Function at 0x11a14
Capabilities:
Complete processing asynchronous io request
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x870
mov rax, qword [0x00015100]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov rax, qword [rdx + 0xb8]
mov rsi, qword [rdx + 0x18]
mov rbp, rdx
mov ecx, dword [rax + 0x18]
mov ebx, dword [rax + 0x10]
mov edx, dword [rax + 8]
mov eax, 0x8000401c
xor edi, edi
cmp ecx, eax
ja 0x11c1c
je 0x11bfa
cmp ecx, 0x80004004
je 0x11bef
cmp ecx, 0x80004008
je 0x11be4
cmp ecx, 0x8000400c
je 0x11bad
cmp ecx, 0x80004010
je 0x11b76
cmp ecx, 0x80004014
je 0x11af3
cmp ecx, 0x80004018
jne 0x11d2a
mov rcx, qword [rsi]
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, edi
jl 0x11d2a
lea rdx, [0x00013730]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
cmp rax, rdi
je 0x11aec
mov rcx, qword [rsp + 0x40]
call rax
mov rcx, qword [rsp + 0x40]
jmp 0x11b6b
mov rcx, qword [rsi]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, edi
jl 0x11d2a
lea rax, [rsp + 0x40]
mov r9d, 0x1fffff
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov byte [rsp + 0x28], dil
mov rcx, qword [rax]
mov edx, 0x200
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
cmp eax, edi
jl 0x11b66
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ZwTerminateProcess]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x11d2a
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x60], di
call fcn.000135b0
lea rcx, [rsp + 0x60]
mov r8, rbx
mov rdx, rsi
call fcn.00013260
lea rcx, [rsp + 0x60]
call qword [0x000179e0]
jmp 0x11d2a
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x60], di
call fcn.000135b0
lea rcx, [rsp + 0x60]
mov r8, rbx
mov rdx, rsi
call fcn.00013260
lea rcx, [rsp + 0x60]
call qword [0x000179d8]
jmp 0x11d2a
call qword [0x000179d0]
jmp 0x11d2a
call qword [0x000179c8]
jmp 0x11d2a
mov rcx, qword [rsi]
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, edi
jl 0x11d2a
lea rdx, [0x00013760]
jmp 0x11aca
cmp ecx, 0x80004020
je 0x11cf9
cmp ecx, 0x80004024
je 0x11cc6
cmp ecx, 0x80004028
je 0x11cac
cmp ecx, 0x8000402c
je 0x11c8d
cmp ecx, 0x80004030
je 0x11c66
cmp ecx, 0x80004034
jne 0x11d2a
movsxd rcx, dword [rsi]
call qword [0x000179f0]
jmp 0x11d2a
mov rcx, qword [rsi]
call fcn.00011938
cmp rax, rdi
jne 0x11c7d
mov edi, 0xc0000010
jmp 0x11d2a
mov qword [rsi], rax
mov qword [rbp + 0x38], 8
jmp 0x11d2a
mov rbx, rdx
mov r8, rdx
mov rcx, rsi
xor edx, edx
call fcn.000135b0
mov rcx, rsi
call qword [0x000179e8]
mov qword [rbp + 0x38], rbx
jmp 0x11d2a
mov rbx, rdx
mov r8, rdx
mov rcx, rsi
xor edx, edx
call fcn.000135b0
mov rcx, rsi
call fcn.00012b18
jmp 0x11ca6
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x60], di
call fcn.000135b0
lea rcx, [rsp + 0x60]
mov r8, rbx
mov rdx, rsi
call fcn.00013260
lea rcx, [rsp + 0x60]
call fcn.00012bd4
jmp 0x11d2a
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x60], di
call fcn.000135b0
lea rcx, [rsp + 0x60]
mov r8, rbx
mov rdx, rsi
call fcn.00013260
lea rcx, [rsp + 0x60]
call fcn.00012cbc
xor edx, edx
mov rcx, rbp
mov dword [rbp + 0x30], edi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.000131f0
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret