Function at 0x180002040
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov r14, r8
mov r15, rdx
movzx r13d, cl
xor ebx, ebx
mov esi, ebx
mov rax, qword [r9]
sub rax, 8
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x30], bl
mov qword [rsp + 0xd8], rbx
xor r12b, r12b
mov qword [r9], 8
mov rcx, qword [rdx + 0x18]
mov qword [rsp + 0x48], rcx
mov eax, dword [rdx]
cmp eax, 8
jb 0x18000213e
cmp qword [0x180005220], rbx
jne 0x18000213e
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, rcx
mov ecx, eax
call fcn.1800013b0
test eax, eax
js 0x180002106
cmp byte [r15 + 0x10], bl
je 0x1800020d0
mov rax, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov r8, qword [rax]
jmp 0x1800020d3
mov r8, rbx
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9b, 1
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dl, 1
mov rcx, qword [rsp + 0x40]
test eax, eax
jns 0x180002110
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
mov eax, 0xc0000022
jmp 0x180002465
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
mov rcx, qword [rsp + 0xd8]
cmp rcx, qword [r15 + 8]
je 0x180002134
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, 0xc0000022
jmp 0x180002465
mov ebx, 1
jmp 0x18000224d
mov rcx, rax
lea rdx, [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov esi, eax
test eax, eax
js 0x180002465
mov rax, qword [0x180005220]
test rax, rax
je 0x180002182
mov rcx, qword [rsp + 0xe0]
call rax
mov esi, eax
movzx r12d, r12b
mov ebx, 1
test eax, eax
cmovns r12d, ebx
jmp 0x180002187
mov ebx, 1
test esi, esi
js 0x18000222f
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
cmp dword [r15], 8
setae r9b
mov rcx, qword [rsp + 0x48]
or rcx, 0xffffffff80000000
cmp dword [r15], 8
cmovae rcx, qword [rsp + 0x48]
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov esi, eax
mov dword [rsp + 0x34], eax
test eax, eax
js 0x180002209
mov rcx, qword [rsp + 0xd8]
cmp rcx, qword [r15 + 8]
je 0x180002209
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov esi, 0xc000000d
mov dword [rsp + 0x34], esi
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test r12b, r12b
je 0x18000222f
mov rax, qword [0x180005228]
test rax, rax
je 0x18000222f
mov rcx, qword [rsp + 0xe0]
call rax
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test esi, esi
js 0x180002463
mov rcx, qword [rsp + 0xd8]
xor r12d, r12d
mov dword [r14], r12d
test r13b, r13b
je 0x18000225f
mov word [r14 + 4], r12w
jmp 0x180002263
mov byte [r14 + 4], r12b
cmp byte [r15 + 0x10], 0
je 0x18000232c
cmp word [rcx], 5
jne 0x18000232c
mov eax, 0xd8
cmp ax, word [rcx + 2]
je 0x180002293
xor al, al
mov esi, 0xc000000d
mov dword [rsp + 0x34], esi
jmp 0x18000232e
mov eax, r12d
cmp byte [rcx + 0x4d], al
je 0x1800022a0
mov dword [r14], ebx
mov eax, ebx
cmp byte [rcx + 0x4e], 0
je 0x1800022ac
or eax, 2
mov dword [r14], eax
cmp byte [rcx + 0x4f], 0
je 0x1800022b8
or eax, 4
mov dword [r14], eax
mov rbx, qword [rsp + 0x38]
mov r9d, ebx
lea r8, [r14 + 4]
mov rdx, rcx
movzx ecx, r13b
call fcn.180001e60
mov esi, eax
mov dword [rsp + 0x34], eax
test eax, eax
js 0x180002320
mov rax, 0xffffffffffffffff
test r13b, r13b
je 0x180002310
nop word [rax + rax]
lea rax, [rax + 1]
cmp word [r14 + rax*2 + 4], 0
jne 0x1800022f0
lea rax, [rax*2 + 0xa]
jmp 0x18000241f
inc rax
cmp byte [r14 + rax + 4], 0
jne 0x180002310
jmp 0x18000241b
mov rcx, qword [rsp + 0xd8]
mov al, 1
jmp 0x180002333
mov al, 1
mov rbx, qword [rsp + 0x38]
test al, al
je 0x180002432
lea r9, [rsp + 0xd0]
mov r8d, ebx
lea rdx, [r14 + 4]
call qword [sym.imp.ntoskrnl.exe_ObQueryNameString]
mov esi, eax
mov dword [rsp + 0x34], eax
test eax, eax
js 0x18000242a
movzx eax, word [r14 + 4]
test ax, ax
je 0x18000242a
test r13b, r13b
je 0x180002397
shr eax, 1
mov ebx, eax
mov dword [rsp + 0xd0], ebx
mov r8d, eax
add r8, r8
mov rdx, qword [r14 + 0xc]
lea rcx, [r14 + 4]
call fcn.180002c40
mov word [r14 + rbx*2 + 4], r12w
jmp 0x1800023da
mov r8b, 1
lea rdx, [r14 + 4]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
mov esi, eax
mov dword [rsp + 0x34], eax
test eax, eax
js 0x1800023da
movzx ebx, word [rsp + 0x50]
mov r8d, ebx
mov rdx, qword [rsp + 0x58]
lea rcx, [r14 + 4]
call fcn.180002c40
mov byte [rbx + r14 + 4], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlFreeAnsiString]
mov rax, 0xffffffffffffffff
test r13b, r13b
je 0x180002410
nop word [rax + rax]
lea rax, [rax + 1]
cmp word [r14 + rax*2 + 4], 0
jne 0x1800023f0
lea rax, [rax*2 + 0xa]
jmp 0x18000241f
inc rax
cmp byte [r14 + rax + 4], 0
jne 0x180002410
add rax, 9
mov rcx, qword [rsp + 0xe8]
mov qword [rcx], rax
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov byte [rsp + 0x30], 1
jmp 0x180002463
mov eax, esi
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret