Function at 0x140007dd0
Capabilities:
Attach user process memory

Disassembly:
push rbp
push rbx
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
xor r15d, r15d
lea rdx, [0x140009af0]
mov rax, 0xffffffffffffffff
mov word [rsp + 0x60], r15w
mov qword [rsp + 0x68], rdx
mov rcx, rax
inc rcx
cmp byte [rdx + rcx], r15b
jne 0x140007e00
mov qword [rsp + 0x70], rcx
lea rdx, [0x140009b10]
lea rcx, [0x140007160]
mov word [rbp - 0x78], r15w
mov qword [rsp + 0x78], rcx
lea rcx, [0x14000e010]
mov qword [rbp - 0x80], rcx
mov rcx, rax
mov qword [rbp - 0x70], rdx
nop dword [rax + rax]
inc rcx
cmp byte [rdx + rcx], r15b
jne 0x140007e40
mov qword [rbp - 0x68], rcx
lea rdx, [0x140009b30]
lea rcx, [0x140007310]
mov word [rbp - 0x50], r15w
mov qword [rbp - 0x60], rcx
lea rcx, [0x14000e0a8]
mov qword [rbp - 0x58], rcx
mov rcx, rax
mov qword [rbp - 0x48], rdx
inc rcx
cmp byte [rdx + rcx], r15b
jne 0x140007e76
mov qword [rbp - 0x40], rcx
lea rdx, [0x140009b50]
lea rcx, [0x140007090]
mov word [rbp - 0x28], r15w
mov qword [rbp - 0x38], rcx
lea rcx, [0x14000df90]
mov qword [rbp - 0x30], rcx
mov rcx, rax
mov qword [rbp - 0x20], rdx
nop dword [rax]
inc rcx
cmp byte [rdx + rcx], r15b
jne 0x140007eb0
mov qword [rbp - 0x18], rcx
lea rbx, [0x140009b70]
lea rcx, [0x140007490]
mov word [rbp], r15w
mov qword [rbp - 0x10], rcx
lea rcx, [0x14000dfd0]
mov qword [rbp - 8], rcx
mov qword [rbp + 8], rbx
inc rax
cmp byte [rbx + rax], r15b
jne 0x140007ee3
cmp dword [0x14000df28], 0x1db1
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x20], r15
ja 0x140007f1b
lea rax, [0x140007240]
mov qword [rsp + 0x78], rax
lea rax, [0x14000e040]
mov qword [rbp - 0x80], rax
lea rcx, [rsp + 0x60]
call fcn.140003160
test al, al
jne 0x140007f55
mov r9d, 0x732
lea r8, [0x14000a0a0]
lea rdx, [0x14000a0c0]
mov ecx, 1
call fcn.140003c60
xor al, al
add rsp, 0x160
pop r15
pop rbx
pop rbp
ret
movzx edx, word [rbp]
mov rcx, rbx
call fcn.1400085c0
mov qword [0x14000dfc0], rax
test rax, rax
jne 0x140007f97
mov r9d, 0x739
lea r8, [0x14000a0a0]
lea rdx, [0x14000a0f0]
lea ecx, [rax + 1]
call fcn.140003c60
xor al, al
add rsp, 0x160
pop r15
pop rbx
pop rbp
ret
mov qword [rsp + 0x188], rdi
lea rbx, [rsp + 0x68]
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x190], r14
nop dword [rax]
nop dword [rax + rax]
mov rdi, qword [rbx + 0x10]
test rdi, rdi
je 0x14000804d
mov r14, qword [rbx]
movzx edx, word [rbx - 8]
mov rcx, r14
call fcn.1400085c0
mov rsi, rax
test rax, rax
je 0x140008088
call fcn.1400086d0
lea rdx, [rbp + 0x30]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
mov rax, cr3
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x30]
lea rcx, [0x1400034c0]
mov word [rsp + 0x50], r15w
call qword [sym.imp.ntoskrnl.exe_KeGenericCallDpc]
mov ecx, 0xffff
call qword [sym.imp.ntoskrnl.exe_KeQueryActiveProcessorCountEx]
movsx edi, word [rsp + 0x50]
lea rcx, [rbp + 0x30]
mov esi, eax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
cmp edi, esi
jne 0x140008088
add rbx, 0x28
lea rcx, [rbp + 0x28]
lea rax, [rbx - 8]
cmp rax, rcx
jne 0x140007fc0
mov al, 1
mov rsi, qword [rsp + 0x180]
mov r14, qword [rsp + 0x190]
mov rdi, qword [rsp + 0x188]
add rsp, 0x160
pop r15
pop rbx
pop rbp
ret
mov r9d, 0x744
mov qword [rsp + 0x20], r14
lea r8, [0x14000a0a0]
mov ecx, 1
lea rdx, [0x14000a080]
call fcn.140003c60
xor al, al
jmp 0x140008064