Function at 0x14b18
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
xor ebx, ebx
mov rbp, rcx
mov qword [rax + 0x18], rbx
mov eax, dword [rcx + 0xc]
mov qword [rsp + 0xe8], rbx
mov r13, rbx
mov r14, rbx
mov r15d, ebx
cmp eax, 0x25
jae 0x14b59
add rax, 0x10
jmp 0x151a2
mov rcx, qword [rcx + 4]
call fcn.00012088
mov rdi, rax
cmp rax, rbx
jne 0x14b6f
mov eax, dword [rbp + 0xc]
jmp 0x14b50
lea rcx, [rax + 0xa8]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp byte [rdi + 0x20], bl
je 0x14ba3
lea rcx, [rdi + 0xa8]
mov dl, al
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rdi
call fcn.00011efc
mov eax, dword [rbp + 0xc]
add eax, 0x10
jmp 0x151a2
cmp dword [rbp], 0xb
jne 0x14bb1
cmp byte [rdi + 0x90], bl
jne 0x14bbf
cmp dword [rbp], 0xa
jne 0x14bd3
cmp byte [rdi + 0x91], bl
je 0x14bd3
lea rcx, [rdi + 0xa8]
mov dl, al
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
jmp 0x15198
lea rcx, [rdi + 0xa8]
mov dl, al
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
call fcn.00012104
mov rsi, rax
cmp rax, rbx
je 0x15104
mov rax, qword [rbp + 0x10]
mov qword [rsi + 0x10], rax
mov rax, qword [rbp + 0x18]
mov qword [rsi + 0x18], rax
mov rax, qword [rbp + 0x20]
mov qword [rsi + 0x20], rax
mov eax, dword [rbp + 0x28]
mov dword [rsi + 0x28], eax
mov eax, dword [rbp + 0x30]
add eax, 0x24
cmp dword [rbp + 0xc], eax
jb 0x15104
lea rcx, [rsi + 0x2c]
lea rdx, [rbp + 0x34]
mov r8d, 0x20
call fcn.00018450
mov r13d, 0x44
mov dword [rsp + 0xd8], r13d
cmp dword [rsi + 0x44], ebx
jbe 0x14c99
movsxd rax, dword [rbp + 0x30]
mov edx, dword [rsi + 0x44]
sub rax, 0x20
cmp rdx, rax
ja 0x15173
xor ecx, ecx
mov r8d, 0x44554c46
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsi + 0x50], rax
cmp rax, rbx
je 0x15173
mov r8d, dword [rsi + 0x44]
lea rdx, [rbp + 0x54]
mov rcx, rax
call fcn.00018450
mov r11d, dword [rsi + 0x44]
add r11d, r13d
mov r13d, r11d
mov dword [rsp + 0xd8], r11d
jmp 0x14c9d
mov qword [rsi + 0x50], rbx
movzx r13d, word [rbp + 0xc]
sub r13w, word [rsp + 0xd8]
mov word [rsp + 0xd0], r13w
je 0x15173
movzx eax, r13w
lea rcx, [0x0001aac0]
mov dword [rsi + 0x5c], eax
inc dword [0x0001aad4]
call qword [sym.imp.ntoskrnl.exe_ExpInterlockedPopEntrySList]
mov r14, rax
cmp rax, rbx
jne 0x14cfe
mov edx, dword [0x0001aaec]
mov r8d, dword [0x0001aae8]
mov ecx, dword [0x0001aae4]
inc dword [0x0001aad8]
call qword [0x0001aaf0]
mov r14, rax
cmp r14, rbx
je 0x15173
movzx edx, r13w
mov r8d, 0x43554c46
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rcx, rax
mov qword [rsp + 0xe8], rax
cmp rax, rbx
je 0x15173
mov eax, dword [rsp + 0xd8]
movzx r8d, r13w
lea rdx, [rax + rbp + 0x10]
call fcn.00018450
mov rcx, qword [rsp + 0xe8]
xor r9d, r9d
xor r8d, r8d
movzx edx, r13w
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov qword [rsp + 0xd8], rax
cmp rax, rbx
je 0x1516e
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
mov r9, qword [rsp + 0xd8]
mov rcx, qword [0x0001ad30]
lea rax, [rsp + 0xe0]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x30], rax
movzx eax, r13w
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call sub.fwpkclnt.sys_FwpsAllocateNetBufferAndNetBufferList0
cmp eax, ebx
jl 0x150fc
mov rax, qword [rsp + 0xe0]
lea rcx, [0x0001a1e8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x70], rax
mov rax, qword [rbp + 4]
mov qword [r14], rax
mov eax, dword [rbp]
mov qword [r14 + 0x18], rdi
mov dword [r14 + 8], eax
mov rax, qword [rsp + 0xd8]
mov qword [r14 + 0x20], rsi
mov qword [r14 + 0x10], rax
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
inc dword [rdi + 0x94]
lea rcx, [0x0001a1e8]
mov dl, al
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
lea rcx, [rdi + 0xa8]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp dword [rbp], 0xb
mov dl, al
mov eax, dword [rsi + 0x5c]
jne 0x14e3c
add dword [rdi + 0x88], eax
cmp dword [rdi + 0x88], 0xc8000
jbe 0x14e55
mov byte [rdi + 0x90], 1
jmp 0x14e55
add dword [rdi + 0x8c], eax
cmp dword [rdi + 0x8c], 0xc8000
jbe 0x14e55
mov byte [rdi + 0x91], 1
lea rcx, [rdi + 0xa8]
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
cmp dword [rbp], 0xb
jne 0x14f65
xor edx, edx
lea rcx, [rsi + 0x70]
lea r8d, [rdx + 0x20]
call fcn.00018340
mov rcx, qword [rsp + 0x70]
mov r9d, 2
lea edx, [r9 + 6]
xor r8d, r8d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.NDIS.SYS_NdisGetDataBuffer]
movzx ecx, r13b
mov r11, rax
mov eax, 2
shl cx, 8
cmp word [rdi + 0x2c], ax
movzx eax, word [rsi + 0x12]
mov word [r11 + 6], bx
mov word [r11 + 2], ax
movzx eax, byte [rsp + 0xd1]
jne 0x14ecc
or cx, ax
lea rax, [rsi + 0x14]
jmp 0x14ed3
or cx, ax
lea rax, [rsi + 0x18]
mov word [r11 + 4], cx
mov r8, qword [rsi + 0x30]
mov qword [rsp + 0x48], r14
lea rcx, [rsi + 0x70]
xor r9d, r9d
xor edx, edx
mov qword [rcx], rax
mov eax, dword [rsi + 0x38]
mov dword [rsi + 0x78], eax
mov rax, qword [rsi + 0x50]
mov qword [rsi + 0x80], rax
mov eax, dword [rsi + 0x44]
mov dword [rsi + 0x88], eax
lea rax, [0x000149c4]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x38], rax
mov eax, dword [rsi + 0x2c]
mov dword [rsp + 0x30], eax
movzx eax, word [rdi + 0x2c]
mov word [rsp + 0x28], ax
mov qword [rsp + 0x20], rcx
mov rcx, qword [0x0001ad20]
call sub.fwpkclnt.sys_FwpsInjectTransportSendAsync0
cmp eax, ebx
mov r13d, eax
jl 0x14f5b
mov r15d, dword [rbp + 0xc]
mov rsi, rbx
mov qword [rsp + 0xe0], rbx
add r15d, 0x10
mov edx, 0xd
jmp 0x15085
mov rcx, qword [rsp + 0x70]
mov r9d, 2
xor r8d, r8d
lea edx, [r9 + 6]
mov dword [rsp + 0x20], ebx
call qword [sym.imp.NDIS.SYS_NdisGetDataBuffer]
movzx ecx, r13b
mov r11, rax
mov eax, 2
shl cx, 8
cmp word [rdi + 0x2c], ax
movzx eax, word [rsi + 0x12]
mov word [r11 + 6], bx
mov word [r11], ax
movzx eax, byte [rsp + 0xd1]
jne 0x14fbe
or cx, ax
lea r9, [rsi + 0x14]
mov word [r11 + 4], cx
lea rcx, [rdi + 0x32]
jmp 0x14fce
or cx, ax
lea r9, [rsi + 0x18]
mov word [r11 + 4], cx
lea rcx, [rdi + 0x36]
movzx eax, word [rdi + 0x4a]
movzx r8d, word [rdi + 0x2c]
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call sub.fwpkclnt.sys_FwpsConstructIpHeaderForTransportPacket0
cmp eax, ebx
jl 0x150fc
mov rcx, qword [0x0001ad20]
mov qword [rsp + 0x50], r14
lea rax, [0x000149c4]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xe0]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov eax, dword [rsi + 0x40]
xor r8d, r8d
mov dword [rsp + 0x38], eax
mov eax, dword [rsi + 0x3c]
xor edx, edx
mov dword [rsp + 0x30], eax
mov eax, dword [rsi + 0x2c]
mov dword [rsp + 0x28], eax
movzx eax, word [rdi + 0x2c]
mov word [rsp + 0x20], ax
call sub.fwpkclnt.sys_FwpsInjectTransportReceiveAsync0
cmp eax, ebx
mov r13d, eax
jl 0x15080
mov r15d, dword [rbp + 0xc]
mov rsi, rbx
mov qword [rsp + 0xe0], rbx
add r15d, 0x10
mov edx, 0xc
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
xor r8d, r8d
call fcn.000128d4
cmp r13d, ebx
jge 0x15195
lea rcx, [rdi + 0xa8]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
cmp dword [rbp], 0xb
mov dl, al
mov eax, dword [rsi + 0x5c]
jne 0x150cf
sub dword [rdi + 0x88], eax
cmp dword [rdi + 0x88], 0xc8000
ja 0x150e7
mov byte [rdi + 0x90], bl
jmp 0x150e7
sub dword [rdi + 0x8c], eax
cmp dword [rdi + 0x8c], 0xc8000
ja 0x150e7
mov byte [rdi + 0x91], bl
lea rcx, [rdi + 0xa8]
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, rdi
call fcn.00011efc
mov r13, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xe0]
cmp rcx, rbx
je 0x15116
call sub.fwpkclnt.sys_FwpsFreeNetBufferList0
cmp r13, rbx
je 0x15124
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov rax, qword [rsp + 0xe8]
cmp rax, rbx
je 0x1513c
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp r14, rbx
je 0x15188
inc dword [0x0001aadc]
lea rcx, [0x0001aac0]
call qword [sym.imp.ntoskrnl.exe_ExQueryDepthSList]
cmp ax, word [0x0001aad0]
jb 0x15178
inc dword [0x0001aae0]
mov rcx, r14
call qword [0x0001aaf8]
jmp 0x15188
mov r13, rax
jmp 0x15104
mov r13, rbx
jmp 0x15104
lea rcx, [0x0001aac0]
mov rdx, r14
call qword [sym.imp.ntoskrnl.exe_ExpInterlockedPushEntrySList]
cmp rsi, rbx
je 0x15195
mov rcx, rsi
call fcn.0001216c
mov ebx, r15d
mov rcx, rdi
call fcn.00011efc
mov eax, ebx
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret