Function at 0x10023de0
Capabilities:
Patch process command line

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x88
mov eax, dword [0x100e8018]
xor eax, esp
mov dword [esp + 0x84], eax
push esi
push edi
push 0x38
lea eax, [esp + 0x58]
push 0
push eax
call fcn.100346a0
add esp, 0xc
mov dword [esp + 0x2c], 0
xorps xmm0, xmm0
mov dword [esp + 0x20], 0
lea eax, [esp + 0x18]
movaps xmmword [esp + 0x30], xmm0
movq qword [esp + 0x40], xmm0
push eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x10023e81
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_determine_process_architecture__GetLastError__0x_X_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x18], 0
je 0x10023e92
push str.Test_can_only_work_on_the_same_architecture_as_the_OS_n
jmp 0x10024144
push 0x100d2c80
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x1002413f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQuerySystemInformation
push esi
call edi
mov dword [0x100eae58], eax
test eax, eax
je 0x1002413f
push str.RtlEqualUnicodeString
push esi
call edi
mov dword [0x100eae80], eax
test eax, eax
je 0x1002413f
push str.NtQueryObject
push esi
call edi
mov dword [0x100eae84], eax
test eax, eax
je 0x1002413f
push str.NtQueryInformationProcess
push esi
call edi
mov dword [0x100eae54], eax
test eax, eax
je 0x1002413f
xor eax, eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], eax
xor esi, esi
lea eax, [esp + 0x10]
push eax
push esi
push esi
push 5
call dword [0x100eae58]
test eax, eax
jns 0x10023f2f
cmp eax, 0xc0000004
jne 0x10024138
mov eax, dword [esp + 0x10]
add eax, eax
push eax
mov dword [esp + 0x14], eax
call fcn.1003980e
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
test edi, edi
je 0x10024138
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push edi
push 5
call dword [0x100eae58]
test eax, eax
js 0x10023fae
cmp dword [esp + 0x10], 0xb8
jbe 0x10023faa
push 1
lea eax, [esi + 0x38]
add eax, edi
push eax
push 0x100e985c
call dword [0x100eae80]
test al, al
jne 0x10023f9e
add esi, dword [edi + esi]
mov edi, dword [esp + 0x14]
lea eax, [esi + 0xb8]
cmp eax, dword [esp + 0x10]
jb 0x10023f70
xor esi, esi
jmp 0x10023fb0
mov eax, dword [edi + esi + 0x44]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
xor esi, esi
jmp 0x10023fb0
mov esi, eax
push edi
call fcn.100395e6
add esp, 4
test esi, esi
js 0x10024138
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10024138
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x10023feb
push str.Failed_to_open_lsass.exe_process_n
jmp 0x10024144
push str.Opened_handle_to_lsass.exe_process_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
lea eax, [esp + 0x20]
push eax
push 0x38
lea eax, [esp + 0x5c]
push eax
push 0
push esi
call dword [0x100eae84]
test eax, eax
jns 0x10024049
push str.Failed_to_query_object_information_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
test byte [esp + 0x58], 0x10
je 0x1002406a
push str.Process_has_VM_read_access_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
mov edi, 1
jmp 0x1002407f
push str.Process_does_not_have_VM_read_access_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
xor edi, edi
lea eax, [esp + 0x20]
push eax
push 0x18
lea eax, [esp + 0x38]
push eax
push 0
push esi
call dword [0x100eae54]
test eax, eax
jns 0x100240ad
push str.Failed_to_query_process_information_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
jmp 0x100240e2
lea eax, [esp + 0x28]
push eax
push 4
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x40]
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x10024103
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_read_process_memory_with_error:_d_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
test edi, edi
jne 0x10024116
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
push str.Read_process_memory_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
push esi
mov edi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
push str.Failed_to_get_PID_for_lsass.exe_n
jmp 0x10024144
push str.Failed_to_get_pointer_for_NtQuerySystemInformation_n
push dword [0x100ee8a4]
call fcn.1000f610
mov ecx, dword [esp + 0x94]
add esp, 8
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.100313c7
mov esp, ebp
pop ebp
ret