Function at 0x140071eec
Capabilities:
Attach user process memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x38]
sub rsp, 0x120
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov ecx, 0x61
call fcn.140029ab4
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
xor r12d, r12d
cmp rax, rbx
cmove rbx, r12
test rbx, rbx
je 0x140071f4c
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.ntoskrnl.exe_KeStackAttachProcess
mov ecx, 0x21
call fcn.140029ab4
mov ecx, 3
mov r15, rax
call fcn.140029ab4
mov r14, rax
test r15d, r15d
je 0x14007215d
test rax, rax
je 0x14007215d
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0xb4
call fcn.1400013f0
mov dword [rsp + 0x50], 0x41f2
mov dword [rsp + 0x54], 0x16e
mov dword [rsp + 0x58], 0x39
mov dword [rsp + 0x5c], 0x41f5
mov dword [rsp + 0x60], 0x16f
mov dword [rsp + 0x64], 0x3a
mov dword [rsp + 0x68], 0x41f8
mov dword [rsp + 0x6c], 0x170
mov dword [rsp + 0x70], 0x3b
mov dword [rsp + 0x74], 0x41fb
mov dword [rsp + 0x78], 0x171
mov dword [rsp + 0x7c], 0x3c
mov dword [rbp - 0x80], 0x4204
mov dword [rbp - 0x7c], 0x172
mov dword [rbp - 0x78], 0x3d
mov dword [rbp - 0x74], 0x4207
mov dword [rbp - 0x70], 0x173
mov dword [rbp - 0x6c], 0x3e
mov dword [rbp - 0x68], 0x420a
mov dword [rbp - 0x64], 0x174
mov dword [rbp - 0x60], 0x3f
mov dword [rbp - 0x5c], 0x420d
mov dword [rbp - 0x58], 0x175
mov dword [rbp - 0x54], 0x40
mov dword [rbp - 0x50], 0x4210
mov dword [rbp - 0x4c], 0x176
mov dword [rbp - 0x48], 0x41
mov dword [rbp - 0x44], 0x4213
mov dword [rbp - 0x40], 0x177
mov dword [rbp - 0x3c], 0x42
mov dword [rbp - 0x38], 0x4216
mov dword [rbp - 0x34], 0x178
mov dword [rbp - 0x30], 0x43
mov dword [rbp - 0x2c], 0x42ac
mov dword [rbp - 0x28], 0x290
mov dword [rbp - 0x24], 0x63
mov dword [rbp - 0x20], 0x42af
mov dword [rbp - 0x1c], 0x291
mov dword [rbp - 0x18], 0x64
mov dword [rbp - 0x14], 0x42b2
mov dword [rbp - 0x10], 0x292
mov dword [rbp - 0xc], 0x65
mov esi, r12d
mov eax, esi
lea rdi, [rax + rax*2]
mov ecx, dword [rsp + rdi*4 + 0x50]
test ecx, ecx
jne 0x1400720db
cmp dword [rsp + rdi*4 + 0x54], r12d
jne 0x1400720db
cmp dword [rsp + rdi*4 + 0x58], r12d
je 0x140072106
call fcn.14007a1f0
test eax, eax
je 0x140072102
mov ecx, eax
call fcn.14007a130
test eax, eax
je 0x140072102
cmp eax, r15d
jae 0x140072102
mov ecx, dword [rsp + rdi*4 + 0x54]
mov edx, eax
add rdx, r14
call fcn.140029bac
inc esi
jmp 0x1400720bf
call fcn.140014bd0
call fcn.140013218
call fcn.140013498
call fcn.140013f60
call fcn.1400145d8
call fcn.1400149f8
call fcn.140012db8
call fcn.14001300c
call fcn.140013994
call fcn.1400149ec
mov ecx, 0x914
call fcn.140029ab4
cmp eax, 0x1770
jb 0x14007215d
call fcn.140012bd4
call fcn.140013d98
call fcn.140013b74
call fcn.1400134b8
call fcn.140014fd4
test rbx, rbx
je 0x140072171
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret