Function at 0x26360
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x2a0
xor r13d, r13d
xor sil, sil
mov rdi, rcx
mov ebx, r13d
mov r12d, 0xc000003a
lea r14, [0x0002ee00]
cmp byte [0x0002ee00], bl
je 0x26415
mov qword [rsp + 0x20], rcx
xor eax, eax
lea rcx, [0x0002ee28]
mov ebp, r12d
mov qword [rsp + 0x28], rax
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
lea rdx, [rsp + 0x20]
lea rcx, [0x0002ee78]
call qword [sym.imp.ntoskrnl.exe_RtlLookupElementGenericTable]
test rax, rax
je 0x263d3
mov ebx, dword [rax + 8]
mov ebp, r13d
lea rcx, [0x0002ee28]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
test ebp, ebp
jns 0x26415
xor eax, eax
lea rdx, [rsp + 0x40]
lea rcx, [0x0001f6b0]
mov qword [rsp + 0x48], rax
xor r8d, r8d
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rax
call fcn.000267c0
test al, al
cmovne ebx, dword [rsp + 0x50]
test bl, 3
je 0x26421
mov al, 1
jmp 0x266e2
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rdi
call fcn.0001f3a0
test eax, eax
js 0x26481
mov rbp, qword [rsp + 0x48]
lea rdx, [0x0002e450]
mov rcx, rbp
call fcn.00029170
test al, al
je 0x26469
mov sil, 1
cmp byte [0x0002ee00], r13b
je 0x26469
mov r8d, 0x80000002
mov rdx, rdi
mov rcx, r14
call fcn.0001f7b0
test rbp, rbp
je 0x2647c
mov edx, 0x73726973
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test sil, sil
jne 0x2641a
bt ebx, 8
jae 0x266df
lea rcx, [rsp + 0x92]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x90], r13w
call fcn.0002b780
movzx r8d, word [0x0002f2d0]
mov rdx, qword [0x0002f2d8]
xor eax, eax
lea rcx, [rsp + 0x90]
mov word [rsp + 0x20], r13w
mov qword [rsp + 0x22], rax
mov dword [rsp + 0x2a], eax
mov word [rsp + 0x2e], ax
mov word [rsp + 0x30], r13w
mov qword [rsp + 0x32], rax
mov dword [rsp + 0x3a], eax
mov word [rsp + 0x3e], ax
call fcn.0002b3f0
lea r8, [0x00012260]
lea rcx, [rsp + 0x90]
mov edx, 0x104
call fcn.00023e30
cmp dword [0x0002f224], 5
mov edx, 0x104
lea rcx, [rsp + 0x90]
ja 0x26537
lea r8, [0x00012298]
call fcn.00023e30
mov edx, 0x104
lea rcx, [rsp + 0x90]
lea r8, [0x0002f0a0]
call fcn.00023e30
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor eax, eax
mov qword [rsp + 0x2d8], r13
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x58], r13
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rdi, rax
jne 0x2659a
lea rcx, [rsp + 0x30]
call fcn.00020590
mov ebp, eax
jmp 0x265dd
lea rdx, [rsp + 0x2d8]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x266df
mov rcx, qword [rsp + 0x2d8]
lea rdx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea rcx, [rsp + 0x30]
call fcn.00020590
lea rcx, [rsp + 0x58]
mov ebp, eax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x2d8]
test rcx, rcx
je 0x265f0
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test ebp, ebp
js 0x266df
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
je 0x266ca
mov rcx, rdi
call fcn.00025e60
mov rdi, rax
cmp byte [0x0002ee00], r13b
je 0x266a3
xor eax, eax
lea rcx, [0x0002ee28]
mov ebx, r13d
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdi
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
lea rdx, [rsp + 0x40]
lea rcx, [0x0002ee78]
call qword [sym.imp.ntoskrnl.exe_RtlLookupElementGenericTable]
test rax, rax
je 0x26660
mov ebx, dword [rax + 8]
mov r12d, r13d
lea rcx, [0x0002ee28]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
test r12d, r12d
jns 0x266a3
xor eax, eax
lea rdx, [rsp + 0x58]
lea rcx, [0x0001f6b0]
mov qword [rsp + 0x60], rax
xor r8d, r8d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rax
call fcn.000267c0
test al, al
cmovne ebx, dword [rsp + 0x68]
test bl, bl
jns 0x266ca
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp byte [0x0002ee00], r13b
je 0x266c7
mov r8d, 0x80000001
mov rdx, rax
mov rcx, r14
call fcn.0001f7b0
mov sil, 1
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x266df
mov edx, 0x73726973
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, sil
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret