Function at 0x190f4
Capabilities:
Find process by pid

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3f8
mov rax, qword [0x00039100]
xor rax, rsp
mov qword [rsp + 0x3e0], rax
mov rbx, qword [rsp + 0x468]
xor r15d, r15d
mov r12, r9
mov qword [rsp + 0x40], r9
mov r13d, r8d
mov rdi, rdx
mov byte [rsp + 0x32], r15b
mov qword [rsp + 0x38], rdx
mov rsi, rcx
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], r15
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, r15d
jl 0x19173
mov rcx, qword [rsp + 0x50]
call fcn.0002f23e
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor edx, edx
lea rcx, [rsp + 0x391]
mov byte [rsp + 0x30], r15b
lea r8d, [rdx + 0x4f]
mov dword [rsp + 0x48], r15d
mov byte [rsp + 0x390], r15b
call fcn.0002f7f0
mov r14d, dword [rsp + 0x460]
mov qword [rsp + 0x138], rdi
mov edi, 0x104
lea rcx, [rsp + 0x14d]
xor edx, edx
mov r8, rdi
mov dword [rsp + 0x149], r14d
mov byte [rsp + 0x31], r15b
mov qword [rsp + 0x130], rsi
mov byte [rsp + 0x140], r13b
mov qword [rsp + 0x141], r12
call fcn.0002f7f0
mov ebp, dword [rsp + 0x470]
cmp rbx, r15
je 0x1920e
cmp ebp, r15d
je 0x1920e
cmp ebp, edi
mov r8, rbp
lea rcx, [rsp + 0x14d]
cmova r8, rdi
mov rdx, rbx
call fcn.0002f2a0
lea rcx, [rsp + 0x130]
call fcn.0001c35c
mov edi, eax
mov rax, cr8
cmp al, r15b
je 0x1928e
mov rax, cr8
lea r8, [0x00030210]
lea rcx, [rsp + 0x390]
movzx r9d, al
mov edx, 0x50
mov dword [rsp + 0x20], edi
call fcn.0001110c
call fcn.0002f700
mov ecx, 0x80001029
lea r9, [rsp + 0x390]
mov rdx, rsi
mov r8d, eax
call fcn.0002de1c
mov al, 1
mov rcx, qword [rsp + 0x3e0]
xor rcx, rsp
call fcn.0002f1d0
add rsp, 0x3f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, [rsp + 0x31]
call fcn.0002cb74
cmp al, r15b
je 0x192cc
cmp byte [rsp + 0x31], r15b
je 0x192cc
lea r8, [0x00030230]
lea rcx, [rsp + 0x390]
mov r9d, edi
mov edx, 0x50
call fcn.0001110c
call fcn.0002f700
mov ecx, 0x8000102a
jmp 0x19255
lea rdx, [0x0003f590]
mov eax, r15d
mov rcx, rdx
cmp dword [rcx], edi
je 0x192ea
inc eax
add rcx, 0x10
cmp eax, 0x36
jb 0x192d9
jmp 0x192f2
add rax, rax
mov r15d, dword [rdx + rax*8 + 4]
lea rcx, [rsp + 0x26c]
lea rdx, [rsp + 0x130]
mov r8d, 0x121
mov dword [rsp + 0x260], 0x12e
mov dword [rsp + 0x60], 0xd0
call fcn.0002f2a0
xor eax, eax
mov dword [rsp + 0x268], 0x121
mov dword [rsp + 0x264], 1
cmp qword [rsp + 0x38], rax
jne 0x1935d
lea r8, [rsp + 0x32]
mov edx, edi
mov rcx, rsi
call fcn.0001c63c
xor ecx, ecx
cmp al, cl
je 0x193c4
mov al, byte [rsp + 0x32]
jmp 0x1926a
cmp r13d, eax
jne 0x193c6
mov rbp, qword [rsp + 0x38]
mov rcx, rsi
mov byte [rsp + 0x33], 1
mov rdx, rbp
call fcn.0002dd64
xor ebx, ebx
mov r12, rax
cmp rax, rbx
je 0x1948b
mov edx, dword [rsp + 0x40]
lea r9, [rsp + 0x33]
mov r8, rsi
mov rcx, rax
call fcn.00020a80
movzx ecx, byte [rsp + 0x33]
mov bl, al
xor eax, eax
movzx ebp, al
cmp bl, al
cmovne ebp, ecx
mov rcx, r12
call fcn.0002e47c
xor ecx, ecx
cmp bl, cl
je 0x19492
mov al, bpl
jmp 0x1926a
xor eax, eax
cmp r13d, 0x16
jne 0x19430
cmp rbx, rax
je 0x19497
cmp ebp, eax
je 0x19497
cmp byte [rbx], al
je 0x19497
lea edx, [r13 + 0x46]
mov rcx, rbx
call fcn.0002f256
xor ecx, ecx
cmp rax, rcx
je 0x193fd
inc rax
jmp 0x19400
mov rax, rbx
mov edx, 0x2e
mov rcx, rax
call fcn.0002f256
xor ebx, ebx
cmp rax, rbx
je 0x19499
lea rdx, [0x00030240]
mov rcx, rax
call fcn.0002f226
cmp eax, ebx
jne 0x19499
jmp 0x19268
cmp r13d, 5
jne 0x19469
cmp r12, 5
jne 0x19497
lea rdx, [0x0002ffa0]
mov rcx, rsi
call fcn.0002ae0c
xor ebx, ebx
cmp al, bl
je 0x19499
lea rdx, [0x00030270]
mov rcx, rsi
call fcn.0002af90
cmp al, bl
je 0x19499
jmp 0x19268
cmp r13d, 0xb
jne 0x19497
call fcn.0002a360
xor ebx, ebx
cmp al, bl
je 0x19499
lea rcx, [0x000320a0]
call fcn.00029dd8
cmp rax, rsi
jmp 0x19429
mov r12, qword [rsp + 0x40]
jmp 0x1949e
mov r12, qword [rsp + 0x40]
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
mov rcx, rsi
call fcn.00018e3c
cmp al, bl
jne 0x19268
cmp qword [0x00040e40], rbx
je 0x19525
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x194d0
lea rcx, [0x0002ff70]
call fcn.0002a140
jmp 0x194df
lea rdx, [0x0002ff70]
mov rcx, rsi
call fcn.0002ae0c
cmp al, bl
je 0x19525
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x194fe
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, rax
call sub.ntoskrnl.exe_PsGetProcessInheritedFromUniqueProcessId
jmp 0x19506
mov rcx, rsi
call fcn.0002a180
cmp rax, rbx
jne 0x19510
mov rax, rbx
jmp 0x19518
mov rcx, rax
call fcn.0002a180
cmp rax, qword [0x00040e40]
je 0x19268
cmp r13d, 6
jne 0x195a7
call fcn.00025f14
cmp al, bl
je 0x195a7
mov al, byte [0x00040ccf]
cmp al, bl
je 0x195a7
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x1957e
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, rax
call fcn.0002a1c8
cmp al, bl
je 0x1955f
mov al, 1
jmp 0x1959c
lea rcx, [0x00032080]
call fcn.00029dd8
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rbx, rax
sete al
xor ebx, ebx
jmp 0x1959c
lea rcx, [0x00032080]
call fcn.00029dd8
cmp rax, rsi
je 0x1955b
mov rcx, rsi
call fcn.0002a1c8
cmp al, bl
setne al
cmp al, bl
je 0x195a7
mov bl, 1
jmp 0x19659
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x195b9
call fcn.0002adb0
jmp 0x195c1
mov rcx, rsi
call fcn.0002ad54
cmp al, bl
je 0x19655
cmp r13d, 0x24
je 0x19655
cmp r13d, 0x27
jne 0x195f6
lea rcx, [0x00032080]
call fcn.00029dd8
cmp rax, rsi
je 0x19655
mov rcx, rsi
call fcn.0002a1c8
cmp al, bl
jne 0x19655
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, rax
call fcn.0002a1c8
cmp al, bl
jne 0x19628
lea rcx, [0x00032080]
call fcn.00029dd8
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rbx, rax
je 0x19628
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp edi, 0x1b
je 0x19268
cmp edi, 0x27
je 0x19268
cmp edi, 0x38
je 0x19268
mov r8b, 1
mov edx, edi
mov rcx, rsi
call fcn.0001c714
jmp 0x19268
mov bl, byte [rsp + 0x30]
mov r9, r12
mov r8d, r13d
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r14d
call fcn.00019da8
xor r14d, r14d
cmp al, r14b
jne 0x19268
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, rax
call fcn.0002e2c0
cmp rax, r14
je 0x1969a
mov rcx, rax
call fcn.0002e47c
call fcn.00025f14
cmp al, r14b
jne 0x1971b
cmp r13d, r14d
jne 0x19705
cmp r12, 0x101
je 0x19705
cmp r12, 0x100
jne 0x19716
lea rcx, [0x00030270]
call fcn.0002a4d4
cmp al, r14b
jne 0x19268
call fcn.0002a360
cmp al, r14b
je 0x19716
lea rcx, [0x00030000]
call fcn.0002a4d4
cmp al, r14b
jne 0x19268
lea rcx, [0x000320c0]
call fcn.0002a4d4
cmp al, r14b
je 0x19716
jmp 0x19268
cmp r13d, 3
jne 0x19710
cmp r12, r14
je 0x19716
cmp r13d, 0xc
jne 0x1971b
call fcn.00019af8
call fcn.00025f14
cmp al, r14b
je 0x19268
mov ecx, r15d
call fcn.0001c2d0
cmp al, r14b
je 0x19268
cmp edi, 0x27
je 0x19268
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, qword [0x00040e40]
cmp rcx, rax
je 0x19268
cmp rcx, rsi
je 0x19268
cmp bl, r14b
jne 0x197bc
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x1977b
call fcn.0002f286
mov ebx, eax
jmp 0x197b0
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov qword [rsp + 0x40], r14
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, r14d
jge 0x19798
mov ebx, r14d
jmp 0x197b0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessSessionId]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp dword [0x00040e3c], ebx
jne 0x19268
mov r8b, 1
mov edx, 0x40
mov rcx, rsi
call fcn.0001da20
lea r9, [rsp + 0x60]
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x48]
mov r8d, 0x12e
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0xd0
call fcn.00025d50
cmp al, r14b
jne 0x1984a
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x19268
mov rcx, qword gs:[0x188]
call qword [sym.imp.ntoskrnl.exe_PsIsThreadTerminating]
cmp al, r14b
je 0x19268
mov rcx, rsi
call fcn.0002c828
mov rbx, rax
call fcn.0002f700
mov r9, rbx
mov rdx, rsi
mov ecx, 0x1002
mov r8d, eax
call fcn.0002de1c
jmp 0x199c5
cmp dword [rsp + 0x64], 4
jne 0x19268
mov eax, dword [rsp + 0x68]
mov ebx, 0x3f
cmp eax, 2
je 0x1986d
cmp eax, 8
je 0x1986d
cmp eax, 7
jne 0x198a6
cmp rbp, r14
jne 0x19891
cmp edi, 0x1b
je 0x198a6
cmp edi, 0x38
je 0x198a6
mov edx, ebx
cmp eax, 2
mov r8b, 1
cmove edx, edi
mov rcx, rsi
call fcn.0001c714
jmp 0x198a2
mov r9b, 1
mov r8d, r12d
mov rdx, rbp
mov rcx, rsi
call fcn.00019d44
mov eax, dword [rsp + 0x68]
cmp eax, 4
je 0x198b5
cmp eax, 6
je 0x198b5
cmp eax, 5
jne 0x198f3
cmp rbp, r14
jne 0x198d9
cmp edi, 0x1b
je 0x198f3
cmp edi, 0x38
je 0x198f3
cmp eax, 4
mov rcx, rsi
cmove ebx, edi
xor r8d, r8d
mov edx, ebx
call fcn.0001c714
jmp 0x198ef
cmp r13d, r14d
jne 0x198f3
xor r9d, r9d
mov r8d, r12d
mov rdx, rbp
mov rcx, rsi
call fcn.00019d44
mov eax, dword [rsp + 0x68]
cmp edi, 0x1f
je 0x1992a
cmp edi, 0x20
je 0x1992a
cmp edi, 0x12
je 0x1992a
cmp edi, 0x13
je 0x1992a
cmp edi, 0x11
je 0x1992a
cmp edi, 0x14
je 0x1992a
cmp edi, 0x2f
je 0x1992a
cmp edi, 0x3c
je 0x1992a
cmp edi, 0x40
je 0x1992a
cmp edi, 0x41
je 0x1992a
cmp edi, 0x28
jne 0x1994a
cmp eax, 3
jne 0x1994a
cmp edi, 0x1b
je 0x1994a
cmp edi, 0x38
je 0x1994a
xor r8d, r8d
mov edx, edi
mov rcx, rsi
call fcn.0001c714
mov eax, dword [rsp + 0x68]
cmp edi, 0x1f
je 0x19981
cmp edi, 0x20
je 0x19981
cmp edi, 0x12
je 0x19981
cmp edi, 0x13
je 0x19981
cmp edi, 0x11
je 0x19981
cmp edi, 0x14
je 0x19981
cmp edi, 0x2f
je 0x19981
cmp edi, 0x3c
je 0x19981
cmp edi, 0x40
je 0x19981
cmp edi, 0x41
je 0x19981
cmp edi, 0x28
jne 0x199a9
cmp eax, 1
jne 0x199a9
cmp edi, 0x1b
je 0x19268
cmp edi, 0x38
je 0x19268
mov r8b, al
mov edx, edi
mov rcx, rsi
call fcn.0001c714
mov eax, dword [rsp + 0x68]
cmp eax, r14d
jbe 0x199c5
cmp eax, 2
jbe 0x19268
cmp eax, 6
jbe 0x199c5
cmp eax, 8
jbe 0x19268
xor al, al
jmp 0x1926a