Function at 0x140015604
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r12, r9
mov r14, r8
mov rbx, rdx
mov rsi, rcx
call fcn.14000e0a4
xor r13d, r13d
mov r15, rax
test rax, rax
jne 0x140015659
mov r9d, dword [rbx + 0x54]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
mov ecx, 0xc10204b1
call fcn.140014a04
jmp 0x140015c96
xor r8d, r8d
mov edx, 0x2c8
mov rcx, r15
call fcn.140014c70
mov rdi, rax
test rax, rax
jne 0x14001568e
mov r9d, dword [rbx + 0x54]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
mov ecx, 0xc10204b1
call fcn.140014a04
jmp 0x140015c8e
lea rcx, [rax + 0x10]
xor edx, edx
mov r8d, 0x2b8
call fcn.140027ec0
mov rdx, rbx
mov qword [rdi], rsi
mov rcx, r15
mov qword [rdi + 8], r15
call fcn.140002d18
mov qword [rdi + 0x10], rax
test rax, rax
je 0x140015c8e
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x1400156ec
lfence
mov ecx, dword [rbx + 0x54]
mov r8d, eax
mov qword [rsp + 0x28], rsi
mov edx, 0x33
mov dword [rsp + 0x20], ecx
jmp 0x140015c7d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessCreateTimeQuadPart]
mov qword [rdi + 0x30], rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [str.sboxS]
or dword [rdi + 0x40], 0xffffffff
mov dword [rdi + 0x38], eax
test r14, r14
je 0x140015816
mov edx, 0x5c
mov rcx, r14
call sub.ntoskrnl.exe_wcsrchr
mov rbp, rax
test rax, rax
je 0x140015803
sub rax, r14
sar rax, 1
cmp eax, dword [0x140052068]
jne 0x140015778
mov rdx, qword [0x140052060]
mov rcx, r14
mov r8d, eax
call sub.ntoskrnl.exe_wcsncmp
test eax, eax
jne 0x140015778
lea rcx, [rbp + 2]
mov byte [rdi + 0x2d], 1
lea rdx, [0x14002cfc0]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x140015778
mov byte [rdi + 0xae], 1
mov rdx, r14
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rdx, qword [rdi + 0x10]
lea rcx, [rsp + 0x38]
mov r8d, dword [rdx + 0x68]
mov rdx, qword [rdx + 0x60]
call fcn.1400037e0
test al, al
je 0x1400157a4
mov byte [rdi + 0x2c], 1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2 + 2], r13w
jne 0x1400157a8
test eax, eax
je 0x140015803
mov rcx, qword [rdi + 8]
lea edx, [rax*2 + 2]
xor r8d, r8d
mov dword [rdi + 0x28], edx
call fcn.140014c70
mov qword [rdi + 0x20], rax
test rax, rax
je 0x1400157e8
mov r8d, dword [rdi + 0x28]
lea rdx, [rbp + 2]
mov rcx, rax
call fcn.140027b80
jmp 0x140015803
mov rax, qword [rdi]
xor r8d, r8d
mov r9d, dword [rbx + 0x54]
xor edx, edx
mov ecx, 0xc10204b1
mov qword [rsp + 0x20], rax
call fcn.140014a04
mov rcx, qword [rdi + 8]
xor r8d, r8d
mov rdx, r14
call fcn.140014c78
mov qword [rdi + 0x18], rax
cmp qword [rdi + 0x20], r13
je 0x140015c63
cmp qword [rdi + 0x18], r13
je 0x140015c63
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14002cfe0]
xor r9d, r9d
xor r8d, r8d
call fcn.140003ff0
mov byte [rdi + 0xb2], al
mov r14d, 1
test al, al
jne 0x14001586d
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14002d010]
mov r9b, r14b
xor r8d, r8d
call fcn.140003ff0
test al, al
mov al, r14b
jne 0x140015870
mov al, r13b
mov byte [rdi + 0xb7], al
cmp byte [rdi + 0xb2], r13b
jne 0x14001589c
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14002d040]
mov r9b, r14b
xor r8d, r8d
call fcn.140003ff0
test al, al
mov al, r14b
jne 0x14001589f
mov al, r13b
mov rcx, qword [rdi + 0x10]
lea rbp, [0x14002d070]
mov rdx, rbp
mov byte [rdi + 0xb8], al
xor r9d, r9d
xor r8d, r8d
call fcn.140003ff0
mov byte [rdi + 0xb9], al
test al, al
jne 0x1400158e5
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14002d090]
xor r9d, r9d
xor r8d, r8d
call fcn.140003ff0
test al, al
mov al, r13b
je 0x1400158e8
mov al, r14b
mov byte [rdi + 0xba], al
cmp byte [rdi + 0xb9], r13b
jne 0x140015914
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14002d0b0]
xor r9d, r9d
xor r8d, r8d
call fcn.140003ff0
test al, al
mov al, r13b
je 0x140015917
mov al, r14b
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14002d0d0]
xor r9d, r9d
mov byte [rdi + 0xbb], al
xor r8d, r8d
call fcn.140003ff0
mov byte [rdi + 0xbd], al
cmp byte [rdi + 0xbb], r13b
jne 0x140015963
test al, al
jne 0x140015963
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14002d0f0]
xor r9d, r9d
xor r8d, r8d
call fcn.140003ff0
test al, al
mov al, r13b
je 0x140015966
mov al, r14b
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14002d120]
xor r9d, r9d
mov byte [rdi + 0xbc], al
xor r8d, r8d
call fcn.140003ff0
mov byte [rdi + 0xbe], al
cmp byte [0x1400522d8], r13b
jne 0x140015a37
cmp byte [rdi + 0x2d], r13b
jne 0x140015a37
cmp byte [rdi + 0xb9], r13b
jne 0x140015a0d
cmp byte [rdi + 0xba], r13b
je 0x1400159ba
lea rbp, [0x14002d090]
jmp 0x140015a0d
cmp byte [rdi + 0xbb], r13b
je 0x1400159cc
lea rbp, [0x14002d0b0]
jmp 0x140015a0d
cmp byte [rdi + 0xbc], r13b
je 0x1400159de
lea rbp, [0x14002d0f0]
jmp 0x140015a0d
cmp byte [rdi + 0xbd], r13b
je 0x1400159f0
lea rbp, [0x14002d0d0]
jmp 0x140015a0d
cmp byte [rdi + 0xb2], r13b
je 0x140015a02
lea rbp, [0x14002cfe0]
jmp 0x140015a0d
test al, al
je 0x140015a37
lea rbp, [0x14002d120]
mov rax, qword [rdi]
mov r8, rbp
mov r9d, dword [rbx + 0x54]
mov ecx, 0xc1021774
mov rdx, qword [rdi + 0x10]
mov qword [rsp + 0x20], rax
call fcn.140014a04
mov edx, 0x493e0
mov rcx, rdi
call fcn.14001ac14
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14002d140]
xor r9d, r9d
xor r8d, r8d
call fcn.140003ff0
mov byte [rdi + 0xb6], al
cmp byte [rdi + 0xb2], r13b
je 0x140015a7b
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14002d170]
xor r9d, r9d
xor r8d, r8d
call fcn.140003ff0
test al, al
je 0x140015a7b
mov bpl, r14b
jmp 0x140015a9b
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14002d1a0]
xor r9d, r9d
xor r8d, r8d
mov bpl, r13b
call fcn.140003ff0
test al, al
mov al, r13b
je 0x140015a9e
mov al, r14b
mov byte [rdi + 0x170], al
test bpl, bpl
jne 0x140015ac6
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14002d1d0]
xor r9d, r9d
xor r8d, r8d
call fcn.140003ff0
test al, al
mov al, r13b
je 0x140015ac9
mov al, r14b
mov byte [rdi + 0x204], al
test bpl, bpl
jne 0x140015af1
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14002d200]
xor r9d, r9d
xor r8d, r8d
call fcn.140003ff0
test al, al
mov al, r13b
je 0x140015af4
mov al, r14b
lea rbp, [rdi + 0xc8]
mov byte [rdi + 0x274], al
mov rcx, rbp
xor edx, edx
call fcn.140014d28
test al, al
je 0x140015c19
lea rcx, [rdi + 0x178]
xor edx, edx
call fcn.140014d28
test al, al
je 0x140015c19
lea rcx, [rdi + 0x208]
xor edx, edx
call fcn.140014d28
test al, al
je 0x140015c19
lea rcx, [rdi + 0x280]
xor edx, edx
call fcn.140014d28
test al, al
je 0x140015c19
lea rdx, [0x14002d230]
mov rcx, rdi
call fcn.140015f24
lea rdx, [0x14002d250]
mov dword [rdi + 0xc0], eax
mov rcx, rdi
call fcn.140015f24
lea rdx, [0x14002d270]
mov dword [rdi + 0x168], eax
mov rcx, rdi
call fcn.140015f24
lea rdx, [0x14002d290]
mov dword [rdi + 0x16c], eax
mov rcx, rdi
call fcn.140015f24
lea rdx, [0x14002d2b0]
mov dword [rdi + 0x200], eax
mov rcx, rdi
call fcn.140015f24
lea rdx, [0x14002d2d0]
mov dword [rdi + 0x270], eax
mov rcx, rdi
call fcn.140015f24
mov rcx, rdi
mov dword [rdi + 0x2c0], eax
call fcn.14000b570
mov rbx, cr8
mov cr8, r14
mov rcx, qword [0x140052208]
mov dl, r14b
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
xor r9d, r9d
mov byte [rsp + 0x20], r13b
mov r8, rdi
lea rcx, [0x140052400]
mov rdx, rsi
call fcn.14000fc7c
mov rax, rdi
mov byte [r12], bl
jmp 0x140015ca3
cmp qword [rbp], r13
je 0x140015c27
mov rcx, rbp
call fcn.140014cdc
lea rcx, [rdi + 0x178]
cmp qword [rcx], r13
je 0x140015c38
call fcn.140014cdc
lea rcx, [rdi + 0x208]
cmp qword [rcx], r13
je 0x140015c49
call fcn.140014cdc
lea rcx, [rdi + 0x280]
cmp qword [rcx], r13
je 0x140015671
call fcn.140014cdc
jmp 0x140015671
mov rax, qword [rdi]
mov edx, 0x11
mov qword [rsp + 0x28], rax
mov r8d, 0xc000007b
mov eax, dword [rbx + 0x54]
mov dword [rsp + 0x20], eax
lea r9, [0x14002cfb0]
mov ecx, 0xc10204cf
call fcn.140014bd4
mov rcx, r15
call fcn.14000e210
mov edx, dword [rbx + 0x54]
mov rcx, rsi
call fcn.140015cc4
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret