Function at 0x1400886a8
Capabilities:
Attach user process memory

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x50], r8
mov dword [rsp + 0x30], edx
mov r12, rcx
xor eax, eax
mov r13b, al
mov ecx, 0x4196
call fcn.140029ab4
mov qword [rsp + 0x40], rax
mov ecx, 3
call fcn.140029ab4
mov r15, rax
mov ecx, 2
call fcn.140029ab4
mov qword [rsp + 0x28], rax
mov ecx, 0x4172
call fcn.140029ab4
mov qword [rsp + 0x38], rax
mov ecx, 0x41db
call fcn.140029ab4
mov r14, rax
mov ecx, 0x1cf
call fcn.140029ab4
mov rbx, rax
mov ecx, 0x1d1
call fcn.140029ab4
mov rsi, rax
mov ecx, 0x3c
call fcn.140029ab4
mov rdi, rax
xor eax, eax
cmp qword [rsp + 0x40], rax
je 0x140088dac
test r15, r15
je 0x140088dac
cmp dword [rsp + 0x28], eax
je 0x140088dac
cmp qword [rsp + 0x38], rax
je 0x140088dac
test r14, r14
je 0x140088dac
test ebx, ebx
je 0x140088dac
test esi, esi
je 0x140088dac
test edi, edi
je 0x140088dac
lea r13d, [rax + 1]
test r12, r12
je 0x140088dac
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call fcn.14004efe0
xor edx, edx
test al, al
je 0x140088dac
mov qword [rsp + 0x58], r12
mov eax, edi
mov rcx, qword [rax + r12]
mov qword [rsp + 0x68], rcx
mov r14d, edx
mov qword [rsp + 0x60], rdx
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x70], eax
mov rcx, r12
call qword [rsp + 0x40]
mov rdi, rax
mov qword [rsp + 0x30], rax
mov rcx, rax
call fcn.140077928
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x78]
mov rcx, rdi
call sub.ntoskrnl.exe_KeStackAttachProcess
mov rcx, r12
call fcn.140078170
cmp al, r13b
jne 0x140088d68
mov ecx, ebx
mov rdi, qword [rcx + r12]
mov ecx, esi
mov rsi, qword [rcx + r12]
lea rcx, [rdi - 1]
mov dl, r13b
call fcn.14005976c
cmp al, r13b
jne 0x140088d63
mov dl, r13b
mov rcx, rsi
call fcn.14005976c
cmp al, r13b
jne 0x140088d63
mov ebx, 0x914
mov ecx, ebx
call fcn.140029ab4
cmp eax, 0xa28
jne 0x1400888be
mov rcx, rsi
xor r9d, r9d
cmp rsi, rdi
jae 0x140088d52
lea rdx, [rcx + 8]
lea rax, [rdx + 0x58]
cmp rax, rdi
ja 0x140088d52
cmp r12, qword [rcx]
jne 0x1400888b6
cmp qword [rdx], r9
jne 0x1400888b6
mov rax, qword [rcx + 0x18]
cmp rax, rsi
jbe 0x1400888b6
cmp rax, rdi
jae 0x1400888b6
mov r8, qword [rcx + 0x20]
cmp r8, r15
jbe 0x1400888b6
mov eax, dword [rsp + 0x28]
add rax, r15
cmp r8, rax
jb 0x140088c20
mov rcx, rdx
cmp rdx, rdi
jmp 0x14008886e
mov ecx, ebx
call fcn.140029ab4
cmp eax, 0x1db0
je 0x140088c29
mov ecx, ebx
call fcn.140029ab4
cmp eax, 0x1db1
je 0x140088c29
mov ecx, ebx
call fcn.140029ab4
cmp eax, 0x23f0
jne 0x14008897f
add rsi, 0x50
cmp rsi, rdi
jae 0x140088d4f
mov r8, qword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
lea rax, [rsi + 0xa0]
cmp rax, rdi
ja 0x140088d4f
cmp r12, qword [rsi]
jne 0x140088967
movabs rax, 0xfffffffe9a5f4400
cmp qword [rsi - 8], rax
jne 0x140088967
mov rdx, qword [rsi + 8]
cmp rdx, r15
jbe 0x140088967
mov ecx, dword [rsp + 0x28]
add rcx, r15
cmp rdx, rcx
jae 0x140088967
mov rax, qword [rsi + 0x10]
cmp rax, r15
jbe 0x140088967
cmp rax, rcx
jae 0x140088967
mov rax, qword [rsi - 0x10]
cmp rax, r15
jbe 0x140088967
cmp rax, rcx
jae 0x140088967
mov rax, qword [r8]
cmp qword [rsi + 0x48], rax
jae 0x140088976
add rsi, 8
cmp rsi, rdi
jae 0x140088d4f
jmp 0x140088908
mov r14, qword [rsi - 0x30]
jmp 0x140088d4f
mov ecx, ebx
call fcn.140029ab4
cmp eax, 0x2580
jne 0x140088ad8
lea rbx, [rsi + 0x50]
cmp rbx, rdi
jae 0x140088d4f
lea rax, [rbx + 0xa0]
cmp rax, rdi
ja 0x140088d4f
cmp r12, qword [rbx]
jne 0x140088ab4
mov ecx, 0x8ea
call fcn.140029ab4
xor edx, edx
mov rcx, qword [rbx + 8]
test rax, rax
jne 0x140088a14
cmp rcx, r15
jbe 0x140088ab4
mov eax, dword [rsp + 0x28]
add rax, r15
cmp rcx, rax
jae 0x140088ab4
mov rax, qword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
mov rcx, qword [rax]
cmp qword [rbx + 0x10], rcx
jbe 0x140088ab4
cmp qword [rbx + 0x18], 2
jne 0x140088ab4
cmp qword [rbx + 0x38], 0x28
je 0x140088abd
jmp 0x140088ab4
cmp rcx, r15
jbe 0x140088a75
mov eax, dword [rsp + 0x28]
add rax, r15
cmp rcx, rax
jae 0x140088a75
mov rax, qword [rbx + 0x10]
cmp rax, r13
jne 0x140088a49
mov rax, qword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
mov rcx, qword [rax]
cmp qword [rbx + 0x18], rcx
jbe 0x140088ab4
mov rax, qword [rbx + 0x20]
cmp qword [rbx], rax
je 0x140088ac6
jmp 0x140088ab4
test rax, rax
jne 0x140088ab4
cmp qword [rbx + 0x18], rdx
jne 0x140088ab4
cmp qword [rbx + 0x20], rdx
jne 0x140088ab4
mov rax, qword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
mov rcx, qword [rax]
cmp qword [rbx + 0x38], rcx
jbe 0x140088ab4
mov rax, qword [rbx + 0x30]
cmp qword [rbx], rax
je 0x140088acf
jmp 0x140088ab4
cmp rcx, r13
jne 0x140088ab4
cmp qword [rbx + 0x30], rdx
jne 0x140088ab4
mov rdx, qword [rbx]
cmp rdx, qword [rbx + 0x18]
jne 0x140088ab4
mov rcx, qword [rbx + 0x28]
mov rax, qword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
cmp rcx, qword [rax]
jbe 0x140088ab4
cmp rdx, rcx
je 0x140088ab4
xor rcx, rdx
movabs rax, 0xffffffff00000000
test rax, rcx
jne 0x140088d4b
add rbx, 8
jmp 0x140088995
mov r14, qword [rbx + 0x10]
jmp 0x140088d4f
mov r14, qword [rbx + 0x18]
jmp 0x140088d4f
mov r14, qword [rbx + 0x38]
jmp 0x140088d4f
mov ecx, ebx
call fcn.140029ab4
cmp eax, 0x1770
jb 0x140088b65
mov ecx, ebx
call fcn.140029ab4
cmp eax, 0x1772
ja 0x140088b65
mov rcx, rsi
xor r9d, r9d
cmp rsi, rdi
jae 0x140088d52
lea rdx, [rcx + 8]
lea rax, [rdx + 0x58]
cmp rax, rdi
ja 0x140088d52
cmp r12, qword [rcx]
jne 0x140088b41
cmp qword [rdx], r9
jne 0x140088b41
mov rax, qword [rcx + 0x50]
cmp rax, rsi
jbe 0x140088b41
cmp rax, rdi
jae 0x140088b41
mov r8, qword [rcx + 0x58]
cmp r8, r15
jbe 0x140088b41
mov eax, dword [rsp + 0x28]
add rax, r15
cmp r8, rax
jb 0x140088b49
mov rcx, rdx
cmp rdx, rdi
jmp 0x140088afd
mov r14, qword [rcx + 0x40]
mov rax, qword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
cmp r14, qword [rax]
jae 0x140088d52
mov r14, r9
jmp 0x140088d52
mov ecx, ebx
call fcn.140029ab4
mov rcx, rsi
xor r9d, r9d
cmp eax, 0xece
jne 0x140088bd1
cmp rsi, rdi
jae 0x140088d52
lea rdx, [rcx + 8]
lea rax, [rdx + 0x58]
cmp rax, rdi
ja 0x140088d52
cmp r12, qword [rcx]
jne 0x140088bc0
cmp qword [rdx], r9
jne 0x140088bc0
mov rax, qword [rcx + 0x38]
cmp rax, rsi
jbe 0x140088bc0
cmp rax, rdi
jae 0x140088bc0
mov r8, qword [rcx + 0x40]
cmp r8, r15
jbe 0x140088bc0
mov eax, dword [rsp + 0x28]
add rax, r15
cmp r8, rax
jb 0x140088bc8
mov rcx, rdx
cmp rdx, rdi
jmp 0x140088b7c
mov r14, qword [rcx + 0x30]
jmp 0x140088d52
cmp rsi, rdi
jae 0x140088d52
lea rdx, [rcx + 8]
lea rax, [rdx + 0x58]
cmp rax, rdi
ja 0x140088d52
cmp r12, qword [rcx]
jne 0x140088c18
cmp qword [rdx], r9
jne 0x140088c18
mov rax, qword [rcx + 0x20]
cmp rax, rsi
jbe 0x140088c18
cmp rax, rdi
jae 0x140088c18
mov r8, qword [rcx + 0x28]
cmp r8, r15
jbe 0x140088c18
mov eax, dword [rsp + 0x28]
add rax, r15
cmp r8, rax
jb 0x140088c20
mov rcx, rdx
cmp rdx, rdi
jmp 0x140088bd4
mov r14, qword [rcx + 0x10]
jmp 0x140088d52
mov rbx, rsi
cmp rsi, rdi
jae 0x140088d4f
lea rax, [rbx + 0xa0]
cmp rax, rdi
ja 0x140088d4f
mov ecx, 0x914
call fcn.140029ab4
cmp eax, 0x1db0
jne 0x140088ceb
cmp r12, qword [rbx]
jne 0x140088d33
mov rcx, qword [rbx + 0x38]
mov rdx, qword [rbx + 0x40]
mov r10, qword [rsp + 0x28]
cmp rcx, rdx
jne 0x140088ca7
mov rax, qword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
cmp rdx, qword [rax]
jb 0x140088ca7
mov rdx, qword [rbx + 0x50]
cmp rdx, r15
jbe 0x140088ca7
mov r8d, r10d
add r8, r15
cmp rdx, r8
jae 0x140088ca7
mov rax, qword [rbx + 0x58]
cmp rax, r15
jbe 0x140088ca7
cmp rax, r8
jb 0x140088d3f
mov rax, qword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
mov r9, qword [rax]
cmp qword [rbx + 0x28], r9
jb 0x140088d33
mov rdx, qword [rbx + 8]
cmp rdx, r15
jbe 0x140088d33
mov r8d, r10d
add r8, r15
cmp rdx, r8
jae 0x140088d33
mov rax, qword [rbx + 0x10]
cmp rax, r15
jbe 0x140088d33
cmp rax, r8
jae 0x140088d33
cmp rcx, rsi
jbe 0x140088d33
cmp rcx, rdi
jae 0x140088d33
cmp qword [rbx + 0x48], r9
jae 0x140088d45
jmp 0x140088d33
xor eax, eax
cmp qword [rbx + 8], rax
jne 0x140088d33
cmp qword [rbx + 0x18], rax
jne 0x140088d33
mov rdx, qword [rbx + 0x20]
mov rax, qword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
mov rcx, qword [rax]
cmp rdx, rcx
jb 0x140088d33
cmp qword [rbx + 0x28], rcx
jb 0x140088d33
cmp qword [rbx + 0x30], r13
jne 0x140088d33
cmp r12, qword [rbx + 0x48]
jne 0x140088d33
cmp qword [rbx + 0x50], rcx
jb 0x140088d33
cmp qword [rbx + 0x58], rcx
jb 0x140088d33
cmp qword [rbx + 0x90], rdx
je 0x140088d4b
add rbx, 8
cmp rbx, rdi
jmp 0x140088c2f
mov r14, qword [rbx + 0x68]
jmp 0x140088d4f
mov r14, qword [rbx + 0x20]
jmp 0x140088d4f
mov r14, qword [rbx + 0x28]
xor r9d, r9d
mov rax, qword [rsp + 0x38]
cmp r14, qword [rax]
cmovb r14, r9
mov qword [rsp + 0x60], r14
mov rdi, qword [rsp + 0x30]
lea rcx, [rsp + 0x78]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
cmp byte [rsp + 0x20], r13b
jne 0x140088d82
mov rcx, rdi
call fcn.140077a00
nop
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rax + 0x10], xmm1
add qword [rcx], 0x20
mov rax, qword [rsp + 0x48]
add dword [rax], r13d
jmp 0x140088dac
mov al, r13b
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14008c320
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret