Function at 0x140002490
Capabilities:
Encode data using xor
Hash data using fnv
Print debug messages

Disassembly:
push rbp
push r12
lea rbp, [rsp - 0x1b8]
sub rsp, 0x2b8
xor ecx, ecx
mov dword [rsp + 0x40], 0x220020
mov qword [rbp + 0x1d0], rcx
lea rax, [0x140004110]
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rbp + 0x1d0]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rax, qword [sym.imp.ntoskrnl.exe_IoDriverObjectType]
mov qword [rsp + 0x30], rcx
lea edx, [r9 + 0x40]
mov byte [rsp + 0x28], cl
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByName]
lea rcx, [0x140007350]
test eax, eax
js 0x140002575
mov eax, dword [0x140009330]
movaps xmm0, xmmword [rsp + 0x40]
mov edx, eax
inc eax
shl rdx, 5
add rdx, rcx
mov dword [0x140009330], eax
mov rax, qword [rbp + 0x1d0]
lea rcx, [0x140002410]
add rax, 0xe0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rdx + 0x10], rax
xchg qword [rax], rcx
movaps xmm0, xmmword [rsp + 0x60]
mov qword [rdx + 0x18], rcx
movups xmmword [rdx], xmm0
mov qword [0x140006320], rcx
lea rdx, [rsp + 0x60]
lea rcx, [0x140003f90]
call qword [sym.imp.ntoskrnl.exe_DbgPrint]
mov rcx, qword [rbp + 0x1d0]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x14000258d
lfence
mov r8d, eax
lea rdx, [rsp + 0x40]
lea rcx, [0x140003f40]
call qword [sym.imp.ntoskrnl.exe_DbgPrint]
lea rcx, [0x140004140]
call fcn.140003320
mov r12, rax
test rax, rax
jne 0x1400025b9
lea rcx, [0x140004150]
add rsp, 0x2b8
pop r12
pop rbp
jmp qword [sym.imp.ntoskrnl.exe_DbgPrint]
mov qword [rsp + 0x2e8], rbx
mov qword [rsp + 0x2b0], rsi
xor esi, esi
mov qword [rsp + 0x2a8], rdi
xor edi, edi
mov qword [rsp + 0x2a0], r13
mov qword [rsp + 0x298], r14
mov qword [rsp + 0x290], r15
movsxd r15, dword [rax + 0x3c]
add r15, r12
movzx eax, word [r15 + 0x14]
lea r11, [r15 + 0x18]
movzx r14d, word [r15 + 6]
add r11, rax
test r14d, r14d
je 0x140002af0
lea r13, [0x140004180]
cmp dword [r11], 0x45474150
je 0x14000262e
cmp dword [r11], 0x7865742e
jne 0x14000269c
cmp byte [r11 + 4], 0x74
jne 0x14000269c
mov ebx, dword [r11 + 0xc]
mov rax, 0xffffffffffffffff
add rbx, r12
nop dword [rax]
inc rax
cmp byte [rax + r13], 0
jne 0x140002640
mov r10d, dword [r11 + 8]
sub r10d, eax
xor r9d, r9d
nop dword [rax]
nop dword [rax + rax]
mov edi, r9d
lea rdx, [0x140004190]
add rdi, rbx
mov al, 0x78
mov r8, rdi
mov rcx, r13
sub r8, r13
cmp al, 0x78
jne 0x140002689
movzx eax, byte [rdx]
cmp byte [r8 + rcx], al
jne 0x14000276a
movzx eax, byte [rcx + 1]
inc rcx
inc rdx
test al, al
jne 0x140002678
test rdi, rdi
jne 0x1400026b4
inc esi
add r11, 0x28
cmp esi, r14d
jb 0x140002615
test rdi, rdi
je 0x140002af0
movzx eax, word [r15 + 0x14]
lea rbx, [r15 + 0x18]
movzx r15d, word [r15 + 6]
lea r13, [0x1400041a0]
add rbx, rax
xor r10d, r10d
xor r14d, r14d
cmp dword [rbx], 0x45474150
je 0x1400026e8
cmp dword [rbx], 0x7865742e
jne 0x140002749
cmp byte [rbx + 4], 0x74
jne 0x140002749
mov esi, dword [rbx + 0xc]
mov rax, 0xffffffffffffffff
add rsi, r12
inc rax
cmp byte [rax + r13], 0
jne 0x1400026f5
mov r11d, dword [rbx + 8]
sub r11d, eax
xor r9d, r9d
nop dword [rax]
mov r10d, r9d
lea rdx, [0x1400041c0]
add r10, rsi
mov cl, 0x78
mov r8, r10
mov rax, r13
sub r8, r13
cmp cl, 0x78
jne 0x140002736
movzx ecx, byte [rdx]
cmp byte [r8 + rax], cl
jne 0x14000277d
movzx ecx, byte [rax + 1]
inc rax
inc rdx
test cl, cl
jne 0x140002728
test r10, r10
jne 0x14000278a
inc r14d
add rbx, 0x28
cmp r14d, r15d
jb 0x1400026d2
test r10, r10
jne 0x14000278a
lea rcx, [0x140004260]
jmp 0x140002af7
inc r9d
cmp r9d, r10d
jbe 0x140002660
xor edi, edi
jmp 0x14000269c
inc r9d
cmp r9d, r11d
jbe 0x140002710
xor r10d, r10d
jmp 0x140002749
movsxd rax, dword [rdi + 6]
xor r13d, r13d
mov ecx, dword [r10 + 0xc]
mov r14d, r13d
mov rsi, qword [rax + rdi + 0xa]
test rsi, rsi
je 0x140002ade
mov r15d, ecx
lea r12, [0x140006358]
mov rdi, qword [r15 + rsi]
test rdi, rdi
je 0x140002ad1
mov rcx, qword [rsi + 0x28]
mov edx, 0x104
add rcx, 0x10
call fcn.140003190
mov rbx, rax
test rax, rax
je 0x1400029ac
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x208
call fcn.140003b80
mov edx, r13d
mov r8, rbx
cmp word [r8], 0x7b
je 0x140002827
add r8, 2
cmp word [r8], 0x7b
je 0x140002825
add r8, 2
cmp word [r8], 0x7b
je 0x140002820
add r8, 2
add edx, 3
cmp edx, 0x81
jb 0x1400027f2
jmp 0x14000283a
add edx, 2
jmp 0x140002827
inc edx
cmp edx, 0x81
jae 0x14000283a
mov eax, edx
inc edx
cmp word [rbx + rax*2], 0x7d
jne 0x140002827
mov eax, edx
lea rcx, [rbp - 0x80]
lea rdx, [0x1400041e0]
mov word [rbx + rax*2], r13w
call qword [sym.imp.ntoskrnl.exe_swprintf]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rdx, [rbp - 0x80]
lea rcx, [0x140004200]
call qword [sym.imp.ntoskrnl.exe_DbgPrint]
xorps xmm0, xmm0
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r9, [rbp + 0x1d8]
mov qword [rbp + 0x1e0], r13
lea r8, [rbp + 0x1e0]
mov qword [rbp + 0x1d8], r13
mov edx, 1
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
test eax, eax
js 0x140002994
mov rax, qword [rbp + 0x1d8]
mov r9, qword [rax + 8]
test r9, r9
je 0x140002965
mov edx, dword [0x140006350]
mov ecx, r13d
test edx, edx
je 0x1400028f5
nop word [rax + rax]
mov eax, ecx
add rax, rax
cmp qword [r12 + rax*8], r9
je 0x140002974
inc ecx
cmp ecx, edx
jb 0x1400028e0
mov eax, dword [0x140009330]
lea rcx, [0x140007350]
mov r8, rdx
mov edx, eax
add r8, r8
shl rdx, 5
add rdx, rcx
inc eax
lea rcx, [0x1400022d0]
mov qword [r12 + r8*8], r9
movups xmm0, xmmword [r9 + 0x38]
mov dword [0x140009330], eax
lea rax, [r9 + 0xe0]
mov qword [rdx + 0x10], rax
movups xmmword [rsp + 0x70], xmm0
xchg qword [rax], rcx
movups xmm0, xmmword [rsp + 0x70]
mov qword [rdx + 0x18], rcx
mov qword [r12 + r8*8 + 8], rcx
lea rcx, [0x140003f90]
movups xmmword [rdx], xmm0
lea rdx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_DbgPrint]
inc dword [0x140006350]
mov rcx, qword [rbp + 0x1e0]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x1400029ac
lea rdx, [r9 + 0x38]
lea rcx, [0x140004220]
call qword [sym.imp.ntoskrnl.exe_DbgPrint]
mov rcx, qword [rbp + 0x1e0]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x1400029ac
lfence
mov r8d, eax
lea rdx, [rsp + 0x50]
lea rcx, [0x140003f40]
call qword [sym.imp.ntoskrnl.exe_DbgPrint]
movzx r10d, word [rdi + 0x464]
lea rdx, [rdi + 0x466]
mov r11d, dword [0x140006348]
test r10d, r10d
je 0x140002a3e
movzx eax, byte [rdx]
xor eax, 0x4b9ace2f
imul ecx, eax, 0x1000193
cmp r10d, 1
jbe 0x140002a0b
lea r8, [rdi + 0x467]
lea r9d, [r10 - 1]
nop word [rax + rax]
movzx eax, byte [r8]
lea r8, [r8 + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
sub r9, 1
jne 0x1400029f0
xor ecx, r11d
jmp 0x140002a13
xor ecx, r11d
test r10d, r10d
je 0x140002a3e
mov r8, r10
nop word [rax + rax]
imul ecx, ecx, 0x41c64e6d
lea rdx, [rdx + 1]
add ecx, 0x3039
mov eax, ecx
shr eax, 0x10
xor byte [rdx - 1], al
sub r8, 1
jne 0x140002a20
movzx r10d, word [rdi + 0x486]
lea rdx, [rdi + 0x488]
test r10d, r10d
je 0x140002ace
movzx eax, byte [rdx]
xor eax, 0x4b9ace2f
imul ecx, eax, 0x1000193
cmp r10d, 1
jbe 0x140002a9b
lea r8, [rdi + 0x489]
lea r9d, [r10 - 1]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8]
lea r8, [r8 + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
sub r9, 1
jne 0x140002a80
xor ecx, r11d
jmp 0x140002aa3
xor ecx, r11d
test r10d, r10d
je 0x140002ace
mov r8, r10
nop word [rax + rax]
imul ecx, ecx, 0x41c64e6d
lea rdx, [rdx + 1]
add ecx, 0x3039
mov eax, ecx
shr eax, 0x10
xor byte [rdx - 1], al
sub r8, 1
jne 0x140002ab0
inc r14d
mov rsi, qword [rsi + 8]
test rsi, rsi
jne 0x1400027b0
mov edx, r14d
lea rcx, [0x140004240]
call qword [sym.imp.ntoskrnl.exe_DbgPrint]
jmp 0x140002afd
lea rcx, [0x140004290]
call qword [sym.imp.ntoskrnl.exe_DbgPrint]
mov r14, qword [rsp + 0x298]
mov r13, qword [rsp + 0x2a0]
mov rdi, qword [rsp + 0x2a8]
mov rsi, qword [rsp + 0x2b0]
mov rbx, qword [rsp + 0x2e8]
mov r15, qword [rsp + 0x290]
add rsp, 0x2b8
pop r12
pop rbp
ret