Function at 0x140005784
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
and qword [rsp + 0x68], 0
mov rdi, rcx
test rcx, 0xfffffffffffffffd
jne 0x140005505
mov ecx, dword [0x14000d850]
mov qword [0x14000d7e0], rcx
test rcx, rcx
jne 0x1400054c4
lea rcx, [0x1400097f0]
call fcn.140001a20
movsxd rcx, eax
mov qword [0x14000d7e0], rcx
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x1400055e9
cmp qword [rsp + 0x68], 0
je 0x1400054e5
nop
test rdi, rdi
je 0x1400054eb
cmp rdi, 2
jne 0x1400054fb
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop dword [rax + rax]
test rdi, rdi
je 0x14000551c
cmp rdi, 2
je 0x14000551c
cmp rdi, 1
jne 0x1400055cb
call fcn.140001820
jmp 0x140005525
nop dword [rax]
call fcn.140001540
test al, al
setne al
test al, al
je 0x1400055cb
and dword ds:[rsp + 0x60], 0
lea rcx, [rsp + 0x60]
call fcn.14003a340
lea rdx, [0x14000a3e0]
mov rcx, rax
mov rbx, rax
call fcn.140001140
lea rdx, [0x14000a400]
mov rcx, rbx
call fcn.140001140
lea rdx, [0x14000a420]
mov rcx, rbx
call fcn.140001140
cmp rdi, 2
jb 0x1400055f6
nop dword [rax + rax]
jne 0x1400056db
xor edx, edx
mov dword [0x14000d830], 1
lea r9, [0x140005220]
sub r9, 3
lea r8, [0x14000a430]
mov qword [0x1400352f8], r9
lea ecx, [rdx + 0x4d]
mov qword [0x14000d838], r9
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [0x1400352f8]
add rcx, 3
call fcn.140001278
cmp qword [rsp + 0x68], 0
je 0x1400055d8
test rdi, rdi
je 0x1400055de
cmp rdi, 2
jne 0x1400055e9
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rbx, qword [rsp + 0x70]
xor eax, eax
add rsp, 0x50
pop rdi
ret
mov rcx, qword [0x14000d810]
mov edx, 0x25e
add rcx, 8
mov qword [0x1400352f8], rcx
call fcn.140005000
mov r9, qword [0x1400352f8]
lea r8, [0x14000a430]
xor edx, edx
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [0x1400352f8]
lea rdx, [0x14000d2e0]
mov eax, 4
lea r8d, [rax + 0x7c]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
add rcx, r8
movups xmm1, xmmword [rdx + 0x70]
add rdx, r8
movups xmmword [rcx - 0x10], xmm1
sub rax, 1
jne 0x140005642
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
mov rax, qword [rdx + 0x50]
mov qword [rcx + 0x50], rax
mov eax, dword [rdx + 0x58]
mov dword [rcx + 0x58], eax
movzx eax, word [rdx + 0x5c]
mov word [rcx + 0x5c], ax
test rdi, rdi
je 0x1400055bb
cmp rdi, 2
je 0x1400055bb
mov rcx, qword [0x1400352f8]
add rcx, 3
call fcn.1400012e0
jmp 0x1400055cb
jmp 0x140005480