Function at 0x18002ff94
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xf88]
mov eax, 0x1060
call fcn.18013dff0
sub rsp, rax
mov rax, qword [0x1801ee5c0]
xor rax, rsp
mov qword [rbp + 0xf50], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
mov r14d, 1
mov rax, qword [0x180218288]
xor r15d, r15d
test rax, rax
jne 0x18003008e
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x180030069
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x180030069
mov esi, dword [r9 + 0x20]
dec r10d
lea rcx, [rsi + r10*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov r11d, 0x5c766d9
mov cl, byte [rdx]
add rdx, r14
test cl, cl
je 0x180030064
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r14
test cl, cl
jne 0x180030045
cmp r11d, 0xfc84e1f9
je 0x18003006e
test r10d, r10d
jne 0x180030028
mov rax, qword [rax]
jmp 0x180030003
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [r9 + 0x24]
add rax, r8
movzx eax, word [rax + r10*2]
mov eax, dword [rcx + rax*4]
add rax, r8
mov qword [0x180218288], rax
lea r8, [rsp + 0x28]
mov r14d, 0x1000
mov edx, r14d
lea rcx, [rsp + 0x50]
call rax
test eax, eax
je 0x180030242
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov esi, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x48], rsi
mov byte [rsp + 0x30], r15b
mov r12d, dword [rsp + 0x28]
shr r12d, 3
movzx r13d, r15w
mov rdi, qword [rsp + 0x30]
cmp r15w, r12w
jae 0x180030168
lea rdx, [rsp + 0x30]
cmp rsi, 0xf
cmova rdx, rdi
movzx eax, r13w
mov r8d, esi
mov rcx, qword [rsp + rax*8 + 0x50]
call qword [sym.imp.KERNEL32.dll_K32GetDeviceDriverBaseNameA]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x30]
test eax, eax
je 0x180030158
lea rdx, [rsp + 0x30]
cmp rsi, 0xf
cmova rdx, rdi
or r14, 0xffffffffffffffff
inc r14
cmp byte [rdx + r14], r15b
jne 0x180030121
mov r15, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x18003013b
mov rcx, qword [rbx]
mov r8, r15
cmp r14, r15
cmovb r8, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x180030155
cmp r15, r14
jb 0x180030155
jbe 0x1800301a2
xor r15d, r15d
inc r13w
cmp r13w, r12w
jb 0x1800300e3
mov r14d, 0x1000
cmp rsi, 0xf
jbe 0x180030242
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, r14
jb 0x180030239
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180030239
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r14d, reloc.WS2_32.dll_ntohs
cmp rsi, r14
jbe 0x1800301da
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1800301d2
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003019b
mov rcx, rdi
call fcn.18013d090
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r14
mov byte [rsp + 0x30], dil
mov rdx, qword [rbx + 0x18]
cmp rdx, r14
jbe 0x180030220
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x18003021b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180030232
mov rcx, r8
call fcn.18013d090
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], r14
mov byte [rbx], dil
mov eax, 1
jmp 0x180030285
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, rdi
call fcn.18013d090
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x180030274
inc rdx
mov rcx, qword [rbx]
cmp rdx, r14
jb 0x18003026f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800302b5
mov rcx, r8
call fcn.18013d090
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r15b
xor al, al
mov rcx, qword [rbp + 0xf50]
xor rcx, rsp
call fcn.18013d070
lea r11, [rsp + 0x1060]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3