Function at 0x12150
Capabilities:
Find process by pid
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x20], 0
mov byte [rsp + 0x50], 0
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xa0]
call sub.ntoskrnl.exe_PsLookupProcessByProcessId
test eax, eax
jl 0x12448
mov eax, dword [0x00019130]
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 1
je 0x121e9
cmp dword [rsp + 0x68], 2
je 0x12314
jmp 0x12448
mov qword [0x00019160], 0x138
cmp qword [0x00019160], 0
je 0x1230f
mov rax, qword [0x00019160]
mov rcx, qword [rsp + 0x48]
add rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x1230f
mov rcx, qword [0x00019160]
mov rax, qword [rsp + 0x48]
add rax, rcx
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x1230f
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x1230f
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1230f
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x1230f
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x1230f
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x1230f
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1230f
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x1230f
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x20]
call fcn.000124d0
mov byte [rsp + 0x50], al
movzx eax, byte [rsp + 0x50]
test eax, eax
jne 0x1230f
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x40]
lea rcx, [0x00017270]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x12448
mov qword [0x00019160], 0x268
cmp qword [0x00019160], 0
je 0x12448
mov rax, qword [0x00019160]
mov rcx, qword [rsp + 0x48]
add rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x12448
mov rcx, qword [0x00019160]
mov rax, qword [rsp + 0x48]
add rax, rcx
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x12448
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x12448
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x12448
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x12448
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x12448
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x12448
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x12448
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x12448
mov rax, qword [rsp + 0x20]
and rax, 0xfffffffffffffff0
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x20]
call fcn.000124d0
mov byte [rsp + 0x50], al
movzx eax, byte [rsp + 0x50]
test eax, eax
jne 0x12448
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x40]
lea rcx, [0x00017270]
call sub.ntoskrnl.exe_DbgPrint
movzx eax, byte [rsp + 0x50]
test eax, eax
jne 0x124be
lea rax, [0x000172a0]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x70]
movzx eax, word [rax]
mov word [rsp + 0x88], ax
mov rcx, qword [rsp + 0x78]
movzx eax, word [rsp + 0x88]
mov word [rcx], ax
mov rax, qword [rsp + 0x70]
add rax, 2
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x78]
add rax, 2
mov qword [rsp + 0x78], rax
cmp word [rsp + 0x88], 0
jne 0x12477
mov al, byte [rsp + 0x50]
add rsp, 0x98
ret