Function at 0x140001578
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r14
mov rbp, rsp
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov rdi, rdx
jne 0x1400015a7
mov rax, qword [sym.imp.ntoskrnl.exe_KdDebuggerEnabled]
cmp byte [rax], 0
je 0x1400015a7
int3
test r8, r8
jne 0x1400015bb
mov rax, qword [sym.imp.ntoskrnl.exe_KdDebuggerEnabled]
cmp byte [rax], r8b
je 0x1400015d7
int3
mov ebx, dword [r8]
lea rdx, [rbp + 0x40]
and qword [rbp + 0x40], 0
mov ecx, ebx
mov rsi, qword [r8 + 8]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x1400015e2
mov dword [rdi], 0x16
jmp 0x1400017a8
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
and qword [rbp + 0x48], 0
lea rdx, [rbp + 0x48]
and qword [rbp + 0x30], 0
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
or r12, 0xffffffffffffffff
test eax, eax
js 0x14000172a
lea rdx, [rbp + 0x30]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rbp + 0x48]
test eax, eax
js 0x140001724
call qword [sym.imp.ntoskrnl.exe_PsGetProcessExitStatus]
mov rcx, qword [rbp + 0x30]
cmp eax, 0x103
jne 0x14000171a
mov rbx, qword [rbp + 0x48]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessImageFileName]
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.ntoskrnl.exe_PsGetProcessImageFileName]
mov r14, rax
mov rbx, r12
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001659
mov r8, r12
inc r8
cmp byte [rsi + r8], 0
jne 0x140001665
inc r8
xor edx, edx
mov rcx, rsi
call fcn.140006c40
lea r8, [rbx + 1]
mov rdx, r14
mov rcx, rsi
call fcn.140006980
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x30]
call fcn.140002d34
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x30]
call fcn.140002f84
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x30]
call fcn.14000311c
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x30]
call fcn.140002e58
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x30]
call fcn.140003298
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x30]
call fcn.1400039f0
mov rcx, qword [rbp + 0x30]
call fcn.140003cec
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessInheritedFromUniqueProcessId]
mov ecx, dword [0x1400082c0]
test cl, 1
jne 0x140001707
or ecx, 1
mov qword [0x140008280], r12
mov dword [0x1400082c0], ecx
mov rcx, qword [0x1400082a8]
mov rdx, qword [rbp + 0x30]
mov qword [rcx + rdx], rax
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [0x1400082c0]
test al, 1
jne 0x140001744
or eax, 1
mov qword [0x140008280], r12
mov dword [0x1400082c0], eax
mov rcx, qword [rbp + 0x40]
mov rdx, qword [0x140008288]
test al, 1
jne 0x140001763
or eax, 1
mov qword [0x140008280], r12
mov dword [0x1400082c0], eax
mov r8d, dword [0x140008260]
lea eax, [r8 - 0x1db0]
cmp eax, 1
jbe 0x1400017a0
cmp r8d, 0x23f0
jne 0x140001785
mov byte [rdx + rcx], 1
jmp 0x1400017a5
cmp r8d, 0x2580
jb 0x1400017a5
xor eax, eax
and eax, 0xffffff6a
or eax, 0x62
mov dword [rbp + 0x48], eax
mov byte [rdx + rcx], al
jmp 0x1400017a5
bts dword [rdx + rcx], 0xb
and dword [rdi], 0
mov rbx, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x20
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret