Function at 0x140083730
Capabilities:
Attach user process memory

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rsi, rcx
xor ebx, ebx
mov ecx, 0x914
mov r15d, ebx
call fcn.140029ab4
cmp eax, 0x1db0
jb 0x1400837a6
mov edi, 0x2ce
mov ecx, edi
call fcn.140029ab4
mov r15, rax
test rax, rax
jne 0x1400837a6
call fcn.14008325c
mov ecx, edi
call fcn.140029ab4
mov r15, rax
test rax, rax
je 0x140083a39
mov ecx, 0x41db
call fcn.140029ab4
mov ecx, 0x42f2
mov r12, rax
call fcn.140029ab4
mov ecx, 0x4172
mov r14, rax
mov qword [rbp - 0x39], rax
call fcn.140029ab4
mov rdi, rax
test r12, r12
je 0x140083a39
test r14, r14
je 0x140083a39
test rax, rax
je 0x140083a39
mov rcx, rsi
call r12
cmp al, 1
jne 0x140083a39
lea rcx, [rsi + 0x14f]
call r12
cmp al, 1
jne 0x140083a39
mov rax, qword [rdi]
cmp qword [rsi + 0x68], rax
jbe 0x14008395e
mov ecx, 0x61
call fcn.140029ab4
mov rdi, rax
test rax, rax
je 0x14008395e
mov ecx, 0x42f8
call fcn.140029ab4
mov ecx, 0x41c6
mov qword [rbp - 0x51], rax
call fcn.140029ab4
mov ecx, 0x4199
mov r13, rax
call fcn.140029ab4
mov ecx, 0x4223
mov r14, rax
call fcn.140029ab4
mov r12, rax
cmp qword [rbp - 0x51], rbx
je 0x14008393e
mov ecx, 0x41bd
call fcn.140029ab4
test rax, rax
je 0x14008393e
test r13, r13
je 0x14008393e
test r14, r14
je 0x14008393e
test r12, r12
je 0x14008393e
lea rax, [0x140083574]
xorps xmm0, xmm0
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x31]
lea rcx, [rbp - 0x49]
movdqu xmmword [rbp - 0x11], xmm0
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rbx
mov dword [rbp - 0x31], 0x30
mov qword [rbp - 0x29], rbx
mov dword [rbp - 0x19], 0x200
mov qword [rbp - 0x21], rbx
call qword [rbp - 0x51]
test eax, eax
js 0x14008393e
mov rcx, qword [rbp - 0x49]
lea rax, [rbp - 0x59]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1fffff
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call r13
test eax, eax
js 0x14008392f
mov rcx, qword [rbp - 0x59]
lea rax, [rbp - 0x41]
mov r9b, 1
xor r8d, r8d
xor edx, edx
mov qword [rbp - 0x41], 0xfffffffffe363c80
mov qword [rsp + 0x20], rax
call r14
mov rcx, qword [rbp - 0x59]
call r12
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x140083a0e
lea rdx, [rbp - 1]
mov rcx, rdi
call sub.ntoskrnl.exe_KeStackAttachProcess
mov rcx, rsi
call qword [rsi + 0x68]
lea rcx, [rbp - 1]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
jmp 0x140083a0e
mov ecx, 0x42f5
call fcn.140029ab4
mov r13, rax
test rax, rax
je 0x140083a39
mov r14d, 0x2a7
mov qword [rsi + 0x50], rbx
mov ecx, r14d
call fcn.140029ab4
mov rdi, rax
test eax, eax
jne 0x14008399c
call fcn.140078244
mov ecx, r14d
call fcn.140029ab4
mov edi, eax
mov ecx, 0x21
call fcn.140029ab4
mov ecx, 3
mov r14, rax
call fcn.140029ab4
mov rcx, rax
test edi, edi
je 0x1400839dc
test r14d, r14d
je 0x1400839dc
test rax, rax
je 0x1400839dc
cmp edi, r14d
jae 0x1400839dc
mov eax, edi
add rax, rcx
je 0x1400839dc
lea rdi, [rsi + 0x70]
mov ecx, 0x1c
rep stosq qword [rdi], rax
mov rdi, qword [rsi + 8]
mov qword [rsi + 0x68], rbx
mov r14d, ebx
jmp 0x140083a09
mov rcx, rdi
call r12
cmp al, 1
jne 0x140083a0e
inc r14d
cmp r14d, 0x10000
ja 0x140083a0e
mov rcx, rdi
call r13
mov rdi, qword [rdi + 0x10]
test rdi, rdi
jne 0x1400839e9
mov ecx, 0x914
mov bl, 1
call fcn.140029ab4
cmp eax, 0x1db0
jb 0x140083a2a
mov rdx, rsi
mov rcx, rsi
call r15
mov rcx, rsi
call qword [rbp - 0x39]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret