Function at 0x18002b5f4
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xf88]
mov eax, 0x1060
call fcn.180103440
sub rsp, rax
mov rax, qword [0x1801bf780]
xor rax, rsp
mov qword [rbp + 0xf50], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
mov r14d, 1
mov rax, qword [0x1801c44a8]
xor r15d, r15d
test rax, rax
jne 0x18002b6f0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x30]
movsxd rcx, dword [rdx + 0x3c]
mov r9d, dword [rcx + rdx + 0x88]
add r9, rdx
cmp r9, rdx
je 0x18002b6cb
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x18002b6cb
mov esi, dword [r9 + 0x20]
dec r10d
lea rcx, [rsi + r10*4]
mov r8d, dword [rcx + rdx]
add r8, rdx
mov r11d, 0x116d3efb
mov cl, byte [r8]
add r8, r14
test cl, cl
je 0x18002b6c6
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r8]
add r8, r14
test cl, cl
jne 0x18002b6a6
cmp r11d, 0xb9cec77b
je 0x18002b6d0
test r10d, r10d
jne 0x18002b688
mov rax, qword [rax]
jmp 0x18002b663
mov ecx, dword [r9 + 0x1c]
add rcx, rdx
mov eax, dword [r9 + 0x24]
add rax, rdx
movzx eax, word [rax + r10*2]
mov eax, dword [rcx + rax*4]
add rax, rdx
mov qword [0x1801c44a8], rax
lea r8, [rsp + 0x28]
mov r14d, 0x1000
mov edx, r14d
lea rcx, [rsp + 0x50]
call rax
test eax, eax
je 0x18002b806
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov esi, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x48], rsi
mov byte [rsp + 0x30], r15b
mov r12d, dword [rsp + 0x28]
shr r12d, 3
movzx r13d, r15w
mov rdi, qword [rsp + 0x30]
cmp r15w, r12w
jae 0x18002b7d2
lea rdx, [rsp + 0x30]
cmp rsi, 0xf
cmova rdx, rdi
movzx eax, r13w
mov r8d, esi
mov rcx, qword [rsp + rax*8 + 0x50]
call qword [sym.imp.KERNEL32.dll_K32GetDeviceDriverBaseNameA]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x30]
test eax, eax
je 0x18002b7be
lea rdx, [rsp + 0x30]
cmp rsi, 0xf
cmova rdx, rdi
or r14, 0xffffffffffffffff
inc r14
cmp byte [rdx + r14], r15b
jne 0x18002b783
mov r15, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x18002b79d
mov rcx, qword [rbx]
mov r8, r15
cmp r14, r15
cmovb r8, r14
call fcn.180131b30
test eax, eax
jne 0x18002b7bb
cmp r15, r14
jb 0x18002b7bb
jbe 0x18002b87d
xor r15d, r15d
inc r13w
cmp r13w, r12w
jb 0x18002b745
mov r14d, 0x1000
cmp rsi, 0xf
jbe 0x18002b806
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, r14
jb 0x18002b7fd
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002b91c
mov rcx, rdi
call fcn.1801027b0
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x18002b83c
inc rdx
mov rcx, qword [rbx]
cmp rdx, r14
jb 0x18002b837
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002b916
mov rcx, r8
call fcn.1801027b0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r15b
xor al, al
mov rcx, qword [rbp + 0xf50]
xor rcx, rsp
call fcn.180102790
lea r11, [rsp + 0x1060]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov r14d, reloc.WS2_32.dll_ntohs
cmp rsi, r14
jbe 0x18002b8b5
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x18002b8ad
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002b91c
mov rcx, rdi
call fcn.1801027b0
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r14
mov byte [rsp + 0x30], dil
mov rdx, qword [rbx + 0x18]
cmp rdx, r14
jbe 0x18002b8fb
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x18002b8f6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002b910
mov rcx, r8
call fcn.1801027b0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], r14
mov byte [rbx], dil
mov eax, 1
jmp 0x18002b84d
call fcn.1801135b4
int3
call fcn.1801135b4
nop
call fcn.1801135b4
int3