Function at 0x1400083bc
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x510]
sub rsp, 0x610
mov rax, qword [0x140012450]
xor rax, rsp
mov qword [rbp + 0x500], rax
mov rax, qword [rcx]
mov rdi, rdx
mov qword [rcx + 8], rax
mov rbx, rcx
cmp qword [0x1400126d0], 0
je 0x1400085fe
and qword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, r8
call qword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
test eax, eax
js 0x1400085fe
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsGetThreadProcessId]
test rax, 0xfffffffffffffffb
je 0x1400085fe
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400085fe
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsIsThreadTerminating]
test al, al
jne 0x1400085fe
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_PsSuspendProcess]
test eax, eax
js 0x1400085fe
mov rcx, qword [rsp + 0x48]
lea rdx, [rbp + 0x4d0]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x4d0
call fcn.14000d740
mov rsi, qword gs:[0x188]
xor r14d, r14d
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadStackBase]
xor r12d, r12d
cmp qword [rsi], rax
je 0x1400084d3
add r12d, 8
cmp qword [r12 + rsi], rax
jne 0x1400084c9
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadStackLimit]
xor r15d, r15d
cmp qword [rsi], rax
je 0x1400084eb
add r15d, 8
cmp qword [r15 + rsi], rax
jne 0x1400084e1
call qword [sym.imp.ntoskrnl.exe_IoGetInitialStack]
xor r8d, r8d
cmp qword [rsi], rax
je 0x140008503
add r8d, 8
cmp qword [r8 + rsi], rax
jne 0x1400084f9
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
mov r13, qword [r12 + rdx]
mov r9, qword [r15 + rdx]
mov r10, qword [r8 + rdx]
cmp ecx, r8d
je 0x140008527
cmp qword [rcx + rdx], r13
jae 0x140008527
cmp qword [rcx + rdx], r9
ja 0x140008532
add ecx, 8
cmp ecx, 0x2f8
jb 0x140008516
mov rsi, qword [rcx + rdx]
test r13, r13
je 0x1400085e6
test r9, r9
je 0x1400085e6
test r10, r10
je 0x1400085e6
test rsi, rsi
je 0x1400085e6
mov r12, r13
xor r15d, r15d
sub r12, rsi
cmp rsi, r9
jbe 0x140008763
cmp rsi, r13
jae 0x140008763
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000875e
lea rcx, [r13 - 8]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000875e
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r8, r12
xor edx, edx
mov rcx, rax
mov r14, rax
call fcn.14000d740
lea rax, [rsp + 0x60]
mov rdx, rsi
lea r8, [r12 - 8]
mov qword [rsp + 0x20], rax
lea r9d, [r15 + 2]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmCopyMemory]
test eax, eax
jns 0x140008636
test r14, r14
je 0x1400085e6
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rcx, [rbp + 0x4d0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_PsResumeProcess]
mov rdx, rbx
mov rcx, rdi
call fcn.140007f08
mov rax, rdi
mov rcx, qword [rbp + 0x500]
xor rcx, rsp
call fcn.14000c300
mov rbx, qword [rsp + 0x668]
add rsp, 0x610
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [r14 + 0x38]
lea rax, [r14 + 0x40]
xorps xmm0, xmm0
mov qword [rbp + 0xf8], rcx
mov qword [rbp + 0x98], rax
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rbp - 0x78], xmm0
test rcx, rcx
je 0x140008755
and qword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
xor r8d, r8d
call qword [sym.imp.ntoskrnl.exe_RtlLookupFunctionEntry]
mov rsi, rax
test rax, rax
jne 0x1400086ab
mov rcx, qword [rbp + 0xf8]
lea rdx, [rsp + 0x78]
mov rax, qword [0x1400126d0]
call qword [0x14000f358]
mov rsi, rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x50], rax
test rsi, rsi
je 0x140008755
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140008755
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140008755
and qword [rsp + 0x38], 0
lea rax, [rsp + 0x68]
mov r8, qword [rbp + 0xf8]
mov r9, rsi
mov rdx, qword [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_RtlVirtualUnwind]
mov rcx, qword [rbp + 0xf8]
test rcx, rcx
je 0x140008745
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x14000872f
mov qword [rdx], rcx
add qword [rbx + 8], 8
jmp 0x14000873e
lea r8, [rbp + 0xf8]
mov rcx, rbx
call fcn.140007dc4
mov rcx, qword [rbp + 0xf8]
inc r15d
cmp r15d, 0x100
jl 0x140008658
test r15d, r15d
jne 0x1400085d6
mov rdx, qword [rsp + 0x40]
and qword [rsp + 0x38], 0
lea r9, [0x1400087e0]
mov byte [rsp + 0x30], 0
lea rcx, [rbp - 0x60]
and qword [rsp + 0x28], 0
xor r8d, r8d
and qword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_KeInitializeApc]
xor r9d, r9d
lea rcx, [rbp - 0x60]
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_KeInsertQueueApc]
xor r8d, r8d
lea rcx, [0x1400126e0]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x58], 0xfffffffffd050f80
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rcx, [0x1400126e0]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
jmp 0x1400085d6