Function at 0x14002b458
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r9d, dword [rcx + 0x40]
mov rbx, rcx
imul ecx, r9d, 0x1b
mov eax, dword [rbx + 0x1c]
mov dword [rbx + 0xb8], ecx
test al, 4
je 0x14002b496
add ecx, r9d
mov dword [rbx + 0xb8], ecx
test al, 8
je 0x14002b4aa
movzx eax, byte [rbx + 0x38]
imul eax, r9d
add ecx, eax
mov dword [rbx + 0xb8], ecx
mov r8d, dword [rbx + 0x3c]
cmp ecx, r8d
jae 0x14002b4bd
mov dword [rbx + 0xb8], r8d
mov ecx, r8d
xor edx, edx
mov eax, ecx
div r9d
xor edx, edx
mov r15d, 0x30
add eax, 7
mov r14d, 0x66746e56
shr eax, 3
add eax, 7
and eax, 0xfffffff8
lea ebp, [r15 - 0x2f]
mov dword [rbx + 0xbc], eax
mov ecx, ebp
lea eax, [r8 + 0x1fff]
div r8d
mov r8d, r14d
mov edx, r15d
mov esi, eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor edi, edi
mov qword [rbx + 0xd8], rax
test rax, rax
je 0x14002b76a
mov qword [rax], rdi
or r12, 0xffffffffffffffff
mov rax, qword [rbx + 0xd8]
mov r8d, esi
shr r8, 3
mov qword [rax + 8], rsi
mov rax, qword [rbx + 0xd8]
mov qword [rax + 0x10], rbp
mov rax, qword [rbx + 0xd8]
mov qword [rax + 0x18], rbp
mov rax, qword [rbx + 0xd8]
mov qword [rax + 0x20], r12
mov rax, qword [rbx + 0xd8]
mov qword [rax + 0x28], rdi
mov eax, esi
mov rdx, qword [rbx + 0x90]
and eax, 7
movzx ecx, byte [r8 + rdx]
bts ecx, eax
mov byte [r8 + rdx], cl
mov r8d, r14d
mov edx, dword [rbx + 0xbc]
mov ecx, ebp
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbx + 0x88], rax
test rax, rax
je 0x14002b76a
mov r8d, dword [rbx + 0xbc]
xor edx, edx
mov rcx, rax
call fcn.140015d40
mov r8d, dword [rbx + 0x3c]
lea rcx, [rsi + 1]
mov eax, r8d
mov qword [rbx + 0x68], rcx
imul rax, rcx
cmp rax, 0x4000
jge 0x14002b5d0
lea eax, [r8 + 0x3fff]
xor edx, edx
div r8d
mov ecx, eax
mov qword [rbx + 0x68], rcx
mov rax, qword [rbx + 0x50]
mov r8d, r14d
shr rax, 3
mov rdx, r15
add rax, rcx
mov ecx, ebp
mov qword [rbx + 0x60], rax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbx + 0xd0], rax
test rax, rax
je 0x14002b76a
mov qword [rax], rdi
xor edx, edx
mov rcx, qword [rbx + 0xd0]
mov r10d, edi
mov rax, qword [rbx + 0x68]
mov qword [rcx + 8], rax
mov ecx, dword [rbx + 0x3c]
mov eax, dword [rbx + 0xb8]
dec eax
add eax, ecx
div ecx
mov rcx, qword [rbx + 0xd0]
mov edx, eax
mov r11d, eax
mov qword [rcx + 0x10], rdx
mov rcx, qword [rbx + 0xd0]
mov qword [rcx + 0x18], rdx
mov rcx, qword [rbx + 0xd0]
mov qword [rcx + 0x20], r12
mov rcx, qword [rbx + 0xd0]
mov qword [rcx + 0x28], rdi
test eax, eax
je 0x14002b687
mov r8, qword [rbx + 0x90]
mov ecx, dword [rbx + 0x68]
add ecx, r10d
mov r9d, r10d
add r9, qword [rbx + 0x68]
and ecx, 7
sar r9, 3
add r10d, ebp
movzx edx, byte [r9 + r8]
bts edx, ecx
mov byte [r9 + r8], dl
cmp r10d, r11d
jb 0x14002b658
mov edx, dword [rbx + 0xb8]
mov r8d, r14d
mov ecx, ebp
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbx + 0x80], rax
test rax, rax
je 0x14002b76a
mov r8d, dword [rbx + 0xb8]
xor edx, edx
mov rcx, rax
call fcn.140015d40
mov rax, qword [rbx + 0x50]
mov r8d, r14d
shr rax, 1
mov rdx, r15
mov ecx, ebp
mov qword [rbx + 0x70], rax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbx + 0xe0], rax
test rax, rax
je 0x14002b76a
mov qword [rax], rdi
xor edx, edx
mov rcx, qword [rbx + 0xe0]
mov rax, qword [rbx + 0x70]
mov qword [rcx + 8], rax
mov ecx, dword [rbx + 0x3c]
mov eax, dword [rbx + 0x40]
lea eax, [rax*4 - 1]
add eax, ecx
div ecx
mov rcx, qword [rbx + 0xe0]
mov edx, eax
mov qword [rcx + 0x10], rdx
mov rcx, qword [rbx + 0xe0]
mov qword [rcx + 0x18], rdx
mov rcx, qword [rbx + 0xe0]
mov qword [rcx + 0x20], r12
mov rcx, qword [rbx + 0xe0]
mov qword [rcx + 0x28], rdi
test eax, eax
je 0x14002b765
mov r8, qword [rbx + 0x90]
mov ecx, dword [rbx + 0x70]
add ecx, edi
mov r9d, edi
add r9, qword [rbx + 0x70]
and ecx, 7
sar r9, 3
add edi, ebp
movzx edx, byte [r9 + r8]
bts edx, ecx
mov byte [r9 + r8], dl
cmp edi, eax
jb 0x14002b739
mov al, bpl
jmp 0x14002b76c
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret