Function at 0x14002f1e0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f0
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov r15, rdx
mov r12, rcx
mov qword [rsp + 0x90], rcx
xor ebp, ebp
call fcn.14002fa60
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14002f2a6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002f2a6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x46c82bd0
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14002f2a1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14002f280
cmp r8d, 0x701820eb
je 0x14002f2ab
test r9d, r9d
jne 0x14002f260
mov rax, qword [rax]
jmp 0x14002f230
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
mov edx, 0x104
lea rcx, [rsp + 0xd0]
call r8
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.14000a110
nop
lea r8, str.driversWinIo.sys
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14000c880
mov rbx, rax
lea r13, [0x14003e068]
cmp r13, rax
je 0x14002f32c
mov rcx, r13
call fcn.14000a870
mov rcx, rbx
call fcn.14000a870
mov rcx, r13
call fcn.14000b2d0
mov rdx, rbx
mov rcx, r13
call fcn.14000b890
lea rcx, [rsp + 0x70]
call fcn.14000a030
nop
lea rcx, [rsp + 0x50]
call fcn.14000a030
mov rcx, r13
call fcn.140009e30
mov rsi, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
mov r11, qword [rcx + 0x30]
movsxd rdx, dword [r11 + 0x3c]
mov edi, dword [rdx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14002f3d6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002f3d6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [r11 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r11
mov r8d, 0x7991928c
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14002f3d1
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14002f3b0
cmp r8d, 0xb8187c1d
je 0x14002f3db
test r9d, r9d
jne 0x14002f390
mov rcx, qword [rcx]
jmp 0x14002f360
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rsi
call r10
mov r14, rax
mov rcx, r12
call fcn.1400078c0
mov rsi, rax
mov rcx, r12
call fcn.1400078f0
mov rbp, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rcx + 0x30]
movsxd rdx, dword [r11 + 0x3c]
mov edi, dword [rdx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x14002f4c6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002f4c6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [rbx + r9*4]
mov edx, dword [rax + r11]
add rdx, r11
mov r8d, 0x9dffaa28
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14002f4c1
nop
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14002f4a0
cmp r8d, 0x8320b5a9
je 0x14002f4cb
test r9d, r9d
jne 0x14002f480
mov rcx, qword [rcx]
jmp 0x14002f450
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
mov rcx, r14
call r10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14002f586
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002f586
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xddfe33f4
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14002f581
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14002f560
cmp r8d, 0x8572d97e
je 0x14002f58b
test r9d, r9d
jne 0x14002f540
mov rax, qword [rax]
jmp 0x14002f510
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
mov rcx, r14
call r8
mov rdx, r13
lea rcx, [rsp + 0x50]
call fcn.14000a250
mov rdx, r15
mov rcx, rax
call fcn.14002e630
lea rcx, [rsp + 0x40]
call fcn.1400047c0
mov rcx, r15
call fcn.1400047c0
mov rdi, qword [r15 + 0x10]
mov rcx, r15
call fcn.140009750
add rdi, rax
mov rcx, r15
call fcn.1400047c0
mov rcx, r15
call fcn.140009750
mov rdx, rax
mov r8, rdi
lea rcx, [rsp + 0xa8]
call fcn.140023390
nop
lea rcx, [rsp + 0xa8]
call fcn.140009900
mov rsi, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14002f6a6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14002f6a6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [rbx + r9*4]
mov eax, dword [rax + r10]
add rax, r10
mov r8d, 0xa612126
movzx edx, byte [rax]
inc rax
test dl, dl
je 0x14002f6a1
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rax]
lea rax, [rax + 1]
test dl, dl
jne 0x14002f680
cmp r8d, 0xd9a003f4
je 0x14002f6ab
test r9d, r9d
jne 0x14002f660
mov rcx, qword [rcx]
jmp 0x14002f630
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
mov rdx, rsi
lea rcx, [rsp + 0x98]
call r8
mov rax, qword [0x14003ec70]
lea rcx, [rsp + 0x98]
call rax
cmp eax, 0xc000010e
je 0x14002f6f1
test eax, eax
jns 0x14002f6f1
xor bl, bl
jmp 0x14002f6f3
mov bl, 1
lea rcx, [rsp + 0xa8]
call fcn.140009ae0
nop
mov rcx, r12
call fcn.140007920
movzx eax, bl
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.140033050
mov rbx, qword [rsp + 0x240]
add rsp, 0x1f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret