Function at 0x14000e4d0
Capabilities:
Attach user process memory
Create thread
Find process by pid
Print debug messages

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbx
push rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x14001c050]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x54], 0xc0000001
cmp qword [rsp + 0xf0], 0
je 0x14000e56f
mov eax, dword [rsp + 0x118]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x108]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xf8]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0xf0]
mov r8d, dword [rsp + 0xe8]
mov edx, dword [rsp + 0xe0]
lea rcx, [0x140017ba0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14000e5c0
mov eax, dword [rsp + 0x118]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x108]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xf8]
mov r8d, dword [rsp + 0xe8]
mov edx, dword [rsp + 0xe0]
lea rcx, [0x140017bd0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0x14
xor ecx, ecx
cpuid
lea r8, [rsp + 0xa0]
mov dword [r8], eax
mov dword [r8 + 4], ebx
mov dword [r8 + 8], ecx
mov dword [r8 + 0xc], edx
mov eax, 4
imul rax, rax, 2
mov eax, dword [rsp + rax + 0xa0]
and eax, 2
test eax, eax
jne 0x14000e60d
lea rcx, [0x140017c00]
call sub.ntoskrnl.exe_DbgPrint
mov dword [0x14001c164], 1
mov eax, dword [rsp + 0x108]
mov dword [0x14001c168], eax
mov eax, dword [rsp + 0x118]
mov dword [0x14001c6f4], eax
mov eax, dword [rsp + 0x110]
mov dword [0x14001c6f0], eax
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0xf0]
movzx eax, word [rcx + rax]
mov edx, eax
lea rcx, [0x140017c20]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0xf0]
movzx eax, word [rcx + rax]
test eax, eax
je 0x14000e67a
mov dword [rsp + 0x58], 1
jmp 0x14000e682
mov dword [rsp + 0x58], 0
mov eax, dword [rsp + 0x58]
mov dword [0x14001f3e8], eax
cmp dword [0x14001f3e8], 0
je 0x14000e6f9
mov r8d, 0xc7
mov rdx, qword [rsp + 0xf0]
lea rcx, [0x14001c520]
call fcn.140013c4c
mov eax, 2
imul rax, rax, 0xc7
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0x190
jae 0x14000e6cd
jmp 0x14000e6d2
call fcn.1400148b8
lea rax, [0x14001c520]
xor ecx, ecx
mov rdx, qword [rsp + 0x60]
mov word [rax + rdx], cx
lea rdx, [0x14001c520]
lea rcx, [0x140017c30]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14000e705
lea rcx, [0x140017c60]
call sub.ntoskrnl.exe_DbgPrint
cmp dword [rsp + 0xf8], 0
je 0x14000e7bd
cmp qword [0x14001c158], 0
je 0x14000e737
xor edx, edx
mov rcx, qword [0x14001c158]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [0x14001c158], 0
movsxd rax, dword [rsp + 0xf8]
imul rax, rax, 0x18
mov r8d, 0x52326c55
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool2]
mov qword [0x14001c158], rax
mov dword [rsp + 0x50], 0
jmp 0x14000e76f
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0xf8]
cmp dword [rsp + 0x50], eax
jge 0x14000e7ae
movsxd rax, dword [rsp + 0x50]
imul rax, rax, 0x18
movsxd rcx, dword [rsp + 0x50]
imul rcx, rcx, 0x18
mov rdx, qword [0x14001c158]
mov rbx, qword [rsp + 0x100]
lea rdi, [rdx + rcx]
lea rsi, [rbx + rax]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
jmp 0x14000e765
mov eax, dword [rsp + 0xf8]
mov dword [0x14001c510], eax
jmp 0x14000e7c7
mov dword [0x14001c510], 0
cmp dword [rsp + 0xe0], 0
je 0x14000e8d2
mov eax, dword [rsp + 0xe0]
lea rdx, [0x14001c6e8]
mov ecx, eax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x14000e8b8
call fcn.140002880
and rax, 0xfff
test rax, rax
je 0x14000e869
lea rcx, [0x140017c80]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [0x14001c6e8]
mov rax, qword [rax + 0x278]
mov qword [0x14001c6e0], rax
mov rax, qword [0x14001c6e0]
and rax, 0xfffffffffffff000
test rax, rax
jne 0x14000e854
lea rcx, [0x140017ca0]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [0x14001c6e8]
mov rax, qword [rax + 0x28]
mov qword [0x14001c6e0], rax
mov rdx, qword [0x14001c6e0]
lea rcx, [0x140017cc0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14000e8b6
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rdx, [rsp + 0x70]
mov rcx, qword [0x14001c6e8]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
call fcn.140002880
mov qword [0x14001c6e0], rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x14000e8b6
jmp 0x14000e8d0
mov edx, dword [rsp + 0xe0]
lea rcx, [0x140017d10]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14000ee95
jmp 0x14000e8e8
mov qword [0x14001c6e8], 0
mov qword [0x14001c6e0], 0
mov rdx, qword [0x14001c6e0]
lea rcx, [0x140017cc0]
call sub.ntoskrnl.exe_DbgPrint
cmp qword [0x14001c748], 0
je 0x14000e90f
cmp qword [0x14001c740], 0
jne 0x14000e920
lea rcx, [0x140017d40]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14000ee95
xor r8d, r8d
lea rdx, [0x14000e480]
lea rcx, [0x14001c700]
call qword [sym.imp.ntoskrnl.exe_KeInitializeDpc]
xor r8d, r8d
mov edx, 1
lea rcx, [0x14001c6c0]
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
xor r8d, r8d
mov edx, 1
lea rcx, [0x14001c4a0]
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
xor edx, edx
lea rcx, [0x14001c4c0]
call qword [sym.imp.ntoskrnl.exe_KeInitializeMutex]
call qword [sym.imp.ntoskrnl.exe_KeQueryMaximumProcessorCount]
mov dword [0x14001c4f8], eax
movsxd rax, dword [0x14001c4f8]
shl rax, 3
mov r8d, 0x666e4950
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool2]
mov qword [0x14001c500], rax
movsxd rax, dword [0x14001c4f8]
shl rax, 3
mov r8d, 0x52443255
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool2]
mov qword [0x14001c508], rax
cmp qword [0x14001c500], 0
jne 0x14000e9dd
lea rcx, [0x140017d60]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14000ee95
cmp qword [0x14001c508], 0
jne 0x14000e9f8
lea rcx, [0x140017d80]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14000ee95
mov dword [rsp + 0x50], 0
jmp 0x14000ea0c
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
mov eax, dword [0x14001c4f8]
cmp dword [rsp + 0x50], eax
jge 0x14000ed06
movzx eax, byte [rsp + 0x50]
shl eax, 0x10
or eax, 0x30304343
mov dword [rsp + 0x5c], eax
mov r8d, dword [rsp + 0x5c]
mov edx, 0x140
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool2]
movsxd rcx, dword [rsp + 0x50]
mov rdx, qword [0x14001c500]
mov qword [rdx + rcx*8], rax
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
mov rdi, rax
xor eax, eax
mov ecx, 0x140
rep stosb byte [rdi], al
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
add rax, 0x58
xor r8d, r8d
mov edx, 1
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
add rax, 0x40
mov r8b, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
add rax, 0x30
movsxd rcx, dword [rsp + 0x50]
mov rdx, qword [0x14001c500]
mov rcx, qword [rdx + rcx*8]
add rcx, 0x20
movsxd rdx, dword [rsp + 0x50]
mov rbx, qword [0x14001c500]
mov rdx, qword [rbx + rdx*8]
add rdx, 0x10
movsxd rbx, dword [rsp + 0x50]
mov rdi, qword [0x14001c500]
mov rbx, qword [rdi + rbx*8]
mov edi, dword [rsp + 0x108]
mov dword [rsp + 0x28], edi
mov edi, dword [rsp + 0xe8]
mov dword [rsp + 0x20], edi
mov r9, rax
mov r8, rcx
mov rcx, rbx
call fcn.14000fc70
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
add rax, 0x38
movsxd rcx, dword [rsp + 0x50]
mov rdx, qword [0x14001c500]
mov rcx, qword [rdx + rcx*8]
add rcx, 0x28
movsxd rdx, dword [rsp + 0x50]
mov rbx, qword [0x14001c500]
mov rdx, qword [rbx + rdx*8]
add rdx, 0x18
movsxd rbx, dword [rsp + 0x50]
mov rdi, qword [0x14001c500]
mov rbx, qword [rdi + rbx*8]
add rbx, 8
mov edi, dword [rsp + 0x108]
mov dword [rsp + 0x28], edi
mov edi, dword [rsp + 0xe8]
mov dword [rsp + 0x20], edi
mov r9, rax
mov r8, rcx
mov rcx, rbx
call fcn.14000fc70
mov edx, dword [rsp + 0x50]
lea rcx, [0x140017da0]
call sub.ntoskrnl.exe_DbgPrint
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
movsxd rcx, dword [rsp + 0x50]
mov rdx, qword [0x14001c500]
mov rcx, qword [rdx + rcx*8]
mov r9d, dword [rsp + 0xe8]
mov r8, qword [rax + 0x10]
mov rdx, qword [rcx]
lea rcx, [0x140017db0]
call sub.ntoskrnl.exe_DbgPrint
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
movsxd rcx, dword [rsp + 0x50]
mov rdx, qword [0x14001c500]
mov rcx, qword [rdx + rcx*8]
mov r9d, dword [rsp + 0xe8]
mov r8, qword [rax + 0x18]
mov rdx, qword [rcx + 8]
lea rcx, [0x140017de0]
call sub.ntoskrnl.exe_DbgPrint
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
add rax, 0x70
xor r8d, r8d
mov edx, 1
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
add rax, 0x88
xor r8d, r8d
mov edx, 1
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
add rax, 0x118
mov r8b, 1
mov edx, 1
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
add rax, 0x70
movsxd rcx, dword [rsp + 0x50]
mov rdx, qword [0x14001c508]
mov qword [rdx + rcx*8], rax
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
add rax, 0xc8
xor r8d, r8d
lea rdx, [0x14000eeb0]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeInitializeDpc]
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [0x14001c500]
mov rax, qword [rcx + rax*8]
add rax, 0xc8
movzx edx, byte [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeSetTargetProcessorDpc]
jmp 0x14000ea02
mov byte [0x14001c150], 1
mov dword [0x14001c160], 1
mov qword [rsp + 0x30], 0
lea rax, [0x140010650]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x14001c480]
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov qword [rsp + 0x30], 0
lea rax, [0x14000f7d0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x14001c6d8]
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov dword [rsp + 0x50], 0
jmp 0x14000ed91
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
mov eax, dword [0x14001c4f8]
cmp dword [rsp + 0x50], eax
jge 0x14000ede3
movsxd rax, dword [rsp + 0x50]
movsxd rcx, dword [rsp + 0x50]
mov rdx, qword [0x14001c500]
mov rcx, qword [rdx + rcx*8]
add rcx, 0x108
mov qword [rsp + 0x30], rax
lea rax, [0x14000f3e0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
jmp 0x14000ed87
cmp dword [rsp + 0x108], 0
jne 0x14000ee78
cmp dword [0x14001c478], 0
jne 0x14000ee78
lea rcx, [0x140017e10]
call sub.ntoskrnl.exe_DbgPrint
lea rax, [0x14000dce0]
mov qword [0x14001c018], rax
mov rax, qword [sym.imp.ntoskrnl.exe_HalDispatchTable]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x68], rax
lea r8, [0x14001c018]
mov edx, 8
mov ecx, 1
mov rax, qword [rsp + 0x68]
call qword [0x14001a3d0]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
jne 0x14000ee55
mov dword [0x14001c478], 1
mov edx, dword [rsp + 0x54]
lea rcx, [0x140017090]
call sub.ntoskrnl.exe_DbgPrint
cmp dword [rsp + 0x54], 0
je 0x14000ee78
lea rcx, [0x140017e30]
call sub.ntoskrnl.exe_DbgPrint
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x140010cd0]
call fcn.1400022c0
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140014890
add rsp, 0xc0
pop rdi
pop rsi
pop rbx
ret