Function at 0x140002a24
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 8]
sub rsp, 0x108
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rbp - 8], rax
xor esi, esi
mov byte [rsp + 0x30], r8b
mov qword [rsp + 0x40], rdx
mov r15, rcx
mov qword [rsp + 0x50], rcx
xor edx, edx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x58], r9
lea r8d, [rsi + 0x28]
mov qword [rsp + 0x38], rsi
mov r12, r9
mov qword [rsp + 0x48], rsi
mov ebx, esi
mov r14d, esi
call fcn.140005440
lea rcx, [rbp - 0x30]
lea edx, [rsi + 2]
sub rcx, rdx
add rcx, rdx
cmp word [rcx], si
jne 0x140002a8f
mov eax, dword [0x140005b00]
mov dword [rcx], eax
movzx eax, word [0x140005b04]
mov word [rcx + 4], ax
lea rcx, [rbp - 0x30]
sub rcx, rdx
add rcx, rdx
cmp word [rcx], si
jne 0x140002ab1
mov eax, dword [0x140005b10]
mov dword [rcx], eax
movzx eax, word [0x140005b14]
mov word [rcx + 4], ax
lea rcx, [rbp - 0x30]
sub rcx, rdx
add rcx, rdx
cmp word [rcx], si
jne 0x140002ad3
mov eax, dword [0x140005b20]
mov dword [rcx], eax
movzx eax, word [0x140005b24]
mov word [rcx + 4], ax
lea rcx, [rbp - 0x30]
sub rcx, rdx
add rcx, rdx
cmp word [rcx], si
jne 0x140002af5
movsd xmm0, qword [0x140005b30]
movzx eax, word [0x140005b38]
movsd qword [rcx], xmm0
mov word [rcx + 8], ax
lea rcx, [rbp - 0x30]
sub rcx, rdx
add rcx, rdx
cmp word [rcx], si
jne 0x140002b1b
mov eax, dword [0x140005af0]
lea rdx, [rsp + 0x38]
mov dword [rcx], eax
movzx eax, word [0x140005af4]
mov word [rcx + 4], ax
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x140002f82
lea rcx, [0x140005b90]
call fcn.140005327
mov rcx, qword [rsp + 0x38]
call sub.ntoskrnl.exe_PsGetProcessWow64Process
mov rcx, qword [rsp + 0x38]
test rax, rax
lea rax, [rsp + 0x48]
setne r13b
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
test eax, eax
jne 0x140002bb2
lea rcx, [0x140005bb0]
call fcn.140005327
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140002ba8
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, 0xc000010a
jmp 0x140002f94
lea rcx, [0x140005bd0]
call fcn.140005327
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x60]
mov r9b, 1
mov r8b, r13b
call fcn.140003958
mov rsi, rax
test rax, rax
jne 0x140002c0b
lea rcx, [0x140005bf0]
call fcn.140005327
mov edi, 0xc0000225
lea rcx, [0x140005c10]
call fcn.140005327
xor edx, edx
test edi, edi
js 0x140002da9
xor eax, eax
lea rcx, [rbp - 0x60]
lea r8d, [rdx + 1]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
sub rcx, r8
mov dword [rbp - 0x38], eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x50], eax
add rcx, r8
cmp byte [rcx], dl
jne 0x140002c44
movzx eax, word [0x140005b40]
mov word [rcx], ax
mov al, byte [0x140005b42]
mov byte [rcx + 2], al
lea rcx, [rbp - 0x60]
sub rcx, r8
add rcx, r8
cmp byte [rcx], dl
jne 0x140002c65
mov eax, dword [0x140005b50]
mov dword [rcx], eax
mov al, byte [0x140005b54]
mov byte [rcx + 4], al
lea rcx, [rbp - 0x60]
sub rcx, r8
add rcx, r8
cmp byte [rcx], dl
jne 0x140002c84
movzx eax, word [0x140005b60]
mov word [rcx], ax
mov al, byte [0x140005b62]
mov byte [rcx + 2], al
lea rcx, [rbp - 0x60]
sub rcx, r8
add rcx, r8
cmp byte [rcx], dl
jne 0x140002ca5
mov eax, dword [0x140005b70]
mov dword [rcx], eax
lea rcx, [rbp - 0x60]
sub rcx, r8
add rcx, r8
cmp byte [rcx], dl
jne 0x140002cbb
mov eax, dword [0x140005b80]
mov dword [rcx], eax
lea rcx, [rbp - 0x48]
sub rcx, r8
add rcx, r8
cmp byte [rcx], dl
jne 0x140002cd1
movzx eax, word [0x140005c30]
mov word [rcx], ax
mov al, byte [0x140005c32]
mov byte [rcx + 2], al
lea rcx, [rbp - 0x48]
sub rcx, r8
add rcx, r8
cmp byte [rcx], dl
jne 0x140002cf2
movzx eax, word [0x140005c40]
mov word [rcx], ax
mov al, byte [0x140005c42]
mov byte [rcx + 2], al
lea rcx, [rbp - 0x48]
sub rcx, r8
add rcx, r8
cmp byte [rcx], dl
jne 0x140002d13
mov eax, dword [0x140005c50]
mov dword [rcx], eax
lea rcx, [rbp - 0x48]
sub rcx, r8
add rcx, r8
cmp byte [rcx], dl
jne 0x140002d29
movzx eax, word [0x140005c60]
mov word [rcx], ax
mov al, byte [0x140005c62]
mov byte [rcx + 2], al
lea rcx, [rbp - 0x48]
sub rcx, r8
add rcx, r8
cmp byte [rcx], dl
jne 0x140002d4a
movzx eax, word [0x140005c70]
mov word [rcx], ax
mov al, byte [0x140005c72]
mov byte [rcx + 2], al
lea rcx, [0x140005c80]
call fcn.140005327
mov r8, qword [rsp + 0x38]
lea rdx, [rbp - 0x60]
xor r9d, r9d
mov rcx, rsi
call fcn.140003060
mov r8, qword [rsp + 0x38]
lea rdx, [rbp - 0x48]
test rax, rax
mov rbx, rax
mov eax, 0xc0000225
mov rcx, rsi
cmove edi, eax
xor r9d, r9d
call fcn.140003060
mov r14, rax
lea rcx, [0x140005ca0]
call fcn.140005327
xor esi, esi
test edi, edi
js 0x140002f77
lea rcx, [0x140005cc0]
call fcn.140005327
mov r8b, byte [rsp + 0x30]
mov rcx, rbx
mov rdx, qword [rsp + 0x40]
test r13b, r13b
je 0x140002de4
call fcn.140003b5c
jmp 0x140002de9
call fcn.1400034ac
mov rbx, rax
mov edi, 0xc0000001
test rax, rax
je 0x140002f77
lea rcx, [0x140005ce0]
call fcn.140005327
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov rcx, rbx
call fcn.140002984
mov edi, eax
test r12, r12
je 0x140002f77
test eax, eax
js 0x140002f77
lea rcx, [0x140005d00]
call fcn.140005327
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140002ea6
lea r15, [rbx + 0x5e8]
mov rcx, r15
mov r12d, esi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140002e9c
cmp dword [r15], 0xc0371e7e
je 0x140002e9c
lea rcx, [0x140005d20]
call fcn.140005327
lea r8, [rsp + 0x40]
mov qword [rsp + 0x40], 0xffffffffff676980
mov dl, 1
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_KeDelayExecutionThread]
inc esi
cmp r12d, 5
jge 0x140002e9c
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x140002e4a
mov r15, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
lea rcx, [0x140005d40]
call fcn.140005327
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140002f72
lea rsi, [rbx + 0x5e8]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140002f72
cmp dword [rsi], 0xc0371e7e
jne 0x140002f72
mov eax, dword [rbx + 0x600]
mov dword [r12], eax
mov rsi, qword [rbx + 0x5f0]
mov rdx, qword [rbx + 0x5f8]
test r13b, r13b
je 0x140002f14
mov dword [r12], edx
mov esi, dword [rbx + 0x5f0]
mov edx, dword [rbx + 0x5f4]
test r14, r14
je 0x140002f77
test rdx, rdx
je 0x140002f43
mov rcx, r14
test r13b, r13b
je 0x140002f2d
call fcn.140003a9c
jmp 0x140002f32
call fcn.1400033bc
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov rcx, rax
call fcn.140002984
test rsi, rsi
je 0x140002f77
mov rdx, rsi
mov rcx, r14
test r13b, r13b
je 0x140002f5a
call fcn.140003a9c
jmp 0x140002f5f
call fcn.1400033bc
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov rcx, rax
call fcn.140002984
jmp 0x140002f77
mov edi, 0xc0000001
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140002f92
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140005270
add rsp, 0x108
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret