Function at 0x140002158
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov eax, dword [0x140004054]
mov ecx, 8
mov qword [rbp + 0x48], rcx
cmp eax, 6
jne 0x1400021f6
mov eax, dword [0x140004058]
cmp eax, 1
jne 0x1400021b3
lea edi, [rcx + 0x66]
lea esi, [rcx + 0x73]
mov r12d, 0x10
lea r15d, [r12 + 0x2c]
lea ebx, [r12 + 4]
lea r14d, [r12 + 0xc]
lea r13d, [r12 - 9]
jmp 0x1400022e5
cmp eax, 2
jne 0x1400021d5
lea edi, [rax + 0x6c]
mov r13d, ecx
lea ebx, [rax + 0x13]
lea esi, [rax + 0x79]
lea r15d, [rax + 0x3b]
lea r12d, [rax + 0xf]
lea r14d, [rax + 0x1b]
jmp 0x1400022e5
cmp eax, 3
jne 0x140002372
lea ebx, [rax + 0x13]
lea r15d, [rax + 0x3b]
lea r12d, [rax + 0xf]
lea r14d, [rax + 0x1b]
lea r13d, [rax + 6]
jmp 0x1400022dd
mov r13d, 0xa
cmp eax, r13d
jne 0x140002372
cmp dword [0x140004058], 0
jne 0x140002372
mov ecx, dword [0x14000405c]
cmp ecx, 0x2800
jne 0x14000223f
mov edi, 0x70
lea ebx, [rdi - 0x59]
lea esi, [rdi + 0xd]
lea r15d, [rdi - 0x31]
lea r12d, [rdi - 0x5d]
lea ecx, [rdi - 0x68]
lea r14d, [rdi - 0x51]
jmp 0x1400022e5
cmp ecx, 0x295a
je 0x140002220
cmp ecx, 0x3839
je 0x140002220
cmp ecx, 0x3ad7
je 0x1400022c9
cmp ecx, 0x3fab
je 0x1400022c9
cmp ecx, 0x42ee
je 0x1400022c9
cmp ecx, 0x4563
je 0x1400022c9
lea eax, [rcx - 0x47ba]
cmp eax, 1
jbe 0x1400022c9
lea eax, [rcx - 0x4a61]
cmp eax, 4
jbe 0x1400022b9
cmp ecx, 0x55f0
je 0x140002299
cmp ecx, 0x585d
jne 0x140002372
mov edi, 0x67
lea ebx, [rdi - 0x55]
lea esi, [rdi + 0xd]
lea r15d, [rdi - 0x30]
lea r12d, [rdi - 0x59]
lea ecx, [rdi - 0x5f]
lea r14d, [rdi - 0x4d]
lea r13d, [rdi - 0x62]
jmp 0x1400022e5
mov edi, 0x6c
lea esi, [rdi + 0xd]
lea ecx, [rdi - 0x64]
jmp 0x140002194
mov ebx, 0x17
lea r15d, [rbx + 0x28]
lea r12d, [rbx - 4]
lea ecx, [rbx - 0xf]
lea r14d, [rbx + 8]
mov esi, 0x7c
lea edi, [rsi - 0xd]
and qword [rbp + 0x40], 0
lea rdx, [rbp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140002359
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
test rax, rax
jne 0x14000234f
xor edx, edx
lea r8d, [rax + 0x30]
lea rcx, [rbp - 0x30]
call fcn.140002b00
mov rcx, qword [rbp + 0x40]
lea rdx, [rbp - 0x30]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rax, qword [rbp + 0x40]
jne 0x14000234f
mov rcx, qword [0x140004030]
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x14000238c
lea rcx, [rbp - 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rbp + 0x48]
add rcx, 4
mov qword [rbp + 0x48], rcx
cmp rcx, 0x32000
jl 0x1400022ea
xor al, al
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [0x140004030]
mov edx, edi
mov rcx, qword [rcx + 0x20]
call fcn.140001570
mov rcx, qword [0x140004030]
mov edx, r15d
mov qword [0x140004190], rax
mov rcx, qword [rcx + 0x20]
call fcn.140001570
mov rcx, qword [0x140004030]
mov edx, r12d
mov qword [0x140004198], rax
mov rcx, qword [rcx + 0x20]
call fcn.140001570
mov rcx, qword [0x140004030]
mov edx, ebx
mov qword [0x1400041a0], rax
mov rcx, qword [rcx + 0x20]
call fcn.140001570
mov rcx, qword [0x140004030]
mov edx, r14d
mov qword [0x1400041a8], rax
mov rcx, qword [rcx + 0x20]
call fcn.140001570
mov rcx, qword [0x140004030]
mov edx, r14d
mov qword [0x1400041b0], rax
mov rcx, qword [rcx + 0x20]
call fcn.140001570
mov rcx, qword [0x140004030]
mov edx, esi
mov qword [0x1400041b8], rax
mov rcx, qword [rcx + 0x20]
call fcn.140001570
mov rcx, qword [0x140004030]
mov edx, r13d
mov qword [0x1400041c0], rax
mov rcx, qword [rcx + 0x20]
call fcn.140001570
lea rcx, [rbp - 0x30]
mov qword [0x1400041c8], rax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor eax, eax
cmp qword [0x140004190], rax
je 0x140002372
cmp qword [0x140004198], rax
je 0x140002372
cmp qword [0x1400041a0], rax
je 0x140002372
cmp qword [0x1400041a8], rax
je 0x140002372
cmp qword [0x1400041b0], rax
je 0x140002372
cmp qword [0x1400041b8], rax
je 0x140002372
cmp qword [0x1400041c0], rax
je 0x140002372
cmp qword [0x1400041c8], rax
je 0x140002372
mov al, 1
jmp 0x140002374