Function at 0x1a4cc
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
and qword [rsp + 0x38], 0
and dword [rsp + 0x40], 0
mov rbp, rcx
lea rcx, [rsp + 0x40]
xor edx, edx
mov esi, r9d
mov dword [rsp + 0x34], 0xc0000001
mov byte [rsp + 0x30], 0
call fcn.00037450
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.00035e20
mov edi, 0xc0000000
mov edx, eax
mov ebx, eax
and edx, edi
cmp edx, edi
je 0x1a7d1
cmp byte [rsp + 0x30], 0
je 0x1a7d1
lea rdx, [rsp + 0x38]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
and eax, edi
cmp eax, edi
je 0x1a7e0
mov rcx, qword [rsp + 0x38]
call sub.ntoskrnl.exe_PsGetProcessPeb
mov rcx, qword [rsp + 0x38]
mov r13, rax
call sub.ntoskrnl.exe_PsGetProcessWow64Process
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x98]
mov r14, rax
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov qword [rsp + 0x90], 0xffffffffff676980
xor r12d, r12d
lea rdx, [0x00093840]
mov r8, r14
mov rcx, r13
call fcn.0002dd18
mov rdi, rax
test rax, rax
jne 0x1a5d7
lea r8, [rsp + 0x90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_KeDelayExecutionThread]
inc r12d
cmp r12d, 0x64
jb 0x1a598
mov ebx, 0xc0000225
jmp 0x1a79e
lea rdx, [0x000938f0]
mov r8b, 1
mov rcx, rax
call fcn.0002d5d4
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1a5cd
lea rdx, [0x00093910]
mov r8b, 1
mov rcx, rdi
call fcn.0002d5d4
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1a5cd
lea rdx, [0x00093880]
mov r8b, 1
mov rcx, rdi
call fcn.0002d5d4
mov r15, rax
test rax, rax
je 0x1a5cd
lea rdx, [0x00093930]
mov r8b, 1
mov rcx, rdi
call fcn.0002d5d4
mov r13, rax
test rax, rax
je 0x1a5cd
lea rdx, [0x00093950]
mov r8b, 1
mov rcx, rdi
call fcn.0002d5d4
mov r12, rax
test rax, rax
je 0x1a5cd
lea rdx, [0x00093970]
mov r8b, 1
mov rcx, rdi
call fcn.0002d5d4
mov rdi, rax
test rax, rax
je 0x1a5cd
xor edx, edx
test r14, r14
je 0x1a6e4
lea r8d, [rdx + 0x20]
lea rcx, [rsp + 0x50]
call fcn.00091d10
mov r11, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x118]
mov dword [rsp + 0x68], r12d
mov r12d, dword [rsp + 0x120]
mov dword [rsp + 0x6c], edi
lea edi, [r12 + 0x4b1]
lea r9, [rsp + 0x50]
lea ecx, [rdi + 0x20]
mov r8d, r12d
mov dword [rsp + 0x58], r11d
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x64], r13d
call fcn.0001a328
jmp 0x1a747
lea rcx, [rsp + 0x50]
mov r8d, 0x3c
call fcn.00091d10
mov r11, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x118]
mov qword [rsp + 0x7c], r12
mov r12d, dword [rsp + 0x120]
mov qword [rsp + 0x84], rdi
lea edi, [r12 + 0x518]
lea r9, [rsp + 0x50]
lea ecx, [rdi + 0x3c]
mov r8d, r12d
mov qword [rsp + 0x5c], r11
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], r15
mov qword [rsp + 0x74], r13
call fcn.0001a3f8
test rax, rax
je 0x1a79e
test esi, esi
jle 0x1a764
cmp esi, 2
jle 0x1a764
cmp esi, 3
je 0x1a7ae
cmp esi, 4
je 0x1a79e
cmp esi, 5
je 0x1a79e
mov r8d, edi
mov edx, r12d
mov r9d, 4
add r8, rax
add rdx, rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rcx, rbp
mov byte [rsp + 0x20], 1
call fcn.0001842c
mov ecx, 0xc0000000
mov ebx, eax
and eax, ecx
cmp eax, ecx
je 0x1a79e
mov ebx, dword [rsp + 0x34]
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x1a7e0
mov r9d, edi
mov r8d, r12d
xor edx, edx
mov rcx, rbp
add r9, rax
add r8, rax
mov byte [rsp + 0x20], 0xfe
call fcn.00089ffc
test al, al
je 0x1a79e
xor ebx, ebx
jmp 0x1a79e
lea rcx, [0x000938c0]
mov rdx, rbp
call fcn.0004505c
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1a7f0
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x110]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret