Function at 0x14000e9f0
Capabilities:
Find process by pid
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7f0]
sub rsp, 0x8f0
mov rax, qword [0x1400d6a00]
xor rax, rsp
mov qword [rbp + 0x7e0], rax
mov qword [rbp - 0x68], rdx
mov r12d, 0x656e6864
mov edx, 0x10000
mov qword [rsp + 0x70], rcx
mov r8d, r12d
mov dword [rsp + 0x40], edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x14000ee2a
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call fcn.14001ea80
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov esi, 0x10
mov rdx, rbx
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov r14d, 0xc0000004
jmp 0x14000eacb
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [rsp + 0x40]
mov r8d, r12d
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x14000ee2a
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call fcn.14001ea80
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, rbx
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov edi, eax
cmp eax, r14d
je 0x14000ea80
test eax, eax
jns 0x14000eadd
mov eax, edi
jmp 0x14000ee2f
mov eax, dword [0x140079b58]
mov ecx, 1
mov r14d, dword [rbx]
mov r8d, 0x6d7467
imul rdx, rax, 0x640
mov qword [rbp - 0x70], r14
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
jne 0x14000eb14
mov eax, 0xc0000023
jmp 0x14000ee2f
mov eax, dword [0x140079b58]
xor edx, edx
imul r8, rax, 0x640
mov rcx, rsi
call fcn.14001ea80
xor ecx, ecx
mov r13d, ecx
mov r12d, ecx
test r14, r14
je 0x14000edf4
lea r15, [rbx + 0xc]
movzx eax, byte [r15]
lea r9, [rbp - 0x60]
movzx ebx, word [r15 - 4]
lea r8, [rbp - 0x50]
movzx r14d, word [r15 + 2]
xorps xmm0, xmm0
and qword [rbp - 0x38], 0
mov edx, 0x40
mov dword [rsp + 0x54], eax
mov rax, qword [r15 + 4]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x50], ecx
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x40], rcx
lea rcx, [rsp + 0x68]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x50], 0x30
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x60], rbx
movdqu xmmword [rbp - 0x30], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
xor ecx, ecx
mov edi, eax
test eax, eax
js 0x14000edbb
mov dword [rsp + 0x30], 2
lea r9, [rsp + 0x60]
mov dword [rsp + 0x28], ecx
or r8, 0xffffffffffffffff
mov rcx, qword [rsp + 0x68]
mov edx, r14d
mov dword [rsp + 0x20], 0x1fffff
call qword [sym.imp.ntoskrnl.exe_ZwDuplicateObject]
mov edi, eax
test eax, eax
js 0x14000edbb
mov edi, 0x400
mov r8d, 0x656e6864
mov edx, edi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r14, rax
test rax, rax
jne 0x14000ec16
mov edi, 0xc00000a0
jmp 0x14000edbb
mov r8, rdi
xor edx, edx
mov rcx, r14
call fcn.14001ea80
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
mov r9d, edi
mov qword [rsp + 0x20], rax
mov r8, r14
mov edx, 1
call qword [sym.imp.ntoskrnl.exe_ZwQueryObject]
mov edi, eax
xor eax, eax
cmp word [r14], ax
jbe 0x14000edad
xor edx, edx
lea rcx, [rbp + 0x3e0]
mov r8d, 0x400
call fcn.14001ea80
xor edx, edx
lea rcx, [rbp - 0x20]
mov r8d, 0x400
call fcn.14001ea80
mov rax, qword [rsp + 0x70]
or r8, 0xffffffffffffffff
xor edx, edx
inc r8
cmp word [rax + r8*2], dx
jne 0x14000ec81
mov rdx, rax
lea rcx, [rbp + 0x3e0]
call sub.ntoskrnl.exe_wcsncpy
mov rcx, qword [r14 + 8]
lea rdx, [rbp - 0x20]
call fcn.1400163bc
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp - 0x20]
call sub.ntoskrnl.exe_wcsstr
xor ecx, ecx
test rax, rax
je 0x14000edad
mov qword [rsp + 0x48], rcx
lea rdx, [rsp + 0x48]
mov rcx, rbx
inc r13d
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x14000edad
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessImageFileName]
xor edi, edi
mov ebx, r13d
test rax, rax
je 0x14000ed0e
imul rcx, rbx, 0x640
lea rdx, [rsi + 0x208]
add rdx, rcx
mov rcx, rax
call fcn.140009e30
mov rax, qword [rsp + 0x78]
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
imul rbx, rbx, 0x640
mov qword [rsp + 0x58], rdi
add rbx, rsi
mov qword [rbx + 0x618], rax
mov rax, qword [rbp - 0x80]
mov qword [rbx + 0x630], rax
mov rax, qword [rbp - 0x78]
mov qword [rbx + 0x628], rax
mov eax, dword [rsp + 0x54]
mov dword [rbx + 0x638], eax
mov qword [rbx + 0x620], rcx
call sub.ntoskrnl.exe_SeLocateProcessImageName
mov edi, eax
test eax, eax
js 0x14000ed76
mov rcx, qword [rsp + 0x58]
mov rdx, rbx
mov rcx, qword [rcx + 8]
call fcn.1400163bc
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea rax, [rbp - 0x20]
sub rbx, rax
lea rcx, [rbp - 0x20]
movzx eax, word [rcx]
mov word [rbx + rcx + 0x410], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14000ed99
mov edx, 0x656e6864
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x60]
xor ebx, ebx
test rcx, rcx
je 0x14000edcd
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000eddd
call qword [sym.imp.ntoskrnl.exe_ZwClose]
inc r12d
add r15, 0x18
movsxd rax, r12d
mov rcx, rbx
cmp rax, qword [rbp - 0x70]
jb 0x14000eb40
mov rcx, qword [rbp - 0x68]
lea eax, [r13 + 1]
mov dword [rsi + 0x63c], eax
mov rdx, rsi
mov eax, dword [0x140079b58]
imul r8, rax, 0x640
call fcn.14001e7c0
mov edx, 0x6d7467
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x14000ead6
mov eax, 0xc00000a0
mov rcx, qword [rbp + 0x7e0]
xor rcx, rsp
call fcn.14001e6e0
mov rbx, qword [rsp + 0x940]
add rsp, 0x8f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret