Function at 0x19118
Capabilities:
Find process by pid

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3f8
mov rax, qword [0x00039100]
xor rax, rsp
mov qword [rsp + 0x3e0], rax
mov rbx, qword [rsp + 0x468]
xor r15d, r15d
mov r12, r9
mov qword [rsp + 0x40], r9
mov r13d, r8d
mov rdi, rdx
mov byte [rsp + 0x32], r15b
mov qword [rsp + 0x38], rdx
mov rsi, rcx
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], r15
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, r15d
jl 0x19197
mov rcx, qword [rsp + 0x50]
call sub.ntoskrnl.exe_PsGetProcessImageFileName
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor edx, edx
lea rcx, [rsp + 0x391]
mov byte [rsp + 0x30], r15b
lea r8d, [rdx + 0x4f]
mov dword [rsp + 0x48], r15d
mov byte [rsp + 0x390], r15b
call fcn.0002f810
mov r14d, dword [rsp + 0x460]
mov qword [rsp + 0x138], rdi
mov edi, 0x104
lea rcx, [rsp + 0x14d]
xor edx, edx
mov r8, rdi
mov dword [rsp + 0x149], r14d
mov byte [rsp + 0x31], r15b
mov qword [rsp + 0x130], rsi
mov byte [rsp + 0x140], r13b
mov qword [rsp + 0x141], r12
call fcn.0002f810
mov ebp, dword [rsp + 0x470]
cmp rbx, r15
je 0x19232
cmp ebp, r15d
je 0x19232
cmp ebp, edi
mov r8, rbp
lea rcx, [rsp + 0x14d]
cmova r8, rdi
mov rdx, rbx
call fcn.0002f2c0
lea rcx, [rsp + 0x130]
call fcn.0001c380
mov edi, eax
mov rax, cr8
cmp al, r15b
je 0x192b2
mov rax, cr8
lea r8, [0x00030230]
lea rcx, [rsp + 0x390]
movzx r9d, al
mov edx, 0x50
mov dword [rsp + 0x20], edi
call fcn.0001110c
call fcn.0002f720
mov ecx, 0x80001029
lea r9, [rsp + 0x390]
mov rdx, rsi
mov r8d, eax
call fcn.0002de2c
mov al, 1
mov rcx, qword [rsp + 0x3e0]
xor rcx, rsp
call fcn.0002f1f0
add rsp, 0x3f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, [rsp + 0x31]
call fcn.0002cbcc
cmp al, r15b
je 0x192f0
cmp byte [rsp + 0x31], r15b
je 0x192f0
lea r8, [0x00030250]
lea rcx, [rsp + 0x390]
mov r9d, edi
mov edx, 0x50
call fcn.0001110c
call fcn.0002f720
mov ecx, 0x8000102a
jmp 0x19279
lea rdx, [0x0003fb30]
mov eax, r15d
mov rcx, rdx
cmp dword [rcx], edi
je 0x1930e
inc eax
add rcx, 0x10
cmp eax, 0x36
jb 0x192fd
jmp 0x19316
add rax, rax
mov r15d, dword [rdx + rax*8 + 4]
lea rcx, [rsp + 0x26c]
lea rdx, [rsp + 0x130]
mov r8d, 0x121
mov dword [rsp + 0x260], 0x12e
mov dword [rsp + 0x60], 0xd0
call fcn.0002f2c0
xor eax, eax
mov dword [rsp + 0x268], 0x121
mov dword [rsp + 0x264], 1
cmp qword [rsp + 0x38], rax
jne 0x19381
lea r8, [rsp + 0x32]
mov edx, edi
mov rcx, rsi
call fcn.0001c660
xor ecx, ecx
cmp al, cl
je 0x193e8
mov al, byte [rsp + 0x32]
jmp 0x1928e
cmp r13d, eax
jne 0x193ea
mov rbp, qword [rsp + 0x38]
mov rcx, rsi
mov byte [rsp + 0x33], 1
mov rdx, rbp
call fcn.0002dd74
xor ebx, ebx
mov r12, rax
cmp rax, rbx
je 0x194af
mov edx, dword [rsp + 0x40]
lea r9, [rsp + 0x33]
mov r8, rsi
mov rcx, rax
call fcn.00020aa4
movzx ecx, byte [rsp + 0x33]
mov bl, al
xor eax, eax
movzx ebp, al
cmp bl, al
cmovne ebp, ecx
mov rcx, r12
call fcn.0002e49c
xor ecx, ecx
cmp bl, cl
je 0x194b6
mov al, bpl
jmp 0x1928e
xor eax, eax
cmp r13d, 0x16
jne 0x19454
cmp rbx, rax
je 0x194bb
cmp ebp, eax
je 0x194bb
cmp byte [rbx], al
je 0x194bb
lea edx, [r13 + 0x46]
mov rcx, rbx
call sub.ntoskrnl.exe_strrchr
xor ecx, ecx
cmp rax, rcx
je 0x19421
inc rax
jmp 0x19424
mov rax, rbx
mov edx, 0x2e
mov rcx, rax
call sub.ntoskrnl.exe_strrchr
xor ebx, ebx
cmp rax, rbx
je 0x194bd
lea rdx, [0x00030260]
mov rcx, rax
call fcn.0002f246
cmp eax, ebx
jne 0x194bd
jmp 0x1928c
cmp r13d, 5
jne 0x1948d
cmp r12, 5
jne 0x194bb
lea rdx, [0x0002ffc0]
mov rcx, rsi
call fcn.0002ae64
xor ebx, ebx
cmp al, bl
je 0x194bd
lea rdx, [0x00030290]
mov rcx, rsi
call fcn.0002afe8
cmp al, bl
je 0x194bd
jmp 0x1928c
cmp r13d, 0xb
jne 0x194bb
call fcn.0002a3b8
xor ebx, ebx
cmp al, bl
je 0x194bd
lea rcx, [0x000320c0]
call fcn.00029e30
cmp rax, rsi
jmp 0x1944d
mov r12, qword [rsp + 0x40]
jmp 0x194c2
mov r12, qword [rsp + 0x40]
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
mov rcx, rsi
call fcn.00018e60
cmp al, bl
jne 0x1928c
cmp qword [0x000413e0], rbx
je 0x19549
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x194f4
lea rcx, [0x0002ff90]
call fcn.0002a198
jmp 0x19503
lea rdx, [0x0002ff90]
mov rcx, rsi
call fcn.0002ae64
cmp al, bl
je 0x19549
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x19522
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, rax
call fcn.0002f7fa
jmp 0x1952a
mov rcx, rsi
call fcn.0002a1d8
cmp rax, rbx
jne 0x19534
mov rax, rbx
jmp 0x1953c
mov rcx, rax
call fcn.0002a1d8
cmp rax, qword [0x000413e0]
je 0x1928c
cmp r13d, 6
jne 0x195cb
call fcn.00025f38
cmp al, bl
je 0x195cb
mov al, byte [0x0004126f]
cmp al, bl
je 0x195cb
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x195a2
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, rax
call fcn.0002a220
cmp al, bl
je 0x19583
mov al, 1
jmp 0x195c0
lea rcx, [0x000320a0]
call fcn.00029e30
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rbx, rax
sete al
xor ebx, ebx
jmp 0x195c0
lea rcx, [0x000320a0]
call fcn.00029e30
cmp rax, rsi
je 0x1957f
mov rcx, rsi
call fcn.0002a220
cmp al, bl
setne al
cmp al, bl
je 0x195cb
mov bl, 1
jmp 0x1967d
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x195dd
call fcn.0002ae08
jmp 0x195e5
mov rcx, rsi
call fcn.0002adac
cmp al, bl
je 0x19679
cmp r13d, 0x24
je 0x19679
cmp r13d, 0x27
jne 0x1961a
lea rcx, [0x000320a0]
call fcn.00029e30
cmp rax, rsi
je 0x19679
mov rcx, rsi
call fcn.0002a220
cmp al, bl
jne 0x19679
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, rax
call fcn.0002a220
cmp al, bl
jne 0x1964c
lea rcx, [0x000320a0]
call fcn.00029e30
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rbx, rax
je 0x1964c
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp edi, 0x1b
je 0x1928c
cmp edi, 0x27
je 0x1928c
cmp edi, 0x38
je 0x1928c
mov r8b, 1
mov edx, edi
mov rcx, rsi
call fcn.0001c738
jmp 0x1928c
mov bl, byte [rsp + 0x30]
mov r9, r12
mov r8d, r13d
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r14d
call fcn.00019dcc
xor r14d, r14d
cmp al, r14b
jne 0x1928c
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, rax
call fcn.0002e2e0
cmp rax, r14
je 0x196be
mov rcx, rax
call fcn.0002e49c
call fcn.00025f38
cmp al, r14b
jne 0x1973f
cmp r13d, r14d
jne 0x19729
cmp r12, 0x101
je 0x19729
cmp r12, 0x100
jne 0x1973a
lea rcx, [0x00030290]
call fcn.0002a52c
cmp al, r14b
jne 0x1928c
call fcn.0002a3b8
cmp al, r14b
je 0x1973a
lea rcx, [0x00030020]
call fcn.0002a52c
cmp al, r14b
jne 0x1928c
lea rcx, [0x000320e0]
call fcn.0002a52c
cmp al, r14b
je 0x1973a
jmp 0x1928c
cmp r13d, 3
jne 0x19734
cmp r12, r14
je 0x1973a
cmp r13d, 0xc
jne 0x1973f
call fcn.00019b1c
call fcn.00025f38
cmp al, r14b
je 0x1928c
mov ecx, r15d
call fcn.0001c2f4
cmp al, r14b
je 0x1928c
cmp edi, 0x27
je 0x1928c
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, qword [0x000413e0]
cmp rcx, rax
je 0x1928c
cmp rcx, rsi
je 0x1928c
cmp bl, r14b
jne 0x197e0
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x1979f
call fcn.0002f2a6
mov ebx, eax
jmp 0x197d4
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov qword [rsp + 0x40], r14
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, r14d
jge 0x197bc
mov ebx, r14d
jmp 0x197d4
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessSessionId]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp dword [0x000413dc], ebx
jne 0x1928c
mov r8b, 1
mov edx, 0x40
mov rcx, rsi
call fcn.0001da44
lea r9, [rsp + 0x60]
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x48]
mov r8d, 0x12e
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0xd0
call fcn.00025d74
cmp al, r14b
jne 0x1986e
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x1928c
mov rcx, qword gs:[0x188]
call qword [sym.imp.ntoskrnl.exe_PsIsThreadTerminating]
cmp al, r14b
je 0x1928c
mov rcx, rsi
call fcn.0002c880
mov rbx, rax
call fcn.0002f720
mov r9, rbx
mov rdx, rsi
mov ecx, 0x1002
mov r8d, eax
call fcn.0002de2c
jmp 0x199e9
cmp dword [rsp + 0x64], 4
jne 0x1928c
mov eax, dword [rsp + 0x68]
mov ebx, 0x3f
cmp eax, 2
je 0x19891
cmp eax, 8
je 0x19891
cmp eax, 7
jne 0x198ca
cmp rbp, r14
jne 0x198b5
cmp edi, 0x1b
je 0x198ca
cmp edi, 0x38
je 0x198ca
mov edx, ebx
cmp eax, 2
mov r8b, 1
cmove edx, edi
mov rcx, rsi
call fcn.0001c738
jmp 0x198c6
mov r9b, 1
mov r8d, r12d
mov rdx, rbp
mov rcx, rsi
call fcn.00019d68
mov eax, dword [rsp + 0x68]
cmp eax, 4
je 0x198d9
cmp eax, 6
je 0x198d9
cmp eax, 5
jne 0x19917
cmp rbp, r14
jne 0x198fd
cmp edi, 0x1b
je 0x19917
cmp edi, 0x38
je 0x19917
cmp eax, 4
mov rcx, rsi
cmove ebx, edi
xor r8d, r8d
mov edx, ebx
call fcn.0001c738
jmp 0x19913
cmp r13d, r14d
jne 0x19917
xor r9d, r9d
mov r8d, r12d
mov rdx, rbp
mov rcx, rsi
call fcn.00019d68
mov eax, dword [rsp + 0x68]
cmp edi, 0x1f
je 0x1994e
cmp edi, 0x20
je 0x1994e
cmp edi, 0x12
je 0x1994e
cmp edi, 0x13
je 0x1994e
cmp edi, 0x11
je 0x1994e
cmp edi, 0x14
je 0x1994e
cmp edi, 0x2f
je 0x1994e
cmp edi, 0x3c
je 0x1994e
cmp edi, 0x40
je 0x1994e
cmp edi, 0x41
je 0x1994e
cmp edi, 0x28
jne 0x1996e
cmp eax, 3
jne 0x1996e
cmp edi, 0x1b
je 0x1996e
cmp edi, 0x38
je 0x1996e
xor r8d, r8d
mov edx, edi
mov rcx, rsi
call fcn.0001c738
mov eax, dword [rsp + 0x68]
cmp edi, 0x1f
je 0x199a5
cmp edi, 0x20
je 0x199a5
cmp edi, 0x12
je 0x199a5
cmp edi, 0x13
je 0x199a5
cmp edi, 0x11
je 0x199a5
cmp edi, 0x14
je 0x199a5
cmp edi, 0x2f
je 0x199a5
cmp edi, 0x3c
je 0x199a5
cmp edi, 0x40
je 0x199a5
cmp edi, 0x41
je 0x199a5
cmp edi, 0x28
jne 0x199cd
cmp eax, 1
jne 0x199cd
cmp edi, 0x1b
je 0x1928c
cmp edi, 0x38
je 0x1928c
mov r8b, al
mov edx, edi
mov rcx, rsi
call fcn.0001c738
mov eax, dword [rsp + 0x68]
cmp eax, r14d
jbe 0x199e9
cmp eax, 2
jbe 0x1928c
cmp eax, 6
jbe 0x199e9
cmp eax, 8
jbe 0x1928c
xor al, al
jmp 0x1928e