Function at 0x14000dc08
Capabilities:
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r13
push r14
push r15
sub rsp, 0xe0
mov rsi, r9
mov edi, edx
mov r14, rcx
xor r15d, r15d
cmp qword [0x14003b480], r15
jne 0x14000dccb
lea rdx, [0x1400163e0]
lea rcx, [0x140016420]
call fcn.14000fa24
mov rbx, rax
mov rcx, rax
call fcn.140010264
mov qword [0x14003b480], rax
mov rcx, rbx
call fcn.140010264
mov qword [0x14003ce18], rax
cmp qword [0x14003b480], r15
jne 0x14000dccb
call fcn.1400102a0
test eax, eax
jns 0x14000dc95
lea rcx, [0x140016450]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x14000dfb3
lea rcx, [0x140016480]
call fcn.14000fe18
mov qword [0x14003b480], rax
lea rcx, [0x140016480]
call fcn.14000fe18
mov qword [0x14003ce18], rax
cmp qword [0x14003b480], r15
jne 0x14000dccb
call fcn.14000f95c
jmp 0x14000dc8e
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x70], r15
xorps xmm0, xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x98], 0xd0f
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0xa0], r15
mov rcx, rdi
lea rdx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x14000dd41
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x14000dd41
mov al, 1
jmp 0x14000dfb3
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov r8, rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], r15b
mov r13d, 7
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x88]
mov rdx, rsi
mov rcx, r14
call sub.ntoskrnl.exe_MmCopyVirtualMemory
mov dword [rsp + 0x60], eax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov r8, rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], r15b
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x90]
mov rdx, rsi
mov rcx, qword [rsp + 0x70]
call sub.ntoskrnl.exe_MmCopyVirtualMemory
mov dword [rsp + 0x60], eax
mov r8d, r13d
lea rdx, [rsp + 0x88]
mov rcx, rsi
call fcn.14000db54
lea edi, [r13 + 0x39]
mov dword [rsp + 0x28], edi
mov ebx, 0x1000
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x98]
xor r8d, r8d
lea rdx, [rsp + 0x68]
or r14, 0xffffffffffffffff
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov dword [rsp + 0x60], eax
mov rdx, qword [rsp + 0x68]
lea rcx, [0x1400164d0]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0xa0]
xor r8d, r8d
lea rdx, [rsp + 0x78]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov dword [rsp + 0x60], eax
mov rdx, qword [rsp + 0x78]
lea rcx, [0x1400164f0]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000df5c
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x14000df5c
test ecx, ecx
js 0x14000df5c
test eax, eax
js 0x14000df5c
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], r15b
mov qword [rsp + 0x20], 0xd0f
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
lea rdx, [0x140017400]
call sub.ntoskrnl.exe_MmCopyVirtualMemory
mov dword [rsp + 0x60], eax
mov rax, qword [0x14003b480]
test rax, rax
je 0x14000df5c
test eax, eax
js 0x14000df5c
xor ecx, ecx
call fcn.14000dae0
mov bl, al
mov rax, qword [0x14003b480]
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r15d
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov r9, r14
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0xa8]
call qword [0x1400172c8]
mov edi, eax
mov dword [rsp + 0x60], eax
mov r8, qword [0x14003b480]
mov edx, eax
lea rcx, [0x140016510]
call sub.ntoskrnl.exe_DbgPrint
mov cl, bl
call fcn.14000dae0
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x78], r15
jmp 0x14000df65
mov edi, 0xc0000001
mov dword [rsp + 0x60], edi
mov ecx, 0x5dc
call fcn.14000dbe0
mov r8, r13
lea rdx, [rsp + 0x90]
mov rcx, rsi
call fcn.14000db54
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x14000dfa5
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, dil
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
ret