Function at 0x140005720
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x60
mov rsi, r8
mov rdi, rdx
mov r12, rcx
test rcx, rcx
jne 0x140005742
xor eax, eax
add rsp, 0x60
pop r12
pop rdi
pop rsi
ret
mov qword [rsp + 0x58], r14
lea rdx, [rsp + 0x80]
xor r14d, r14d
mov qword [rsp + 0x80], r14
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140005774
xor eax, eax
mov r14, qword [rsp + 0x58]
add rsp, 0x60
pop r12
pop rdi
pop rsi
ret
mov qword [rsp + 0x88], rbx
or rbx, 0xffffffffffffffff
mov rdx, rbx
mov qword [rsp + 0x50], r15
nop dword [rax + rax]
inc rdx
cmp byte [rdi + rdx], r14b
jne 0x140005790
add rdx, 0x64
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r15, rax
test rax, rax
jne 0x1400057c2
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor eax, eax
jmp 0x14000597c
mov qword [rsp + 0x90], rbp
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rdi + r8], r14b
jne 0x1400057d0
add r8, 0x64
xor edx, edx
mov rcx, r15
call fcn.140005e00
mov rdx, rbx
nop word [rax + rax]
inc rdx
cmp byte [rsi + rdx], r14b
jne 0x1400057f0
add rdx, 0x64
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbp, rax
test rax, rax
jne 0x140005822
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor eax, eax
jmp 0x140005974
mov r8, rbx
inc r8
cmp byte [rsi + r8], r14b
jne 0x140005825
add r8, 0x64
xor edx, edx
mov rcx, rbp
call fcn.140005e00
xor eax, eax
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000594d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000594d
mov rcx, rbx
inc rcx
cmp byte [rsi + rcx], r14b
jne 0x140005881
add rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000594d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx ecx, al
mov rax, rbx
nop word [rax + rax]
inc rax
cmp byte [rdi + rax], r14b
jne 0x1400058b0
add rax, rcx
je 0x14000594d
mov r8, rbx
inc r8
cmp byte [rsi + r8], r14b
jne 0x1400058c5
inc r8
mov rdx, rsi
mov rcx, rbp
call fcn.140005f00
nop dword [rax]
cmp byte [rdi + rbx + 1], r14b
lea rbx, [rbx + 1]
jne 0x1400058e0
lea r8, [rbx + 1]
mov rdx, rdi
mov rcx, r15
call fcn.140005f00
mov rcx, qword [rsp + 0x80]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rdx, r15
mov ecx, r12d
call fcn.1400032e0
mov rbx, rax
test rax, rax
je 0x140005942
mov rdx, rbp
mov rcx, rax
call fcn.140005640
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140005942
mov rdx, rbp
mov rcx, rbx
call fcn.140005570
mov r14, rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor edx, edx
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, r14
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x88]
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x60
pop r12
pop rdi
pop rsi
ret