Function at 0x140013ed0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x28], 0
mov r8d, 0x4d525356
mov edx, 0x32
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140013f21
jmp 0x1400147fd
mov r8d, 0x32
xor edx, edx
mov rcx, qword [rsp + 0x28]
call fcn.140001bd0
mov rax, qword [rsp + 0x28]
mov byte [rax], 1
mov dword [rsp + 0x30], 0
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x3c], 0
mov rax, qword [rsp + 0x80]
mov eax, dword [rax]
mov dword [rsp + 0x44], eax
movabs rax, 0xfffff78000000320
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x78]
movzx eax, byte [rax]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
sub eax, 0xc
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0x81
ja case.0x140013fb3.14
movsxd rax, dword [rsp + 0x38]
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0x14834]
mov eax, dword [rcx + rax*4 + 0x14804]
add rax, rcx
jmp rax
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
movzx ecx, word [rcx + 1]
mov word [rax + 0xc], cx
mov eax, 0xa0cb
mov rcx, qword [rsp + 0x70]
mov word [rcx + 0xe], ax
mov rax, qword [rsp + 0x70]
movzx ecx, byte [rsp + 0x70]
mov byte [rax + 3], cl
mov rax, qword [rsp + 0x70]
mov byte [rax + 1], 1
mov rax, qword [rsp + 0x28]
mov byte [rax], 0
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x28]
mov byte [rcx + rax + 2], 1
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 0x28]
mov byte [rcx + rax + 2], 1
mov eax, 1
imul rax, rax, 2
mov rcx, qword [rsp + 0x28]
mov byte [rcx + rax + 2], 0
movzx eax, word [rsp + 0x70]
and eax, 0xff
mov ecx, 1
imul rcx, rcx, 3
mov rdx, qword [rsp + 0x28]
mov byte [rdx + rcx + 2], al
movzx eax, word [rsp + 0x70]
sar eax, 8
and eax, 0xff
mov ecx, 1
imul rcx, rcx, 4
mov rdx, qword [rsp + 0x28]
mov byte [rdx + rcx + 2], al
mov dword [rsp + 0x30], 5
mov byte [rsp + 0x20], 1
jmp 0x140014672
mov rax, qword [rsp + 0x78]
inc rax
mov r8, qword [rsp + 0x70]
mov edx, 4
mov rcx, rax
call fcn.140010960
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
mov ecx, dword [rcx + 0x43c]
cmp dword [rax + 1], ecx
jne 0x140014134
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 1]
cmp eax, 1
jne 0x140014134
mov rax, qword [rsp + 0x28]
mov byte [rax], 0
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 0x14]
test eax, eax
je 0x1400140d9
mov dword [rsp + 0x40], 0x80
jmp 0x1400140e1
mov dword [rsp + 0x40], 0
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x28]
movzx edx, byte [rsp + 0x40]
mov byte [rcx + rax + 2], dl
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 0x28]
mov byte [rcx + rax + 2], 0
mov eax, 1
imul rax, rax, 2
mov rcx, qword [rsp + 0x28]
mov byte [rcx + rax + 2], 0x20
mov dword [rsp + 0x30], 3
mov byte [rsp + 0x20], 1
mov rax, qword [rsp + 0x70]
mov byte [rax + 2], 1
jmp 0x140014672
mov rax, qword [rsp + 0x78]
inc rax
mov r8, qword [rsp + 0x70]
mov edx, 2
mov rcx, rax
call fcn.140010960
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 2]
test eax, eax
je 0x1400141d2
mov rax, qword [rsp + 0x78]
movzx eax, word [rax + 1]
test eax, eax
jl 0x1400141d2
mov rax, qword [rsp + 0x78]
movzx eax, word [rax + 1]
shl eax, 1
cdqe
cmp rax, 0x80
jae 0x1400141d2
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 0x14]
test eax, eax
je 0x1400141d2
mov rax, qword [rsp + 0x28]
mov byte [rax], 0
mov rax, qword [rsp + 0x78]
movzx eax, word [rax + 1]
shl eax, 1
cdqe
mov rcx, qword [rsp + 0x70]
lea rax, [rcx + rax + 0x15]
mov rcx, qword [rsp + 0x28]
add rcx, 2
mov r8d, 6
mov rdx, rax
call fcn.140001880
mov dword [rsp + 0x30], 6
mov byte [rsp + 0x20], 1
jmp 0x140014672
mov rax, qword [rsp + 0x78]
inc rax
mov r8, qword [rsp + 0x70]
mov edx, 4
mov rcx, rax
call fcn.140010960
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 2]
test eax, eax
je 0x1400142b3
mov rax, qword [rsp + 0x78]
movzx eax, word [rax + 1]
test eax, eax
jl 0x1400142b3
mov rax, qword [rsp + 0x78]
movzx eax, word [rax + 1]
shl eax, 1
cdqe
cmp rax, 0x80
jae 0x1400142b3
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 0x14]
test eax, eax
je 0x1400142b3
mov rax, qword [rsp + 0x28]
mov byte [rax], 0
mov rax, qword [rsp + 0x78]
add rax, 3
mov rcx, qword [rsp + 0x78]
movzx ecx, word [rcx + 1]
shl ecx, 1
movsxd rcx, ecx
mov rdx, qword [rsp + 0x70]
lea rcx, [rdx + rcx + 0x15]
mov r8d, 2
mov rdx, rax
call fcn.140001880
mov dword [rsp + 0x30], 0
mov byte [rsp + 0x20], 0
mov rcx, qword [rsp + 0x70]
call fcn.140016c00
mov rcx, qword [rsp + 0x70]
add rcx, 0x15
mov r9, qword [rsp + 0x70]
mov r8d, eax
mov rdx, rcx
lea rcx, [0x140001310]
call fcn.140016c70
test eax, eax
jne 0x1400142b3
mov rax, qword [rsp + 0x28]
mov byte [rax], 0
jmp 0x140014672
mov rax, qword [rsp + 0x78]
inc rax
mov r8, qword [rsp + 0x70]
mov edx, 2
mov rcx, rax
call fcn.140010960
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 2]
test eax, eax
je 0x140014364
mov rax, qword [rsp + 0x28]
mov byte [rax], 4
mov rax, qword [rsp + 0x78]
movzx eax, word [rax + 1]
cmp eax, 0xd
jne 0x140014321
mov rax, qword [rsp + 0x70]
add rax, 0x10
mov rcx, qword [rsp + 0x28]
add rcx, 4
mov r8d, 4
mov rdx, rax
call fcn.140001880
mov rax, qword [rsp + 0x28]
mov byte [rax], 0
mov rax, qword [rsp + 0x78]
movzx eax, word [rax + 1]
cmp eax, 0xc
jne 0x140014357
mov rax, qword [rsp + 0x70]
add rax, 0x10
mov rcx, qword [rsp + 0x28]
add rcx, 6
mov r8d, 4
mov rdx, rax
call fcn.140001880
mov rax, qword [rsp + 0x28]
mov byte [rax], 0
mov dword [rsp + 0x30], 6
mov byte [rsp + 0x20], 1
jmp 0x140014672
mov rax, qword [rsp + 0x78]
inc rax
mov r8, qword [rsp + 0x70]
mov edx, 4
mov rcx, rax
call fcn.140010960
mov rax, qword [rsp + 0x88]
mov r8, qword [rsp + 0x70]
mov edx, 4
mov rcx, rax
call fcn.140010960
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 2]
test eax, eax
je 0x14001441f
mov rax, qword [rsp + 0x28]
mov byte [rax], 0
mov rax, qword [rsp + 0x78]
inc rax
mov ecx, 1
imul rcx, rcx, 4
mov rdx, qword [rsp + 0x70]
lea rcx, [rdx + rcx + 0x9b]
mov r8d, 4
mov rdx, rax
call fcn.140001880
mov rax, qword [rsp + 0x88]
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x70]
lea rcx, [rdx + rcx + 0x9b]
mov r8d, 4
mov rdx, rax
call fcn.140001880
mov dword [rsp + 0x30], 0
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x3c], 1
jmp 0x140014672
mov rax, qword [rsp + 0x78]
inc rax
mov r8, qword [rsp + 0x70]
mov edx, 4
mov rcx, rax
call fcn.140010960
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 2]
test eax, eax
je 0x14001448f
mov rax, qword [rsp + 0x28]
mov byte [rax], 0
mov rax, qword [rsp + 0x78]
movzx r8d, word [rax + 3]
mov rax, qword [rsp + 0x78]
movzx edx, word [rax + 1]
mov rcx, qword [rsp + 0x70]
call fcn.14000c5a0
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x28]
mov byte [rdx + rcx + 2], al
mov dword [rsp + 0x30], 2
mov byte [rsp + 0x20], 1
jmp 0x140014672
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 2]
test eax, eax
je 0x1400144f9
mov rax, qword [rsp + 0x28]
mov byte [rax], 0
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x70]
lea rax, [rcx + rax + 0x9b]
mov rcx, qword [rsp + 0x28]
add rcx, 2
mov r8d, 8
mov rdx, rax
call fcn.140001880
mov rax, qword [rsp + 0x28]
add rax, 2
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.14000cb90
mov dword [rsp + 0x30], 8
mov byte [rsp + 0x20], 1
jmp 0x140014672
mov rax, qword [rsp + 0x78]
inc rax
mov r8, qword [rsp + 0x70]
mov edx, 4
mov rcx, rax
call fcn.140010960
mov rax, qword [rsp + 0x88]
mov r8, qword [rsp + 0x70]
mov edx, 4
mov rcx, rax
call fcn.140010960
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 2]
test eax, eax
je 0x1400145b4
mov rax, qword [rsp + 0x28]
mov byte [rax], 0
mov rax, qword [rsp + 0x78]
inc rax
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x70]
lea rcx, [rdx + rcx + 0x9b]
mov r8d, 4
mov rdx, rax
call fcn.140001880
mov rax, qword [rsp + 0x88]
mov ecx, 1
imul rcx, rcx, 4
mov rdx, qword [rsp + 0x70]
lea rcx, [rdx + rcx + 0x9b]
mov r8d, 4
mov rdx, rax
call fcn.140001880
mov dword [rsp + 0x30], 0
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x3c], 1
jmp 0x140014672
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 2]
test eax, eax
je 0x1400145f1
mov rax, qword [rsp + 0x28]
mov byte [rax], 0
mov rax, qword [rsp + 0x28]
add rax, 2
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.14000c8d0
mov dword [rsp + 0x30], 0x1a
mov byte [rsp + 0x20], 1
jmp 0x140014672
mov rax, qword [rsp + 0x78]
inc rax
mov r8, qword [rsp + 0x70]
mov edx, 4
mov rcx, rax
call fcn.140010960
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 2]
test eax, eax
je 0x14001464d
mov rax, qword [rsp + 0x28]
mov byte [rax], 0
mov rax, qword [rsp + 0x28]
add rax, 2
mov r8, rax
mov rdx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x78]
mov ecx, dword [rax + 1]
call fcn.14000c450
mov dword [rsp + 0x30], 6
mov byte [rsp + 0x20], 1
jmp 0x140014672
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 2]
test eax, eax
je 0x140014664
mov rax, qword [rsp + 0x28]
mov byte [rax], 0
mov rax, qword [rsp + 0x80]
mov dword [rax], 0
cmp dword [rsp + 0x3c], 0
je 0x14001468c
mov rax, qword [rsp + 0x80]
mov dword [rax], 0
jmp 0x1400147fd
movzx eax, byte [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
movzx ecx, byte [rcx + 3]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x70]
mov byte [rcx + 3], al
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax]
test eax, eax
jl 0x140014706
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax]
cmp eax, 0x1f
jg 0x140014706
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 3]
inc al
mov byte [rsp + 0x34], al
mov rax, qword [rsp + 0x70]
movzx ecx, byte [rsp + 0x34]
mov byte [rax + 3], cl
mov rax, qword [rsp + 0x28]
movzx ecx, byte [rsp + 0x34]
mov byte [rax + 1], cl
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
movzx ecx, byte [rcx]
and ecx, 0x7f
mov r8, rax
mov dl, 2
call fcn.1400054a0
test eax, eax
je 0x1400146bf
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax]
mov byte [rsp + 0x35], al
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 1]
mov byte [rsp + 0x36], al
mov rax, qword [rsp + 0x28]
mov r8, qword [rsp + 0x70]
mov edx, 2
mov rcx, rax
call fcn.140010960
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x140014759
mov rax, qword [rsp + 0x28]
add rax, 2
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x30]
mov rcx, rax
call fcn.140010960
movzx eax, byte [rsp + 0x35]
test eax, eax
jne 0x140014783
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + 0xe]
and eax, 0xff
movzx ecx, byte [rsp + 0x36]
shl ecx, 8
or eax, ecx
mov rcx, qword [rsp + 0x70]
mov word [rcx + 0xe], ax
mov eax, dword [rsp + 0x30]
add rax, 2
mov rcx, qword [rsp + 0x80]
mov ecx, dword [rcx]
cmp rax, rcx
jae 0x1400147a9
mov eax, dword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x48], rax
jmp 0x1400147b8
mov rax, qword [rsp + 0x80]
mov eax, dword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x80]
mov ecx, dword [rsp + 0x48]
mov dword [rax], ecx
mov rax, qword [rsp + 0x80]
mov eax, dword [rax]
mov r8d, eax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
call fcn.140001880
cmp qword [rsp + 0x28], 0
je 0x1400147fd
mov edx, 0x4d525356
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
add rsp, 0x68
ret