Function at 0x17e8c
Capabilities:
Attach user process memory

Disassembly:
push rbx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x398
mov rax, qword [0x00013100]
xor rax, rsp
mov qword [rsp + 0x380], rax
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x88], rdx
mov qword [rsp + 0x80], rcx
mov rax, qword [rsp + 0x400]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x50], rax
xor ebx, ebx
mov byte [rsp + 0x30], bl
mov byte [rsp + 0x32], bl
mov r13, rdx
mov qword [rsp + 0x58], rdx
mov r15, r9
lea rsi, [rsp + 0x180]
mov qword [rsp + 0x38], rsi
mov edi, 0xc000
mov rax, qword [rsp + 0x3f0]
cmp rax, rdi
cmovb rdi, rax
mov r14, rax
mov qword [rsp + 0x48], rax
cmp r14, rbx
je 0x1827b
cmp rdi, r14
cmova rdi, r14
cmp rdi, 0x3ff
jbe 0x17f4c
mov byte [rsp + 0x31], 1
jmp 0x17fe7
mov byte [rsp + 0x31], bl
cmp rdi, 0x200
ja 0x17f83
lea rax, [rsp + 0x180]
cmp rsi, rax
je 0x17f74
mov edx, 0x4368704b
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rsi, [rsp + 0x180]
mov qword [rsp + 0x38], rsi
jmp 0x17fe7
lea rax, [rsp + 0x180]
cmp rsi, rax
jne 0x17fe7
mov r8d, 0x4368704b
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
mov qword [rsp + 0x38], rax
cmp rax, rbx
jne 0x17fe7
shr rdi, 1
cmp rdi, 0x200
jbe 0x17fda
mov r8d, 0x4368704b
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
mov qword [rsp + 0x38], rax
cmp rax, rbx
je 0x17fae
jmp 0x17fe7
lea rsi, [rsp + 0x180]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rbx
mov byte [rsp + 0x33], bl
mov byte [rsp + 0x34], bl
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
cmp r13, qword [rsp + 0x88]
jne 0x1803e
cmp byte [rsp + 0x3f8], bl
je 0x1803e
mov byte [rsp + 0x30], 1
mov r8d, 1
mov rdx, qword [rsp + 0x3f0]
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov byte [rsp + 0x30], bl
cmp byte [rsp + 0x31], bl
je 0x180f9
lea r9, [rsp + 0xd0]
mov qword [r9], rbx
mov ecx, r13d
mov r8d, 0xfff
and ecx, r8d
mov eax, edi
and eax, r8d
lea edx, [rcx + rax + 0xfff]
shr edx, 0xc
mov rax, rdi
shr rax, 0xc
add eax, edx
lea rax, [rax*8 + 0x30]
mov word [r9 + 8], ax
mov word [r9 + 0xa], bx
mov rax, r13
and rax, 0xfffffffffffff000
mov qword [r9 + 0x20], rax
mov rax, r13
and rax, r8
mov dword [r9 + 0x2c], eax
mov dword [r9 + 0x28], edi
xor r8d, r8d
mov dl, byte [rsp + 0x3f8]
mov rcx, r9
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
mov byte [rsp + 0x33], 1
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov qword [rsp + 0x40], rax
cmp rax, rbx
jne 0x18107
mov byte [rsp + 0x32], 1
mov ecx, 0xc000009a
call qword [sym.imp.ntoskrnl.exe_ExRaiseStatus]
mov r8, rdi
mov rdx, r13
mov rcx, rsi
call fcn.00011a40
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
cmp r15, qword [rsp + 0x90]
jne 0x1815b
cmp byte [rsp + 0x3f8], bl
je 0x1815b
mov byte [rsp + 0x30], 1
mov r8d, 1
mov rdx, qword [rsp + 0x3f0]
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_ProbeForWrite]
mov byte [rsp + 0x30], bl
mov byte [rsp + 0x34], 1
cmp byte [rsp + 0x31], bl
je 0x18178
mov r8, rdi
mov rdx, qword [rsp + 0x40]
mov rcx, r15
call fcn.00011a40
jmp 0x18187
mov r8, rdi
mov rdx, rsi
mov rcx, r15
call fcn.00011a40
nop
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
cmp byte [rsp + 0x31], bl
je 0x181bc
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
sub r14, rdi
mov qword [rsp + 0x48], r14
add r13, rdi
mov qword [rsp + 0x58], r13
add r15, rdi
jmp 0x17f29
lea rax, [rsp + 0x180]
cmp rsi, rax
je 0x18296
mov edx, 0x4368704b
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [rsp + 0x3f0]
mov rcx, qword [rsp + 0x78]
mov qword [rcx], rax
xor eax, eax
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.00011950
add rsp, 0x398
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
ret