Function at 0x140001d70
Capabilities:
Attach user process memory
Find process by pid
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
xor ebx, ebx
mov dword [rbp - 0x19], 0x1a0018
lea rax, [0x140003310]
mov qword [0x140005560], rbx
lea rcx, [rbp - 0x19]
mov dword [0x140005558], ebx
mov qword [0x140005550], rbx
mov dword [0x140005548], ebx
mov qword [rbp - 0x11], rax
call fcn.14000173c
test rax, rax
je 0x1400020ae
lea rdx, [rbp + 0x67]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400020a5
mov rcx, qword [rbp + 0x67]
lea rdx, [rbp + 0x17]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea rax, [0x140003330]
mov dword [rbp - 9], 0x140012
lea rcx, [rbp - 9]
mov qword [rbp - 1], rax
call fcn.140001944
mov rsi, rax
test rax, rax
je 0x14000205a
movsxd rax, dword [rax + 0x3c]
xor ecx, ecx
mov r8d, 0x6e556353
mov r14d, dword [rax + rsi + 0x88]
add r14, rsi
mov eax, dword [r14 + 0x18]
imul rdx, rax, 0x104
mov dword [0x140005558], eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [0x140005560], rax
mov rcx, rax
test rax, rax
je 0x140002051
mov eax, dword [0x140005558]
xor edx, edx
imul r8, rax, 0x104
call fcn.140002f80
cmp dword [0x140005558], ebx
mov r15d, ebx
je 0x140001f0a
mov ecx, dword [r14 + 0x20]
add rcx, rsi
mov r9d, r15d
mov edx, dword [rcx + r9*4]
add rdx, rsi
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], bl
jne 0x140001e92
cmp rax, 2
jbe 0x140001efa
cmp byte [rdx], 0x4e
jne 0x140001efa
cmp byte [rdx + 1], 0x74
jne 0x140001efa
mov ecx, dword [r14 + 0x24]
add rcx, rsi
movzx r8d, word [rcx + r9*2]
mov ecx, dword [r14 + 0x1c]
add rcx, rsi
mov eax, dword [rcx + r8*4]
cmp dword [rax + rsi], 0xb8d18b4c
jne 0x140001efa
mov ecx, dword [rax + rsi + 4]
mov rax, qword [0x140005560]
imul r8, r9, 0x104
mov dword [r8 + rax + 0x100], ecx
mov rcx, qword [0x140005560]
add rcx, r8
mov r8d, 0xff
call sub.ntoskrnl.exe_strncpy
inc r15d
cmp r15d, dword [0x140005558]
jb 0x140001e7d
lea rax, [0x140003350]
mov dword [rbp + 7], 0x160014
lea rcx, [rbp + 7]
mov qword [rbp + 0xf], rax
call fcn.140001944
mov rsi, rax
test rax, rax
je 0x140002048
movsxd rax, dword [rax + 0x3c]
xor ecx, ecx
mov r8d, 0x6e556353
mov r15d, dword [rax + rsi + 0x88]
add r15, rsi
mov eax, dword [r15 + 0x18]
imul rdx, rax, 0x104
mov dword [0x140005548], eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [0x140005550], rax
mov rcx, rax
test rax, rax
je 0x14000203f
mov eax, dword [0x140005548]
xor edx, edx
imul r8, rax, 0x104
call fcn.140002f80
mov eax, dword [0x140005548]
mov r14d, ebx
test eax, eax
je 0x140002026
mov ecx, dword [r15 + 0x20]
add rcx, rsi
mov r9d, r14d
mov edx, dword [rcx + r9*4]
add rdx, rsi
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], bl
jne 0x140001fac
cmp rax, 2
jbe 0x140002014
cmp byte [rdx], 0x4e
jne 0x140002014
cmp byte [rdx + 1], 0x74
jne 0x140002014
mov ecx, dword [r15 + 0x24]
add rcx, rsi
movzx r8d, word [rcx + r9*2]
mov ecx, dword [r15 + 0x1c]
add rcx, rsi
mov eax, dword [rcx + r8*4]
cmp dword [rax + rsi], 0xb8d18b4c
jne 0x140002014
mov ecx, dword [rax + rsi + 4]
mov rax, qword [0x140005550]
imul r8, r9, 0x104
mov dword [r8 + rax + 0x100], ecx
mov rcx, qword [0x140005550]
add rcx, r8
mov r8d, 0xff
call sub.ntoskrnl.exe_strncpy
mov eax, dword [0x140005548]
inc r14d
cmp r14d, eax
jb 0x140001f97
cmp dword [0x140005558], ebx
jbe 0x140002036
test eax, eax
je 0x140002036
mov bl, 1
jmp 0x14000206c
lea r8, [0x140003370]
jmp 0x140002061
lea r8, [0x1400033a0]
jmp 0x140002061
lea r8, [0x1400033e0]
jmp 0x140002061
lea r8, [0x140003420]
jmp 0x140002061
lea r8, [0x140003460]
xor edx, edx
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, dword [0x140005548]
lea r8, [0x1400034a0]
mov r9d, dword [0x140005558]
xor edx, edx
mov dword [rsp + 0x20], eax
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea rcx, [rbp + 0x17]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x1400020c0
lea r8, [0x1400034d0]
jmp 0x1400020b5
lea r8, [0x140003510]
xor edx, edx
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r11, [rsp + 0x90]
mov al, bl
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret