Function at 0x4e62a7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x47aa20]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x88], eax
mov eax, dword [ebp + 0x10]
push 0x706d7544
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x14]
push 0xd8
xor esi, esi
push esi
mov dword [ebp - 0x44], eax
call sym.ntoskrnl.exe_ExAllocatePoolWithTag
mov ebx, eax
cmp ebx, esi
je 0x50debc
push edi
push 0x36
pop ecx
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
push 0x706d7544
lea eax, [ebx + 0xb0]
mov dword [ebx + 0x78], eax
lea eax, [ebx + 0x84]
push 0x1000
push 1
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [ebp - 0x40], esi
call sym.ntoskrnl.exe_ExAllocatePoolWithTag
cmp eax, esi
mov dword [ebp - 0x3c], eax
je 0x50dec6
lea eax, [ebx + 0x8c]
push eax
push 0x4000008b
call fcn.0043aedd
test al, al
je 0x4e66b1
lea eax, [ebx + 0x94]
push eax
push 0x4000008c
call fcn.0043aedd
test al, al
je 0x4e66b1
lea eax, [ebx + 0x9c]
push eax
push 0x4000008d
call fcn.0043aedd
test al, al
je 0x4e66b1
mov eax, dword [ebp - 0x48]
push 0x40
mov dword [ebp - 0x6c], eax
push 3
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x74]
push eax
push 0x100180
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x74], 0x18
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], esi
call sym.ntoskrnl.exe_ZwOpenFile
mov edi, eax
cmp edi, esi
jl 0x4e669c
push 8
lea eax, [ebp - 0x90]
push eax
push esi
push esi
push 0x41018
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push esi
push dword [ebp - 0x30]
call sym.ntoskrnl.exe_ZwDeviceIoControlFile
mov edi, 0x103
cmp eax, edi
jne 0x4e63e7
push esi
push esi
push dword [ebp - 0x30]
call sym.ntoskrnl.exe_ZwWaitForSingleObject
mov eax, dword [ebp - 0x58]
cmp eax, esi
setge byte [ebp - 0x29]
cmp byte [ebp - 0x29], 0
mov dword [ebx + 0x50], esi
je 0x4e641f
push 0x706d7544
push 8
push esi
call sym.ntoskrnl.exe_ExAllocatePoolWithTag
cmp eax, esi
mov dword [ebx + 0x50], eax
je 0x50ded7
mov ecx, dword [ebp - 0x90]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x8c]
mov dword [eax + 4], ecx
push 0x90
lea eax, [ebp - 0x130]
push eax
push esi
push esi
push 0x70048
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push esi
push dword [ebp - 0x30]
call sym.ntoskrnl.exe_ZwDeviceIoControlFile
cmp eax, edi
jne 0x4e644f
push esi
push esi
push dword [ebp - 0x30]
call sym.ntoskrnl.exe_ZwWaitForSingleObject
mov edi, dword [ebp - 0x3c]
push 0x38
push edi
push esi
push esi
push 0x700a0
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push esi
push dword [ebp - 0x30]
call sym.ntoskrnl.exe_ZwDeviceIoControlFile
cmp eax, 0x103
jne 0x4e647c
push esi
push esi
push dword [ebp - 0x30]
call sym.ntoskrnl.exe_ZwWaitForSingleObject
mov eax, dword [edi + 0x24]
cmp eax, esi
mov dword [ebx + 0x58], eax
jne 0x50dee1
mov eax, dword [edi + 0x28]
mov dword [ebx + 0x5c], eax
mov eax, dword [edi + 0x2c]
mov dword [ebx + 0x60], eax
push esi
lea eax, [ebp - 0x34]
push eax
push esi
push dword [sym.ntoskrnl.exe_IoFileObjectType]
push esi
push dword [ebp - 0x30]
call sym.ntoskrnl.exe_ObReferenceObjectByHandle
mov edi, dword [ebp - 0x34]
push edi
call sym.ntoskrnl.exe_IoGetRelatedDeviceObject
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x84]
push eax
push esi
push 0x28
lea eax, [ebx + 0xb0]
push eax
push esi
push esi
push dword [ebp - 0x38]
mov byte [ebp - 0x84], 0
push 0x41020
mov byte [ebp - 0x82], 4
mov dword [ebp - 0x80], esi
call sym.ntoskrnl.exe_IoBuildDeviceIoControlRequest
cmp eax, esi
je 0x50def2
mov ecx, dword [eax + 0x60]
mov dword [ecx - 0xc], edi
mov ecx, dword [ebp - 0x38]
mov edx, eax
call sym.ntoskrnl.exe_IofCallDriver
mov edi, eax
cmp edi, 0x103
jne 0x4e652a
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x84]
push eax
call sym.ntoskrnl.exe_KeWaitForMutexObject
mov edi, dword [ebp - 0x58]
cmp edi, esi
jl 0x4e66a4
mov eax, dword [ebp - 0x54]
cmp eax, 0x20
jb 0x4e66a4
mov dword [ebx + 0x7c], eax
mov eax, dword [ebx + 0xd0]
cmp eax, esi
je 0x4e6574
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x20]
mov edi, 0x4e656c
push edi
push eax
mov dword [ebp - 0x40], eax
call sym.ntoskrnl.exe_wcsstr
cmp eax, esi
pop ecx
pop ecx
je 0x4e6570
add eax, 2
jmp 0x4e6556
mov byte [ebp - 0x29], 0
mov eax, dword [ebp - 0x34]
mov dword [ebx + 0xa4], eax
push dword [ebp - 0x30]
call sym.ntoskrnl.exe_ZwClose
mov eax, dword [sym.imp.HAL.dll_KeStallExecutionProcessor]
mov dword [ebx + 0x28], eax
mov dword [ebx], 0x70
mov dword [ebx + 4], esi
lea edi, [ebx + 0xb0]
mov eax, dword [edi]
mov dword [ebx + 0x38], eax
mov eax, dword [edi + 4]
mov dword [ebx + 0x3c], eax
mov eax, dword [edi + 8]
mov dword [ebx + 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x80], eax
mov eax, dword [ebp - 0x128]
mov dword [ebx + 0x70], eax
mov eax, dword [ebp - 0x124]
mov dword [ebx + 0x74], eax
mov eax, 0x2000
mov dword [ebx + 0xa8], esi
cmp dword [edi + 0x18], eax
jae 0x4e65db
mov dword [edi + 0x18], eax
mov eax, dword [edi + 0x18]
mov dword [ebx + 0x4c], eax
cmp byte [edi + 0x1c], 0
jne 0x50df0b
cmp byte [ebp - 0x29], 0
jne 0x50df9c
cmp dword [ebp - 0x40], esi
je 0x50e096
push dword [ebp - 0x40]
push 0x4e66b8
push dword [ebp - 0x3c]
call sym.ntoskrnl.exe_swprintf
add esp, 0xc
push esi
push dword [ebp - 0x3c]
push ebx
call fcn.004e4f6e
mov edi, eax
cmp edi, esi
jl 0x50e0a0
mov eax, dword [ebx + 0xa4]
push eax
mov dword [ebp - 0x44], eax
call sym.ntoskrnl.exe_IoGetRelatedDeviceObject
mov edx, eax
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x10], eax
push esi
lea eax, [ebp - 0x28]
push eax
push edx
mov byte [ebp - 0x28], 0x1b
mov byte [ebp - 0x27], 0x16
mov byte [ebp - 0x24], 1
call fcn.00506367
mov edi, eax
cmp edi, esi
jl 0x50e0b7
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0xa8], eax
cmp edi, esi
jl 0x4e669c
mov eax, dword [ebp - 0x88]
mov dword [eax], ebx
push esi
push dword [ebp - 0x3c]
call sym.ntoskrnl.exe_ExFreePoolWithTag
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0040d8f1
leave
ret 0x18
push ebx
call fcn.0053e78f
jmp 0x4e6682
mov ecx, dword [ebp - 0x34]
call sym.ntoskrnl.exe_ObfDereferenceObject
jmp 0x50e0cb
mov edi, 0xc0000001
jmp 0x4e6676
mov eax, 0xc000009a
jmp 0x4e668e
push esi
push ebx
call sym.ntoskrnl.exe_ExFreePoolWithTag
mov eax, 0xc000009a
jmp 0x4e668d
mov edi, 0xc0000017
jmp 0x4e669c
lea esi, [edi + 0x28]
lea edi, [ebx + 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
jmp 0x4e6496
mov ecx, edi
call sym.ntoskrnl.exe_ObfDereferenceObject
push dword [ebp - 0x30]
call sym.ntoskrnl.exe_ZwClose
mov edi, 0xc000009a
jmp 0x4e669c
lea eax, [ebx + 0x18]
mov dword [ebp - 0x48], eax
lea eax, [ebx + 0xc]
mov dword [ebp - 0x50], 0xffffff
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], eax
mov eax, dword [ebx + 0x38]
cmp eax, esi
je 0x50df3c
mov ecx, dword [eax + 4]
push esi
lea edx, [ebp - 0x50]
push edx
push dword [edi + 0x18]
push eax
call dword [ecx + 8]
jmp 0x50df6d
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push dword [edi + 0x18]
call sym.ntoskrnl.exe_MmAllocateContiguousMemory
cmp eax, esi
mov dword [ebp - 0x5c], eax
jne 0x50df5c
push dword [edi + 0x18]
call sym.ntoskrnl.exe_MmAllocateNonCachedMemory
mov dword [ebp - 0x5c], eax
push dword [ebp - 0x5c]
call sym.ntoskrnl.exe_MmGetPhysicalAddress
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x4c], edx
cmp eax, esi
je 0x50df01
mov ecx, dword [ebp - 0x38]
inc dword [ebp - 0x34]
add dword [ebp - 0x38], 4
mov dword [ecx], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x4c]
mov dword [eax + 4], ecx
add eax, 8
cmp dword [ebp - 0x34], 2
mov dword [ebp - 0x48], eax
jb 0x50df24
jmp 0x4e65eb
push 0x50e0d8
push dword [ebp - 0x44]
push ebx
call fcn.004e4f6e
mov edi, eax
cmp edi, esi
jge 0x50dfc1
push esi
push esi
push esi
push esi
push 0xc004002d
push esi
push 9
jmp 0x50e0ac
movzx eax, byte [ebp - 0x8c]
push eax
push 0x50e0f4
push dword [ebp - 0x3c]
call sym.ntoskrnl.exe_sprintf
add esp, 0xc
push dword [ebp - 0x3c]
lea eax, [ebp - 0xa0]
push eax
call sym.ntoskrnl.exe_RtlInitAnsiString
push 1
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x98]
push eax
call sym.ntoskrnl.exe_RtlAnsiStringToUnicodeString
push 0x40
lea eax, [ebp - 0x98]
mov dword [ebp - 0x6c], eax
push 3
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x74]
push eax
push 0x80
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x74], 0x18
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], esi
call sym.ntoskrnl.exe_ZwOpenFile
mov edi, eax
lea eax, [ebp - 0x98]
push eax
call sym.ntoskrnl.exe_RtlFreeAnsiString
cmp edi, esi
jl 0x4e669c
push esi
lea eax, [ebp - 0x44]
push eax
push esi
push dword [sym.ntoskrnl.exe_IoFileObjectType]
push esi
push dword [ebp - 0x30]
call sym.ntoskrnl.exe_ObReferenceObjectByHandle
mov ecx, dword [ebp - 0x44]
mov eax, dword [ecx + 4]
mov edi, dword [eax + 8]
call sym.ntoskrnl.exe_ObfDereferenceObject
push dword [ebp - 0x30]
call sym.ntoskrnl.exe_ZwClose
mov eax, dword [edi + 0x20]
mov edi, 0x50e108
jmp 0x50e081
add eax, 2
push edi
push eax
mov dword [ebp - 0x40], eax
call sym.ntoskrnl.exe_wcsstr
cmp eax, esi
pop ecx
pop ecx
jne 0x50e07e
jmp 0x4e65f5
mov edi, 0xc00000bb
jmp 0x4e669c
push esi
push esi
push esi
push esi
push 0xc004002d
push esi
push 0xa
push esi
call fcn.00459994
jmp 0x4e6676
cmp dword [ebp + 0x1c], esi
je 0x50e0be
xor edi, edi
cmp edi, esi
jl 0x4e669c
jmp 0x4e666d
push dword [ebp - 0x30]
call sym.ntoskrnl.exe_ZwClose
jmp 0x4e6676