0]
mov edx, 0x2000
lea rcx, [rbp + 0x90]
call qword [sym.imp.kernel32.dll_K32EnumDeviceDrivers]
mov rax, qword [rbp + 0x90]
test rax, rax
je 0x1401efbde
mov qword [rsp + 0x21c8], rbx
mov qword [rsp + 0x21d0], rsi
mov rsi, r14
mov qword [rsp + 0x21d8], rdi
mov edi, 0x76
mov qword [rsp + 0x21a0], r12
mov r12d, 0x64
mov qword [rsp + 0x2198], r13
mov qword [rsp + 0x2190], r15
lea ebx, [rdi - 0x31]
nop word [rax + rax]
mov r8d, r12d
lea rdx, [rbp + 0x20]
mov rcx, rax
call qword [sym.imp.kernel32.dll_K32GetDeviceDriverBaseNameW]
test eax, eax
je 0x1401efb9a
mov dword [rsp + 0x20], 0x440042
mov ecx, r14d
mov dword [rsp + 0x24], 0x620046
mov dword [rsp + 0x28], 0x76006d
mov dword [rsp + 0x2c], 0x7f
nop dword [rax + rax]
movsxd rax, ecx
xor word [rsp + rax*2 + 0x20], cx
inc ecx
cmp ecx, 7
jb 0x1401ef8a0
lea rdx, [rsp + 0x20]
mov word [rsp + 0x2e], r14w
lea rcx, [rbp + 0x20]
call fcn.1403cbeb0
test rax, rax
jne 0x1401ef97c
mov dword [rbp - 0x18], 0x600045
mov ecx, r14d
mov dword [rbp - 0x14], 0x7a0071
mov dword [rbp - 0x10], 0x6b0045
mov dword [rbp - 0xc], 0x6e0072
mov dword [rbp - 8], 0x61004b
mov dword [rbp - 4], 0x6a006f
mov dword [rbp], 0x78
movsxd rax, ecx
xor word [rbp + rax*2 - 0x18], cx
inc ecx
cmp ecx, 0xd
jb 0x1401ef900
lea rdx, [rbp - 0x18]
mov word [rbp + 2], r14w
lea rcx, [rbp + 0x20]
call fcn.1403cbeb0
test rax, rax
jne 0x1401ef97c
mov dword [rsp + 0x30], 0x73006d
mov ecx, r14d
mov dword [rsp + 0x34], 0x600063
mov dword [rsp + 0x38], 0x770060
mov dword [rsp + 0x3c], 0x70
nop dword [rax]
movsxd rax, ecx
xor word [rsp + rax*2 + 0x30], cx
inc ecx
cmp ecx, 7
jb 0x1401ef950
lea rdx, [rsp + 0x30]
mov word [rsp + 0x3e], r14w
lea rcx, [rbp + 0x20]
call fcn.1403cbeb0
test rax, rax
je 0x1401efb9a
mov dword [rsp + 0x40], 0x6f0041
mov ecx, r14d
mov dword [rsp + 0x44], 0x6a0076
mov dword [rsp + 0x48], 0x6d0067
mov dword [rsp + 0x4c], 0x660063
mov dword [rsp + 0x50], 0x29007c
mov dword [rsp + 0x54], 0x79006e
mov dword [rsp + 0x58], 0x7b0065
mov dword [rsp + 0x5c], 0x7d006b
mov dword [rsp + 0x60], 0x360030
mov dword [rsp + 0x64], 0x640037
mov dword [rsp + 0x68], 0x320067
mov dword [rsp + 0x6c], 0x7e0036
mov dword [rsp + 0x70], 0x39006b
mov dword [rsp + 0x74], 0x740076
mov dword [rsp + 0x78], 0x79007d
mov dword [rsp + 0x7c], 0x7b007b
mov dword [rbp - 0x80], 0x480000
mov dword [rbp - 0x7c], 0x3004c
mov dword [rbp - 0x78], 0x4d0050
mov dword [rbp - 0x74], 0x70043
mov dword [rbp - 0x70], 0x50005b
mov dword [rbp - 0x6c], 0x5f0059
mov dword [rbp - 0x68], 0x400049
mov dword [rbp - 0x64], 0x250000
mov dword [rbp - 0x60], 0x5d0060
mov dword [rbp - 0x5c], 0x520057
mov dword [rbp - 0x58], 0x500047
mov dword [rbp - 0x54], 0x17001a
mov dword [rbp - 0x50], 0x4d004b
mov dword [rbp - 0x4c], 0x49005b
mov dword [rbp - 0x48], 0x1d0048
mov dword [rbp - 0x44], 0x500052
mov dword [rbp - 0x40], 0x250021
mov dword [rbp - 0x3c], 0x310027
mov dword [rbp - 0x38], 0x270064
mov dword [rbp - 0x34], 0x210023
mov dword [rbp - 0x30], 0x3b0027
mov dword [rbp - 0x2c], 0x6b002f
mov dword [rbp - 0x28], 0x2c002b
mov dword [rbp - 0x24], 0x2a0023
mov dword [rbp - 0x20], 0x7e
nop
movsxd rax, ecx
xor word [rsp + rax*2 + 0x40], cx
inc ecx
cmp ecx, 0x51
jb 0x1401efab0
lea r8, [rbp + 0x20]
mov word [rbp - 0x1e], r14w
lea rdx, [rsp + 0x40]
xor ecx, ecx
call fcn.1401a8450
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1401efb67
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1401efb67
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x3c28c227
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1401efb62
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1401efb40
cmp r8d, 0x6fdbe0ca
je 0x1401efb6c
test r9d, r9d
jne 0x1401efb20
mov rax, qword [rax]
jmp 0x1401efaf0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, r12d
add rax, r10
call rax
call fcn.1401a9e40
call fcn.1401a9e40
mov ebx, 0x45
lea edi, [rbx + 0x31]
mov rax, qword [rbp + rsi*8 + 0x98]
inc rsi
test rax, rax
jne 0x1401ef860
mov r15, qword [rsp + 0x2190]
mov r13, qword [rsp + 0x2198]
mov r12, qword [rsp + 0x21a0]
mov rdi, qword [rsp + 0x21d8]
mov rsi, qword [rsp + 0x21d0]
mov rbx, qword [rsp + 0x21c8]
add rsp, 0x21a8
pop r14
pop rbp
ret