Function at 0x1e3b8
Capabilities:
Attach user process memory
Find process by pid
Get system information on windows

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xd0
mov r11d, 0x200
mov r14, rcx
mov edi, 0x67426649
mov dword [rax + 0x20], r11d
mov edx, r11d
mov r8d, edi
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r8d, dword [rsp + 0x128]
lea r9, [rsp + 0x128]
mov rdx, rax
mov ecx, 0x10
mov rsi, rax
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov ebx, eax
test eax, eax
jns 0x1e43c
mov edx, edi
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov r11d, dword [rsp + 0x128]
add r11d, r11d
mov dword [rsp + 0x128], r11d
cmp ebx, 0xc0000004
je 0x1e3de
mov r13, qword [rsi]
lea rbp, [rsi + 8]
test r13, r13
je 0x1e6b1
movzx eax, word [rbp]
and qword [rsp + 0x68], 0
movzx r12d, word [rbp + 6]
and qword [rsp + 0x78], 0
and dword [rsp + 0x88], 0
and qword [rsp + 0x80], 0
and qword [rsp + 0x90], 0
and qword [rsp + 0x98], 0
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x70]
lea rcx, [rsp + 0x50]
mov edx, 0x40
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x70], 0x30
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
mov ebx, eax
test eax, eax
js 0x1e6a3
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x30], 2
and dword [rsp + 0x28], 0
lea r9, [rsp + 0x48]
or r8, 0xffffffffffffffff
mov rdx, r12
mov dword [rsp + 0x20], 0x1f0fff
call qword [sym.imp.ntoskrnl.exe_ZwDuplicateObject]
mov ebx, eax
test eax, eax
js 0x1e698
mov eax, 0x400
mov r8d, edi
mov ecx, 1
mov rdx, rax
mov dword [rsp + 0x120], eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r8d, dword [rsp + 0x120]
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x40], rax
call fcn.00013190
mov r9d, dword [rsp + 0x120]
mov r8, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
lea r11, [rsp + 0x120]
mov edx, 1
mov qword [rsp + 0x20], r11
call qword [sym.imp.ntoskrnl.exe_ZwQueryObject]
mov ebx, eax
test eax, eax
jns 0x1e5c0
mov rcx, qword [rsp + 0x40]
cmp eax, 0xc0000004
jne 0x1e685
test rcx, rcx
je 0x1e56c
mov edx, edi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [rsp + 0x120]
mov r8d, edi
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r9d, dword [rsp + 0x120]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x120]
lea r8, [rsp + 0x40]
mov edx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryObject]
mov ebx, eax
test eax, eax
jns 0x1e5c0
mov rcx, qword [rsp + 0x40]
jmp 0x1e685
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1e685
cmp qword [rcx + 8], 0
je 0x1e685
mov rdx, rcx
mov r8b, 1
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
test eax, eax
jne 0x1e67b
movzx ecx, word [rbp]
and qword [rsp + 0x58], 0
lea rdx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x1e5b6
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea rdx, [rsp + 0x118]
xor r8d, r8d
mov rcx, r12
mov byte [rsp + 0x118], 0
mov byte [rsp + 0x119], 0
call qword [sym.imp.ntoskrnl.exe_ObSetHandleAttributes]
mov edi, eax
test eax, eax
js 0x1e653
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov edi, eax
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x58]
mov ebx, edi
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test edi, edi
mov edi, 0x67426649
js 0x1e5b6
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1e68d
mov edx, edi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
add rbp, 0x18
sub r13, 1
jne 0x1e44c
mov edx, edi
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
add rsp, 0xd0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret