Function at 0x14003e494
Capabilities:
Attach user process memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x118]
sub rsp, 0x1f0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov ecx, 0x61
xor r15b, r15b
call fcn.140029ab4
mov rsi, rax
test rax, rax
je 0x14003e4ef
lea rdx, [rbp + 0xb0]
mov rcx, rax
call sub.ntoskrnl.exe_KeStackAttachProcess
mov ecx, 0x42d0
call fcn.140029ab4
mov ecx, 0x43a8
mov r14, rax
call fcn.140029ab4
mov ecx, 0x20
mov rbx, rax
call fcn.140029ab4
mov ecx, 0x21
mov r12, rax
call fcn.140029ab4
mov ecx, 3
mov rdi, rax
call fcn.140029ab4
mov ecx, 2
mov r13, rax
call fcn.140029ab4
test r14d, r14d
je 0x14003e76d
cmp r14d, edi
jae 0x14003e76d
test ebx, ebx
je 0x14003e76d
cmp ebx, edi
jae 0x14003e76d
test r12, r12
je 0x14003e76d
test edi, edi
je 0x14003e76d
test r13, r13
je 0x14003e76d
test eax, eax
je 0x14003e76d
mov edx, r12d
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
or dword [rsp + 0x20], 0xffffffff
mov ecx, r14d
lea r8d, [r9 + 2]
add rcx, r12
sub edx, ecx
add edx, edi
call fcn.14008a254
xor r14d, r14d
mov ebx, 0x512
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.140089fbc
test eax, eax
jne 0x14003e76d
mov eax, dword [rbp + 0x80]
add qword [rsp + 0x48], rax
mov rax, qword [rbp + 0xa8]
movzx ecx, word [rax + 6]
mov eax, 0x545
cmp ax, cx
je 0x14003e76d
cmp bx, cx
jne 0x14003e6a9
cmp qword [rbp - 0x20], 0x40
jne 0x14003e6a9
cmp dword [rbp - 0x18], 2
jne 0x14003e6a9
cmp dword [rbp + 0x20], 4
jne 0x14003e6a9
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.140089fbc
test eax, eax
jne 0x14003e6a9
mov eax, dword [rbp + 0x80]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, qword [rbp + 0xa8]
mov qword [rsp + 0x48], rcx
cmp bx, word [rax + 6]
jne 0x14003e6a9
cmp qword [rbp - 0x20], 0x40
jne 0x14003e6a9
cmp dword [rbp - 0x18], 1
jne 0x14003e6a9
cmp qword [rbp + 0x18], 0x40000
jne 0x14003e6a9
mov ebx, dword [rbp + 8]
lea rdx, [rbp - 0x70]
sub ebx, r12d
add ebx, ecx
lea rcx, [rsp + 0x40]
call fcn.140089fbc
test eax, eax
jne 0x14003e6a4
mov eax, dword [rbp + 0x80]
mov ecx, 0x558
add qword [rsp + 0x48], rax
mov rax, qword [rbp + 0xa8]
cmp cx, word [rax + 6]
jne 0x14003e6a4
test ebx, ebx
je 0x14003e6a4
cmp ebx, edi
jb 0x14003e6be
mov ebx, 0x512
inc r14d
cmp r14d, 0xc8
jae 0x14003e76d
jmp 0x14003e5ba
mov edx, ebx
mov ecx, 0x2b8
add rdx, r13
call fcn.140029bac
xor r15b, r15b
xor ebx, ebx
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.140089fbc
test eax, eax
jne 0x14003e76d
mov eax, dword [rbp + 0x80]
mov rdx, qword [rsp + 0x48]
add rdx, rax
mov rax, qword [rbp + 0xa8]
mov qword [rsp + 0x48], rdx
movzx ecx, word [rax + 6]
mov eax, 0x545
cmp ax, cx
je 0x14003e76d
mov eax, 0x4b1
cmp ax, cx
je 0x14003e72e
mov eax, 0x175
cmp ax, cx
je 0x14003e72e
mov eax, 0x472
cmp ax, cx
jne 0x14003e74c
test byte [rbp - 0x50], 4
je 0x14003e74c
cmp qword [rbp - 0x20], 0x40000
jne 0x14003e74c
mov eax, dword [rbp - 0x30]
sub eax, r12d
add eax, edx
je 0x14003e74c
cmp eax, edi
jb 0x14003e75b
inc ebx
cmp ebx, 0x12c
jae 0x14003e76d
jmp 0x14003e6d2
mov edx, eax
mov ecx, 0x2ba
add rdx, r13
call fcn.140029bac
mov r15b, 1
test rsi, rsi
je 0x14003e77e
lea rcx, [rbp + 0xb0]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov al, r15b
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret