Function at 0x14002a8dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x20
mov ebp, r8d
lea rsi, [r9 - 1]
mov rdi, rdx
mov r14, rcx
mov r13d, pe_nt_image_headers64
mov r8d, 0x66746e56
mov edx, r13d
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor r15d, r15d
mov rbx, rax
test rax, rax
je 0x14002ab4d
mov r8, r13
xor edx, edx
mov rcx, rbx
call fcn.140015d40
movzx eax, word [rdi]
mov r13d, 2
cmp r13w, ax
jbe 0x14002a947
mov eax, r13d
mov ecx, 0xfe
mov dword [rbx + 8], eax
cmp eax, ecx
jbe 0x14002a958
mov dword [rbx + 8], ecx
jmp 0x14002a95a
mov ecx, eax
mov edx, ecx
mov r8d, 0x66746e56
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbx], rax
test rax, rax
je 0x14002ab3d
cmp word [rdi], r15w
je 0x14002a991
mov r8d, dword [rbx + 8]
mov rcx, rax
mov rdx, qword [rdi + 8]
call fcn.140015a80
jmp 0x14002a995
mov word [rax], r15w
mov eax, dword [rsp + 0x80]
mov edx, dword [rsp + 0x78]
mov dword [rbx + 0x24], eax
mov eax, edx
and al, 0x10
mov qword [rbx + 0x10], r14
neg al
mov dword [rbx + 0x18], ebp
mov dword [rbx + 0x1c], edx
sbb ecx, ecx
and ecx, dword [rsp + 0xa0]
mov dword [rbx + 0x20], ecx
jne 0x14002a9c9
mov eax, edx
and eax, 0xffffffef
mov dword [rbx + 0x1c], eax
mov edi, dword [rsp + 0x70]
and dl, 8
neg dl
mov word [rbx + 0xc], 0x103
sbb al, al
and al, byte [rsp + 0x88]
mov byte [rbx + 0x38], al
mov rax, qword [rsp + 0x90]
mov qword [rbx + 0x28], rax
mov rax, qword [rsp + 0x98]
mov qword [rbx + 0x30], rax
test edi, edi
je 0x14002aa22
mov ecx, 0xa000000
call sub.ntoskrnl.exe_RtlIsNtDdiVersionAvailable
neg al
sbb ecx, ecx
and ecx, 0xf80
sub ecx, 0xffffff80
cmp edi, ecx
ja 0x14002aa22
lea eax, [rdi - 1]
test edi, eax
je 0x14002aa52
cmp rsi, 0x100000
ja 0x14002aa32
mov edi, 1
jmp 0x14002aa52
cmp rsi, 0x200000
ja 0x14002aa40
mov edi, r13d
jmp 0x14002aa52
mov edi, 8
cmp rsi, 0x400000
lea eax, [rdi - 4]
cmovbe edi, eax
mov eax, 0x200
mov r9d, edi
mov word [rbx + 0x3a], ax
xor edx, edx
mov rax, rsi
mov dword [rbx + 0x40], 0x400
div r9
mov r11d, 0x1000
mov qword [rbx + 0x48], rsi
mov r10d, edi
mov qword [rbx + 0x50], rax
shl r10d, 9
mov dword [rbx + 0x3c], r10d
mov dword [rbx + 0x44], r11d
cmp r10d, r11d
jbe 0x14002aa93
and dword [rbx + 0x1c], 0xfffffffd
mov edx, 0x20000
mov dword [rbx + 0xcc], 0x10000
mov ecx, 1
mov r8d, 0x66746e56
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbx + 0xb0], rax
test rax, rax
je 0x14002ab3d
mov ecx, dword [rbx + 0xcc]
mov rdx, rax
call fcn.14002a7c0
lea rax, str._STANDARD_INFORMATION
mov dword [rbx + 0xc8], 0xa00
mov rcx, rbx
mov qword [rbx + 0xa8], rax
call fcn.14002b0b4
mov dil, al
test al, al
je 0x14002ab42
mov rcx, rbx
call fcn.14002b458
mov dil, al
test al, al
je 0x14002ab42
mov rcx, rbx
call fcn.14002b2c8
mov dil, al
test al, al
je 0x14002ab42
mov rcx, rbx
call fcn.14002b150
mov dil, al
test al, al
je 0x14002ab42
mov rcx, rbx
call fcn.14002b038
mov dil, al
test al, al
je 0x14002ab42
mov rcx, rbx
call fcn.140029200
mov dil, al
jmp 0x14002ab42
mov dil, byte [rsp + 0x68]
mov rcx, rbx
call fcn.14002ad60
mov al, dil
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret