Function at 0x14000fcac
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r12, rdx
mov rbx, rcx
xor esi, esi
mov dword [rsp + 0x80], esi
mov eax, dword [0x140079b64]
imul rdx, rax, 0x38
mov r8d, 0x6d7467
lea r14d, [rsi + 1]
mov ecx, r14d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [0x1400d7918], rax
mov ecx, dword [0x140079b64]
imul r8, rcx, 0x38
xor edx, edx
mov rcx, rax
call fcn.14001ea80
and qword [rsp + 0x30], rsi
and qword [rsp + 0x28], rsi
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov r15d, eax
mov dword [rsp + 0x20], eax
test eax, eax
jns 0x14000fd36
mov eax, 0xc0000001
jmp 0x14000ff32
mov rdi, qword [rsp + 0x30]
xor bl, bl
test rdi, rdi
je 0x14000fd82
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000fd82
mov rcx, qword [0x1400d6b50]
add rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000fd82
mov rax, qword [0x1400d6b50]
mov rcx, qword [rax + rdi]
test rcx, rcx
je 0x14000fd82
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx ebx, bl
test al, al
cmovne ebx, r14d
test bl, bl
jne 0x14000fd93
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x14000fd2c
mov edi, 4
mov dword [rsp + 0x88], edi
cmp edi, 0x40000
jae 0x14000feef
mov ecx, edi
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
test eax, eax
js 0x14000fee7
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_IoThreadToProcess]
cmp rax, qword [rsp + 0x30]
jne 0x14000fee7
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000fee7
mov eax, esi
imul rbx, rax, 0x38
mov rcx, qword [rsp + 0x28]
mov rax, qword [0x1400d7918]
mov qword [rbx + rax + 0x20], rcx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_PsGetThreadId]
mov rcx, qword [0x1400d7918]
mov dword [rbx + rcx], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_PsGetThreadTeb]
mov rcx, qword [0x1400d7918]
mov qword [rbx + rcx + 0x10], rax
mov rcx, qword [0x1400d6be0]
mov rax, qword [rsp + 0x28]
mov rdx, qword [rcx + rax]
mov rax, qword [0x1400d7918]
mov qword [rbx + rax + 0x18], rdx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeQueryPriorityThread]
mov rcx, qword [0x1400d7918]
mov dword [rbx + rcx + 4], eax
mov rcx, qword [0x1400d6bd0]
mov rax, qword [rsp + 0x28]
mov edx, dword [rcx + rax]
mov rax, qword [0x1400d7918]
mov dword [rbx + rax + 8], edx
mov rcx, qword [0x1400d6bd8]
mov rax, qword [rsp + 0x28]
movsx edx, byte [rcx + rax]
mov rax, qword [0x1400d7918]
mov dword [rbx + rax + 0xc], edx
mov rcx, qword [rsp + 0x28]
call fcn.14001a384
movzx ecx, al
mov rax, qword [0x1400d7918]
mov qword [rbx + rax + 0x28], rcx
jmp 0x14000fecc
add esi, r14d
mov dword [rsp + 0x80], esi
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
and qword [rsp + 0x28], 0
add edi, 4
jmp 0x14000fd98
mov rax, qword [0x1400d7918]
mov dword [rax + 0x30], esi
mov eax, dword [0x140079b64]
imul r8, rax, 0x38
mov rdx, qword [0x1400d7918]
mov rcx, r12
call fcn.14001e7c0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov edx, 0x6d7467
mov rcx, qword [0x1400d7918]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, r15d
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret