Function at 0x14001bd4c
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x560]
sub rsp, 0x660
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x74]
mov r8d, 0x118
call fcn.140020100
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x11c
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
lea rax, [0x14001bbbc]
mov qword [rdi + 0x68], rax
movabs rax, 0xfffff6fb40000000
mov qword [0x140644d00], rax
movabs rax, 0xfffff68000000000
mov qword [0x140644d08], rax
movabs rax, 0xfffff6fb7dbed000
mov qword [0x140644d10], rax
movabs rax, 0xfffff6fb7da00000
mov qword [0x140644d18], rax
mov eax, dword [rsp + 0x7c]
mov dword [0x140644cf8], eax
cmp eax, 0x3839
jb 0x14001bf24
xor edx, edx
lea rcx, [rbp + 0x90]
mov r8d, 0x4d0
call fcn.140020100
lea rcx, [rbp + 0x90]
mov dword [rbp + 0xc0], 0x10000b
call qword [sym.imp.ntoskrnl.exe_RtlCaptureContext]
mov edx, 0x40000
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
test rax, rax
je 0x14001c305
mov qword [rsp + 0x38], rax
lea rcx, [rbp + 0x90]
and qword [rsp + 0x30], 0
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
and qword [rsp + 0x20], 0
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeCapturePersistentThreadState]
mov eax, 7
lea rcx, [rbx + 0x2080]
lea rdx, [0x1406472a0]
lea r8d, [rax + 0x79]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
add rdx, r8
movups xmm1, xmmword [rcx + 0x70]
add rcx, r8
movups xmmword [rdx - 0x10], xmm1
sub rax, 1
jne 0x14001be79
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rdx, qword [0x140647600]
movabs rax, 0x7fc0000000
mov rcx, rdx
mov qword [0x140644d08], rdx
shr rcx, 9
and rcx, rax
mov rax, rdx
or rcx, rdx
shr rax, 0x12
and eax, 0x3fe00000
shr rdx, 0x1b
or rax, rcx
mov qword [0x140644d00], rcx
and edx, 0x1ff000
mov qword [0x140644d18], rax
or rdx, rax
mov qword [0x140644d10], rdx
mov edx, dword [0x140644cf8]
mov ecx, 0x1d8
mov r8d, 0x90
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea eax, [rdx - 0x1db0]
cmp eax, 1
lea eax, [rdx - 0x1db0]
cmova ecx, r8d
cmp eax, 1
mov dword [0x140644cf0], ecx
mov ecx, 0x1f6
lea edx, [rcx + 0x3c]
cmova ecx, edx
xor eax, eax
mov dword [0x140644cf4], ecx
lea rdx, [rsp + 0x40]
lea rcx, [0x140021330]
mov qword [rsp + 0x50], rax
call fcn.140001f7c
test al, al
je 0x14001bf9e
mov rax, qword [rsp + 0x40]
mov qword [0x140644e08], rax
mov rax, qword [rsp + 0x50]
mov qword [0x140644e10], rax
xorps xmm0, xmm0
lea rdx, [rsp + 0x40]
xor eax, eax
lea rcx, [0x140021340]
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
call fcn.140001f7c
test al, al
je 0x14001bfda
mov rax, qword [rsp + 0x40]
mov qword [0x140644e18], rax
mov rax, qword [rsp + 0x50]
mov qword [0x140644e20], rax
xorps xmm0, xmm0
lea rdx, [rsp + 0x40]
xor eax, eax
lea rcx, [0x140021350]
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
call fcn.140001f7c
test al, al
je 0x14001c016
mov rax, qword [rsp + 0x40]
mov qword [0x140644e28], rax
mov rax, qword [rsp + 0x50]
mov qword [0x140644e30], rax
lea rcx, [0x140021360]
call fcn.140002148
mov ecx, eax
call fcn.1400023e8
lea rcx, [0x140021380]
mov qword [0x140644d30], rax
call fcn.140002148
mov ecx, eax
call fcn.1400023e8
lea rcx, [0x1400213a0]
mov qword [0x140644d38], rax
call fcn.140002148
mov ecx, eax
call fcn.1400023e8
lea rcx, [0x1400213c0]
mov qword [0x140644d80], rax
call fcn.140002148
mov ecx, eax
call fcn.1400023e8
lea rcx, [0x1400213e0]
mov qword [0x140644d88], rax
call fcn.140002148
mov ecx, eax
call fcn.1400023e8
lea rcx, [0x140021400]
mov qword [0x140644d90], rax
call fcn.140002148
mov ecx, eax
call fcn.1400023e8
lea rcx, [0x140021420]
mov qword [0x140644d98], rax
call fcn.140002148
mov ecx, eax
call fcn.1400023e8
lea rcx, [0x140021430]
mov qword [0x140644db8], rax
call fcn.140002148
mov ecx, eax
call fcn.1400023e8
lea rcx, [0x140021450]
mov qword [0x140644dc0], rax
call fcn.14000249c
lea rcx, [0x140021470]
mov qword [0x140644dd8], rax
call fcn.14000249c
mov qword [0x140644df0], rax
call fcn.14001c5f0
mov qword [0x140644d40], rax
call fcn.14001cb88
mov qword [0x140644d48], rax
call fcn.14001c828
mov qword [0x140644d70], rax
call fcn.14001ca0c
lea rcx, [rsp + 0x40]
mov qword [0x140644d78], rax
call fcn.14001ceac
movups xmm0, xmmword [rax]
movdqu xmmword [0x140644d60], xmm0
call fcn.14001d08c
mov qword [0x140644de0], rax
call fcn.14001d1e8
mov qword [0x140644de8], rax
call fcn.14001c334
mov qword [0x140644e00], rax
call fcn.14001cdb4
mov ecx, dword [0x140644cf8]
mov qword [0x140644dd0], rax
lea eax, [rcx - 0x1db0]
cmp eax, 1
jbe 0x14001c1cf
lea eax, [rcx - 0x2800]
cmp eax, 0x1fbb
ja 0x14001c1ab
mov dword [0x140644cfc], 0x1047
jmp 0x14001c1d9
lea eax, [rcx - 0x4a61]
cmp eax, 4
jbe 0x14001c1cf
lea eax, [rcx - 0x55f0]
cmp eax, 0x26f
ja 0x14001c1d9
mov dword [0x140644cfc], 0x103f
jmp 0x14001c1d9
mov dword [0x140644cfc], 0x1044
lea rcx, [0x140021490]
call fcn.1400022dc
lea rdx, [0x140644d20]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x14001c274
mov rcx, qword [0x140644d20]
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov ecx, dword [0x140644cfc]
call fcn.140002474
xor edx, edx
mov qword [0x140644d58], rax
lea rcx, [0x140020cb0]
call fcn.140001c00
mov rcx, rax
lea rdx, [0x1400214b0]
call fcn.140002074
test rax, rax
je 0x14001c25c
mov ecx, dword [rax + 4]
call fcn.140002474
test rax, rax
je 0x14001c25c
movsxd rcx, dword [rax + 3]
mov rax, qword [rcx + rax + 7]
mov qword [0x140644db0], rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [0x140644d20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov ecx, 0xc0000082
rdmsr
shl rdx, 0x20
or rax, rdx
mov eax, dword [rax + 8]
cmp al, 0x10
je 0x14001c295
mov ecx, 0x6666
call qword [sym.imp.ntoskrnl.exe_KeBugCheck]
int3
and eax, 0xff00
lea eax, [rax + 8]
mov dword [0x14064729c], eax
mov eax, 0
setne al
mov dword [0x140647620], eax
lea rax, [0x140644e90]
mov qword [0x140644e98], rax
mov qword [0x140644e90], rax
lea rax, [0x140644e80]
mov qword [0x140644e88], rax
mov qword [0x140644e80], rax
lea rax, [0x140644ea0]
mov qword [0x140644ea8], rax
mov qword [0x140644ea0], rax
call fcn.1400191e0
mov qword [0x140644ce0], rax
call fcn.14001aee0
test al, al
jne 0x14001c30c
mov eax, 0xc0000001
jmp 0x14001c31f
mov edx, dword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
call fcn.140001458
call fcn.140003bfc
xor eax, eax
lea r11, [rsp + 0x660]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret