Function at 0x46a0c
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rsi
push rdi
push r13
sub rsp, 0xd0
mov r13, rdx
mov esi, ecx
xor ebx, ebx
mov qword [rax + 0x20], rbx
mov qword [rax - 0x58], rbx
mov qword [rax + 0x18], rbx
or qword [rax - 0x60], 0xffffffffffffffff
mov edi, ebx
cmp ecx, 0xc
jae 0x46a4a
mov rcx, rdx
call fcn.00047758
jmp 0x46cd9
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp esi, eax
je 0x46ac0
mov qword [rsp + 0x78], rbx
mov rcx, rsi
lea rdx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, ebx
jl 0x46cd9
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], bl
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov r9d, 0x80000000
xor r8d, r8d
mov edx, 0x200
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov edi, eax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp edi, ebx
jge 0x46ac0
mov eax, edi
jmp 0x46cd9
mov edx, 0x400
mov dword [rsp + 0xf0], edx
mov ecx, 1
mov r8d, 0x75505349
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
mov qword [rsp + 0x90], rax
cmp rax, rbx
je 0x46c8a
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xf0]
mov r8, rsi
mov edx, 0x1b
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
mov edi, eax
mov dword [rsp + 0x70], eax
cmp eax, 0xc0000004
jne 0x46b87
mov edx, 0x75505349
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [rsp + 0xf0]
mov ecx, 1
mov r8d, 0x75505349
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xf0]
mov r8, rsi
mov edx, 0x1b
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
mov edi, eax
mov dword [rsp + 0x70], eax
cmp edi, ebx
jl 0x46c8a
mov dword [rsp + 0x98], 0x30
mov qword [rsp + 0xa0], rbx
mov dword [rsp + 0xb0], 0x240
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xc0], rbx
mov dword [rsp + 0x68], 0x100
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x98]
mov edx, 0x80000000
lea rcx, [rsp + 0x108]
call qword [sym.imp.ntoskrnl.exe_IoCreateFile]
mov edi, eax
mov dword [rsp + 0x70], eax
cmp eax, ebx
jl 0x46c8a
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x100]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov r8, qword [r8]
xor edx, edx
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov edi, eax
mov dword [rsp + 0x70], eax
cmp eax, ebx
jl 0x46c8a
mov rdx, r13
mov rcx, qword [rsp + 0x100]
call fcn.00047e34
mov edi, eax
mov dword [rsp + 0x70], eax
cmp eax, ebx
jl 0x46c8a
mov rcx, r13
call fcn.00047cf4
nop
mov rcx, qword [rsp + 0x100]
cmp rcx, rbx
je 0x46c9d
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x108]
cmp rcx, rbx
je 0x46cb0
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp rsi, rbx
je 0x46cc3
mov edx, 0x75505349
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x46cd7
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
mov rbx, qword [rsp + 0xf8]
add rsp, 0xd0
pop r13
pop rdi
pop rsi
ret