Function at 0x140012e00
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x140006090]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
and rax, 0xfff
mov eax, eax
mov rcx, qword [rsp + 0x70]
mov ecx, dword [rcx + 0xc]
lea rax, [rax + rcx + 0xfff]
shr rax, 0xc
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x70]
mov rcx, qword [sym.imp.ntoskrnl.exe_MmHighestUserAddress]
mov rcx, qword [rcx]
cmp qword [rax], rcx
jae 0x140012e93
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x70]
add rax, qword [rcx]
mov rcx, qword [sym.imp.ntoskrnl.exe_MmHighestUserAddress]
cmp rax, qword [rcx]
jbe 0x140012e9d
mov eax, 0xc0000141
jmp 0x1400130aa
lea rcx, [0x140006460]
call qword [sym.imp.ntoskrnl.exe_KeAcquireGuardedMutex]
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
lea rdx, [rsp + 0x50]
mov ecx, eax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x140012f0a
lfence
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
mov dword [rsp + 0x20], eax
lea r9, [0x1400171a0]
lea r8, [0x140016fe0]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea rcx, [0x140006460]
call qword [sym.imp.ntoskrnl.exe_KeReleaseGuardedMutex]
mov eax, dword [rsp + 0x30]
jmp 0x1400130aa
mov rcx, qword [rsp + 0x50]
call fcn.140003190
movzx eax, al
test eax, eax
je 0x140012f64
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
mov dword [rsp + 0x20], eax
lea r9, [0x1400171a0]
lea r8, [0x140015330]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea rcx, [0x140006460]
call qword [sym.imp.ntoskrnl.exe_KeReleaseGuardedMutex]
mov eax, 0xc000010a
jmp 0x1400130aa
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
xor edx, edx
mov ecx, eax
call fcn.140011940
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140012fb6
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
mov dword [rsp + 0x20], eax
lea r9, [0x1400171a0]
lea r8, [0x1400171c0]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov dword [rsp + 0x30], 0xc0000225
jmp 0x140013086
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, qword [rsp + 0x38]
cmp qword [rcx], rax
je 0x140012fee
lea r9, [0x1400171a0]
lea r8, [0x140017050]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov dword [rsp + 0x30], 0xc000000d
jmp 0x140013086
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
and rax, 0xfffffffffffff000
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov eax, dword [rsp + 0x40]
shl eax, 0xc
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 0xc], eax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x38]
add rcx, 0x38
mov r8d, eax
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax]
call fcn.140011410
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x140013056
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call fcn.1400130c0
mov dword [rsp + 0x30], eax
jmp 0x140013086
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea r9, [0x1400171a0]
lea r8, [0x140017200]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov dword [rsp + 0x30], 0xc0000141
cmp qword [rsp + 0x50], 0
je 0x140013099
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea rcx, [0x140006460]
call qword [sym.imp.ntoskrnl.exe_KeReleaseGuardedMutex]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003e80
add rsp, 0x68
ret