Function at 0x1a128
Capabilities:
Find process by pid

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3e8
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0x3d0], rax
mov rbx, qword [rsp + 0x458]
xor ebp, ebp
mov r15, r9
mov r14d, r8d
mov rdi, rdx
mov qword [rsp + 0x38], rdx
mov byte [rsp + 0x31], bpl
mov rsi, rcx
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
lea rdx, [rsp + 0x48]
mov rcx, rax
mov qword [rsp + 0x48], rbp
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, ebp
jl 0x1a1a0
mov rcx, qword [rsp + 0x48]
call sub.ntoskrnl.exe_PsGetProcessImageFileName
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor edx, edx
lea rcx, [rsp + 0x381]
mov byte [rsp + 0x30], bpl
lea r8d, [rdx + 0x4f]
mov byte [rsp + 0x33], bpl
mov dword [rsp + 0x40], ebp
mov byte [rsp + 0x380], bpl
call fcn.0003b2d0
mov r13d, dword [rsp + 0x450]
mov qword [rsp + 0x258], rdi
mov edi, 0x104
lea rcx, [rsp + 0x26d]
xor edx, edx
mov r8, rdi
mov dword [rsp + 0x269], r13d
mov byte [rsp + 0x34], bpl
mov qword [rsp + 0x250], rsi
mov byte [rsp + 0x260], r14b
mov qword [rsp + 0x261], r15
call fcn.0003b2d0
mov r12d, dword [rsp + 0x460]
cmp rbx, rbp
je 0x1a241
cmp r12d, ebp
je 0x1a241
cmp r12d, edi
mov r8, r12
lea rcx, [rsp + 0x26d]
cmova r8, rdi
mov rdx, rbx
call fcn.0003ad80
lea rcx, [rsp + 0x250]
call fcn.0001d5f8
mov edi, eax
mov rcx, cr8
cmp cl, bpl
je 0x1a2a2
mov rcx, cr8
movzx r9d, cl
lea r8, [0x0003be60]
lea rcx, [rsp + 0x380]
mov edx, 0x50
mov dword [rsp + 0x20], eax
call fcn.0001110c
call fcn.0003b1e0
mov ecx, 0x80001029
lea r9, [rsp + 0x380]
mov rdx, rsi
mov r8d, eax
call fcn.00035fd0
mov al, 1
jmp 0x1a433
lea rcx, [rsp + 0x34]
call fcn.00034a9c
cmp al, bpl
je 0x1a2e0
cmp byte [rsp + 0x34], bpl
je 0x1a2e0
lea r8, [0x0003be80]
lea rcx, [rsp + 0x380]
mov r9d, edi
mov edx, 0x50
call fcn.0001110c
call fcn.0003b1e0
mov ecx, 0x8000102a
jmp 0x1a288
lea rcx, [rsp + 0x250]
call fcn.0001d92c
mov ebp, 0x121
lea rcx, [rsp + 0x12c]
lea rdx, [rsp + 0x250]
mov r8, rbp
mov dword [rsp + 0x120], 0x12e
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x50], 0xd0
call fcn.0003ad80
mov dword [rsp + 0x128], ebp
xor eax, eax
mov ebp, 1
mov dword [rsp + 0x124], ebp
cmp qword [rsp + 0x38], rax
jne 0x1a35b
lea r8, [rsp + 0x31]
mov edx, edi
mov rcx, rsi
call fcn.0001d99c
xor ecx, ecx
cmp al, cl
je 0x1a3c0
mov al, byte [rsp + 0x31]
jmp 0x1a433
cmp r14d, eax
jne 0x1a3c2
mov r12, qword [rsp + 0x38]
mov rcx, rsi
mov byte [rsp + 0x32], bpl
mov rdx, r12
call fcn.00035f18
xor ebx, ebx
mov r13, rax
cmp rax, rbx
je 0x1a4b2
lea r9, [rsp + 0x32]
mov r8, rsi
mov edx, r15d
mov rcx, rax
call fcn.000224dc
movzx ecx, byte [rsp + 0x32]
mov bl, al
xor eax, eax
movzx r12d, al
cmp bl, al
cmovne r12d, ecx
mov rcx, r13
call fcn.00036630
xor ecx, ecx
cmp bl, cl
je 0x1a4bc
mov al, r12b
jmp 0x1a433
xor eax, eax
cmp r14d, 0x16
jne 0x1a457
cmp rbx, rax
je 0x1a4c4
cmp r12d, eax
je 0x1a4c4
cmp byte [rbx], al
je 0x1a4c4
lea edx, [r14 + 0x46]
mov rcx, rbx
call sub.ntoskrnl.exe_strrchr
xor ecx, ecx
cmp rax, rcx
je 0x1a3fe
add rax, rbp
jmp 0x1a401
mov rax, rbx
mov edx, 0x2e
mov rcx, rax
call sub.ntoskrnl.exe_strrchr
xor ebx, ebx
cmp rax, rbx
je 0x1a4c6
lea rdx, [0x0003be90]
mov rcx, rax
call sub.ntoskrnl.exe__stricmp
cmp eax, ebx
jne 0x1a4c6
mov al, bpl
mov rcx, qword [rsp + 0x3d0]
xor rcx, rsp
call fcn.0003acb0
add rsp, 0x3e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp r14d, 5
jne 0x1a48d
cmp r15, 5
jne 0x1a4c4
lea rdx, [0x0003bb40]
mov rcx, rsi
call fcn.00032728
xor ebx, ebx
cmp al, bl
je 0x1a4c6
lea rdx, [0x0003bec0]
mov rcx, rsi
call fcn.000328ac
cmp al, bl
je 0x1a4c6
jmp 0x1a430
cmp r14d, 0xb
jne 0x1a4c4
call fcn.00031bf8
xor ebx, ebx
cmp al, bl
je 0x1a4c6
lea rcx, [0x0003e630]
call fcn.000315c0
cmp rax, rsi
jmp 0x1a42a
mov r13d, dword [rsp + 0x450]
jmp 0x1a4cb
mov r13d, dword [rsp + 0x450]
xor ebx, ebx
mov r12, qword [rsp + 0x38]
mov rcx, rsi
call fcn.00019d9c
cmp al, bl
je 0x1a4f1
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x120]
mov rcx, rsi
call fcn.00019e24
jmp 0x1a433
cmp qword [0x0004e488], rbx
je 0x1a574
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x1a513
lea rcx, [0x0003bb10]
call fcn.00031928
jmp 0x1a522
lea rdx, [0x0003bb10]
mov rcx, rsi
call fcn.00032728
cmp al, bl
je 0x1a574
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x1a541
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, rax
call fcn.0003b2ba
jmp 0x1a549
mov rcx, rsi
call fcn.00031968
cmp rax, rbx
jne 0x1a553
mov rax, rbx
jmp 0x1a55b
mov rcx, rax
call fcn.00031968
cmp rax, qword [0x0004e488]
jne 0x1a574
mov rcx, rsi
call fcn.0002374c
cmp al, bl
je 0x1a4d7
lea rax, [rsp + 0x33]
mov r9, rsi
mov r8d, r13d
mov rdx, r15
mov ecx, edi
mov qword [rsp + 0x20], rax
call fcn.000235c0
cmp al, bl
je 0x1a5ea
mov bl, byte [rsp + 0x33]
xor r13d, r13d
cmp r12, r13
jne 0x1a5bf
cmp edi, 0x1b
je 0x1a5bf
cmp edi, 0x27
je 0x1a5bf
cmp edi, 0x38
je 0x1a5bf
cmp edi, 0x35
je 0x1a5bf
mov r8b, bl
mov edx, edi
mov rcx, rsi
call fcn.0001da74
cmp bl, r13b
je 0x1a5e2
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x120]
mov rcx, rsi
call fcn.00019e24
cmp al, r13b
jne 0x1a430
mov bpl, r13b
jmp 0x1a430
cmp r14d, 6
jne 0x1a66e
call fcn.0002b6b0
cmp al, bl
je 0x1a66e
mov al, byte [0x0004e30f]
cmp al, bl
je 0x1a66e
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x1a644
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, rax
call fcn.000319b0
cmp al, bl
je 0x1a625
mov al, bpl
jmp 0x1a662
lea rcx, [0x0003e610]
call fcn.000315c0
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rbx, rax
sete al
xor ebx, ebx
jmp 0x1a662
lea rcx, [0x0003e610]
call fcn.000315c0
cmp rax, rsi
je 0x1a620
mov rcx, rsi
call fcn.000319b0
cmp al, bl
setne al
cmp al, bl
je 0x1a66e
mov bl, bpl
jmp 0x1a729
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x1a680
call fcn.000326cc
jmp 0x1a688
mov rcx, rsi
call fcn.00032670
cmp al, bl
je 0x1a725
cmp r14d, 0x24
je 0x1a725
cmp r14d, 0x27
jne 0x1a6bd
lea rcx, [0x0003e610]
call fcn.000315c0
cmp rax, rsi
je 0x1a725
mov rcx, rsi
call fcn.000319b0
cmp al, bl
jne 0x1a725
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, rax
call fcn.000319b0
cmp al, bl
jne 0x1a6ef
lea rcx, [0x0003e610]
call fcn.000315c0
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rbx, rax
je 0x1a6ef
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp edi, 0x1b
je 0x1a4d7
cmp edi, 0x27
je 0x1a4d7
cmp edi, 0x38
je 0x1a4d7
cmp edi, 0x35
je 0x1a4d7
mov r8b, bpl
mov edx, edi
mov rcx, rsi
call fcn.0001da74
jmp 0x1a4d7
mov bl, byte [rsp + 0x30]
mov r9, r15
mov r8d, r14d
mov rdx, r12
mov rcx, rsi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r13d
call fcn.0001aee8
xor r13d, r13d
cmp al, r13b
jne 0x1a4d7
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, rax
call fcn.00036474
cmp rax, r13
je 0x1a76a
mov rcx, rax
call fcn.00036630
call fcn.0002b6b0
cmp al, r13b
jne 0x1a7eb
cmp r14d, r13d
jne 0x1a7d5
cmp r15, 0x101
je 0x1a7d5
cmp r15, 0x100
jne 0x1a7e6
lea rcx, [0x0003bec0]
call fcn.00031df0
cmp al, r13b
jne 0x1a430
call fcn.00031bf8
cmp al, r13b
je 0x1a7e6
lea rcx, [0x0003bba0]
call fcn.00031df0
cmp al, r13b
jne 0x1a430
lea rcx, [0x0003e650]
call fcn.00031df0
cmp al, r13b
je 0x1a7e6
jmp 0x1a430
cmp r14d, 3
jne 0x1a7e0
cmp r15, r13
je 0x1a7e6
cmp r14d, 0xc
jne 0x1a7eb
call fcn.0001ac28
call fcn.0002b6b0
cmp al, r13b
je 0x1a430
mov ecx, dword [rsp + 0x44]
call fcn.0001d564
cmp al, r13b
je 0x1a430
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, qword [0x0004e488]
cmp rcx, rax
je 0x1a430
cmp rcx, rsi
je 0x1a430
cmp bl, r13b
jne 0x1a884
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x1a843
call sub.ntoskrnl.exe_PsGetCurrentProcessSessionId
mov ebx, eax
jmp 0x1a878
lea rdx, [rsp + 0x38]
mov rcx, rsi
mov qword [rsp + 0x38], r13
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, r13d
jge 0x1a860
mov ebx, r13d
jmp 0x1a878
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessSessionId]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp dword [0x0004e484], ebx
jne 0x1a4d7
mov r8b, bpl
mov edx, 0x40
mov rcx, rsi
call fcn.0001f19c
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x40]
mov r8d, 0x12e
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0xd0
call fcn.0002b4d4
cmp al, r13b
jne 0x1a912
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x1a430
mov rcx, qword gs:[0x188]
call qword [sym.imp.ntoskrnl.exe_PsIsThreadTerminating]
cmp al, r13b
je 0x1a430
mov rcx, rsi
call fcn.00034750
mov rbx, rax
call fcn.0003b1e0
mov r9, rbx
mov rdx, rsi
mov ecx, 0x1002
mov r8d, eax
call fcn.00035fd0
jmp 0x1aaf6
cmp dword [rsp + 0x54], 4
jne 0x1a430
mov eax, dword [rsp + 0x58]
mov ebx, 0x3f
cmp eax, 2
je 0x1a935
cmp eax, 8
je 0x1a935
cmp eax, 7
jne 0x1a978
cmp r12, r13
jne 0x1a963
cmp edi, 0x1b
je 0x1a978
cmp edi, 0x27
je 0x1a978
cmp edi, 0x38
je 0x1a978
cmp edi, 0x35
je 0x1a978
mov edx, ebx
cmp eax, 2
mov r8b, bpl
cmove edx, edi
mov rcx, rsi
call fcn.0001da74
jmp 0x1a974
mov r9b, bpl
mov r8d, r15d
mov rdx, r12
mov rcx, rsi
call fcn.0001ae74
mov eax, dword [rsp + 0x58]
cmp eax, 4
je 0x1a987
cmp eax, 6
je 0x1a987
cmp eax, 5
jne 0x1a9d3
cmp r12, r13
jne 0x1a9b9
cmp edi, 0x1b
je 0x1a9d3
cmp edi, 0x27
je 0x1a9d3
cmp edi, 0x38
je 0x1a9d3
cmp edi, 0x35
je 0x1aada
cmp eax, 4
mov rcx, rsi
cmove ebx, edi
xor r8d, r8d
mov edx, ebx
call fcn.0001da74
jmp 0x1a9cf
cmp r14d, r13d
jne 0x1a9d3
xor r9d, r9d
mov r8d, r15d
mov rdx, r12
mov rcx, rsi
call fcn.0001ae74
mov eax, dword [rsp + 0x58]
cmp edi, 0x1f
je 0x1aa23
cmp edi, 0x20
je 0x1aa23
cmp edi, 0x12
je 0x1aa23
cmp edi, 0x13
je 0x1aa23
cmp edi, 0x11
je 0x1aa23
cmp edi, 0x14
je 0x1aa23
cmp edi, 0x2f
je 0x1aa23
cmp edi, 0x3c
je 0x1aa23
cmp edi, 0x40
je 0x1aa23
cmp edi, 0x41
je 0x1aa23
cmp edi, 0x36
je 0x1aa23
cmp edi, 0x30
je 0x1aa23
cmp edi, 0x32
je 0x1aa23
cmp edi, 0x33
je 0x1aa23
cmp edi, 0x31
je 0x1aa23
cmp edi, 0x28
jne 0x1aa51
cmp eax, 3
jne 0x1aa51
cmp edi, 0x1b
je 0x1aa51
cmp edi, 0x27
je 0x1aa51
cmp edi, 0x38
je 0x1aa51
cmp edi, 0x35
je 0x1aaf6
xor r8d, r8d
mov edx, edi
mov rcx, rsi
call fcn.0001da74
mov eax, dword [rsp + 0x58]
cmp edi, 0x1f
je 0x1aaa1
cmp edi, 0x20
je 0x1aaa1
cmp edi, 0x12
je 0x1aaa1
cmp edi, 0x13
je 0x1aaa1
cmp edi, 0x11
je 0x1aaa1
cmp edi, 0x14
je 0x1aaa1
cmp edi, 0x2f
je 0x1aaa1
cmp edi, 0x3c
je 0x1aaa1
cmp edi, 0x40
je 0x1aaa1
cmp edi, 0x41
je 0x1aaa1
cmp edi, 0x36
je 0x1aaa1
cmp edi, 0x30
je 0x1aaa1
cmp edi, 0x32
je 0x1aaa1
cmp edi, 0x33
je 0x1aaa1
cmp edi, 0x31
je 0x1aaa1
cmp edi, 0x28
jne 0x1aada
cmp eax, ebp
jne 0x1aada
cmp edi, 0x1b
je 0x1a430
cmp edi, 0x27
je 0x1a430
cmp edi, 0x38
je 0x1a430
cmp edi, 0x35
je 0x1a430
mov r8b, bpl
mov edx, edi
mov rcx, rsi
call fcn.0001da74
mov eax, dword [rsp + 0x58]
cmp eax, r13d
jbe 0x1aaf6
cmp eax, 2
jbe 0x1a430
cmp eax, 6
jbe 0x1aaf6
cmp eax, 8
jbe 0x1a430
xor al, al
jmp 0x1a433