Function at 0x1400085dc
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r12, rdx
mov rbx, rcx
xor esi, esi
mov dword [rsp + 0x80], esi
mov eax, dword [0x14001a014]
imul rdx, rax, 0x38
mov r8d, 0x6d7467
lea r14d, [rsi + 1]
mov ecx, r14d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [0x140077178], rax
mov ecx, dword [0x14001a014]
imul r8, rcx, 0x38
xor edx, edx
mov rcx, rax
call fcn.140015340
and qword [rsp + 0x30], rsi
and qword [rsp + 0x28], rsi
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov r15d, eax
mov dword [rsp + 0x20], eax
test eax, eax
jns 0x140008666
mov eax, 0xc0000001
jmp 0x140008862
mov rdi, qword [rsp + 0x30]
xor bl, bl
test rdi, rdi
je 0x1400086b2
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400086b2
mov rcx, qword [0x1400774d0]
add rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400086b2
mov rax, qword [0x1400774d0]
mov rcx, qword [rax + rdi]
test rcx, rcx
je 0x1400086b2
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx ebx, bl
test al, al
cmovne ebx, r14d
test bl, bl
jne 0x1400086c3
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x14000865c
mov edi, 4
mov dword [rsp + 0x88], edi
cmp edi, 0x40000
jae 0x14000881f
mov ecx, edi
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
test eax, eax
js 0x140008817
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_IoThreadToProcess]
cmp rax, qword [rsp + 0x30]
jne 0x140008817
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140008817
mov eax, esi
imul rbx, rax, 0x38
mov rcx, qword [rsp + 0x28]
mov rax, qword [0x140077178]
mov qword [rbx + rax + 0x20], rcx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_PsGetThreadId]
mov rcx, qword [0x140077178]
mov dword [rbx + rcx], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_PsGetThreadTeb]
mov rcx, qword [0x140077178]
mov qword [rbx + rcx + 0x10], rax
mov rcx, qword [0x140077560]
mov rax, qword [rsp + 0x28]
mov rdx, qword [rcx + rax]
mov rax, qword [0x140077178]
mov qword [rbx + rax + 0x18], rdx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeQueryPriorityThread]
mov rcx, qword [0x140077178]
mov dword [rbx + rcx + 4], eax
mov rcx, qword [0x140077550]
mov rax, qword [rsp + 0x28]
mov edx, dword [rcx + rax]
mov rax, qword [0x140077178]
mov dword [rbx + rax + 8], edx
mov rcx, qword [0x140077558]
mov rax, qword [rsp + 0x28]
movsx edx, byte [rcx + rax]
mov rax, qword [0x140077178]
mov dword [rbx + rax + 0xc], edx
mov rcx, qword [rsp + 0x28]
call fcn.1400113e8
movzx ecx, al
mov rax, qword [0x140077178]
mov qword [rbx + rax + 0x28], rcx
jmp 0x1400087fc
add esi, r14d
mov dword [rsp + 0x80], esi
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
and qword [rsp + 0x28], 0
add edi, 4
jmp 0x1400086c8
mov rax, qword [0x140077178]
mov dword [rax + 0x30], esi
mov eax, dword [0x14001a014]
imul r8, rax, 0x38
mov rdx, qword [0x140077178]
mov rcx, r12
call fcn.140015080
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov edx, 0x6d7467
mov rcx, qword [0x140077178]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, r15d
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret