Function at 0x20bc0
Capabilities:
Attach user process memory
Create thread
Find process by pid
Print debug messages

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbx
push rsi
push rdi
sub rsp, 0xc0
mov eax, 0x14
xor ecx, ecx
cpuid
mov edi, edx
mov edx, ecx
mov ecx, eax
lea rax, [rsp + 0x60]
mov dword [rax], ecx
mov dword [rax + 4], ebx
mov dword [rax + 8], edx
mov dword [rax + 0xc], edi
lea rcx, [0x00026f10]
call sub.ntoskrnl.exe_DbgPrint
mov dword [0x0002d4ec], 1
mov rax, qword [rsp + 0xf0]
movzx edx, word [rax]
lea rcx, [0x00026f30]
call sub.ntoskrnl.exe_DbgPrint
mov rdx, qword [rsp + 0xf0]
movzx eax, word [rdx]
test eax, eax
je 0x20c44
mov dword [rsp + 0xb8], 1
jmp 0x20c4f
mov dword [rsp + 0xb8], 0
mov eax, dword [rsp + 0xb8]
mov dword [0x00030448], eax
cmp dword [0x00030448], 0
je 0x20c9e
mov r8d, 0xc7
mov rdx, qword [rsp + 0xf0]
lea rcx, [0x0002d5e0]
call qword [sym.imp.ntoskrnl.exe_wcsncpy]
xor edx, edx
mov word [0x0002d76e], dx
lea rdx, [0x0002d5e0]
lea rcx, [0x00026f40]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x20caa
lea rcx, [0x00026f70]
call sub.ntoskrnl.exe_DbgPrint
cmp dword [rsp + 0xf8], 0
je 0x20d74
cmp qword [0x0002d4e0], 0
je 0x20cdc
xor edx, edx
mov rcx, qword [0x0002d4e0]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [0x0002d4e0], 0
movsxd rdx, dword [rsp + 0xf8]
imul rdx, rdx, 0x18
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [0x0002d4e0], rax
mov dword [rsp + 0x40], 0
jmp 0x20d0f
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0xf8]
cmp dword [rsp + 0x40], eax
jge 0x20d65
movsxd rcx, dword [rsp + 0x40]
imul rcx, rcx, 0x18
lea rdi, [rsp + 0xa0]
mov rax, qword [rsp + 0x100]
lea rsi, [rax + rcx]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
movsxd rcx, dword [rsp + 0x40]
imul rcx, rcx, 0x18
mov rax, qword [0x0002d4e0]
lea rsi, [rsp + 0xa0]
lea rdi, [rax + rcx]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
jmp 0x20d04
mov eax, dword [rsp + 0xf8]
mov dword [0x0002d5d8], eax
jmp 0x20d7e
mov dword [0x0002d5d8], 0
mov ecx, dword [rsp + 0xe0]
lea rdx, [0x0002d5d0]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x20de2
lea rdi, [rsp + 0x70]
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rdx, [rsp + 0x70]
mov rcx, qword [0x0002d5d0]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
call fcn.00012510
mov qword [0x0002d5c8], rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x20de0
jmp 0x20dfa
mov edx, dword [rsp + 0xe0]
lea rcx, [0x00026fc0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x212ae
cmp qword [0x0002d7b0], 0
je 0x20e0e
cmp qword [0x0002d7a0], 0
jne 0x20e1f
lea rcx, [0x00026ff0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x212ae
xor r8d, r8d
lea rdx, [0x0001fb80]
lea rcx, [0x0002d580]
call qword [sym.imp.ntoskrnl.exe_KeInitializeDpc]
xor r8d, r8d
mov edx, 1
lea rcx, [0x0002d780]
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
xor r8d, r8d
mov edx, 1
lea rcx, [0x0002d520]
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
xor edx, edx
lea rcx, [0x0002d540]
call qword [sym.imp.ntoskrnl.exe_KeInitializeMutex]
call qword [sym.imp.ntoskrnl.exe_KeQueryMaximumProcessorCount]
mov dword [0x0002d798], eax
movsxd rdx, dword [0x0002d798]
shl rdx, 3
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [0x0002d7a8], rax
movsxd rdx, dword [0x0002d798]
shl rdx, 3
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [0x0002d5c0], rax
mov dword [rsp + 0x40], 0
jmp 0x20eca
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x40], eax
mov eax, dword [0x0002d798]
cmp dword [rsp + 0x40], eax
jge 0x21178
xor r8d, r8d
mov edx, 0x13c
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdx, rax
movsxd rcx, dword [rsp + 0x40]
mov rax, qword [0x0002d7a8]
mov qword [rax + rcx*8], rdx
movsxd rax, dword [rsp + 0x40]
mov rdi, qword [0x0002d7a8]
mov rdi, qword [rdi + rax*8]
xor eax, eax
mov ecx, 0x13c
rep stosb byte [rdi], al
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rax*8]
add rcx, 0x58
xor r8d, r8d
mov edx, 1
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
movsxd rdx, dword [rsp + 0x40]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rdx*8]
add rcx, 0x40
mov r8b, 1
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
movsxd rdx, dword [rsp + 0x40]
mov r9, qword [0x0002d7a8]
mov r9, qword [r9 + rdx*8]
add r9, 0x30
movsxd rax, dword [rsp + 0x40]
mov r8, qword [0x0002d7a8]
mov r8, qword [r8 + rax*8]
add r8, 0x20
movsxd rax, dword [rsp + 0x40]
mov rdx, qword [0x0002d7a8]
mov rdx, qword [rdx + rax*8]
add rdx, 0x10
movsxd rbx, dword [rsp + 0x40]
mov eax, dword [rsp + 0xe8]
mov dword [rsp + 0x20], eax
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rbx*8]
call fcn.00020250
movsxd rdx, dword [rsp + 0x40]
mov r9, qword [0x0002d7a8]
mov r9, qword [r9 + rdx*8]
add r9, 0x38
movsxd rax, dword [rsp + 0x40]
mov r8, qword [0x0002d7a8]
mov r8, qword [r8 + rax*8]
add r8, 0x28
movsxd rax, dword [rsp + 0x40]
mov rdx, qword [0x0002d7a8]
mov rdx, qword [rdx + rax*8]
add rdx, 0x18
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rax*8]
add rcx, 8
mov eax, dword [rsp + 0xe8]
mov dword [rsp + 0x20], eax
call fcn.00020250
mov edx, dword [rsp + 0x40]
lea rcx, [0x00027010]
call sub.ntoskrnl.exe_DbgPrint
movsxd rdx, dword [rsp + 0x40]
mov r8, qword [0x0002d7a8]
mov r8, qword [r8 + rdx*8]
movsxd rax, dword [rsp + 0x40]
mov rdx, qword [0x0002d7a8]
mov rdx, qword [rdx + rax*8]
mov r9d, dword [rsp + 0xe8]
mov r8, qword [r8 + 0x10]
mov rdx, qword [rdx]
lea rcx, [0x00027020]
call sub.ntoskrnl.exe_DbgPrint
movsxd rdx, dword [rsp + 0x40]
mov r8, qword [0x0002d7a8]
mov r8, qword [r8 + rdx*8]
movsxd rax, dword [rsp + 0x40]
mov rdx, qword [0x0002d7a8]
mov rdx, qword [rdx + rax*8]
mov r9d, dword [rsp + 0xe8]
mov r8, qword [r8 + 0x18]
mov rdx, qword [rdx + 8]
lea rcx, [0x00027050]
call sub.ntoskrnl.exe_DbgPrint
movsxd rdx, dword [rsp + 0x40]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rdx*8]
add rcx, 0x70
xor r8d, r8d
mov edx, 1
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
movsxd rdx, dword [rsp + 0x40]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rdx*8]
add rcx, 0x88
xor r8d, r8d
mov edx, 1
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
movsxd rdx, dword [rsp + 0x40]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rdx*8]
add rcx, 0x118
mov r8b, 1
mov edx, 1
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
movsxd rcx, dword [rsp + 0x40]
mov rdx, qword [0x0002d7a8]
mov rdx, qword [rdx + rcx*8]
add rdx, 0x70
movsxd rcx, dword [rsp + 0x40]
mov rax, qword [0x0002d5c0]
mov qword [rax + rcx*8], rdx
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rax*8]
add rcx, 0xc8
xor r8d, r8d
lea rdx, [0x0001f400]
call qword [sym.imp.ntoskrnl.exe_KeInitializeDpc]
movsxd rdx, dword [rsp + 0x40]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rdx*8]
add rcx, 0xc8
movzx edx, byte [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeSetTargetProcessorDpc]
jmp 0x20ebf
mov byte [0x0002d4dc], 1
mov dword [0x0002d4e8], 1
mov qword [rsp + 0x30], 0
lea rax, [0x0001e890]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x0002d7b8]
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov qword [rsp + 0x30], 0
lea rax, [0x0001f830]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x0002d508]
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov dword [rsp + 0x40], 0
jmp 0x21204
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x40], eax
mov eax, dword [0x0002d798]
cmp dword [rsp + 0x40], eax
jge 0x21256
movsxd rdx, dword [rsp + 0x40]
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [0x0002d7a8]
mov rcx, qword [rcx + rax*8]
add rcx, 0x108
mov qword [rsp + 0x30], rdx
lea rax, [0x0001ee70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
jmp 0x211f9
lea r8, [0x000291a0]
mov edx, 8
mov ecx, 1
mov rax, qword [sym.imp.ntoskrnl.exe_HalDispatchTable]
call qword [rax + 0x10]
mov dword [rsp + 0x58], eax
mov edx, dword [rsp + 0x58]
lea rcx, [0x00026630]
call sub.ntoskrnl.exe_DbgPrint
cmp dword [rsp + 0x58], 0
je 0x2129a
lea rcx, [0x00027080]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x212ae
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x0001fd80]
call fcn.00012100
add rsp, 0xc0
pop rdi
pop rsi
pop rbx
ret