Function at 0x1400037c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov r12, r9
mov r13, r8
mov ebx, edx
mov rsi, rcx
call fcn.140002838
mov edx, ebx
mov rcx, rsi
mov rdi, rax
call fcn.140002800
mov r9b, byte [rdi + 0x12]
xor r14d, r14d
mov word [rsp + 0x28], r14w
xor r8d, r8d
mov rcx, rsi
mov byte [rsp + 0x20], r14b
mov rbp, rax
lea edx, [r14 + 2]
call fcn.140006768
mov ebx, eax
test eax, eax
js 0x140003cb1
lfence
movzx eax, byte [rbp + 8]
lea edx, [r14 + 0xc]
movzx ecx, word [rbp + 0x18]
movzx r8d, byte [rbp + 0x10]
mov r9b, byte [rdi + 0x14]
shl r8d, 4
or r8d, eax
mov eax, dword [rdi + 0x2c]
mov dword [rsp + 0x58], eax
mov eax, dword [rdi + 0x28]
mov dword [rsp + 0x50], eax
mov eax, dword [rdi + 0x24]
mov dword [rsp + 0x48], eax
mov eax, dword [rdi + 0x20]
mov dword [rsp + 0x40], eax
mov eax, dword [rbp + 0x30]
mov dword [rsp + 0x38], ecx
mov rcx, rsi
mov dword [rsp + 0x30], eax
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x28], rax
mov al, byte [rdi + 0x12]
mov byte [rsp + 0x20], al
call fcn.140007490
mov ebx, eax
test eax, eax
js 0x140003ca6
lfence
mov ecx, dword [rdi + 0x44]
lea r14, [rdi + 8]
movsd xmm0, qword [rdi + 0x3c]
lea r9, [rdi + 0x38]
mov rax, qword [rsi + 0x68]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x78], ecx
mov r8, r14
mov rcx, qword [rsi + 0x28]
movsd qword [rsp + 0x70], xmm0
call qword [0x14000b220]
mov ebx, eax
test eax, eax
js 0x140003ca6
lfence
mov rdx, qword [r14]
mov r9, r12
mov r8, r13
mov rcx, rsi
call fcn.1400025e4
xor r12d, r12d
mov ebx, eax
test eax, eax
js 0x140003c81
lfence
mov r9b, byte [rdi + 0x11]
lea edx, [r12 + 4]
mov word [rsp + 0x28], r12w
xor r8d, r8d
mov rcx, rsi
mov byte [rsp + 0x20], r12b
call fcn.140006768
mov ebx, eax
test eax, eax
js 0x140003c81
lfence
mov eax, dword [rdi + 0x34]
xor edx, edx
movzx ecx, word [rbp + 0x18]
movzx r8d, byte [rdi + 0x38]
mov r9b, byte [rdi + 0x13]
dec r8d
mov dword [rsp + 0x58], eax
mov eax, dword [rdi + 0x30]
mov dword [rsp + 0x50], eax
lea eax, [r12 + 0x10]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], eax
mov al, byte [rdi + 0x11]
mov dword [rsp + 0x38], ecx
mov rcx, rsi
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r12
mov byte [rsp + 0x20], al
call fcn.140007490
mov ebx, eax
test eax, eax
js 0x140003c76
lfence
movzx ecx, word [rbp + 0x18]
lea eax, [r12 + 0x20]
mov dword [rsp + 0x50], eax
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x48], eax
mov eax, dword [rdi + 0x34]
mov dword [rsp + 0x40], eax
mov eax, dword [rdi + 0x30]
mov dword [rsp + 0x38], eax
mov eax, 0xff
mov dword [rsp + 0x30], ecx
mov r9d, eax
mov r8d, eax
mov dword [rsp + 0x28], r12d
mov rcx, rsi
mov qword [rsp + 0x20], r12
call fcn.140007134
lea r13d, [r12 + 3]
mov r15, rax
mov edx, r13d
or dword [rax + 0x44], 0xffffffff
mov dword [rax + 0x48], r12d
mov ecx, dword [rsp + 0x60]
mov r9b, byte [rdi + 0x11]
mov r8b, byte [rdi + 0x1c]
mov dword [rsp + 0x38], ecx
mov rcx, rsi
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], r12b
mov byte [rsp + 0x20], r12b
call fcn.140006db4
mov ebx, eax
test eax, eax
js 0x140003c76
lfence
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_ExFreePool]
mov eax, dword [rdi + 0x18]
mov rcx, rsi
movzx r9d, word [rbp + 0x18]
mov r8b, byte [rdi + 0x11]
mov dl, byte [rdi + 0x1e]
mov dword [rsp + 0x20], eax
call fcn.14000755c
mov ebx, eax
test eax, eax
js 0x140003c76
lfence
mov eax, dword [rdi + 0x34]
lea rdx, [rsp + 0x60]
movzx ecx, word [rbp + 0x18]
mov r8d, 0xff
mov dword [rsp + 0x50], eax
mov r9d, r8d
mov eax, dword [rdi + 0x30]
mov dword [rsp + 0x48], eax
lea eax, [r12 + 0x20]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov rcx, rsi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call fcn.140007134
mov edx, r13d
mov rbp, rax
or dword [rax + 0x44], 0xffffffff
mov dword [rax + 0x48], r12d
mov ecx, dword [rsp + 0x60]
mov r9b, byte [rdi + 0x11]
mov r8b, byte [rdi + 0x1d]
mov dword [rsp + 0x38], ecx
mov rcx, rsi
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], r12b
mov byte [rsp + 0x20], r12b
call fcn.140006db4
mov ebx, eax
test eax, eax
js 0x140003c76
lfence
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePool]
mov al, byte [rdi + 0x1c]
mov r9d, r13d
mov r8b, byte [rdi + 0x13]
mov edx, r13d
mov byte [rsp + 0x30], r12b
mov rcx, rsi
mov byte [rsp + 0x28], r12b
mov byte [rsp + 0x20], al
call fcn.1400066d0
mov ebx, eax
test eax, eax
js 0x140003c76
lfence
mov al, byte [rdi + 0x1e]
lea ebp, [r12 + 4]
mov r8b, byte [rdi + 0x1c]
mov r9d, ebp
mov byte [rsp + 0x30], r12b
mov edx, r13d
mov byte [rsp + 0x28], r12b
mov rcx, rsi
mov byte [rsp + 0x20], al
call fcn.1400066d0
mov ebx, eax
test eax, eax
js 0x140003c53
lfence
mov al, byte [rdi + 0x1d]
mov r9d, r13d
mov r8b, byte [rdi + 0x1e]
mov edx, ebp
mov byte [rsp + 0x30], r12b
mov rcx, rsi
mov byte [rsp + 0x28], r12b
mov byte [rsp + 0x20], al
call fcn.1400066d0
mov ebx, eax
test eax, eax
js 0x140003c30
lfence
mov al, byte [rdi + 0x14]
mov r9d, r13d
mov r8b, byte [rdi + 0x1d]
mov edx, r13d
mov byte [rsp + 0x30], r12b
mov rcx, rsi
mov byte [rsp + 0x28], r12b
mov byte [rsp + 0x20], al
call fcn.1400066d0
mov ebx, eax
test eax, eax
js 0x140003c0e
lfence
mov dl, byte [rdi + 0x11]
lea r15d, [r12 + 2]
mov r8d, r15d
mov rcx, rsi
call fcn.140007010
mov ebx, eax
test eax, eax
js 0x140003beb
lfence
mov dl, byte [rdi + 0x11]
mov r8d, r13d
mov rcx, rsi
call fcn.140007010
mov ebx, eax
test eax, eax
js 0x140003beb
lfence
mov dl, byte [rdi + 0x12]
mov r8d, r15d
mov rcx, rsi
call fcn.140007010
mov ebx, eax
test eax, eax
js 0x140003beb
lfence
mov dl, byte [rdi + 0x12]
mov r8d, r13d
mov rcx, rsi
call fcn.140007010
mov ebx, eax
test eax, eax
js 0x140003beb
lfence
jmp 0x140003cb3
mov al, byte [rdi + 0x14]
mov r9d, r13d
mov r8b, byte [rdi + 0x1d]
mov edx, r13d
mov byte [rsp + 0x30], r12b
mov rcx, rsi
mov byte [rsp + 0x28], r12b
mov byte [rsp + 0x20], al
call fcn.14000705c
mov al, byte [rdi + 0x1d]
mov r9d, r13d
mov r8b, byte [rdi + 0x1e]
mov edx, ebp
mov byte [rsp + 0x30], r12b
mov rcx, rsi
mov byte [rsp + 0x28], r12b
mov byte [rsp + 0x20], al
call fcn.14000705c
mov al, byte [rdi + 0x1e]
mov r9d, ebp
mov r8b, byte [rdi + 0x1c]
mov edx, r13d
mov byte [rsp + 0x30], r12b
mov rcx, rsi
mov byte [rsp + 0x28], r12b
mov byte [rsp + 0x20], al
call fcn.14000705c
mov al, byte [rdi + 0x1c]
mov r9d, r13d
mov r8b, byte [rdi + 0x13]
mov edx, r13d
mov byte [rsp + 0x30], r12b
mov rcx, rsi
mov byte [rsp + 0x28], r12b
mov byte [rsp + 0x20], al
call fcn.14000705c
mov dl, byte [rdi + 0x11]
mov rcx, rsi
call fcn.1400067ec
mov rax, qword [rsi + 0x88]
mov rdx, qword [r14]
mov rcx, qword [rsi + 0x28]
call qword [0x14000b220]
mov rax, qword [rsi + 0x78]
mov rdx, qword [r14]
mov rcx, qword [rsi + 0x28]
call qword [0x14000b220]
mov dl, byte [rdi + 0x12]
mov rcx, rsi
call fcn.1400067ec
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret