Function at 0x140003cec
Capabilities:
Attach user process memory

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rbx, rcx
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
xor r12d, r12d
mov rsi, rax
test rax, rax
je 0x14000416b
xorps xmm0, xmm0
mov rcx, rbx
movups xmmword [rbp - 1], xmm0
movups xmmword [rbp + 0xf], xmm0
movups xmmword [rbp + 0x1f], xmm0
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov qword [rbp - 0x11], r12
mov r14, rax
mov qword [rbp - 0x19], r12
test rax, rax
je 0x14000416b
lea rdx, [rbp - 1]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov qword [rbp - 9], r12
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
lea rcx, [rbp - 0x19]
mov r8, rbx
mov qword [rsp + 0x30], rcx
lea r13d, [r12 + 1]
mov byte [rsp + 0x28], r13b
lea r9, [rbp - 0x11]
mov rcx, rax
mov qword [rsp + 0x20], r13
mov rdx, r14
call qword [sym.imp.ntoskrnl.exe_MmCopyVirtualMemory]
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rbx, qword [r14 + 0x20]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
lea rcx, [rbp - 0x19]
mov r8, rdi
mov qword [rsp + 0x30], rcx
lea r9, [rbp - 0x11]
mov byte [rsp + 0x28], r13b
mov rcx, rax
mov rdx, rbx
mov qword [rsp + 0x20], r13
call qword [sym.imp.ntoskrnl.exe_MmCopyVirtualMemory]
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
lea rcx, [rbp - 0x19]
mov r8, rbx
mov qword [rsp + 0x30], rcx
lea r9, [rbp - 0x11]
mov byte [rsp + 0x28], r13b
mov rcx, rax
mov rdx, rsi
mov qword [rsp + 0x20], r13
call qword [sym.imp.ntoskrnl.exe_MmCopyVirtualMemory]
mov esi, dword [rsi + 0x10]
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
lea rcx, [rbp - 0x19]
mov r8, rbx
mov qword [rsp + 0x30], rcx
lea r9, [rbp - 0x11]
mov byte [rsp + 0x28], r13b
mov rcx, rax
mov edx, esi
mov qword [rsp + 0x20], r13
call qword [sym.imp.ntoskrnl.exe_MmCopyVirtualMemory]
lea r9, [rbp - 0x19]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rbp - 0x19], 0x1000
lea rdx, [rbp - 9]
mov dword [rsp + 0x20], 0x3000
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x140004161
mov rax, qword [r14 + 0x20]
mov r15, qword [rbp - 9]
movzx ecx, word [rax + 0x60]
test cx, cx
je 0x140003f44
cmp word [rsi + 0x40], cx
jb 0x140003ee0
mov ecx, dword [rsi + 0x44]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140003ee0
movzx r8d, word [rsi + 0x42]
xor edx, edx
mov ecx, dword [rsi + 0x44]
call fcn.140006c40
mov rdx, qword [r14 + 0x20]
mov ecx, dword [rsi + 0x44]
movzx r8d, word [rdx + 0x60]
mov rdx, qword [rdx + 0x68]
call fcn.140006980
mov rax, qword [r14 + 0x20]
movzx ecx, word [rax + 0x60]
mov word [rsi + 0x40], cx
jmp 0x140003f44
mov ecx, dword [rsi + 0x44]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140003efc
movzx r8d, word [rsi + 0x42]
xor edx, edx
mov ecx, dword [rsi + 0x44]
call fcn.140006c40
cmp qword [rbp - 9], r12
jne 0x140003f08
mov dword [rsi + 0x40], r12d
jmp 0x140003f44
mov rdx, qword [r14 + 0x20]
mov rcx, r15
movzx r8d, word [rdx + 0x60]
mov rdx, qword [rdx + 0x68]
call fcn.140006980
mov dword [rsi + 0x44], r15d
mov rax, qword [r14 + 0x20]
movzx ecx, word [rax + 0x60]
mov word [rsi + 0x40], cx
mov rax, qword [r14 + 0x20]
movzx ecx, word [rax + 0x62]
mov word [rsi + 0x42], cx
mov rax, qword [r14 + 0x20]
movzx ecx, word [rax + 0x62]
add r15, rcx
mov rax, qword [r14 + 0x20]
movzx ecx, word [rax + 0xb0]
test cx, cx
je 0x14000401c
cmp word [rsi + 0x78], cx
jb 0x140003fa9
mov ecx, dword [rsi + 0x7c]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140003fa9
movzx r8d, word [rsi + 0x7a]
xor edx, edx
mov ecx, dword [rsi + 0x7c]
call fcn.140006c40
mov rdx, qword [r14 + 0x20]
mov ecx, dword [rsi + 0x7c]
movzx r8d, word [rdx + 0xb0]
mov rdx, qword [rdx + 0xb8]
call fcn.140006980
mov rax, qword [r14 + 0x20]
movzx ecx, word [rax + 0xb0]
mov word [rsi + 0x78], cx
jmp 0x140004073
mov ecx, dword [rsi + 0x7c]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140003fc5
movzx r8d, word [rsi + 0x7a]
xor edx, edx
mov ecx, dword [rsi + 0x7c]
call fcn.140006c40
cmp qword [rbp - 9], r12
je 0x14000406f
mov rdx, qword [r14 + 0x20]
mov rcx, r15
movzx r8d, word [rdx + 0xb0]
mov rdx, qword [rdx + 0xb8]
call fcn.140006980
mov dword [rsi + 0x7c], r15d
mov rax, qword [r14 + 0x20]
movzx ecx, word [rax + 0xb0]
mov word [rsi + 0x78], cx
mov rax, qword [r14 + 0x20]
movzx ecx, word [rax + 0xb2]
mov word [rsi + 0x7a], cx
mov rax, qword [r14 + 0x20]
movzx ecx, word [rax + 0xb2]
add r15, rcx
jmp 0x140004073
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov ebx, dword [rsi + 0x7c]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
lea rcx, [rbp - 0x19]
mov r8, rdi
mov qword [rsp + 0x30], rcx
lea r9, [rbp - 0x11]
mov byte [rsp + 0x28], r13b
mov rcx, rax
mov edx, ebx
mov qword [rsp + 0x20], r13
call qword [sym.imp.ntoskrnl.exe_MmCopyVirtualMemory]
mov ecx, dword [rsi + 0x7c]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140004073
movzx r8d, word [rsi + 0x7a]
xor edx, edx
mov ecx, dword [rsi + 0x7c]
call fcn.140006c40
mov dword [rsi + 0x78], r12d
mov rax, qword [r14 + 0x20]
movzx ecx, word [rax + 0xd0]
test cx, cx
je 0x140004161
cmp word [rsi + 0x88], cx
jb 0x1400040e7
mov ecx, dword [rsi + 0x8c]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400040e7
movzx r8d, word [rsi + 0x8a]
xor edx, edx
mov ecx, dword [rsi + 0x8c]
call fcn.140006c40
mov rdx, qword [r14 + 0x20]
mov ecx, dword [rsi + 0x8c]
movzx r8d, word [rdx + 0xd0]
mov rdx, qword [rdx + 0xd8]
call fcn.140006980
mov rax, qword [r14 + 0x20]
movzx ecx, word [rax + 0xd0]
mov word [rsi + 0x88], cx
jmp 0x140004161
mov ecx, dword [rsi + 0x8c]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000410c
movzx r8d, word [rsi + 0x8a]
xor edx, edx
mov ecx, dword [rsi + 0x8c]
call fcn.140006c40
cmp qword [rbp - 9], r12
jne 0x14000411b
mov dword [rsi + 0x88], r12d
jmp 0x140004161
mov rdx, qword [r14 + 0x20]
mov rcx, r15
movzx r8d, word [rdx + 0xd0]
mov rdx, qword [rdx + 0xd8]
call fcn.140006980
mov dword [rsi + 0x8c], r15d
mov rax, qword [r14 + 0x20]
movzx ecx, word [rax + 0xd0]
mov word [rsi + 0x88], cx
mov rax, qword [r14 + 0x20]
movzx ecx, word [rax + 0xd2]
mov word [rsi + 0x8a], cx
lea rcx, [rbp - 1]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140006890
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret