How to find the fifth function argument on stack in windbg?

Question

I know that in x64, the first 4 arguments are passed by RCX, RDX, r8, r9. The rest arguments are pushed on stack. In x64, rsp serves as base pointer(prolog) and frame pointer(epilog) and save value for other use. So I guess I need to access the fifth argument through offset of rsp in prolog. I guess space is allocated for stack-based arguments and homing space in the following instruction.

sub rsp,60h

My assumption is that the fifth argument is below the homing space if all 4 registers are passed to homing space. However, as you can see, only r8 and RCX are pushed on stack. I can understand that since that's how x64 works. But this makes me confused because I don't know which one is the fifth argument. I think the command should look like

dt typename @rsp+offset

I don't want to brute force by the way since it may be difficult for functions with many arguments and unknown types.

0: kd> uf tcpip!IppFindPath
tcpip!IppFindPath:
fffff806`b9b38494 48895c2420      mov     qword ptr [rsp+20h],rbx
fffff806`b9b38499 4c89442418      mov     qword ptr [rsp+18h],r8
fffff806`b9b3849e 48894c2408      mov     qword ptr [rsp+8],rcx
fffff806`b9b384a3 55              push    rbp
fffff806`b9b384a4 56              push    rsi
fffff806`b9b384a5 57              push    rdi
fffff806`b9b384a6 4154            push    r12
fffff806`b9b384a8 4155            push    r13
fffff806`b9b384aa 4156            push    r14
fffff806`b9b384ac 4157            push    r15
fffff806`b9b384ae 4883ec60        sub     rsp,60h
fffff806`b9b384b2 488b4128        mov     rax,qword ptr [rcx+28h]
fffff806`b9b384b6 4d8bd0          mov     r10,r8
fffff806`b9b384b9 418bd9          mov     ebx,r9d
fffff806`b9b384bc 4c8bea          mov     r13,rdx
fffff806`b9b384bf 4c8bf1          mov     r14,rcx
fffff806`b9b384c2 498bd2          mov     rdx,r10
fffff806`b9b384c5 8b0d61cc1f00    mov     ecx,dword ptr [tcpip!g_37HashSeed (fffff806`b9d3512c)]
fffff806`b9b384cb 4c8b4810        mov     r9,qword ptr [rax+10h]
fffff806`b9b384cf 410fb76906      movzx   ebp,word ptr [r9+6]
fffff806`b9b384d4 448bc5          mov     r8d,ebp
fffff806`b9b384d7 48ff1502832100  call    qword ptr [tcpip!_imp_RtlCompute37Hash (fffff806`b9d507e0)]
fffff806`b9b384de 0f1f440000      nop     dword ptr [rax+rax]
fffff806`b9b384e3 b102            mov     cl,2
fffff806`b9b384e5 498db600030000  lea     rsi,[r14+300h]
fffff806`b9b384ec 448be0          mov     r12d,eax
fffff806`b9b384ef 410fbaec1f      bts     r12d,1Fh