Function at 0x1400039f0
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1f], rax
xorps xmm0, xmm0
mov qword [rbp - 0x59], rcx
xorps xmm1, xmm1
mov rbx, rdx
movups xmmword [rbp - 0x41], xmm0
movups xmmword [rbp - 0x31], xmm0
movups xmmword [rbp - 0x21], xmm0
movups xmmword [rbp - 0x11], xmm1
movups xmmword [rbp - 1], xmm1
movups xmmword [rbp + 0xf], xmm1
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rcx, rbx
mov qword [rbp - 0x69], rax
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
xor r13d, r13d
xorps xmm0, xmm0
mov qword [rbp - 0x61], r13
mov rsi, rax
mov qword [rbp - 0x71], r13
mov r15d, r13d
movups xmmword [rbp - 0x51], xmm0
test rdi, rdi
jne 0x140003a7b
test rax, rax
je 0x140003cc2
lea rdx, [rbp - 0x41]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
lea rcx, [rbp - 0x71]
mov r14d, 1
mov qword [rsp + 0x30], rcx
lea r9, [rbp - 0x61]
mov byte [rsp + 0x28], r14b
mov rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_MmCopyVirtualMemory]
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rbx, qword [rsi + 0x18]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
lea rcx, [rbp - 0x71]
mov r8, rdi
mov qword [rsp + 0x30], rcx
lea r9, [rbp - 0x61]
mov byte [rsp + 0x28], r14b
mov rcx, rax
mov rdx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ntoskrnl.exe_MmCopyVirtualMemory]
mov rax, qword [rsi + 0x18]
movzx r12d, r13w
movzx r14d, r13w
mov rbx, qword [rax + 0x10]
cmp word [rbx + 0x48], r13w
je 0x140003b4e
movzx edx, word [rbx + 0x4a]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
movzx r8d, word [rbx + 0x48]
mov rcx, rax
mov rdx, qword [rbx + 0x50]
mov rsi, rax
call fcn.140006980
movzx r12d, word [rbx + 0x48]
mov r15d, dword [rbx + 0x60]
movzx r13d, r12w
sub r15d, dword [rbx + 0x50]
movzx r14d, r12w
movzx eax, word [rbx + 0x4a]
jmp 0x140003b5b
mov rsi, qword [rbp - 0x49]
movzx eax, word [rbp - 0x4f]
movzx r13d, word [rbp - 0x51]
lea rcx, [rbp - 0x41]
mov word [rbp - 0x79], ax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp - 0x59]
lea rdx, [rbp - 0x11]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
lea rcx, [rbp - 0x71]
mov r8, rbx
mov rbx, qword [rbp - 0x69]
lea r9, [rbp - 0x61]
mov qword [rsp + 0x30], rcx
mov rdx, rbx
mov byte [rsp + 0x28], 1
mov rcx, rax
mov qword [rsp + 0x20], 1
call qword [sym.imp.ntoskrnl.exe_MmCopyVirtualMemory]
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rbx, qword [rbx + 0x18]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
lea rcx, [rbp - 0x71]
mov r8, rdi
mov qword [rsp + 0x30], rcx
lea r9, [rbp - 0x61]
mov byte [rsp + 0x28], 1
mov rcx, rax
mov rdx, rbx
mov qword [rsp + 0x20], 1
call qword [sym.imp.ntoskrnl.exe_MmCopyVirtualMemory]
mov rcx, qword [rbp - 0x69]
mov rax, qword [rcx + 0x18]
mov rbx, qword [rax + 0x10]
movzx eax, word [rbx + 0x48]
cmp ax, r13w
jb 0x140003c2b
mov rcx, qword [rbx + 0x50]
mov r8d, eax
xor edx, edx
call fcn.140006c40
mov rcx, qword [rbx + 0x50]
mov rdx, rsi
movzx r8d, r12w
call fcn.140006980
mov rdi, qword [rbx + 0x50]
jmp 0x140003c86
and qword [rbp - 0x69], 0
lea r9, [rbp - 0x71]
mov dword [rsp + 0x28], 4
lea rdx, [rbp - 0x69]
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
or rcx, 0xffffffffffffffff
mov qword [rbp - 0x71], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
jns 0x140003c67
lea rcx, [rbp - 0x41]
jmp 0x140003cac
mov rdi, qword [rbp - 0x69]
mov rdx, rsi
mov rcx, rdi
movzx r8d, r12w
call fcn.140006980
movzx eax, word [rbp - 0x79]
mov word [rbx + 0x4a], ax
mov qword [rbx + 0x50], rdi
sub r14w, r15w
mov eax, r15d
add rax, rdi
mov word [rbx + 0x58], r14w
add r14w, 2
mov word [rbx + 0x48], r13w
mov word [rbx + 0x5a], r14w
lea rcx, [rbp - 0x11]
mov qword [rbx + 0x60], rax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test rsi, rsi
je 0x140003cc2
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.140006890
mov rbx, qword [rsp + 0x130]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret