Function at 0x1400022c4
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rax, qword [0x140009010]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xorps xmm0, xmm0
xor r12d, r12d
mov r14d, r12d
mov qword [rbp - 0x79], r12
movups xmmword [rbp - 0x11], xmm0
mov rsi, rcx
movups xmmword [rbp - 1], xmm0
movups xmmword [rbp + 0xf], xmm0
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, rax
lea rdx, [rbp - 0x11]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
test rsi, rsi
jne 0x14000232e
mov ebx, 0xc0000225
jmp 0x140002562
movsd xmm0, qword [0x140007030]
lea rdx, [rbp + 0x1f]
movzx eax, word [0x140007038]
mov rcx, rsi
movsd qword [rbp + 0x1f], xmm0
mov word [rbp + 0x27], ax
call sub.ntoskrnl.exe_wcsstr
mov rcx, rax
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r12w
jne 0x140002359
test rcx, rcx
je 0x14000239f
lea eax, [rax*2 + 2]
xor ecx, ecx
movsxd rbx, eax
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
test rax, rax
jne 0x14000238f
mov ebx, 0xc000009a
jmp 0x140002562
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140005408
jmp 0x1400023e6
lea eax, [rax*2 + 0xa]
xor ecx, ecx
movsxd r15, eax
mov rdx, r15
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
test rax, rax
je 0x140002385
lea r8, [rbp + 0x1f]
mov rdx, r15
mov rcx, rax
call fcn.140005408
mov ebx, eax
test eax, eax
js 0x140002554
lfence
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call fcn.140005348
mov ebx, eax
test eax, eax
js 0x140002554
lfence
xorps xmm0, xmm0
lea rcx, [rbp - 0x71]
mov rdx, rdi
movups xmmword [rbp - 0x71], xmm0
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x60
lea rax, [rbp - 0x71]
mov qword [rbp - 0x51], 0x30
mov r15d, 1
mov qword [rbp - 0x41], rax
lea r9, [rbp - 0x21]
mov qword [rbp - 0x39], 0x40
lea r8, [rbp - 0x51]
mov qword [rbp - 0x49], r12
mov edx, 0x100000
mov dword [rsp + 0x20], r15d
lea rcx, [rbp - 0x79]
movups xmmword [rbp - 0x21], xmm0
movdqu xmmword [rbp - 0x31], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
mov ebx, eax
mov r14, rdi
test eax, eax
js 0x140002562
mov r8, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
lea rax, [rsp + 0x38]
mov rcx, qword [rbp - 0x79]
xor r9d, r9d
mov qword [rsp + 0x38], r12
xor edx, edx
mov qword [rsp + 0x28], r12
mov r8, qword [r8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov ebx, eax
test eax, eax
js 0x140002562
mov rcx, qword [rsp + 0x38]
mov rsi, r12
mov rbx, r12
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400024d6
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x28]
mov rsi, qword [rcx + 0x10]
mov rbx, qword [rcx]
mov qword [rcx + 0x10], r12
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x28]
mov qword [rcx], r12
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x30]
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0xd
mov r9d, r15d
lea rdx, [rbp - 0x61]
mov byte [rax + 0x4c], r15b
mov rcx, qword [rsp + 0x38]
movups xmmword [rbp - 0x61], xmm0
mov byte [rsp + 0x30], r15b
call fcn.140004574
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000253f
test rsi, rsi
je 0x14000252e
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x28]
mov qword [rcx + 0x10], rsi
test rbx, rbx
je 0x14000253f
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x28]
mov qword [rcx], rbx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov ebx, dword [rbp - 0x61]
mov qword [rsp + 0x38], r12
jmp 0x140002562
lfence
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp - 0x79]
test rcx, rcx
je 0x140002575
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rbp - 0x79], r12
test r14, r14
je 0x140002585
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rcx, [rbp - 0x11]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, ebx
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140006680
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret