Function at 0x14000fa0c
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
test rcx, 0xfffffffffffffffb
je 0x14000fca9
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1400d6a00]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r15d, r8d
mov qword [rsp + 0x28], rdx
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000fc8b
mov rdi, qword [rsp + 0x20]
xor r14b, r14b
test rdi, rdi
je 0x14000faba
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000faba
mov rcx, qword [0x1400d6b50]
add rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000faba
mov rax, qword [0x1400d6b50]
mov rcx, qword [rax + rdi]
test rcx, rcx
je 0x14000faba
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx r14d, r14b
mov esi, 1
test al, al
cmovne r14d, esi
jmp 0x14000fabf
mov esi, 1
test r14b, r14b
je 0x14000fc8b
test ebx, ebx
js 0x14000fc8b
imul r13, r15, 0x220
add r13, 4
mov r8d, 0x4d7a66
mov rdx, r13
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x14000fc80
mov r8, r13
xor edx, edx
mov rcx, rax
call fcn.14001ea80
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov r12, rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov r14, rax
test rax, rax
je 0x14000fc6d
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rbx, qword [r14 + 0x18]
test rbx, rbx
je 0x14000fbd0
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000fbd0
mov r8d, esi
mov edx, 0x70
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov r8d, esi
mov edx, 0x58
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
lea rax, [rbx - 1]
movabs rcx, 0x7ffffffefffd
cmp rax, rcx
ja 0x14000fbd0
lea rcx, [rbx + 0x10]
mov r9d, r15d
mov r8, rdi
mov edx, esi
call fcn.14001d854
lea rcx, [rbx + 0x20]
mov r9d, r15d
mov r8, rdi
mov edx, 2
call fcn.14001d854
lea rcx, [rbx + 0x30]
mov r9d, r15d
mov r8, rdi
mov edx, 3
call fcn.14001d854
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000fc41
mov ebx, dword [r12 + 0xc]
mov r8d, esi
mov edx, 0x3c
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov r8d, esi
mov edx, 0x28
mov ecx, ebx
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
test rbx, rbx
je 0x14000fc41
lea rcx, [rbx + 0xc]
mov r9d, r15d
mov r8, rdi
mov edx, esi
call fcn.14001d9f8
lea rcx, [rbx + 0x14]
mov r9d, r15d
mov r8, rdi
mov edx, 2
call fcn.14001d9f8
lea rcx, [rbx + 0x1c]
mov r9d, r15d
mov r8, rdi
mov edx, 3
call fcn.14001d9f8
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
nop
cmp dword [rdi], 0
jbe 0x14000fc6d
mov r8, r13
mov rdx, rdi
mov rcx, qword [rsp + 0x28]
call fcn.14001e7c0
xor ebx, ebx
jmp 0x14000fc72
mov ebx, 0xc0000001
mov edx, 0x4d7a66
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14001e6e0
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret