Function at 0x14003f378
Capabilities:
Attach user process memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x128]
sub rsp, 0x200
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov ecx, 0x61
xor dil, dil
xor r14b, r14b
call fcn.140029ab4
mov r13, rax
test rax, rax
je 0x14003f3d6
lea rdx, [rbp + 0xc0]
mov rcx, rax
call sub.ntoskrnl.exe_KeStackAttachProcess
mov ecx, 0x42e2
call fcn.140029ab4
mov ecx, 0x20
mov rbx, rax
call fcn.140029ab4
mov ecx, 0x21
mov r12, rax
call fcn.140029ab4
mov ecx, 3
mov rsi, rax
call fcn.140029ab4
mov ecx, 2
mov r15, rax
call fcn.140029ab4
test ebx, ebx
je 0x14003f692
cmp ebx, esi
jae 0x14003f692
test r12, r12
je 0x14003f692
test esi, esi
je 0x14003f692
test r15, r15
je 0x14003f692
test eax, eax
je 0x14003f692
mov edx, r12d
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
or dword [rsp + 0x20], 0xffffffff
mov ecx, ebx
lea r8d, [r9 + 2]
add rcx, r12
sub edx, ecx
add edx, esi
call fcn.14008a254
xor ebx, ebx
mov dword [rsp + 0x40], ebx
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x50]
call fcn.140089fbc
test eax, eax
jne 0x14003f692
mov eax, dword [rbp + 0x90]
mov ecx, 0x545
add qword [rsp + 0x58], rax
mov rax, qword [rbp + 0xb8]
cmp cx, word [rax + 6]
je 0x14003f692
mov ecx, 0x914
call fcn.140029ab4
cmp eax, 0x23f0
jae 0x14003f4fe
mov rax, qword [rbp + 0xb8]
mov ecx, 0x50e
cmp cx, word [rax + 6]
jne 0x14003f66b
cmp qword [rbp - 0x10], 0x40000
jne 0x14003f66b
cmp qword [rbp + 0x28], 0x40
jne 0x14003f66b
mov eax, dword [rbp - 0x20]
jmp 0x14003f65e
mov ecx, 0x914
call fcn.140029ab4
cmp eax, 0x2800
jae 0x14003f584
mov rax, qword [rbp + 0xb8]
mov ecx, 0x512
cmp cx, word [rax + 6]
jne 0x14003f66b
cmp qword [rbp + 0x28], 0x40000
jne 0x14003f66b
cmp qword [rbp - 0x10], 0x40
jne 0x14003f66b
mov eax, dword [rbp + 0x18]
sub eax, r12d
add eax, dword [rsp + 0x58]
je 0x14003f66b
cmp eax, esi
jae 0x14003f66b
mov ebx, eax
mov ecx, 0x82a
add rbx, r15
call fcn.140029ab4
mov rdx, rbx
test rax, rax
jne 0x14003f683
mov ecx, 0x82a
call fcn.140029bac
mov ebx, dword [rsp + 0x40]
jmp 0x14003f66b
mov ecx, 0x914
call fcn.140029ab4
cmp eax, 0x585d
mov rax, qword [rbp + 0xb8]
movzx ecx, word [rax + 6]
jae 0x14003f5fe
mov eax, 0x430
cmp ax, cx
jne 0x14003f5d5
movabs rax, 0x400000000
cmp qword [rbp + 0x28], rax
jne 0x14003f5d5
cmp qword [rbp + 0x10], 4
mov eax, 1
jne 0x14003f5da
cmp qword [rbp - 0x10], 0x20
movzx r14d, r14b
cmove r14d, eax
jmp 0x14003f5da
mov eax, 1
mov edx, 0x512
cmp dx, cx
jne 0x14003f66b
cmp qword [rbp + 0x28], 0x40000
jne 0x14003f66b
cmp qword [rbp - 0x10], 0x40
jne 0x14003f66b
cmp r14b, al
jmp 0x14003f659
mov eax, 0x418
cmp ax, cx
jne 0x14003f636
cmp qword [rbp + 0x28], 0x80000
jne 0x14003f636
cmp qword [rbp + 0x10], 0
jne 0x14003f636
cmp qword [rbp - 0x10], 0x4041
mov edx, 1
jne 0x14003f63b
cmp dword [rbp - 0x20], 0x2c
movzx r14d, r14b
cmove r14d, edx
jmp 0x14003f63b
mov edx, 1
mov eax, 0x512
cmp ax, cx
jne 0x14003f66b
cmp qword [rbp + 0x28], 0x40000
jne 0x14003f66b
cmp qword [rbp - 0x10], 0x40
jne 0x14003f66b
cmp r14b, dl
jne 0x14003f66b
mov eax, dword [rbp + 0x18]
sub eax, r12d
add eax, dword [rsp + 0x58]
je 0x14003f66b
cmp eax, esi
jb 0x14003f67e
inc ebx
mov dword [rsp + 0x40], ebx
cmp ebx, 0xc8
jae 0x14003f692
jmp 0x14003f47f
mov edx, eax
add rdx, r15
mov ecx, 0x2bc
call fcn.140029bac
mov edi, 1
test r13, r13
je 0x14003f6a3
lea rcx, [rbp + 0xc0]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov al, dil
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret