Function at 0x140005c84
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor esi, esi
mov r15, r8
mov r12, rdx
mov dword [rsp + 0x38], esi
mov r8b, 1
mov dword [rsp + 0x30], esi
mov rbx, rcx
mov dword [rsp + 0x34], esi
lea edx, [rsi + 3]
mov dword [rsp + 0x3c], esi
mov edi, esi
mov r13d, esi
mov ebp, esi
mov r14d, esi
call fcn.1400024b8
test al, al
je 0x140006432
test r12, r12
je 0x1400063fd
mov edx, 0x80
mov rax, qword [r15]
mov rsi, r13
test rax, rax
jne 0x140005da7
mov rdi, qword [0x14000b248]
add rdi, 0xb0
mov rcx, rdi
inc dword [rdi + 0x14]
call qword [sym.imp.ntoskrnl.exe_ExpInterlockedPopEntrySList]
mov qword [rsp + 0x40], rax
mov r15, rax
test rax, rax
jne 0x140005d44
inc dword [rdi + 0x18]
mov r9, rdi
mov edx, dword [rdi + 0x2c]
mov rax, qword [rdi + 0x30]
mov r8d, dword [rdi + 0x28]
mov ecx, dword [rdi + 0x24]
call qword [0x140009420]
mov r15, rax
mov qword [rsp + 0x40], rax
test r15, r15
je 0x1400063c7
mov rcx, qword [rsp + 0xa0]
xor eax, eax
mov rdi, qword [rsp + 0xa8]
xorps xmm0, xmm0
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x10], xmm0
mov qword [r15 + 0x20], rax
lea rax, [r15 + 8]
mov dword [r15 + 0x20], 1
mov qword [rcx], rax
cmp dword [rdi], r13d
jne 0x140005d99
mov r8d, dword [rbx + 0xe0]
lea rdx, [rbx + 0xe4]
mov rcx, rdi
call fcn.1400054ac
mov rax, qword [rdi]
mov edx, 0x80
mov qword [r15 + 0x10], rax
jmp 0x140005db0
lea r15, [rax - 8]
mov qword [rsp + 0x40], r15
mov eax, dword [rbx + 0x74]
test al, 1
je 0x140005fd4
mov rax, qword [rbx + 0x20]
mov ecx, dword [rax + 0x30]
test cl, 0x10
je 0x140005fd4
mov rdi, qword [r12 + 0xc0]
test rdi, rdi
je 0x140005fd4
cmp byte [rdi], dl
jne 0x140005fd4
cmp byte [rdi + 1], 1
jne 0x140005fd4
cmp word [rdi + 2], 0x30
jne 0x140005fd4
mov rbp, qword [0x14000b248]
add rbp, 0x290
mov rcx, rbp
inc dword [rbp + 0x14]
call qword [sym.imp.ntoskrnl.exe_ExpInterlockedPopEntrySList]
test rax, rax
jne 0x140005e32
inc dword [rbp + 0x18]
mov r9, rbp
mov edx, dword [rbp + 0x2c]
mov rax, qword [rbp + 0x30]
mov r8d, dword [rbp + 0x28]
mov ecx, dword [rbp + 0x24]
call qword [0x140009420]
mov qword [r15 + 0x18], rax
test rax, rax
je 0x140005fd4
xor ecx, ecx
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov dword [rax + 0x20], ecx
mov word [rax + 0x24], cx
mov eax, dword [rdi + 4]
mov rsi, qword [r15 + 0x18]
test al, 4
je 0x140005e78
or dword [rsi + 4], 1
lea edx, [rcx + 0x11]
mov rax, qword [rdi + 0x28]
lea ecx, [rdx - 1]
mov r8d, dword [rsi + 4]
mov qword [rsi + 8], rax
mov eax, dword [rdi + 4]
jmp 0x140005e84
mov r8d, dword [rsi + 4]
mov edx, 9
lea ecx, [rdx - 1]
or r8d, 2
mov dword [rsi + 4], r8d
and eax, 1
jne 0x140005e97
mov byte [rsi + rcx], r13b
jmp 0x140005eb0
mov byte [rsi + rcx], 0x10
mov r8d, 0x50
test byte [rdi + 4], 2
movzx eax, byte [rsi + rcx]
cmovne eax, r8d
mov byte [rsi + rcx], al
mov rax, qword [rbx + 0x20]
movzx ecx, r13w
mov r8, qword [rax + 0x48]
test r8, r8
je 0x140005f05
mov r9d, dword [r8 + 4]
mov eax, r13d
test r9d, r9d
je 0x140005ee9
mov r10b, byte [rdi + 0x18]
mov ecx, eax
cmp byte [r8 + rcx*4 + 8], r10b
je 0x140005ee3
inc eax
cmp eax, r9d
jb 0x140005ed1
jmp 0x140005f05
movzx ecx, word [r8 + rcx*4 + 0xa]
test cx, cx
je 0x140005f05
or dword [rsi + 4], 4
mov ebp, 0xff
cmp cx, bp
jbe 0x140005efe
mov ecx, ebp
mov eax, edx
inc edx
mov byte [rax + rsi], cl
mov eax, dword [rdi + 8]
test eax, eax
jne 0x140005f12
cmp dword [rdi + 0xc], r13d
je 0x140005f83
inc edx
movzx ecx, r13w
and edx, 0xfffffffe
cmp eax, 1
jne 0x140005f36
mov ecx, 0x800
mov eax, pe_overlay
cmp dword [rdi + 0xc], eax
ja 0x140005f6d
movzx r8d, word [rdi + 0xc]
jmp 0x140005f70
cmp eax, 4
je 0x140005f4a
cmp eax, 5
jne 0x140005f45
lea ecx, [rax + 0x1b]
jmp 0x140005f25
cmp eax, 6
jne 0x140005f51
mov ecx, 0x40
jmp 0x140005f25
cmp eax, 3
je 0x140005f25
cmp dword [rdi + 0xc], 0x9b4
jbe 0x140005f66
mov ecx, 0x100
jmp 0x140005f25
mov ecx, 0x80
jmp 0x140005f2f
mov r8d, eax
mov word [rsi + rdx*2], r8w
add edx, 2
or dword [rsi + 4], 8
mov word [rsi + rdx*2], cx
add edx, 2
mov eax, 0x20
mov ecx, edx
or dword [rsi + 4], eax
inc edx
mov al, byte [rdi + 0x14]
mov byte [rcx + rsi], al
mov eax, dword [rdi + 8]
cmp eax, 7
jne 0x140005fb1
bts dword [rsi + 4], 0x13
xor ecx, ecx
mov word [rdx + rsi], cx
mov byte [rdx + rsi + 2], cl
add edx, 3
jmp 0x140005fcd
cmp eax, 8
jne 0x140005fcd
bts dword [rsi + 4], 0x15
inc edx
and edx, 0xfffffffe
xor ecx, ecx
mov qword [rdx + rsi], rcx
mov dword [rdx + rsi + 8], ecx
add edx, 0xc
mov byte [rsi], r13b
mov word [rsi + 2], dx
mov r14, qword [r12 + 8]
mov qword [rsp + 0x48], r15
test r14, r14
je 0x140006122
cmp qword [r14 + 8], r13
je 0x140006106
cmp qword [r14 + 0x20], r13
je 0x140006106
inc dword [rsp + 0x38]
mov rdi, qword [r15]
mov r13d, dword [r14 + 0x18]
test rdi, rdi
jne 0x140006075
mov rbp, qword [0x14000b248]
add rbp, 0x170
mov rcx, rbp
inc dword [rbp + 0x14]
call qword [sym.imp.ntoskrnl.exe_ExpInterlockedPopEntrySList]
mov rdi, rax
test rax, rax
jne 0x14000604a
inc dword [rbp + 0x18]
mov r9, rbp
mov edx, dword [rbp + 0x2c]
mov rax, qword [rbp + 0x30]
mov r8d, dword [rbp + 0x28]
mov ecx, dword [rbp + 0x24]
call qword [0x140009420]
mov rdi, rax
test rdi, rdi
je 0x1400063bf
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
mov qword [rdi + 0x20], rax
mov qword [r15], rdi
mov rax, qword [r14 + 8]
mov qword [rdi + 0x18], rax
mov eax, dword [r14 + 0x10]
mov dword [rdi + 0x20], eax
mov rcx, qword [rbx + 0x78]
lea rdx, [rsp + 0xb0]
mov r8b, 1
call qword [sym.imp.NDIS.SYS_NdisAcquireRWLockRead]
mov r8d, dword [r14 + 0x10]
mov r9d, r13d
mov rdx, qword [r14 + 8]
mov rcx, qword [rbx + 0x40]
call fcn.14000673c
mov rcx, qword [rbx + 0x78]
lea rdx, [rsp + 0xb0]
mov r12d, eax
call qword [sym.imp.NDIS.SYS_NdisReleaseRWLock]
test r12d, r12d
je 0x140006103
cmp r12d, r13d
ja 0x1400060c3
cmp r12d, 0xffffffff
jne 0x1400060c6
mov r12d, r13d
mov eax, dword [rbx + 0x74]
test al, 1
jne 0x140006154
lea rcx, [rbx + 0x60]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockAtDpcLevel]
mov rcx, qword [rbx + 0x50]
inc qword [rbx + 0x58]
lea rax, [rcx + 0x3c]
cmp r13d, 0x3c
jb 0x1400060f1
lea rax, [rcx + r13]
add rax, 0xc
lea rcx, [rbx + 0x60]
mov qword [rbx + 0x50], rax
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLockFromDpcLevel]
xor r13d, r13d
mov r14, qword [r14]
mov r15, qword [r15]
mov qword [rsp + 0x48], r15
test r14, r14
jne 0x140005fe7
mov r12, qword [rsp + 0x98]
mov r15, qword [rsp + 0xa0]
mov edx, 0x80
mov r12, qword [r12]
mov qword [rsp + 0x98], r12
mov r15, qword [r15]
mov qword [rsp + 0xa0], r15
test r12, r12
jne 0x140005cec
jmp 0x1400063c7
cmp dword [rbx + 0xa4], 0
jg 0x140006163
inc dword [rsp + 0x30]
jmp 0x140006103
cmp dword [rbx + 0xa0], 0
jg 0x14000618c
inc dword [rsp + 0x30]
xor r13d, r13d
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x140006106
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
jmp 0x140006106
test rsi, rsi
je 0x140006197
movzx eax, word [rsi + 2]
jmp 0x140006199
xor eax, eax
lea ebp, [r12 + 0x14]
add ebp, eax
js 0x14000615d
mov rcx, qword [rbx + 0x80]
lea rdx, [rsp + 0xb0]
mov r8b, 1
call qword [sym.imp.NDIS.SYS_NdisAcquireRWLockRead]
mov eax, ebp
neg eax
lock xadd dword [rbx + 0xa0], eax
test eax, eax
jns 0x1400061ee
inc dword [rsp + 0x30]
xor r13d, r13d
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1400062ef
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
jmp 0x1400062ef
cmp qword [rdi + 8], 0
jne 0x140006286
mov r15, qword [0x14000b248]
add r15, 0x110
mov rcx, r15
inc dword [r15 + 0x14]
call qword [sym.imp.ntoskrnl.exe_ExpInterlockedPopEntrySList]
test rax, rax
jne 0x140006236
inc dword [r15 + 0x18]
mov r9, r15
mov edx, dword [r15 + 0x2c]
mov rax, qword [r15 + 0x30]
mov r8d, dword [r15 + 0x28]
mov ecx, dword [r15 + 0x24]
call qword [0x140009420]
mov qword [rdi + 8], rax
test rax, rax
jne 0x14000624b
inc dword [rsp + 0x34]
xor r13d, r13d
jmp 0x1400062ef
xor edx, edx
mov r8d, 0x120
mov rcx, rax
call fcn.140007bc0
mov rax, qword [rdi + 8]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov rax, qword [rdi + 8]
mov dword [rax + 0xc], r13d
mov rax, qword [rdi + 8]
mov dword [rax + 0x10], 1
mov rax, qword [rdi + 8]
add rax, 0x18
mov qword [rdi + 0x10], rax
mov r8, qword [0x14000b248]
mov edx, r12d
add r8, 0x50
mov rcx, rdi
call fcn.140005ad4
xor r13d, r13d
test al, al
je 0x1400062eb
mov r15, qword [rdi + 8]
mov rdi, qword [0x14000b248]
add rdi, 0x230
mov rcx, rdi
inc dword [rdi + 0x14]
call qword [sym.imp.ntoskrnl.exe_ExpInterlockedPopEntrySList]
mov rdx, rax
test rax, rax
jne 0x140006304
mov edx, dword [rdi + 0x2c]
mov r9, rdi
mov rax, qword [rdi + 0x30]
mov r8d, dword [rdi + 0x28]
mov ecx, dword [rdi + 0x24]
inc dword [rdi + 0x18]
call qword [0x140009420]
mov rdx, rax
test rax, rax
jne 0x140006304
inc dword [rsp + 0x34]
test ebp, ebp
jle 0x1400063a0
lock xadd dword [rbx + 0xa0], ebp
jmp 0x1400063a0
mov qword [rdx], r13
mov qword [rdx + 8], r13
mov qword [rdx + 0x18], r13
mov qword [rdx + 0x10], r15
lock inc dword [r15 + 0x10]
mov rax, qword [rsp + 0x40]
lock inc dword [rax + 0x20]
mov dword [rdx + 0x18], r12d
test rsi, rsi
je 0x140006330
movzx ecx, word [rsi + 2]
jmp 0x140006333
mov rcx, r13
mov eax, r12d
add rax, 0x14
add rcx, rax
movsxd rax, ebp
cmp rcx, rax
je 0x140006363
test rsi, rsi
je 0x140006350
movzx eax, word [rsi + 2]
jmp 0x140006353
mov eax, r13d
sub ebp, eax
sub ebp, r12d
sub ebp, 0x14
lock xadd dword [rbx + 0xa0], ebp
lea r8, [rbx + 0x98]
lea rcx, [rbx + 0x88]
call qword [sym.imp.ntoskrnl.exe_ExInterlockedInsertTailList]
mov ecx, dword [rbx + 0xa4]
sub ecx, dword [rbx + 0xa0]
inc dword [rsp + 0x3c]
cmp ecx, dword [rbx + 0x48]
jl 0x1400063a0
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1400063a0
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov rcx, qword [rbx + 0x80]
lea rdx, [rsp + 0xb0]
call qword [sym.imp.NDIS.SYS_NdisReleaseRWLock]
mov r15, qword [rsp + 0x48]
jmp 0x140006106
mov r12, qword [rsp + 0x98]
mov ebp, dword [rsp + 0x34]
test r12, r12
je 0x1400063f4
mov edi, dword [rsp + 0x38]
test r14, r14
je 0x1400063e9
mov r14, qword [r14]
inc edi
inc ebp
test r14, r14
jne 0x1400063d9
mov dword [rsp + 0x38], edi
mov r12, qword [r12]
test r12, r12
jne 0x1400063d0
jmp 0x1400063f8
mov edi, dword [rsp + 0x38]
mov r13d, dword [rsp + 0x30]
lock xadd dword [rbx + 0xb4], ebp
lock xadd dword [rbx + 0xb0], r13d
lock xadd dword [rbx + 0xac], edi
mov eax, dword [rsp + 0x3c]
lock xadd dword [rbx + 0xa8], eax
mov r8b, 1
mov edx, 3
mov rcx, rbx
call fcn.14000274c
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret