Function at 0x17150
Capabilities:
Attach user process memory
Create thread
Find process by pid

Disassembly:
mov r11, rsp
push rbx
push rsi
push r12
push r14
push r15
sub rsp, 0x110
xor r15d, r15d
xor eax, eax
mov r10, rcx
mov qword [r11 - 0x78], rax
mov qword [r11 - 0x70], rax
mov qword [r11 - 0x68], rax
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x58], rax
mov rax, qword [0x00011598]
lea rcx, [r11 - 0x90]
xor r14b, r14b
cmp word [r10], 7
mov qword [rcx], rax
mov rax, qword [0x000115a0]
mov qword [r11 - 0x80], r15
mov dword [r11 + 0x10], r15d
mov rsi, r15
mov qword [r11 + 8], r15
mov qword [rcx + 8], rax
mov qword [r11 - 0xa0], r15
mov qword [rsp + 0x48], r15
mov r12, r15
mov ebx, r15d
mov qword [r11 - 0x98], r15
jae 0x171e1
mov eax, 0xc000000d
add rsp, 0x110
pop r15
pop r14
pop r12
pop rsi
pop rbx
ret
mov rax, qword [r10 + 8]
lea r9, [rsp + 0x140]
lea r8, [rsp + 0x98]
movzx ecx, word [rax + 8]
lea rdx, [rsp + 0xa8]
mov qword [rsp + 0xf8], r13
mov word [rsp + 0xb0], cx
mov rcx, r10
call fcn.00016ea0
mov r13, rax
test rax, rax
jne 0x1722b
mov ebx, 0xc0000001
jmp 0x17683
movzx edx, word [rax]
xor ecx, ecx
add rdx, 0x12
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rsi, rax
test rax, rax
jne 0x1724c
mov ebx, 0xc000009a
jmp 0x17683
movzx eax, word [r13]
add ax, 2
mov word [rsi + 2], ax
call fcn.00016df0
mov r12, rax
test rax, rax
jne 0x17270
mov ebx, 0xc000009a
jmp 0x17683
mov edx, dword [r12]
mov qword [rsp + 0x108], rbp
mov qword [rsp + 0x100], rdi
lea rdi, [rax + 8]
mov ecx, r15d
mov rax, rdi
test edx, edx
je 0x172b7
mov r8, qword [rsp + 0x140]
nop word [rax + rax]
cmp qword [rax + 8], r8
je 0x172b2
inc ecx
add rax, 0x18
cmp ecx, edx
jb 0x172a0
jmp 0x172b7
movzx r14d, byte [rax + 4]
mov ebp, r15d
test edx, edx
je 0x17673
cmp r14b, byte [rdi + 4]
jne 0x17663
xor eax, eax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x68]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x60], rax
mov eax, dword [rdi]
lea rcx, [rsp + 0x150]
mov edx, 0x1fffff
mov qword [rsp + 0x150], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x158], r15
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x68], 0x30
mov qword [rsp + 0x70], r15
mov dword [rsp + 0x80], 0x40
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x90], r15
mov qword [rsp + 0x60], r15
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
mov ebx, eax
test eax, eax
js 0x17663
mov dword [rsp + 0x68], 0x30
mov qword [rsp + 0x70], r15
mov dword [rsp + 0x80], 0x40
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x90], r15
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x68]
lea rcx, [rsp + 0x40]
mov edx, 0x1fffff
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x58], rax
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
mov ebx, eax
test eax, eax
jns 0x173da
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x17663
movzx edx, word [rdi + 6]
mov r8, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x150]
mov dword [rsp + 0x30], 2
lea r9, [rsp + 0x48]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ntoskrnl.exe_ZwDuplicateObject]
mov ebx, eax
test eax, eax
js 0x1764a
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1764a
mov r8, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
lea rax, [rsp + 0x158]
xor r9d, r9d
mov r8, qword [r8]
mov edx, 0x80000000
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov ebx, eax
test eax, eax
jns 0x17479
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x17663
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x17616
mov rcx, qword [rsp + 0x158]
mov rax, qword [rcx + 8]
cmp dword [rax + 0x48], 7
jne 0x1761e
movzx eax, word [r13]
lea r9, [rsp + 0x148]
mov rdx, rsi
add ax, 2
movzx r8d, ax
mov word [rsi + 2], r8w
add r8d, 0x10
call qword [sym.imp.ntoskrnl.exe_ObQueryNameString]
test eax, eax
js 0x17616
mov r8b, 1
mov rdx, r13
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
je 0x17616
mov eax, dword [rdi]
cmp eax, 4
je 0x1758a
cmp eax, 8
je 0x1758a
test eax, eax
je 0x1758a
lea rdx, [rsp + 0xa0]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x17616
mov rcx, qword [rsp + 0xa0]
lea rdx, [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
movzx ecx, word [rdi + 6]
mov r9d, 2
lea r8, [rsp + 0x140]
lea edx, [r9 + 2]
mov byte [rsp + 0x140], r15b
mov byte [rsp + 0x141], r15b
call sub.ntoskrnl.exe_ZwSetInformationObject
movzx ecx, word [rdi + 6]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rcx, [rsp + 0xb8]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x158]
jmp 0x1761e
movzx eax, word [rdi + 6]
mov ecx, 0x80000000
xor r9d, r9d
or rax, rcx
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea rax, [0x00016db0]
mov edx, 0x1fffff
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x50], r15
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x17663
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x17663
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
inc ebp
add rdi, 0x18
cmp ebp, dword [r12]
jb 0x172c2
mov rbp, qword [rsp + 0x108]
mov rdi, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x17696
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test r12, r12
je 0x176a6
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test r13, r13
je 0x176b6
xor edx, edx
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov r13, qword [rsp + 0xf8]
test rsi, rsi
je 0x176ce
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
add rsp, 0x110
pop r15
pop r14
pop r12
pop rsi
pop rbx
ret