Function at 0x14000e858
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor edi, edi
mov esi, edx
mov rdx, rcx
mov qword [rbp - 0x28], rdi
xorps xmm0, xmm0
mov qword [rbp - 0x30], rdi
lea rcx, [rbp - 0x10]
mov qword [rbp - 0x60], rdi
movups xmmword [rbp - 0x10], xmm0
mov r14d, edi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
movaps xmm0, xmmword [rbp - 0x10]
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x30]
movdqa xmmword [rbp - 0x40], xmm0
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x40]
call fcn.14000ec40
mov ebx, eax
test eax, eax
js 0x14000eaad
imul r15, rsi, 0x328
mov r8d, 0x6d7467
lea ecx, [rdi + 1]
mov rdx, r15
mov qword [rbp - 0x18], r15
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
je 0x14000eaad
mov r8, r15
xor edx, edx
mov rcx, rax
call fcn.140015300
mov r15, qword [rbp - 0x60]
movsxd rax, dword [r15 + 0x3c]
mov r8d, dword [rax + r15 + 0x88]
mov eax, edi
add r8, r15
mov dword [rbp - 0x58], eax
mov qword [rbp - 0x60], r8
mov ecx, dword [r8 + 0x18]
mov r13d, dword [r8 + 0x20]
add r13, r15
mov dword [rbp - 0x50], ecx
test ecx, ecx
je 0x14000ea75
mov edx, dword [r8 + 0x24]
add eax, eax
mov ecx, dword [r8 + 0x1c]
add rax, r15
mov r12d, dword [r13]
add rcx, r15
add r12, r15
xorps xmm0, xmm0
movzx r9d, word [rdx + rax]
mov qword [rbp - 0x20], r9
mov r10d, dword [rcx + r9*4]
mov dword [rbp - 0x54], r10d
movups xmmword [rbp - 0x40], xmm0
cmp dword [rbp + 0x58], edi
je 0x14000e9d7
mov rax, qword [rbp + 0x60]
test rax, rax
je 0x14000ea3f
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x14000e978
mov rdx, r12
mov rcx, rax
call sub.ntoskrnl.exe__strnicmp
test eax, eax
jne 0x14000ea3b
inc r14d
mov rdx, r12
mov eax, r14d
imul r8, rax, 0x328
mov rcx, r8
sub rcx, r12
add rcx, rsi
mov al, byte [rdx]
mov byte [rcx + rdx + 0x220], al
inc rdx
test al, al
jne 0x14000e9ad
mov eax, dword [rbp - 0x54]
lea rbx, [r8 + rsi]
mov qword [rbx + 0x208], rax
movzx eax, word [rbp - 0x20]
mov dword [rbx + 0x218], eax
jmp 0x14000ea12
inc r14d
mov rcx, r12
mov eax, r14d
imul r8, rax, 0x328
mov rdx, r8
sub rdx, r12
add rdx, rsi
mov al, byte [rcx]
mov byte [rdx + rcx + 0x220], al
inc rcx
test al, al
jne 0x14000e9f0
lea rbx, [r8 + rsi]
mov qword [rbx + 0x208], r10
mov dword [rbx + 0x218], r9d
mov rdx, rbx
mov rcx, r12
call fcn.14000271c
mov rdx, rbx
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [rbx + 0x210], rax
mov r8, qword [rbp - 0x60]
mov eax, dword [rbp - 0x58]
add r13, 4
inc eax
mov dword [rbp - 0x58], eax
cmp eax, dword [rbp - 0x50]
jb 0x14000e933
test r14d, r14d
je 0x14000ea75
mov r8, qword [rbp - 0x18]
lea eax, [r14 + 1]
mov rcx, qword [rbp + 0x50]
mov rdx, rsi
mov dword [rsi + 0x21c], eax
call fcn.140015040
jmp 0x14000ea7a
mov edi, 0xc0000001
mov edx, 0x6d7467
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rdx, r15
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
jmp 0x14000eaaf
mov eax, ebx
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret