Function at 0x14005430c
Capabilities:
Attach user process memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov ecx, 0x61
call fcn.140029ab4
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
xor r12d, r12d
cmp rax, rdi
cmove rdi, r12
mov qword [rbp - 0x11], rdi
test rdi, rdi
je 0x14005436f
lea rdx, [rbp - 9]
mov rcx, rdi
call sub.ntoskrnl.exe_KeStackAttachProcess
mov ecx, 0x20
call fcn.140029ab4
mov ecx, 0x21
mov rsi, rax
call fcn.140029ab4
mov ecx, 3
mov r15, rax
call fcn.140029ab4
mov ecx, 0x42b8
mov rbx, rax
mov qword [rbp - 0x49], rax
call fcn.140029ab4
mov rcx, rax
test rsi, rsi
je 0x140054556
test r15d, r15d
je 0x140054556
test rbx, rbx
je 0x140054556
test eax, eax
je 0x140054556
cmp eax, r15d
jae 0x140054556
movsxd rax, dword [rsi + 0x3c]
mov ebx, ecx
mov r14d, r15d
mov r13, qword [rax + rsi + 0x30]
add rbx, rsi
add r14, rsi
mov esi, r12d
lea r8, [rbp - 0x41]
mov rdx, r14
mov rcx, rbx
call fcn.140010e58
test al, al
je 0x140054556
mov eax, dword [rbp - 0x29]
add rbx, rax
mov rax, qword [rbp - 0x19]
mov ecx, dword [rax]
mov eax, dword [rbp - 0x35]
cmp ecx, 0x107c
jne 0x14005441c
test eax, eax
js 0x140054435
cmp ecx, 0x1096
jne 0x140054428
test eax, eax
js 0x140054435
inc esi
cmp esi, 0x50
jae 0x140054556
jmp 0x1400543ea
mov rdi, qword [rbp - 0x49]
xor esi, esi
lea r8, [rbp - 0x41]
mov rdx, r14
mov rcx, rbx
call fcn.140010e58
test al, al
je 0x140054552
mov eax, dword [rbp - 0x29]
add rbx, rax
mov rax, qword [rbp - 0x19]
mov ecx, dword [rax]
cmp ecx, 0x1024
je 0x140054472
cmp ecx, 0x1285
jne 0x140054547
cmp dword [rbp - 0x31], 0x7f
mov eax, pe_nt_image_headers64
lea r8, [rbp - 0x41]
lea ecx, [rax - 0x80]
movzx r12d, r12b
mov rdx, r14
cmove eax, ecx
cmp dword [rbp - 0x31], 0x1ff
mov dword [rbp - 0x49], eax
lea eax, [rcx - 0x7f]
mov rcx, rbx
cmove r12d, eax
call fcn.140010e58
test r12b, r12b
jne 0x1400544d0
cmp al, 1
jne 0x140054547
mov rax, qword [rbp - 0x19]
cmp dword [rax], 0x1080
jne 0x140054547
movsxd rcx, dword [rbp - 0x35]
cmp rcx, r13
jbe 0x140054547
sub ecx, r13d
jmp 0x140054514
cmp al, 1
jne 0x140054547
mov eax, dword [rbp - 0x29]
add rbx, rax
mov rax, qword [rbp - 0x19]
cmp dword [rax], 0x1270
jne 0x140054547
lea r8, [rbp - 0x41]
mov rdx, r14
mov rcx, rbx
call fcn.140010e58
cmp al, 1
jne 0x140054547
mov rax, qword [rbp - 0x19]
cmp dword [rax], 0x1037
jne 0x140054547
movsxd rcx, dword [rbp - 0x35]
cmp rcx, r13
jbe 0x140054547
sub ecx, r13d
sub ecx, 0xc
test ecx, ecx
je 0x140054547
cmp ecx, r15d
jae 0x140054547
mov edx, ecx
mov ecx, 0x299
add rdx, rdi
call fcn.140029bac
mov edx, dword [rbp - 0x49]
mov ecx, 0x29a
call fcn.140029bac
movzx edx, r12b
mov ecx, 0x29b
call fcn.140029bac
inc esi
cmp esi, 0xa
jb 0x14005443b
mov rdi, qword [rbp - 0x11]
test rdi, rdi
je 0x140054564
lea rcx, [rbp - 9]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret