Function at 0x140001efc
Capabilities:
Complete processing asynchronous io request
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rdx + 0xb8]
mov rdi, rdx
mov rbx, qword [rdx + 0x18]
mov ecx, dword [rax + 0x18]
mov esi, dword [rax + 8]
cmp ecx, 0x221e60
jne 0x140001fe1
mov r10d, dword [0x140006024]
mov eax, 0x2e8ba2e9
mov r9d, dword [0x140006020]
imul r10d
mov ecx, edx
sar ecx, 4
mov eax, ecx
shr eax, 0x1f
add ecx, eax
mov eax, 0x3e0f83e1
imul r10d
mov eax, 0x3531dec1
sar edx, 4
mov r8d, edx
add edx, ecx
shr r8d, 0x1f
add r8d, edx
imul r9d
mov eax, 0x94f2095
sar edx, 4
mov ecx, edx
add edx, r8d
shr ecx, 0x1f
add ecx, edx
imul r9d
sar edx, 1
mov eax, edx
add edx, ecx
shr eax, 0x1f
lea ecx, [r9 - 0x1ad302a9]
add eax, edx
sub eax, r10d
add ecx, eax
mov eax, 0x9c09c09d
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul ecx, edx, 0x26a0
mov edx, dword [rbx]
lea eax, [rcx - 0x56558117]
cmp edx, eax
jle 0x14000222a
lea eax, [rcx - 0x5654e4cd]
cmp edx, eax
jge 0x14000222a
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov qword [0x140006018], rax
jmp 0x14000222a
cmp ecx, 0x221e61
jne 0x140002025
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rax, qword [0x140006018]
jne 0x14000222a
movsxd rcx, dword [rbx]
lea rdx, [rsp + 0x38]
and qword [rsp + 0x38], 0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x14000222a
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsSuspendProcess]
jmp 0x140002067
cmp ecx, 0x221e62
jne 0x140002077
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rax, qword [0x140006018]
jne 0x14000222a
movsxd rcx, dword [rbx]
lea rdx, [rsp + 0x38]
and qword [rsp + 0x38], 0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x14000222a
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsResumeProcess]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x14000222a
cmp ecx, 0x222000
jne 0x14000209e
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rax, qword [0x140006018]
jne 0x14000222a
mov ecx, dword [rbx]
call fcn.140003840
jmp 0x14000222a
cmp ecx, 0x222004
jne 0x1400020c5
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rax, qword [0x140006018]
jne 0x14000222a
and dword [0x140006218], 0
jmp 0x14000222a
cmp ecx, 0x222008
jne 0x1400020ec
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rax, qword [0x140006018]
jne 0x14000222a
mov ecx, dword [rbx]
call fcn.1400038b0
jmp 0x14000222a
cmp ecx, 0x22200c
jne 0x140002113
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rax, qword [0x140006018]
jne 0x14000222a
and dword [0x140006164], 0
jmp 0x14000222a
cmp ecx, 0x222010
jne 0x14000213a
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rax, qword [0x140006018]
jne 0x14000222a
mov ecx, dword [rbx]
call fcn.140003798
jmp 0x14000222a
cmp ecx, 0x222014
jne 0x140002161
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rax, qword [0x140006018]
jne 0x14000222a
and dword [0x1400061e8], 0
jmp 0x14000222a
cmp ecx, 0x222018
jne 0x140002188
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rax, qword [0x140006018]
jne 0x14000222a
mov ecx, dword [rbx]
call fcn.140003808
jmp 0x14000222a
cmp ecx, 0x22201c
jne 0x1400021ac
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rax, qword [0x140006018]
jne 0x14000222a
and dword [0x1400061ec], 0
jmp 0x14000222a
cmp ecx, 0x222020
jne 0x1400021cc
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rax, qword [0x140006018]
jne 0x14000222a
mov ecx, dword [rbx]
call fcn.1400037d0
jmp 0x14000222a
cmp ecx, 0x222024
jne 0x1400021ec
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rax, qword [0x140006018]
jne 0x14000222a
and dword [0x140006200], 0
jmp 0x14000222a
cmp ecx, 0x222028
jne 0x14000220c
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rax, qword [0x140006018]
jne 0x14000222a
mov ecx, dword [rbx]
call fcn.140003878
jmp 0x14000222a
cmp ecx, 0x22202c
jne 0x14000222a
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rax, qword [0x140006018]
jne 0x14000222a
and dword [0x140006204], 0
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rax, qword [0x140006018]
je 0x140002262
or rbx, 0xffffffffffffffff
xor edx, edx
mov rcx, rbx
mov r8d, 0x270f
call fcn.140003a80
mov r8d, 0x270f
mov rdx, rbx
mov rcx, 0xffffffffffffc3e8
call fcn.140003a80
and dword [rdi + 0x30], 0
xor edx, edx
mov rcx, rdi
mov qword [rdi + 0x38], rsi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret