Function at 0x14000fbcc
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x14000a330]
xor rax, rsp
mov qword [rsp + 0xd8], rax
mov rsi, r9
mov ebx, r8d
mov rdi, rdx
mov r12, rcx
mov r15, qword [rsp + 0x138]
mov qword [rsp + 0x68], r15
cmp byte [rsp + 0x140], 0
je 0x14000fc4c
mov r14d, dword [rsp + 0x130]
mov edx, r14d
mov r8d, 4
mov rcx, r9
call qword [sym.imp.ntoskrnl.exe_ProbeForWrite]
test r15, r15
je 0x14000fc45
mov edx, 4
mov r8d, edx
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_ProbeForWrite]
jmp 0x14000fc54
mov r14d, dword [rsp + 0x130]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9b, byte [rsp + 0x140]
mov r8, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov r8, qword [r8]
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
js 0x14001036f
mov rax, qword [sym.imp.ntoskrnl.exe_PsInitialSystemProcess]
mov rcx, qword [rax]
cmp qword [rsp + 0x38], rcx
jne 0x14000fca6
or rdi, 0xffffffff80000000
xor r15b, r15b
jmp 0x14000fcc8
test rdi, rdi
jns 0x14000fcc0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, 0xc0000008
jmp 0x14001036f
mov r15b, byte [rsp + 0x140]
test ebx, ebx
je 0x1400102a0
sub ebx, 1
je 0x1400101a0
sub ebx, 1
je 0x1400100c9
sub ebx, 1
je 0x140010058
sub ebx, 1
je 0x14000ffcb
sub ebx, 1
je 0x14000ff49
sub ebx, 1
je 0x14000fdf5
cmp ebx, 1
je 0x14000fd1e
mov edi, 0xc0000003
mov dword [rsp + 0x30], edi
and dword [rsp + 0x34], 0
jmp 0x140010336
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9b, r15b
mov r8, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov r8, qword [r8]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov edi, eax
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test edi, edi
js 0x14000ff3c
mov rdx, qword [rsp + 0x40]
mov cl, byte [rdx + 0x48]
mov byte [rsp + 0x50], cl
mov cl, byte [rdx + 0x49]
mov byte [rsp + 0x51], cl
mov cl, byte [rdx + 0x4a]
mov byte [rsp + 0x52], cl
mov cl, byte [rdx + 0x4b]
mov byte [rsp + 0x53], cl
mov al, byte [rdx + 0x4c]
mov byte [rsp + 0x54], al
mov al, byte [rdx + 0x4d]
mov byte [rsp + 0x55], al
mov al, byte [rdx + 0x4e]
mov byte [rsp + 0x56], al
mov al, byte [rdx + 0x4f]
mov byte [rsp + 0x57], al
mov rax, qword [rdx + 0x68]
mov qword [rsp + 0x58], rax
mov eax, dword [rdx + 0x50]
mov dword [rsp + 0x60], eax
cmp r14d, 0x18
jne 0x14000fde4
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi], xmm0
movsd xmm1, qword [rsp + 0x60]
movsd qword [rsi + 0x10], xmm1
jmp 0x14000fde2
jmp 0x14000fded
mov edi, 0xc0000004
mov dword [rsp + 0x30], edi
mov rcx, rdx
jmp 0x14000ff2b
or ecx, 0xffffffff
cmp dword [section..data], ecx
je 0x14000ff33
cmp dword [0x14000a00c], ecx
je 0x14000ff33
cmp dword [0x14000a014], ecx
je 0x14000ff33
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9b, r15b
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov edi, eax
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test edi, edi
js 0x14000ff3c
mov rcx, qword [rsp + 0x40]
call fcn.14000ea68
test rax, rax
je 0x14000feac
mov ebx, dword [0x14000a014]
add rbx, rax
lea rdx, [0x140012ac0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
jne 0x14000feb5
mov edi, 0xc0000024
jmp 0x14000feb1
mov edi, 0xc00000bb
mov dword [rsp + 0x30], edi
test edi, edi
js 0x14000ff26
mov ecx, dword [0x14000a00c]
mov rax, qword [rsp + 0x40]
mov rdx, qword [rcx + rax]
test rdx, rdx
je 0x14000fed9
mov eax, dword [section..data]
movups xmm0, xmmword [rax + rdx]
jmp 0x14000fef3
xor eax, eax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
movups xmm0, xmmword [rsp + 0xa0]
and qword [rsp + 0xb0], 0
cmp r14d, 0x18
jne 0x14000ff1d
movups xmmword [rsi], xmm0
movsd xmm1, qword [rsp + 0xb0]
movsd qword [rsi + 0x10], xmm1
jmp 0x14000ff1b
jmp 0x14000ff26
mov edi, 0xc0000004
mov dword [rsp + 0x30], edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x14000ff3c
mov edi, 0xc00000bb
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x34], 0x18
jmp 0x140010336
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and qword [rsp + 0x20], 0
mov r9d, 0x30
lea r8, [rsp + 0xa0]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationThread]
mov edi, eax
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test edi, edi
js 0x14001004b
cmp r14d, 0x30
jne 0x140010042
movups xmm0, xmmword [rsp + 0xa0]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rsp + 0xb0]
movups xmmword [rsi + 0x10], xmm1
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsi + 0x20], xmm0
jmp 0x14000ffc6
jmp 0x14001004b
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and qword [rsp + 0x20], 0
mov r9d, 0x30
lea r8, [rsp + 0xa0]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
mov edi, eax
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test edi, edi
js 0x14001004b
cmp r14d, 0x30
jne 0x140010042
movups xmm0, xmmword [rsp + 0xa0]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rsp + 0xb0]
movups xmmword [rsi + 0x10], xmm1
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsi + 0x20], xmm0
jmp 0x140010040
jmp 0x14001004b
mov edi, 0xc0000004
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x34], 0x30
jmp 0x140010336
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and qword [rsp + 0x20], 0
mov r9d, 2
lea r8, [rsp + 0x48]
lea edx, [r9 + 2]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwQueryObject]
mov edi, eax
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test edi, edi
js 0x1400100bc
cmp r14d, 2
jne 0x1400100b3
movzx eax, word [rsp + 0x48]
mov word [rsi], ax
jmp 0x1400100b1
jmp 0x1400100bc
mov edi, 0xc0000004
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x34], 2
jmp 0x140010336
mov eax, 0x68
mov dword [rsp + 0x34], eax
cmp r14d, eax
cmovae eax, r14d
lea edx, [rax + 8]
mov ecx, 1
mov r8d, 0x5168704b
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithQuotaTag]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140010192
mov r15d, r14d
mov r8d, r14d
xor edx, edx
mov rcx, rax
call fcn.140006200
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8, rbx
mov edx, 2
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwQueryObject]
mov edi, eax
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test edi, edi
js 0x14001017f
mov rax, qword [rbx + 8]
test rax, rax
je 0x140010164
sub rax, rbx
add rax, rsi
mov qword [rbx + 8], rax
mov r8, r15
mov rdx, rbx
mov rcx, rsi
call fcn.140005ec0
jmp 0x14001017f
mov edx, 0x5168704b
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140010336
mov edi, 0xc000009a
mov dword [rsp + 0x30], edi
jmp 0x140010336
mov ebx, 0x10
mov dword [rsp + 0x34], ebx
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9b, r15b
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov edi, eax
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test edi, edi
js 0x140010336
cmp r14d, ebx
cmovae ebx, r14d
mov edx, ebx
mov ecx, 1
mov r8d, 0x5168704b
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithQuotaTag]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140010287
mov r15d, r14d
mov r8d, r14d
xor edx, edx
mov rcx, rax
call fcn.140006200
lea r9, [rsp + 0x34]
mov r8d, r14d
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
call fcn.14000ed1c
mov edi, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x140010277
mov rax, qword [rbx + 8]
test rax, rax
je 0x14001025c
sub rax, rbx
add rax, rsi
mov qword [rbx + 8], rax
mov r8, r15
mov rdx, rbx
mov rcx, rsi
call fcn.140005ec0
jmp 0x140010277
mov edx, 0x5168704b
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140010290
mov edi, 0xc000009a
mov dword [rsp + 0x30], edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x140010336
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and qword [rsp + 0x20], 0
mov r9d, 0x38
lea r8, [rsp + 0xa0]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwQueryObject]
mov edi, eax
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test edi, edi
js 0x14001032e
cmp r14d, 0x38
jne 0x140010325
movups xmm0, xmmword [rsp + 0xa0]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rsp + 0xb0]
movups xmmword [rsi + 0x10], xmm1
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsi + 0x20], xmm0
movsd xmm1, qword [rsp + 0xd0]
movsd qword [rsi + 0x30], xmm1
jmp 0x140010323
jmp 0x14001032e
mov edi, 0xc0000004
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x34], 0x38
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov r15, qword [rsp + 0x68]
test r15, r15
je 0x14001036d
cmp byte [rsp + 0x140], 0
je 0x140010364
mov eax, dword [rsp + 0x34]
mov dword [r15], eax
jmp 0x140010362
jmp 0x14001036d
mov ecx, dword [rsp + 0x34]
mov rax, r15
mov dword [rax], ecx
mov eax, edi
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.140005c60
mov rbx, qword [rsp + 0x120]
add rsp, 0xe0
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret