Function at 0x26cf0
Capabilities:
Attach user process memory

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
push r13
sub rsp, 0xf0
mov rsi, r9
movzx r12d, r8b
mov r13, rdx
mov rbx, rcx
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 0x1000
mov qword [rsp + 0x58], rdi
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [r11 - 0x80], rax
mov qword [r11 - 0x78], rax
mov byte [r11 - 0x68], al
xor edx, edx
lea r8d, [rdi + 0x57]
lea rcx, [r11 - 0x67]
call fcn.0002b780
mov r11d, dword [0x0002edf8]
test r11d, r11d
jne 0x26d72
call fcn.00026c30
mov r11d, dword [0x0002edf8]
test r11d, r11d
jne 0x26d81
mov eax, 0xc0000001
jmp 0x26fc8
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r11, qword [0x0002ebd0]
test r11, r11
jne 0x26da7
call fcn.0001aed0
mov r11, qword [0x0002ebd0]
test r11, r11
jne 0x26db6
mov ebx, 0xc0000001
jmp 0x26f7b
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, [rsp + 0x40]
or rcx, 0xffffffffffffffff
call r11
mov ebx, eax
test eax, eax
js 0x26f7b
mov ebx, 0xc0000001
mov rax, qword [rsp + 0x40]
mov byte [rax + 0x14], 0
mov rax, qword [rsp + 0x40]
mov qword [rax], rsi
mov rax, qword [rsp + 0x40]
mov dword [rax + 0x10], edi
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x120]
mov qword [rcx + 8], rax
mov rsi, qword [rsp + 0x40]
add rsi, 0x15
test r12b, r12b
je 0x26e93
mov rax, qword [0x0002e950]
mov qword [rsi], rax
mov rax, qword [0x0002e958]
mov qword [rsi + 8], rax
mov rax, qword [0x0002e960]
mov qword [rsi + 0x10], rax
mov rax, qword [0x0002e968]
mov qword [rsi + 0x18], rax
mov rax, qword [0x0002e970]
mov qword [rsi + 0x20], rax
mov rax, qword [0x0002e978]
mov qword [rsi + 0x28], rax
mov rax, qword [0x0002e980]
mov qword [rsi + 0x30], rax
movzx eax, word [0x0002e988]
mov word [rsi + 0x38], ax
movzx eax, byte [0x0002e98a]
mov byte [rsi + 0x3a], al
lea rax, [rsi - 1]
not rax
lea rsi, [rax*4]
jmp 0x26ea8
lea rdx, [0x00026cc0]
mov rcx, rsi
mov r8d, 0x3e8
call fcn.0002b3f0
mov eax, dword [0x0002edf8]
mov byte [rax + r13 + 0x2a], 1
mov r12, qword [rsp + 0x40]
mov rax, qword [0x0002eb28]
test rax, rax
jne 0x26ed1
call fcn.0001aed0
mov rax, qword [0x0002eb28]
test rax, rax
je 0x26f01
mov qword [rsp + 0x38], r12
mov byte [rsp + 0x30], 1
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
lea r9, [0x0001cca0]
xor r8d, r8d
mov rdx, r13
lea rcx, [rsp + 0x90]
call rax
mov rax, qword [0x0002eb60]
test rax, rax
jne 0x26f19
call fcn.0001aed0
mov rax, qword [0x0002eb60]
test rax, rax
je 0x26f75
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x90]
call rax
test al, al
je 0x26f75
mov rax, qword [rsp + 0x40]
cmp byte [rax + 0x14], 0
jne 0x26f4b
mov ecx, 0xc8
call fcn.00019a80
jmp 0x26f34
mov ecx, 0x320
call fcn.00019a80
mov r11, qword [rsp + 0x128]
test r11, r11
je 0x26f6d
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + 0x10]
mov dword [r11], ecx
mov ebx, edi
mov dword [rsp + 0x50], ebx
jmp 0x26f7b
jmp 0x26f7b
cmp qword [rsp + 0x40], 0
je 0x26fbb
mov qword [rsp + 0x48], rdi
mov rax, qword [0x0002ec08]
test rax, rax
jne 0x26fa0
call fcn.0001aed0
mov rax, qword [0x0002ec08]
test rax, rax
je 0x26fbb
mov r9d, 0x8000
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
or rcx, 0xffffffffffffffff
call rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, ebx
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret