Function at 0x17208
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb8
xor ebx, ebx
mov rbp, rcx
mov qword [rax + 0x18], rbx
mov eax, dword [rcx + 0xc]
mov r12, rbx
mov r14, rbx
mov r13, rbx
mov dword [rsp + 0x108], ebx
cmp eax, 0x25
jae 0x17248
add rax, 0x10
jmp 0x17997
mov rcx, qword [rcx + 4]
call fcn.000126e0
mov rdi, rax
cmp rax, rbx
jne 0x1726e
cmp dword [rbp], 0xb
je 0x17264
mov eax, dword [rbp + 0xc]
jmp 0x1723f
xor ecx, ecx
call fcn.00012414
mov rdi, rax
lea rdx, [rsp + 0x78]
lea rcx, [rdi + 0x360]
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
cmp byte [rdi + 0x30], bl
je 0x172a3
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
mov rcx, rdi
call fcn.00012548
mov eax, dword [rbp + 0xc]
add eax, 0x10
jmp 0x17997
cmp dword [rbp], 0xb
jne 0x172b1
cmp byte [rdi + 0xb0], bl
jne 0x172bf
cmp dword [rbp], 0xa
jne 0x172cf
cmp byte [rdi + 0xb1], bl
je 0x172cf
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
jmp 0x1798d
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
xor ecx, ecx
call fcn.00012740
mov rsi, rax
cmp rax, rbx
je 0x178f2
mov rax, qword [rbp + 0x10]
mov qword [rsi + 0x10], rax
mov rax, qword [rbp + 0x18]
mov qword [rsi + 0x18], rax
mov rax, qword [rbp + 0x20]
mov qword [rsi + 0x20], rax
mov eax, dword [rbp + 0x28]
mov dword [rsi + 0x28], eax
mov eax, dword [rbp + 0x30]
add eax, 0x24
cmp dword [rbp + 0xc], eax
jb 0x178f2
lea rcx, [rsi + 0x2c]
lea rdx, [rbp + 0x34]
mov r8d, 0x3c
call fcn.0001dc00
mov r14d, 0x60
cmp dword [rsi + 0x44], ebx
jbe 0x1737d
movsxd rax, dword [rbp + 0x30]
mov edx, dword [rsi + 0x44]
sub rax, 0x3c
cmp rdx, rax
ja 0x17964
xor ecx, ecx
mov r8d, 0x44554c46
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsi + 0x68], rax
cmp rax, rbx
je 0x17964
mov r8d, dword [rsi + 0x44]
lea rdx, [rbp + 0x70]
mov rcx, rax
call fcn.0001dc00
add r14d, dword [rsi + 0x44]
jmp 0x17381
mov qword [rsi + 0x68], rbx
movzx r12d, word [rbp + 0xc]
sub r12w, r14w
mov word [rsp + 0x100], r12w
je 0x1795c
movzx eax, r12w
lea rcx, [0x00021200]
mov dword [rsi + 0x78], eax
inc dword [0x00021214]
call qword [sym.imp.ntoskrnl.exe_ExpInterlockedPopEntrySList]
mov r13, rax
cmp rax, rbx
jne 0x173dd
mov edx, dword [0x0002122c]
mov r8d, dword [0x00021228]
mov ecx, dword [0x00021224]
inc dword [0x00021218]
call qword [0x00021230]
mov r13, rax
cmp r13, rbx
je 0x1795c
movzx r15d, r12w
mov r8d, 0x43554c46
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rcx, rax
mov qword [rsp + 0x118], rax
cmp rax, rbx
je 0x17954
mov eax, r14d
mov r8, r15
lea rdx, [rax + rbp + 0x10]
call fcn.0001dc00
mov rcx, qword [rsp + 0x118]
xor r9d, r9d
xor r8d, r8d
movzx edx, r12w
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov r14, rax
mov qword [rsp + 0x70], rax
cmp rax, rbx
je 0x178ea
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
mov rcx, qword [0x000216f0]
lea rax, [rsp + 0x110]
mov qword [rsp + 0x30], rax
xor r8d, r8d
xor edx, edx
mov r9, r14
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], ebx
call sub.fwpkclnt.sys_FwpsAllocateNetBufferAndNetBufferList0
cmp eax, ebx
jl 0x178ea
mov rax, qword [rsp + 0x110]
lea rdx, [rsp + 0x90]
lea rcx, [0x000208a0]
mov r14, qword [rax + 8]
mov rax, qword [rbp + 4]
mov qword [r13], rax
mov eax, dword [rbp]
mov qword [r13 + 0x18], rdi
mov dword [r13 + 8], eax
mov rax, qword [rsp + 0x70]
mov qword [r13 + 0x20], rsi
mov qword [r13 + 0x10], rax
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
inc dword [rdi + 0x348]
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
lea r15, [rdi + 0x360]
lea rdx, [rsp + 0x78]
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
cmp dword [rbp], 0xb
mov eax, dword [rsi + 0x78]
jne 0x17516
add dword [rdi + 0xa8], eax
cmp dword [rdi + 0xa8], 0x800000
jbe 0x1752f
mov byte [rdi + 0xb0], 1
jmp 0x1752f
add dword [rdi + 0xac], eax
cmp dword [rdi + 0xac], 0x800000
jbe 0x1752f
mov byte [rdi + 0xb1], 1
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
cmp dword [rbp], 0xb
jne 0x17741
xor edx, edx
lea r15, [rsi + 0x80]
lea r8d, [rdx + 0x20]
mov rcx, r15
call fcn.0001dfe0
mov r9d, 1
xor r8d, r8d
lea edx, [r9 + 7]
mov rcx, r14
mov dword [rsp + 0x20], ebx
call qword [sym.imp.NDIS.SYS_NdisGetDataBuffer]
mov r11, rax
cmp rax, rbx
je 0x178e5
cmp qword [rdi + 0x20], rbx
jne 0x175b4
movzx eax, word [rsi + 0x10]
mov word [rdi + 0x3c], ax
mov eax, 0x11
mov word [rdi + 0x76], ax
mov rax, qword [rsi + 0x4c]
mov qword [rdi + 0x3e], rax
mov rax, qword [rsi + 0x54]
mov qword [rdi + 0x46], rax
mov rax, qword [rsi + 0x5c]
mov qword [rdi + 0x4e], rax
mov eax, dword [rsi + 0x64]
mov dword [rdi + 0x56], eax
movzx eax, word [rsi + 0x12]
movzx ecx, r12b
shl cx, 8
cmp word [rdi + 0x3c], 2
mov word [r11 + 2], ax
movzx eax, byte [rsp + 0x101]
mov word [r11 + 6], bx
jne 0x175e3
lea r9, [rsi + 0x14]
lea r10, [rdi + 0x42]
jmp 0x175eb
lea r9, [rsi + 0x18]
lea r10, [rdi + 0x46]
or cx, ax
mov word [r11 + 4], cx
mov eax, dword [rsi + 0x38]
mov rdx, qword [rsi + 0x68]
mov r8d, dword [rsi + 0x44]
mov dword [rsi + 0x88], eax
mov qword [rsi + 0x90], rdx
mov qword [r15], r9
mov dword [rsi + 0x98], r8d
cmp byte [0x0002169e], bl
jne 0x17670
cmp qword [rdi + 0x20], rbx
je 0x17670
mov r8, qword [rsi + 0x30]
mov rcx, qword [0x000216c0]
mov qword [rsp + 0x48], r13
lea rax, [0x00017038]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x38], rax
mov eax, dword [rsi + 0x2c]
mov dword [rsp + 0x30], eax
movzx eax, word [rdi + 0x3c]
mov word [rsp + 0x28], ax
mov qword [rsp + 0x20], r15
call sub.fwpkclnt.sys_FwpsInjectTransportSendAsync0
jmp 0x17703
mov eax, dword [rsi + 0x40]
movzx ecx, word [rdi + 0x76]
mov dword [rsp + 0x60], eax
mov eax, dword [rsi + 0x3c]
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], r8d
movzx r8d, word [rdi + 0x3c]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x110]
mov qword [rsp + 0x20], r9
xor edx, edx
mov r9, r10
call sub.fwpkclnt.sys_FwpsConstructIpHeaderForTransportPacket0
cmp eax, ebx
jl 0x178e5
mov r9d, dword [rsi + 0x2c]
mov rcx, qword [0x000216c8]
lea rax, [0x00017038]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x110]
xor r8d, r8d
xor edx, edx
cmp word [rdi + 0x3c], 2
mov qword [rsp + 0x20], rax
je 0x176fe
mov rcx, qword [0x000216d0]
call sub.fwpkclnt.sys_FwpsInjectNetworkSendAsync0
cmp eax, ebx
mov r12d, eax
jl 0x17722
mov eax, dword [rbp + 0xc]
mov rsi, rbx
mov qword [rsp + 0x110], rbx
add eax, 0x10
mov dword [rsp + 0x108], eax
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xd]
call fcn.00014778
lea r15, [rdi + 0x360]
jmp 0x17880
mov r9d, 1
xor r8d, r8d
mov rcx, r14
lea edx, [r9 + 7]
mov dword [rsp + 0x20], ebx
call qword [sym.imp.NDIS.SYS_NdisGetDataBuffer]
mov r11, rax
cmp rax, rbx
je 0x178e5
movzx eax, word [rsi + 0x12]
movzx ecx, r12b
shl cx, 8
cmp word [rdi + 0x3c], 2
mov word [r11], ax
movzx eax, byte [rsp + 0x101]
mov word [r11 + 6], bx
jne 0x1779d
or cx, ax
lea r9, [rsi + 0x14]
mov word [r11 + 4], cx
lea rcx, [rdi + 0x42]
jmp 0x177ad
or cx, ax
lea r9, [rsi + 0x18]
mov word [r11 + 4], cx
lea rcx, [rdi + 0x46]
movzx eax, word [rdi + 0x40]
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x48], ebx
mov word [r11 + 2], ax
movzx eax, word [rdi + 0x76]
movzx r8d, word [rdi + 0x3c]
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x110]
xor edx, edx
call sub.fwpkclnt.sys_FwpsConstructIpHeaderForTransportPacket0
cmp eax, ebx
jl 0x178e5
mov rcx, qword [0x000216c0]
mov qword [rsp + 0x50], r13
lea rax, [0x00017038]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x110]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov eax, dword [rsi + 0x40]
xor r8d, r8d
mov dword [rsp + 0x38], eax
mov eax, dword [rsi + 0x3c]
xor edx, edx
mov dword [rsp + 0x30], eax
mov eax, dword [rsi + 0x2c]
mov dword [rsp + 0x28], eax
movzx eax, word [rdi + 0x3c]
mov word [rsp + 0x20], ax
call sub.fwpkclnt.sys_FwpsInjectTransportReceiveAsync0
cmp eax, ebx
mov r12d, eax
jl 0x1786d
mov eax, dword [rbp + 0xc]
mov rsi, rbx
mov qword [rsp + 0x110], rbx
add eax, 0x10
mov dword [rsp + 0x108], eax
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xc]
call fcn.00014778
cmp r12d, ebx
jge 0x17986
lea rdx, [rsp + 0x78]
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
cmp dword [rbp], 0xb
mov eax, dword [rsi + 0x78]
jne 0x178ba
sub dword [rdi + 0xa8], eax
cmp dword [rdi + 0xa8], 0x800000
ja 0x178d2
mov byte [rdi + 0xb0], bl
jmp 0x178d2
sub dword [rdi + 0xac], eax
cmp dword [rdi + 0xac], 0x800000
ja 0x178d2
mov byte [rdi + 0xb1], bl
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
mov rcx, rdi
call fcn.00012548
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x110]
cmp rcx, rbx
je 0x17904
call sub.fwpkclnt.sys_FwpsFreeNetBufferList0
cmp r14, rbx
je 0x17912
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
cmp r12, rbx
je 0x17922
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp r13, rbx
je 0x17979
inc dword [0x0002121c]
lea rcx, [0x00021200]
call qword [sym.imp.ntoskrnl.exe_ExQueryDepthSList]
cmp ax, word [0x00021210]
jb 0x17969
inc dword [0x00021220]
mov rcx, r13
call qword [0x00021238]
jmp 0x17979
mov r14, rbx
mov r12, rax
jmp 0x178f2
mov r14, rbx
mov r12, rbx
jmp 0x178f2
mov r14, rbx
jmp 0x178f2
lea rcx, [0x00021200]
mov rdx, r13
call qword [sym.imp.ntoskrnl.exe_ExpInterlockedPushEntrySList]
cmp rsi, rbx
je 0x17986
mov rcx, rsi
call fcn.00012814
mov ebx, dword [rsp + 0x108]
mov rcx, rdi
call fcn.00012548
mov eax, ebx
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret