Function at 0x140089318
Capabilities:
Attach user process memory

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], rdx
mov rsi, rcx
xor eax, eax
mov byte [rsp + 0x20], al
mov ecx, 0x4196
call fcn.140029ab4
mov qword [rsp + 0x38], rax
mov ecx, 3
call fcn.140029ab4
mov r15, rax
mov ecx, 2
call fcn.140029ab4
mov r12, rax
mov ecx, 0x4172
call fcn.140029ab4
mov qword [rsp + 0x30], rax
mov ecx, 0x41db
call fcn.140029ab4
mov r13, rax
mov ecx, 0x1cf
call fcn.140029ab4
mov rbx, rax
mov ecx, 0x1d1
call fcn.140029ab4
mov r14, rax
mov ecx, 0x3c
call fcn.140029ab4
mov rdi, rax
xor eax, eax
cmp qword [rsp + 0x38], rax
je 0x140089cbd
test r15, r15
je 0x140089cbd
xor r15d, r15d
test r12d, r12d
je 0x140089cbd
cmp qword [rsp + 0x30], r15
je 0x140089cbd
test r13, r13
je 0x140089cbd
test ebx, ebx
je 0x140089cbd
test r14d, r14d
je 0x140089cbd
test edi, edi
je 0x140089cbd
lea r12d, [rax + 1]
mov qword [rsp + 0x20], r12
test rsi, rsi
je 0x140089cc2
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.14004efe0
test al, al
je 0x140089cc2
mov qword [rsp + 0x50], rsi
mov eax, edi
mov rcx, qword [rax + rsi]
mov qword [rsp + 0x60], rcx
mov edi, r15d
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x68], r15d
mov rcx, rsi
call qword [rsp + 0x38]
mov r13, rax
mov rcx, rax
call fcn.140077928
mov byte [rsp + 0x28], al
lea rdx, [rsp + 0x70]
mov rcx, r13
call sub.ntoskrnl.exe_KeStackAttachProcess
mov rcx, rsi
call fcn.140078170
cmp al, r12b
jne 0x140089c77
mov ecx, ebx
mov r15, qword [rcx + rsi]
mov ecx, r14d
mov rbx, qword [rcx + rsi]
lea rcx, [r15 - 1]
mov r14d, r12d
mov dl, r14b
call fcn.14005976c
cmp al, r14b
jne 0x140089c72
mov dl, r14b
mov rcx, rbx
call fcn.14005976c
cmp al, r14b
jne 0x140089c72
mov r14d, 0x914
mov ecx, r14d
call fcn.140029ab4
cmp eax, 0x2800
je 0x140089b65
mov ecx, r14d
call fcn.140029ab4
cmp eax, 0x295a
je 0x140089b65
mov ecx, r14d
call fcn.140029ab4
cmp eax, 0x3839
je 0x140089b65
mov ecx, r14d
call fcn.140029ab4
cmp eax, 0x3ad7
jne 0x14008960d
lea rcx, [rbx + 0x50]
cmp rcx, r15
jae 0x140089c55
lea r14d, [r12 + 0x7f]
mov r11, qword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
lea rax, [rcx + 0x78]
cmp rax, r15
ja 0x140089c55
mov r10, qword [rcx]
cmp r10, r14
jne 0x1400895a3
mov r8, qword [rcx - 8]
mov rax, qword [r11]
cmp r8, rax
jbe 0x14008957c
mov rdx, qword [rcx - 0x10]
cmp rdx, rax
jbe 0x14008957c
mov r9, qword [rcx + 8]
cmp rdx, r9
jne 0x14008957c
cmp r9, qword [rcx + 0x18]
jne 0x14008957c
mov rdx, qword [rcx + 0x10]
cmp rdx, r8
jbe 0x14008957c
sub rdx, r8
cmp rdx, 0x200
jb 0x1400895fc
xor edx, edx
test r8, r8
jne 0x1400895a5
cmp qword [rcx - 0x10], rdx
jne 0x1400895a5
cmp qword [rcx + 8], rax
jbe 0x1400895a5
cmp qword [rcx + 0x18], rax
jbe 0x1400895a5
cmp qword [rcx + 0x20], rax
jbe 0x1400895a5
cmp rsi, qword [rcx + 0x10]
je 0x1400895fc
jmp 0x1400895a5
xor edx, edx
test r10, 0xffffffffffffff7f
jne 0x1400895ea
cmp qword [rcx - 0x18], rdx
jne 0x1400895ea
cmp qword [rcx - 0x10], rdx
jne 0x1400895ea
cmp qword [rcx + 0x40], rdx
jne 0x1400895ea
mov rax, qword [rcx + 0x18]
cmp rsi, rax
jne 0x1400895ea
cmp rax, qword [rcx + 0x60]
jne 0x1400895ea
mov rax, qword [r11]
cmp qword [rcx - 8], rax
jbe 0x1400895ea
cmp qword [rcx + 0x30], rax
jbe 0x1400895ea
cmp qword [rcx + 0x48], rax
jbe 0x1400895ea
cmp qword [rcx + 0x58], rax
ja 0x140089604
add rcx, 8
cmp rcx, r15
jae 0x140089c55
jmp 0x14008952a
mov rdi, r8
jmp 0x140089c55
mov rdi, qword [rcx + 0x58]
jmp 0x140089c55
mov ecx, r14d
call fcn.140029ab4
cmp eax, 0x3fab
je 0x14008982e
mov ecx, r14d
call fcn.140029ab4
cmp eax, 0x42ee
je 0x14008982e
mov ecx, r14d
call fcn.140029ab4
cmp eax, 0x4563
je 0x14008982e
mov ecx, r14d
call fcn.140029ab4
cmp eax, 0x47ba
je 0x14008982e
mov ecx, r14d
call fcn.140029ab4
cmp eax, 0x47bb
je 0x14008982e
mov ecx, r14d
call fcn.140029ab4
cmp eax, 0x4a61
jb 0x140089738
mov ecx, r14d
call fcn.140029ab4
cmp eax, 0x4a65
ja 0x140089738
lea rcx, [rbx + 0x50]
cmp rcx, r15
jae 0x140089c55
mov r8, qword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
lea rax, [rcx + 0x78]
cmp rax, r15
ja 0x140089c55
mov rdx, qword [rcx]
xor r9d, r9d
cmp rsi, rdx
jne 0x14008971d
mov rax, qword [r8]
cmp qword [rcx + 8], rax
jbe 0x1400896e5
cmp qword [rcx - 8], rax
jbe 0x1400896e5
cmp qword [rcx + 0x40], rax
jbe 0x1400896e5
cmp qword [rcx + 0x48], rax
jbe 0x1400896e5
cmp qword [rcx - 0x20], r9
jne 0x1400896e5
cmp qword [rcx - 0x30], r9
je 0x14008972f
cmp rsi, rdx
jne 0x14008971d
mov rax, qword [r8]
cmp qword [rcx + 8], rax
jbe 0x14008971d
cmp qword [rcx - 8], rax
jbe 0x14008971d
cmp qword [rcx + 0x10], rax
jbe 0x14008971d
cmp qword [rcx + 0x18], r9
jne 0x14008971d
cmp qword [rcx + 0x38], rax
jbe 0x14008971d
cmp qword [rcx - 0x20], r9
jne 0x14008971d
cmp qword [rcx - 0x28], rax
jbe 0x14008971d
cmp qword [rcx - 0x30], rax
ja 0x14008972f
add rcx, 8
cmp rcx, r15
jae 0x140089c55
jmp 0x1400896a6
mov rdi, qword [rcx + 8]
jmp 0x140089c55
mov ecx, r14d
call fcn.140029ab4
cmp eax, 0x55f0
je 0x14008975a
mov ecx, r14d
call fcn.140029ab4
cmp eax, 0x585d
jne 0x140089c55
lea rcx, [rbx + 0x50]
cmp rcx, r15
jae 0x140089c55
mov rdx, qword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
lea rax, [rcx + 0x78]
cmp rax, r15
ja 0x140089c55
mov r8, qword [rcx]
xor r9d, r9d
cmp rsi, r8
jne 0x140089801
mov rax, qword [rdx]
cmp qword [rcx + 8], rax
jbe 0x1400897c5
cmp qword [rcx - 8], rax
jbe 0x1400897c5
cmp qword [rcx + 0x40], rax
jbe 0x1400897c5
cmp qword [rcx + 0x48], rax
jbe 0x1400897c5
cmp qword [rcx - 0x20], r9
jne 0x1400897c5
cmp qword [rcx - 0x30], r9
jne 0x1400897c5
cmp qword [rcx - 0x40], r9
jne 0x140089813
cmp qword [rcx - 0x48], r9
jne 0x140089813
cmp qword [rcx - 0x50], r9
jne 0x140089813
cmp qword [rcx - 0x58], r9
jne 0x140089813
cmp rsi, r8
jne 0x140089801
mov rax, qword [rdx]
cmp qword [rcx + 8], rax
jbe 0x140089801
cmp qword [rcx - 8], rax
jbe 0x140089801
cmp qword [rcx + 0x10], rax
jbe 0x140089801
cmp qword [rcx + 0x18], r9
jne 0x140089801
cmp qword [rcx + 0x38], rax
jbe 0x140089801
cmp qword [rcx - 0x20], r9
jne 0x140089801
cmp qword [rcx - 0x28], rax
jbe 0x140089801
cmp qword [rcx - 0x30], rax
ja 0x14008972f
add rcx, 8
cmp rcx, r15
jae 0x140089c55
jmp 0x14008976e
mov rdi, qword [rcx - 0x18]
mov r12, qword [rsp + 0x20]
cmp rdi, rax
ja 0x140089c5a
mov rdi, qword [rcx + 8]
jmp 0x140089c5a
add rbx, 0x50
mov r12, qword [rsp + 0x20]
cmp rbx, r15
jae 0x140089c5a
mov r14d, 0x80
lea rax, [rbx + 0x78]
cmp rax, r15
ja 0x140089c5a
mov ecx, 0x914
call fcn.140029ab4
cmp eax, 0x3fab
jne 0x1400899c7
mov r8, qword [rbx]
cmp rsi, r8
jne 0x1400898c1
cmp rsi, qword [rbx + 8]
jne 0x1400898c1
mov rcx, qword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
mov rax, qword [rcx]
cmp qword [rbx - 8], rax
jbe 0x1400898c8
xor edx, edx
cmp qword [rbx + 0x18], rdx
jne 0x1400898c8
cmp qword [rbx + 0x20], rdx
jne 0x1400898c8
cmp qword [rbx + 0x28], rax
jbe 0x1400898c8
cmp qword [rbx + 0x30], r14
jne 0x1400898c8
cmp qword [rbx + 0x40], rdx
jne 0x1400898c8
mov rdx, qword [rbx + 0x50]
cmp rdx, qword [rbx + 0x60]
jne 0x1400898c8
cmp rdx, rax
jbe 0x1400898c8
cmp qword [rbx + 0x58], rax
ja 0x140089b38
jmp 0x1400898c8
mov rcx, qword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
xor eax, eax
cmp r8, r14
jne 0x140089932
cmp qword [rbx - 0x10], rax
jne 0x1400898fc
cmp qword [rbx - 0x18], rax
jne 0x1400898fc
mov rax, qword [rcx]
cmp qword [rbx + 8], rax
jbe 0x1400898fa
cmp rsi, qword [rbx + 0x10]
jne 0x1400898fa
cmp qword [rbx + 0x18], rax
jbe 0x1400898fa
cmp qword [rbx + 0x20], rax
ja 0x140089b38
xor eax, eax
cmp r8, r14
jne 0x140089932
cmp qword [rbx - 0x10], rax
jne 0x140089932
cmp qword [rbx - 0x18], rax
jne 0x140089932
mov rax, qword [rcx]
cmp qword [rbx + 8], rax
jbe 0x140089932
cmp qword [rbx + 0x20], rax
jbe 0x140089932
cmp qword [rbx + 0x28], rax
jbe 0x140089932
cmp rsi, qword [rbx + 0x30]
jne 0x140089932
cmp qword [rbx + 0x38], rax
ja 0x140089b41
test r8, 0xffffffffffff00ff
jne 0x140089b26
xor r8d, r8d
cmp qword [rbx - 8], r8
jne 0x140089b26
mov rax, qword [rcx]
cmp qword [rbx - 0x20], rax
jbe 0x140089b26
cmp qword [rbx - 0x18], rax
jbe 0x140089b26
cmp qword [rbx + 8], rax
jbe 0x140089b26
mov rdx, qword [rbx + 0x10]
cmp rdx, rax
jbe 0x140089b26
cmp qword [rbx + 0x18], rax
jbe 0x140089b26
cmp rsi, qword [rbx + 0x20]
jne 0x140089b26
cmp qword [rbx + 0x28], rax
jbe 0x140089b26
mov rcx, qword [rbx + 0x30]
cmp rcx, rax
jbe 0x140089b26
cmp qword [rbx + 0x38], rax
jbe 0x140089b26
cmp qword [rbx + 0x40], rax
jbe 0x140089b26
cmp rdx, rcx
je 0x140089b4a
jmp 0x140089b26
mov ecx, 0x914
call fcn.140029ab4
cmp eax, 0x42ee
jne 0x140089a9f
mov rdx, qword [rbx]
xor r8d, r8d
cmp rsi, rdx
jne 0x140089b26
mov rax, qword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
mov rcx, qword [rax]
cmp qword [rbx + 8], rcx
jbe 0x140089a3f
test qword [rbx + 0x10], 0xffffffffffff00ff
jne 0x140089a3f
cmp qword [rbx + 0x18], rcx
jbe 0x140089a3f
cmp qword [rbx + 0x20], rcx
jbe 0x140089a3f
cmp qword [rbx - 0x30], rcx
jbe 0x140089a3f
cmp qword [rbx - 0x20], r8
jne 0x140089a3f
cmp qword [rbx - 0x18], rcx
jbe 0x140089a3f
cmp qword [rbx - 0x10], rcx
jbe 0x140089a3f
cmp qword [rbx + 0x40], r8
jne 0x140089a3f
cmp qword [rbx + 0x48], rcx
jbe 0x140089a3f
cmp qword [rbx - 8], rcx
ja 0x140089b5c
cmp rsi, rdx
jne 0x140089b26
cmp rsi, qword [rbx + 0x10]
jne 0x140089b26
mov rax, qword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
mov rdx, qword [rax]
cmp qword [rbx + 8], rdx
jbe 0x140089b26
cmp qword [rbx - 0x10], rdx
jbe 0x140089b26
mov eax, dword [rbx - 8]
cmp rax, r12
jne 0x140089b26
cmp qword [rbx + 0x18], r14
jne 0x140089b26
cmp qword [rbx + 0x30], r8
jne 0x140089b26
cmp qword [rbx + 0x20], rdx
ja 0x140089b53
jmp 0x140089b26
mov ecx, 0x914
call fcn.140029ab4
cmp eax, 0x4563
jne 0x140089aed
cmp rsi, qword [rbx]
jne 0x140089b26
cmp rsi, qword [rbx + 0x10]
jne 0x140089b26
mov rax, qword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
mov rdx, qword [rax]
cmp qword [rbx + 8], rdx
jbe 0x140089b26
cmp qword [rbx - 0x10], rdx
jbe 0x140089b26
mov eax, dword [rbx - 8]
cmp rax, r12
jne 0x140089b26
cmp qword [rbx + 0x20], rdx
jbe 0x140089b26
cmp qword [rbx - 0x18], rdi
jne 0x140089b26
cmp qword [rbx + 0x18], rdx
ja 0x140089b4a
jmp 0x140089b26
cmp rsi, qword [rbx]
jne 0x140089b26
mov rax, qword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
mov rcx, qword [rax]
cmp qword [rbx + 8], rcx
jbe 0x140089b26
cmp qword [rbx + 0x10], rcx
jbe 0x140089b26
cmp qword [rbx - 8], rcx
jbe 0x140089b26
cmp qword [rbx - 0x10], rcx
jbe 0x140089b26
cmp qword [rbx - 0x18], rcx
jbe 0x140089b26
cmp qword [rbx - 0x28], rdi
jne 0x140089b26
cmp qword [rbx + 0x18], rcx
ja 0x140089b5c
add rbx, 8
cmp rbx, r15
jae 0x140089c5a
jmp 0x140089846
mov rdi, qword [rbx + 0x58]
jmp 0x140089c5a
mov rdi, qword [rbx + 0x28]
jmp 0x140089c5a
mov rdi, qword [rbx + 0x18]
jmp 0x140089c5a
mov rdi, qword [rbx + 0x20]
jmp 0x140089c5a
mov rdi, qword [rbx - 8]
jmp 0x140089c5a
lea rcx, [rbx + 0x50]
cmp rcx, r15
jae 0x140089c55
mov ebx, 0x1000
mov r14d, 0x80
mov r11, qword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
lea rax, [rcx + 0xa0]
cmp rax, r15
ja 0x140089c55
mov r9, qword [rcx - 8]
cmp r9, r14
jne 0x140089c0d
mov rax, qword [rcx]
cmp rsi, rax
jne 0x140089bdb
mov rax, qword [rcx + 8]
mov rdx, qword [r11]
cmp rax, rdx
jbe 0x140089c3f
cmp qword [rcx + 0x10], rdx
jbe 0x140089c3f
mov r8, qword [rcx + 0x18]
cmp r8, rdx
jbe 0x140089c3f
cmp rax, r8
jbe 0x140089c3f
sub rax, r8
cmp rax, rbx
jb 0x1400895fc
jmp 0x140089c3f
mov rdx, qword [rcx + 0x10]
cmp rax, rdx
jne 0x140089c3f
mov rax, qword [rcx + 8]
mov r8, qword [r11]
cmp rax, r8
jbe 0x140089c3f
cmp rdx, r8
jbe 0x140089c3f
mov rdx, qword [rcx + 0x18]
cmp rdx, r8
jbe 0x140089c3f
cmp rax, rdx
jbe 0x140089c3f
sub rax, rdx
cmp rax, rbx
jb 0x140089c4d
jmp 0x140089c3f
mov r8, qword [rcx]
cmp rsi, r8
jne 0x140089c3f
mov rax, qword [r11]
cmp qword [rcx + 8], rax
jbe 0x140089c3f
mov r10, qword [rcx + 0x10]
cmp r10, rax
jbe 0x140089c3f
mov rdx, qword [rcx + 0x18]
cmp rdx, rax
jbe 0x140089c3f
cmp r9, rdx
je 0x140089c3a
cmp r8, rdx
jne 0x140089c3f
cmp r8, r10
jne 0x140089c52
add rcx, 8
cmp rcx, r15
jae 0x140089c55
jmp 0x140089b84
mov rdi, rdx
jmp 0x140089c55
mov rdi, r9
mov r12, qword [rsp + 0x20]
mov rax, qword [rsp + 0x30]
cmp rdi, qword [rax]
mov eax, 0
cmovb rdi, rax
mov qword [rsp + 0x58], rdi
jmp 0x140089c77
mov r12, qword [rsp + 0x20]
lea rcx, [rsp + 0x70]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
cmp byte [rsp + 0x28], r12b
jne 0x140089c91
mov rcx, r13
call fcn.140077a00
nop
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rax + 0x10], xmm1
add qword [rcx], 0x20
mov rax, qword [rsp + 0x40]
add dword [rax], r12d
jmp 0x140089cc2
mov r12, qword [rsp + 0x20]
mov al, r12b
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14008c320
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret