Function at 0x140011f44
Capabilities:
Attach user process memory

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x390
mov rax, qword [0x14000a330]
xor rax, rsp
mov qword [rsp + 0x380], rax
mov qword [rsp + 0x80], r9
mov qword [rsp + 0x78], r8
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x68], rcx
mov r13, qword [rsp + 0x400]
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x60], r13
lea rcx, [rsp + 0xd0]
mov qword [rsp + 0x48], rcx
xor ecx, ecx
mov byte [rsp + 0x30], cl
mov byte [rsp + 0x32], cl
mov rsi, rdx
mov qword [rsp + 0x50], rdx
mov r12, r9
lea rdi, [rsp + 0x180]
mov qword [rsp + 0x38], rdi
mov r15, qword [rsp + 0x3f0]
mov r14, r15
mov qword [rsp + 0x58], r15
mov rbx, r15
mov eax, 0xc000
cmp r15, rax
cmovae rbx, rax
mov r15d, 0x4368704b
test r14, r14
je 0x1400122f2
cmp rbx, r14
cmova rbx, r14
cmp rbx, 0x3ff
jbe 0x140012007
mov r13b, 1
jmp 0x14001206b
mov r13b, cl
lea rax, [rsp + 0x180]
cmp rbx, 0x200
ja 0x14001202e
cmp rdi, rax
je 0x14001205e
mov edx, r15d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x14001205e
cmp rdi, rax
jne 0x14001206b
jmp 0x140012041
shr rbx, 1
cmp rbx, 0x200
jbe 0x14001205e
mov r8d, r15d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
test rax, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
je 0x140012035
jmp 0x14001206b
lea rdi, [rsp + 0x180]
mov qword [rsp + 0x38], rdi
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov byte [rsp + 0x31], r15b
mov byte [rsp + 0x33], r15b
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
cmp rsi, qword [rsp + 0x70]
jne 0x1400120c1
cmp byte [rsp + 0x3f8], r15b
je 0x1400120c1
mov byte [rsp + 0x30], 1
lea r8d, [r15 + 1]
mov rdx, qword [rsp + 0x3f0]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov byte [rsp + 0x30], r15b
test r13b, r13b
je 0x140012186
xor r15d, r15d
mov qword [rsp + 0xd0], r15
mov rax, rsi
mov ecx, 0xfff
and rax, rcx
add rax, rcx
add rax, rbx
shr rax, 0xc
lea rax, [rax*8 + 0x30]
mov word [rsp + 0xd8], ax
mov word [rsp + 0xda], r15w
mov rax, rsi
and rax, 0xfffffffffffff000
mov qword [rsp + 0xf0], rax
mov rax, rsi
and rax, rcx
mov dword [rsp + 0xfc], eax
mov dword [rsp + 0xf8], ebx
xor r8d, r8d
mov dl, byte [rsp + 0x3f8]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
mov byte [rsp + 0x31], 1
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor edx, edx
lea r8d, [r15 + 1]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov r15, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140012194
mov byte [rsp + 0x32], 1
mov ecx, 0xc000009a
call qword [sym.imp.ntoskrnl.exe_ExRaiseStatus]
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.140005ec0
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
cmp r12, qword [rsp + 0x80]
jne 0x1400121ea
xor eax, eax
cmp byte [rsp + 0x3f8], al
je 0x1400121ea
mov byte [rsp + 0x30], 1
lea r8d, [rax + 1]
mov rdx, qword [rsp + 0x3f0]
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ProbeForWrite]
xor eax, eax
mov byte [rsp + 0x30], al
mov byte [rsp + 0x33], 1
mov r8, rbx
mov rcx, r12
test r13b, r13b
mov rdx, r15
jne 0x140012200
mov rdx, rdi
call fcn.140005ec0
nop
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
xor ecx, ecx
test r13b, r13b
je 0x14001223c
lea rdx, [rsp + 0xd0]
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
xor ecx, ecx
sub r14, rbx
mov qword [rsp + 0x58], r14
add rsi, rbx
mov qword [rsp + 0x50], rsi
add r12, rbx
jmp 0x140011fe3
lea rax, [rsp + 0x180]
cmp rdi, rax
je 0x14001230b
mov edx, r15d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [rsp + 0x3f0]
mov rcx, qword [rsp + 0x90]
mov qword [rcx], rax
xor eax, eax
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.140005c60
add rsp, 0x390
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret