Function at 0x1400027d4
Capabilities:
Attach user process memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov r12d, r8d
mov rdi, rdx
mov rbx, rcx
xor r14d, r14d
mov r15d, r14d
test rcx, rcx
jne 0x140002812
xor eax, eax
jmp 0x140002a74
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
test rax, rax
setne sil
lea rdx, [rsp + 0x48]
mov rcx, rbx
call sub.ntoskrnl.exe_KeStackAttachProcess
nop
mov rcx, rbx
test sil, sil
je 0x14000295f
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov r12, rax
test rax, rax
je 0x140002a5d
mov eax, dword [rax + 0xc]
test eax, eax
je 0x140002a5d
mov r13d, dword [rax + 0xc]
mov eax, dword [r12 + 0xc]
add rax, 0xc
cmp r13, rax
je 0x140002a5d
mov edx, dword [r13 + 0x28]
lea rcx, [rsp + 0x38]
call fcn.140002e2c
mov edx, dword [r13 + 0x30]
lea rcx, [rsp + 0x28]
call fcn.140002e2c
cmp r15d, dword [rsp + 0xc0]
jae 0x140002946
mov eax, r15d
imul rsi, rax, 0x3a0
lea rbx, [rsi + rdi]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbx + 0xc]
call fcn.140007900
xor edx, edx
mov r8d, 0x208
lea rcx, [rsi + 0x10c]
add rcx, rdi
call fcn.140007900
mov eax, dword [r13 + 0x18]
mov rcx, qword [rsp + 0xb8]
mov qword [rsi + rcx], rax
mov eax, dword [r13 + 0x20]
mov dword [rsi + rcx + 8], eax
movzx eax, word [rsp + 0x28]
mov ecx, 0x7f
mov r8d, ecx
cmp cx, word [rsp + 0x28]
cmovae r8d, eax
mov rdx, qword [rsp + 0x30]
lea rcx, [rbx + 0xc]
call fcn.1400075c0
movzx eax, word [rsp + 0x38]
mov ebx, 0x103
mov r8d, ebx
cmp bx, word [rsp + 0x38]
cmovae r8d, eax
mov rdx, qword [rsp + 0x40]
lea rcx, [rdi + 0x10c]
add rcx, rsi
call fcn.1400075c0
mov eax, dword [r13 + 0x44]
mov rdi, qword [rsp + 0xb8]
mov qword [rsi + rdi + 0x318], rax
inc r14d
mov dword [rsp + 0x20], r14d
inc r15d
mov dword [rsp + 0x24], r15d
mov r13d, dword [r13]
jmp 0x14000285a
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rsi, rax
test rax, rax
je 0x140002a5d
mov rbx, qword [rax + 0x18]
test rbx, rbx
je 0x140002a5d
mov rbx, qword [rbx + 0x10]
mov r13d, 0x103
mov rax, qword [rsi + 0x18]
add rax, 0x10
cmp rbx, rax
je 0x140002a5d
cmp r15d, r12d
jae 0x140002a45
mov eax, r15d
imul r12, rax, 0x3a0
lea rcx, [rdi + 0xc]
add rcx, r12
xor edx, edx
mov r8d, 0x100
call fcn.140007900
lea rcx, [rdi + 0x10c]
add rcx, r12
xor edx, edx
mov r8d, 0x208
call fcn.140007900
mov rax, qword [rbx + 0x30]
mov qword [r12 + rdi], rax
mov eax, dword [rbx + 0x40]
mov dword [r12 + rdi + 8], eax
movzx ecx, word [rbx + 0x58]
mov eax, 0x7f
cmp ax, cx
jb 0x1400029f8
movzx eax, cx
mov r8, rax
mov rdx, qword [rbx + 0x60]
lea rcx, [rdi + 0xc]
add rcx, r12
call fcn.1400075c0
movzx eax, word [rbx + 0x48]
cmp r13w, ax
movzx r8d, ax
jae 0x140002a1c
mov r8, r13
mov rdx, qword [rbx + 0x50]
lea rcx, [rdi + 0x10c]
add rcx, r12
call fcn.1400075c0
mov eax, dword [rbx + 0x80]
mov qword [r12 + rdi + 0x318], rax
mov r12d, dword [rsp + 0xc0]
inc r14d
mov dword [rsp + 0x20], r14d
inc r15d
mov dword [rsp + 0x24], r15d
mov rbx, qword [rbx]
jmp 0x140002988
jmp 0x140002a67
lea rcx, [rsp + 0x48]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov eax, r14d
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret