Function at 0x1597c
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xf0
mov rax, qword [0x00013100]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov r12, r9
mov ebx, r8d
mov rdi, rdx
mov r14, rcx
mov r13, qword [rsp + 0x148]
mov qword [rsp + 0x70], r13
cmp byte [rsp + 0x150], 0
je 0x159fb
mov esi, dword [rsp + 0x140]
mov rdx, rsi
mov r8d, 4
mov rcx, r9
call qword [sym.imp.ntoskrnl.exe_ProbeForWrite]
test r13, r13
je 0x159f4
mov edx, 4
mov r8d, edx
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ProbeForWrite]
jmp 0x15a02
mov esi, dword [rsp + 0x140]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9b, byte [rsp + 0x150]
mov r8, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov r8, qword [r8]
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
js 0x16279
mov rax, qword [sym.imp.ntoskrnl.exe_PsInitialSystemProcess]
mov rcx, qword [rax]
cmp qword [rsp + 0x48], rcx
jne 0x15a54
or rdi, 0xffffffff80000000
xor r13b, r13b
jmp 0x15a76
test rdi, rdi
jns 0x15a6e
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, 0xc0000008
jmp 0x16279
mov r13b, byte [rsp + 0x150]
test ebx, ebx
je 0x161c8
mov r14d, 1
sub ebx, r14d
je 0x1607c
sub ebx, r14d
je 0x15fa7
sub ebx, r14d
je 0x15f35
sub ebx, r14d
je 0x15eb9
sub ebx, r14d
je 0x15e3d
sub ebx, r14d
je 0x15cd2
sub ebx, r14d
je 0x15bc5
cmp ebx, r14d
je 0x15adb
mov edi, 0xc0000003
mov dword [rsp + 0x40], edi
and dword [rsp + 0x44], 0
jmp 0x1623f
cmp esi, 8
jne 0x15bb7
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9b, r13b
mov r8, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov r8, qword [r8]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov edi, eax
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test edi, edi
js 0x1623f
mov rcx, qword [rsp + 0x60]
cmp qword [rcx + 8], 0
je 0x15b90
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x15b90
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov al, byte [rsp + 0x150]
mov byte [rsp + 0x28], al
mov rax, qword [sym.imp.ntoskrnl.exe_IoDriverObjectType]
mov rdx, qword [rax]
mov qword [rsp + 0x20], rdx
mov r9d, 0x100000
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov edi, eax
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x50]
jmp 0x15b97
xor eax, eax
mov qword [rsp + 0x50], rax
test edi, edi
js 0x15ba7
mov qword [r12], rax
jmp 0x15ba7
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x1623f
mov edi, 0xc0000004
mov dword [rsp + 0x40], edi
jmp 0x1623f
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9b, r13b
mov r8, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov r8, qword [r8]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov edi, eax
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test edi, edi
js 0x15cc5
mov rcx, qword [rsp + 0x60]
mov al, byte [rcx + 0x48]
mov byte [rsp + 0xa8], al
mov al, byte [rcx + 0x49]
mov byte [rsp + 0xa9], al
mov al, byte [rcx + 0x4a]
mov byte [rsp + 0xaa], al
mov al, byte [rcx + 0x4b]
mov byte [rsp + 0xab], al
mov al, byte [rcx + 0x4c]
mov byte [rsp + 0xac], al
mov al, byte [rcx + 0x4d]
mov byte [rsp + 0xad], al
mov al, byte [rcx + 0x4e]
mov byte [rsp + 0xae], al
mov al, byte [rcx + 0x4f]
mov byte [rsp + 0xaf], al
mov rax, qword [rcx + 0x68]
mov qword [rsp + 0xb0], rax
mov eax, dword [rcx + 0x50]
mov dword [rsp + 0xb8], eax
cmp esi, 0x18
jne 0x15cb6
lea rdx, [rsp + 0xa8]
mov rax, qword [rdx]
mov qword [r12], rax
mov rax, qword [rdx + 8]
mov qword [r12 + 8], rax
mov rax, qword [rdx + 0x10]
mov qword [r12 + 0x10], rax
jmp 0x15cb4
jmp 0x15cbf
mov edi, 0xc0000004
mov dword [rsp + 0x40], edi
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov dword [rsp + 0x44], 0x18
jmp 0x1623f
or eax, 0xffffffff
cmp dword [0x00013158], eax
je 0x15e27
cmp dword [0x00013160], eax
je 0x15e27
cmp dword [0x00013168], eax
je 0x15e27
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9b, r13b
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov edi, eax
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test edi, edi
js 0x15e30
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObGetObjectType]
test rax, rax
je 0x15d8e
mov ebx, dword [0x00013168]
add rbx, rax
lea rdx, [0x00018570]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
jne 0x15d97
mov edi, 0xc0000024
mov dword [rsp + 0x40], edi
jmp 0x15d97
mov edi, 0xc00000bb
mov dword [rsp + 0x40], edi
test edi, edi
js 0x15e1a
mov ecx, dword [0x00013160]
mov rax, qword [rsp + 0x50]
mov rdx, qword [rcx + rax]
test rdx, rdx
je 0x15dc5
mov eax, dword [0x00013158]
movdqu xmm0, xmmword [rax + rdx]
movdqu xmmword [rsp + 0xa8], xmm0
jmp 0x15dd8
xor edx, edx
lea r8d, [rdx + 0x10]
lea rcx, [rsp + 0xa8]
call fcn.00011eb0
and qword [rsp + 0xb8], 0
cmp esi, 0x18
jne 0x15e11
lea rcx, [rsp + 0xa8]
mov rax, qword [rcx]
mov qword [r12], rax
mov rax, qword [rcx + 8]
mov qword [r12 + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [r12 + 0x10], rax
jmp 0x15e0f
jmp 0x15e1a
mov edi, 0xc0000004
mov dword [rsp + 0x40], edi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x15e30
mov edi, 0xc00000bb
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x44], 0x18
jmp 0x1623f
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and qword [rsp + 0x20], 0
mov r9d, 0x30
lea r8, [rsp + 0xa8]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationThread]
mov edi, eax
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test edi, edi
js 0x15eac
cmp esi, 0x30
jne 0x15ea3
mov rcx, r12
lea rdx, [rsp + 0xa8]
mov r8d, esi
call fcn.00011a40
jmp 0x15ea1
jmp 0x15eac
mov edi, 0xc0000004
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x44], 0x30
jmp 0x1623f
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and qword [rsp + 0x20], 0
mov r9d, 0x30
lea r8, [rsp + 0xa8]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
mov edi, eax
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test edi, edi
js 0x15f28
cmp esi, 0x30
jne 0x15f1f
mov rcx, r12
lea rdx, [rsp + 0xa8]
mov r8d, esi
call fcn.00011a40
jmp 0x15f1d
jmp 0x15f28
mov edi, 0xc0000004
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x44], 0x30
jmp 0x1623f
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and qword [rsp + 0x20], 0
mov r9d, 2
lea r8, [rsp + 0x58]
lea edx, [r9 + 2]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwQueryObject]
mov edi, eax
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test edi, edi
js 0x15f9a
cmp esi, 2
jne 0x15f91
movzx eax, word [rsp + 0x58]
mov word [r12], ax
jmp 0x15f8f
jmp 0x15f9a
mov edi, 0xc0000004
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x44], 2
jmp 0x1623f
mov edx, 0x68
mov dword [rsp + 0x44], edx
mov eax, esi
cmp esi, edx
cmovb eax, edx
lea edx, [rax + 8]
mov r8d, 0x5168704b
mov ecx, r14d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithQuotaTag]
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1606e
mov r13d, esi
mov r8d, esi
xor edx, edx
mov rcx, rax
call fcn.00011eb0
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea r11, [rsp + 0x44]
mov qword [rsp + 0x20], r11
mov r9d, esi
mov r8, rbx
mov edx, 2
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwQueryObject]
mov edi, eax
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test edi, edi
js 0x1605b
mov rax, qword [rbx + 8]
test rax, rax
je 0x16040
sub rax, rbx
add rax, r12
mov qword [rbx + 8], rax
mov r8, r13
mov rdx, rbx
mov rcx, r12
call fcn.00011a40
jmp 0x1605b
mov edx, 0x5168704b
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x1623f
mov edi, 0xc000009a
mov dword [rsp + 0x40], edi
jmp 0x1623f
mov ebx, 0x10
mov dword [rsp + 0x44], ebx
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9b, r13b
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov edi, eax
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test edi, edi
js 0x1623f
mov edx, esi
cmp esi, ebx
cmovb edx, ebx
mov r8d, 0x5168704b
mov ecx, r14d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithQuotaTag]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x161b2
mov r13d, esi
mov r8d, esi
xor edx, edx
mov rcx, rax
call fcn.00011eb0
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ObGetObjectType]
mov rdx, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
cmp rax, qword [rdx]
jne 0x16141
cmp dword [rdi + 0x74], 0
jne 0x1612c
cmp dword [rdi + 0x70], 0
je 0x16141
lea r9, [rsp + 0x44]
mov r8d, esi
mov rdx, rbx
mov rcx, rdi
call fcn.00015868
jmp 0x16155
lea r9, [rsp + 0x44]
mov r8d, esi
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ObQueryNameString]
mov ecx, 0xc0000023
cmp eax, 0x80000005
cmove eax, ecx
lea edi, [rcx - 0x1f]
cmp eax, edi
cmove eax, ecx
mov edi, eax
mov dword [rsp + 0x40], eax
test eax, eax
js 0x161a2
mov rax, qword [rbx + 8]
test rax, rax
je 0x16187
sub rax, rbx
add rax, r12
mov qword [rbx + 8], rax
mov r8, r13
mov rdx, rbx
mov rcx, r12
call fcn.00011a40
jmp 0x161a2
mov edx, 0x5168704b
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x161bb
mov edi, 0xc000009a
mov dword [rsp + 0x40], edi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x1623f
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and qword [rsp + 0x20], 0
mov r9d, 0x38
lea r8, [rsp + 0xa8]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwQueryObject]
mov edi, eax
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test edi, edi
js 0x16237
cmp esi, 0x38
jne 0x1622e
mov rcx, r12
lea rdx, [rsp + 0xa8]
mov r8d, esi
call fcn.00011a40
jmp 0x1622c
jmp 0x16237
mov edi, 0xc0000004
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x44], 0x38
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov r13, qword [rsp + 0x70]
test r13, r13
je 0x16277
cmp byte [rsp + 0x150], 0
je 0x1626e
mov eax, dword [rsp + 0x44]
mov dword [r13], eax
jmp 0x1626c
jmp 0x16277
mov ecx, dword [rsp + 0x44]
mov rax, r13
mov dword [rax], ecx
mov eax, edi
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.00011950
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret