Function at 0x140002030
Capabilities:
Attach user process memory
Find process by pid
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push r12
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rbx, rdx
xor r12d, r12d
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x60], r12
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x14000206e
xor al, al
add rsp, 0x140
pop r12
pop rbx
pop rbp
ret
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140002060
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
call fcn.140003280
test eax, eax
je 0x140002060
mov qword [rsp + 0x128], r14
mov r14d, eax
mov rax, qword [rsp + 0x40]
mov qword [r14 + rax], r12
mov rcx, qword [rsp + 0x40]
add rcx, 0x60
add rcx, r14
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
cmp qword [rdx + 8], rcx
jne 0x140002cbe
cmp qword [rax], rcx
jne 0x140002cbe
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov qword [rcx + 8], rcx
mov qword [rcx], rcx
call fcn.1400030a0
test eax, eax
je 0x1400029cf
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x40]
mov r8d, eax
add rcx, r8
mov qword [rsp + 0x160], rsi
add rdx, r8
mov qword [rsp + 0x138], rdi
movsd xmm0, qword [rcx]
movsd qword [rdx], xmm0
mov eax, dword [rcx + 8]
mov dword [rdx + 8], eax
movzx eax, word [rcx + 0xc]
mov word [rdx + 0xc], ax
movzx eax, byte [rcx + 0xe]
mov byte [rdx + 0xe], al
mov edx, 0x18
mov rax, qword [rsp + 0x60]
mov ecx, dword [r8 + rax + 0x4c]
mov rax, qword [rsp + 0x40]
mov dword [r8 + rax + 0x4c], ecx
mov ecx, 0xb0
mov eax, dword [0x14001823c]
add eax, 0xffffe250
cmp eax, 1
mov rax, qword [rsp + 0x40]
cmova ecx, edx
mov edx, 0x100
add rcx, r8
mov rsi, qword [rcx + rax]
mov rax, qword [rsp + 0x60]
mov rdi, qword [rcx + rax]
xor ecx, ecx
mov rax, qword [rdi]
mov qword [rsi], rax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
xor edx, edx
mov r8d, 0x100
mov rcx, rax
mov rbx, rax
call fcn.140005e00
movzx r8d, word [rdi]
mov rcx, rbx
mov rdx, qword [rdi + 8]
call fcn.140005f00
mov qword [rsi + 8], rbx
mov eax, dword [0x14001823c]
add eax, 0xffffe250
cmp eax, 1
mov rax, qword [rsp + 0x60]
jbe 0x1400021de
mov rcx, qword [r14 + rax + 0xe0]
mov rax, qword [rsp + 0x40]
mov qword [r14 + rax + 0xe0], rcx
jmp 0x1400021f3
mov rcx, qword [r14 + rax + 0xf0]
mov rax, qword [rsp + 0x40]
mov qword [r14 + rax + 0xf0], rcx
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.140005ab0
mov qword [rbp - 0x60], rax
mov rsi, rax
test rax, rax
je 0x140002221
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov qword [rbp + 8], rax
mov r14, rax
test rax, rax
jne 0x140002228
xor al, al
jmp 0x1400029bf
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x120], r15
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov qword [rbp + 0x10], rax
mov r15, rax
test rax, rax
je 0x14000236c
xor eax, eax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
call fcn.140003620
mov rdi, rax
test rax, rax
je 0x14000236c
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp - 0x58]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov eax, dword [rsi + 8]
lea r8, [rbp + 0x78]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
lea rax, [rbp + 0x70]
mov qword [rbp + 0x78], 0x1000
mov ebx, 4
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov dword [rbp + 0x70], r12d
or rcx, 0xffffffffffffffff
call rdi
test eax, eax
js 0x1400022cd
mov ecx, dword [rsi + 8]
xor edx, edx
mov r8d, 0x1000
call fcn.140005e00
mov r9d, dword [rbp + 0x70]
lea rax, [rbp + 0x70]
lea r8, [rbp + 0x78]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x70]
or rcx, 0xffffffffffffffff
call rdi
mov rax, qword [r14 + 0x10]
lea r8, [rbp - 0x78]
mov qword [rbp - 0x70], rax
lea rdx, [rbp - 0x70]
lea rax, [rsp + 0x68]
mov qword [rbp - 0x78], 0x1000
mov r9d, ebx
mov qword [rsp + 0x20], rax
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x68], r12d
call rdi
test eax, eax
js 0x14000232e
mov rcx, qword [r14 + 0x10]
xor edx, edx
mov r8d, 0x1000
call fcn.140005e00
mov r9d, dword [rsp + 0x68]
lea rax, [rsp + 0x68]
lea r8, [rbp - 0x78]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x70]
or rcx, 0xffffffffffffffff
call rdi
lea rcx, [rbp - 0x58]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x140002373
xor al, al
jmp 0x1400029b7
xor edx, edx
mov qword [rsp + 0x130], r13
mov r8d, 0x1000
mov rcx, rax
call fcn.140005e00
mov rcx, qword [rsp + 0x60]
lea rdx, [rbp - 0x58]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rdx, qword [r15 + 0x20]
movzx ecx, word [rdx + 0x3a]
movzx eax, word [rdx + 0x38]
mov rbx, qword [rdx + 0x58]
mov r8d, eax
mov rdi, qword [rdx + 0x68]
mov rsi, qword [rdx + 0x78]
mov r14, qword [rdx + 0xb8]
mov r15, qword [rdx + 0xc8]
mov r12, qword [rdx + 0xd8]
mov r13, qword [rdx + 0xe8]
mov word [rsp + 0x4a], cx
movzx ecx, word [rdx + 0x50]
mov word [rbp + 0x70], cx
movzx ecx, word [rdx + 0x52]
mov word [rsp + 0x4c], cx
movzx ecx, word [rdx + 0x60]
mov word [rbp + 0x78], cx
movzx ecx, word [rdx + 0x62]
mov word [rsp + 0x4e], cx
movzx ecx, word [rdx + 0x70]
mov word [rsp + 0x38], cx
movzx ecx, word [rdx + 0x72]
mov word [rsp + 0x50], cx
movzx ecx, word [rdx + 0xb0]
mov word [rsp + 0x3a], cx
movzx ecx, word [rdx + 0xb2]
mov word [rsp + 0x52], cx
movzx ecx, word [rdx + 0xc0]
mov word [rsp + 0x3c], cx
movzx ecx, word [rdx + 0xc2]
mov word [rsp + 0x54], cx
movzx ecx, word [rdx + 0xd0]
mov word [rsp + 0x56], cx
movzx ecx, word [rdx + 0xd2]
mov word [rsp + 0x58], cx
movzx ecx, word [rdx + 0xe0]
mov word [rsp + 0x5a], cx
movzx ecx, word [rdx + 0xe2]
mov rdx, qword [rdx + 0x40]
mov word [rsp + 0x5c], cx
mov rcx, qword [rsp + 0x70]
mov word [rsp + 0x48], ax
mov qword [rbp - 0x68], rax
call fcn.140005f00
mov rcx, qword [rsp + 0x70]
mov rdx, rbx
movzx r8d, word [rbp + 0x70]
add rcx, 0x100
call fcn.140005f00
mov rbx, qword [rsp + 0x70]
mov rdx, rdi
movzx r8d, word [rbp + 0x78]
lea rcx, [rbx + 0x200]
call fcn.140005f00
movzx r8d, word [rsp + 0x38]
lea rcx, [rbx + 0x300]
mov rdx, rsi
call fcn.140005f00
movzx r8d, word [rsp + 0x3a]
lea rcx, [rbx + 0x400]
mov rdx, r14
call fcn.140005f00
movzx r8d, word [rsp + 0x3c]
lea rcx, [rbx + 0x500]
mov rdx, r15
call fcn.140005f00
movzx r15d, word [rsp + 0x56]
lea rcx, [rbx + 0x600]
mov r8d, r15d
mov rdx, r12
call fcn.140005f00
movzx r12d, word [rsp + 0x5a]
mov r8d, r12d
lea rcx, [rbx + 0x700]
mov rdx, r13
call fcn.140005f00
lea rcx, [rbp - 0x58]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp - 0x58]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea r9, [rbp - 0x28]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rbp - 0x28], 0x1000
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], 0
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1400025d7
mov rcx, rbx
mov edx, 0x20
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm1, xmmword [rcx - 0x70]
movups xmmword [rax - 0x70], xmm1
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x60], xmm0
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x50], xmm1
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x40], xmm0
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x30], xmm1
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x20], xmm0
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x140002584
mov rax, qword [rbp - 0x60]
xor edx, edx
mov r8, qword [rbp - 0x68]
add eax, 0x10
mov r14d, dword [rax]
movzx eax, word [rsp + 0x48]
mov dword [rbp - 0x80], r14d
lea ecx, [r14 + 0x24]
mov word [rcx], ax
lea ebx, [r14 + 0x30]
movzx eax, word [rsp + 0x4a]
lea ecx, [r14 + 0x26]
mov word [rcx], ax
lea edi, [r14 + 0x38]
movzx eax, word [rbp + 0x70]
lea ecx, [r14 + 0x32]
mov word [rbx], ax
lea esi, [r14 + 0x40]
movzx eax, word [rsp + 0x4c]
mov word [rcx], ax
lea ecx, [r14 + 0x3a]
movzx eax, word [rbp + 0x78]
mov word [rdi], ax
movzx eax, word [rsp + 0x4e]
mov word [rcx], ax
lea ecx, [r14 + 0x42]
movzx eax, word [rsp + 0x38]
mov word [rsi], ax
movzx eax, word [rsp + 0x50]
mov word [rcx], ax
lea eax, [r14 + 0x70]
movzx ecx, word [rsp + 0x3a]
mov qword [rbp - 0x20], rax
mov word [rax], cx
lea ecx, [r14 + 0x72]
movzx eax, word [rsp + 0x52]
mov word [rcx], ax
lea eax, [r14 + 0x78]
movzx ecx, word [rsp + 0x3c]
mov qword [rbp - 0x18], rax
mov word [rax], cx
lea ecx, [r14 + 0x7a]
movzx eax, word [rsp + 0x54]
mov word [rcx], ax
lea eax, [r14 + 0x80]
mov qword [rbp - 0x10], rax
lea ecx, [r14 + 0x82]
mov word [rax], r15w
movzx eax, word [rsp + 0x58]
mov word [rcx], ax
lea eax, [r14 + 0x88]
mov qword [rbp - 8], rax
lea ecx, [r14 + 0x8a]
mov word [rax], r12w
movzx eax, word [rsp + 0x5c]
mov word [rcx], ax
lea eax, [r14 + 0x28]
mov qword [rbp], rax
mov ecx, dword [rax]
call fcn.140005e00
movzx r8d, word [rbx]
lea eax, [r14 + 0x34]
xor edx, edx
mov r13d, eax
mov ecx, dword [rax]
call fcn.140005e00
movzx r8d, word [rdi]
lea eax, [r14 + 0x3c]
xor edx, edx
mov r12d, eax
mov ecx, dword [rax]
call fcn.140005e00
movzx r8d, word [rsi]
lea eax, [r14 + 0x44]
xor edx, edx
mov r15d, eax
mov ecx, dword [rax]
call fcn.140005e00
mov rax, qword [rbp - 0x20]
add r14d, 0x74
movzx r8d, word [rax]
mov ecx, dword [r14]
xor edx, edx
call fcn.140005e00
mov rax, qword [rbp - 0x18]
xor edx, edx
mov ebx, dword [rbp - 0x80]
movzx r8d, word [rax]
lea esi, [rbx + 0x7c]
mov ecx, dword [rsi]
call fcn.140005e00
mov rax, qword [rbp - 0x10]
lea edi, [rbx + 0x84]
mov ecx, dword [rdi]
xor edx, edx
movzx r8d, word [rax]
call fcn.140005e00
mov rax, qword [rbp - 8]
add ebx, 0x8c
xor edx, edx
movzx r8d, word [rax]
mov ecx, dword [rbx]
call fcn.140005e00
mov eax, dword [rsp + 0x30]
mov rcx, qword [rbp]
mov r8, qword [rbp - 0x68]
mov dword [rcx], eax
mov eax, dword [rsp + 0x30]
add eax, 0x100
mov dword [r13], eax
mov eax, dword [rsp + 0x30]
add eax, 0x200
mov dword [r12], eax
mov eax, dword [rsp + 0x30]
add eax, 0x300
mov dword [r15], eax
mov eax, dword [rsp + 0x30]
add eax, 0x400
mov dword [r14], eax
mov eax, dword [rsp + 0x30]
add eax, 0x500
mov dword [rsi], eax
mov eax, dword [rsp + 0x30]
add eax, 0x600
mov dword [rdi], eax
mov eax, dword [rsp + 0x30]
mov rdi, qword [rbp + 8]
add eax, 0x700
mov dword [rbx], eax
movzx eax, word [rsp + 0x48]
mov rbx, qword [rdi + 0x20]
mov word [rbx + 0x38], ax
movzx eax, word [rsp + 0x4a]
mov word [rbx + 0x3a], ax
movzx eax, word [rbp + 0x70]
mov word [rbx + 0x50], ax
movzx eax, word [rsp + 0x4c]
mov word [rbx + 0x52], ax
movzx eax, word [rbp + 0x78]
mov word [rbx + 0x60], ax
movzx eax, word [rsp + 0x4e]
mov word [rbx + 0x62], ax
movzx eax, word [rsp + 0x38]
mov word [rbx + 0x70], ax
movzx eax, word [rsp + 0x50]
mov word [rbx + 0x72], ax
movzx eax, word [rsp + 0x3a]
mov word [rbx + 0xb0], ax
movzx eax, word [rsp + 0x52]
mov word [rbx + 0xb2], ax
movzx eax, word [rsp + 0x3c]
mov word [rbx + 0xc0], ax
movzx eax, word [rsp + 0x54]
mov word [rbx + 0xc2], ax
movzx eax, word [rsp + 0x56]
mov word [rbx + 0xd0], ax
movzx eax, word [rsp + 0x58]
mov word [rbx + 0xd2], ax
movzx eax, word [rsp + 0x5a]
mov word [rbx + 0xe0], ax
movzx eax, word [rsp + 0x5c]
mov word [rbx + 0xe2], ax
mov rcx, qword [rbx + 0x40]
xor edx, edx
call fcn.140005e00
movzx r8d, word [rbx + 0x50]
xor edx, edx
mov rcx, qword [rbx + 0x58]
call fcn.140005e00
movzx r8d, word [rbx + 0x60]
xor edx, edx
mov rcx, qword [rbx + 0x68]
call fcn.140005e00
movzx r8d, word [rbx + 0x70]
xor edx, edx
mov rcx, qword [rbx + 0x78]
call fcn.140005e00
movzx r8d, word [rbx + 0xb0]
xor edx, edx
mov rcx, qword [rbx + 0xb8]
call fcn.140005e00
movzx r8d, word [rbx + 0xc0]
xor edx, edx
mov rcx, qword [rbx + 0xc8]
call fcn.140005e00
movzx r8d, word [rbx + 0xd0]
xor edx, edx
mov rcx, qword [rbx + 0xd8]
call fcn.140005e00
movzx r8d, word [rbx + 0xe0]
xor edx, edx
mov rcx, qword [rbx + 0xe8]
call fcn.140005e00
mov rax, qword [rsp + 0x30]
lea rcx, [rbp - 0x58]
mov qword [rbx + 0x40], rax
mov rax, qword [rsp + 0x30]
add rax, 0x100
mov qword [rbx + 0x58], rax
mov rax, qword [rsp + 0x30]
add rax, 0x200
mov qword [rbx + 0x68], rax
mov rax, qword [rsp + 0x30]
add rax, 0x300
mov qword [rbx + 0x78], rax
mov rax, qword [rsp + 0x30]
add rax, 0x400
mov qword [rbx + 0xb8], rax
mov rax, qword [rsp + 0x30]
add rax, 0x500
mov qword [rbx + 0xc8], rax
mov rax, qword [rsp + 0x30]
add rax, 0x600
mov qword [rbx + 0xd8], rax
mov rax, qword [rsp + 0x30]
add rax, 0x700
mov qword [rbx + 0xe8], rax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, 0x200
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rsi, rax
test rax, rax
jne 0x1400029e3
mov r13, qword [rsp + 0x130]
mov r15, qword [rsp + 0x120]
mov rdi, qword [rsp + 0x138]
mov rsi, qword [rsp + 0x160]
mov r14, qword [rsp + 0x128]
add rsp, 0x140
pop r12
pop rbx
pop rbp
ret
xor edx, edx
mov r8d, 0x200
mov rcx, rsi
call fcn.140005e00
mov rcx, qword [rsp + 0x60]
lea rdx, [rbp - 0x58]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx + 0x18]
mov rcx, rsi
mov rbx, qword [rax + 0x10]
movzx r14d, word [rbx + 0x48]
mov rdx, qword [rbx + 0x50]
mov r8d, r14d
movzx r12d, word [rbx + 0x4a]
call fcn.140005f00
movzx r15d, word [rbx + 0x58]
lea rcx, [rsi + 0x100]
mov rdx, qword [rbx + 0x60]
mov r8d, r15d
movzx r13d, word [rbx + 0x5a]
call fcn.140005f00
lea rcx, [rbp - 0x58]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp - 0x58]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov ebx, 4
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x28], ebx
lea r9, [rbp + 0x18]
xor r8d, r8d
mov dword [rsp + 0x20], 0x1000
lea rdx, [rsp + 0x78]
mov qword [rbp + 0x18], 0x200
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140002af5
mov rax, rsi
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub rbx, 1
jne 0x140002aa2
mov rax, qword [rbp - 0x60]
add eax, 0xc
mov eax, dword [rax]
mov ebx, dword [rax + 0xc]
mov edx, dword [rbx]
mov ecx, dword [rbx + 4]
test rdx, rdx
je 0x140002b15
test rcx, rcx
je 0x140002b15
mov dword [rcx], edx
mov dword [rdx + 4], ecx
lea eax, [rbx + 8]
mov dword [rbx + 4], ebx
mov dword [rbx], ebx
mov edx, dword [rax]
mov ecx, eax
mov eax, dword [rax + 4]
test rdx, rdx
je 0x140002b33
test rax, rax
je 0x140002b33
mov dword [rax], edx
mov dword [rdx + 4], eax
lea eax, [rbx + 0x10]
mov dword [rcx + 4], ecx
mov dword [rcx], ecx
mov edx, dword [rax]
mov ecx, eax
mov eax, dword [rax + 4]
test rdx, rdx
je 0x140002b51
test rax, rax
je 0x140002b51
mov dword [rax], edx
mov dword [rdx + 4], eax
mov dword [rcx + 4], ecx
xor edx, edx
mov dword [rcx], ecx
movzx r8d, word [rbx + 0x24]
mov ecx, dword [rbx + 0x28]
call fcn.140005e00
movzx r8d, word [rbx + 0x2c]
xor edx, edx
mov ecx, dword [rbx + 0x30]
call fcn.140005e00
mov word [rbx + 0x24], r14w
mov word [rbx + 0x26], r12w
mov eax, dword [rsp + 0x78]
mov dword [rbx + 0x28], eax
mov word [rbx + 0x2c], r15w
mov word [rbx + 0x2e], r13w
mov eax, dword [rsp + 0x78]
add eax, 0x100
mov dword [rbx + 0x30], eax
mov rax, qword [rdi + 0x18]
mov rbx, qword [rax + 0x10]
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
test rcx, rcx
je 0x140002bce
test rax, rax
je 0x140002bce
cmp qword [rcx + 8], rbx
jne 0x140002ca9
cmp qword [rax], rbx
jne 0x140002ca9
mov qword [rax], rcx
mov qword [rcx + 8], rax
lea rax, [rbx + 0x10]
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
test rdx, rdx
je 0x140002c04
test rcx, rcx
je 0x140002c04
cmp qword [rdx + 8], rax
jne 0x140002cb0
cmp qword [rcx], rax
jne 0x140002cb0
mov qword [rcx], rdx
mov qword [rdx + 8], rcx
mov qword [rax + 8], rax
mov qword [rax], rax
lea rax, [rbx + 0x20]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
test rdx, rdx
je 0x140002c3a
test rcx, rcx
je 0x140002c3a
cmp qword [rdx + 8], rax
jne 0x140002cb7
cmp qword [rcx], rax
jne 0x140002cb7
mov qword [rcx], rdx
mov qword [rdx + 8], rcx
mov qword [rax + 8], rax
xor edx, edx
mov qword [rax], rax
movzx r8d, word [rbx + 0x48]
mov rcx, qword [rbx + 0x50]
call fcn.140005e00
movzx r8d, word [rbx + 0x58]
xor edx, edx
mov rcx, qword [rbx + 0x60]
call fcn.140005e00
mov word [rbx + 0x48], r14w
lea rcx, [rbp - 0x58]
mov word [rbx + 0x4a], r12w
mov rax, qword [rsp + 0x78]
mov qword [rbx + 0x50], rax
mov word [rbx + 0x58], r15w
mov word [rbx + 0x5a], r13w
mov rax, qword [rsp + 0x78]
add rax, 0x100
mov qword [rbx + 0x60], rax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, 1
jmp 0x1400029af
mov ecx, 3
int 0x29
mov ecx, 3
int 0x29
mov ecx, 3
int 0x29
mov ecx, 3
int 0x29
int3