Function at 0x140001128
Capabilities:
Find process by pid

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
xor esi, esi
xor r14d, r14d
xor r13d, r13d
xor r15d, r15d
xor r12d, r12d
xor edi, edi
lea ebx, [rsi + 8]
and qword [rsp + 0x70], 0
lea rdx, [rsp + 0x70]
movsxd rcx, ebx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140001228
mov rcx, qword [rsp + 0x70]
call fcn.14000283c
test al, al
je 0x14000121a
mov rcx, qword [rsp + 0x70]
call sub.ntoskrnl.exe_PsGetProcessWow64Process
test rax, rax
jne 0x14000121a
test r15, r15
jne 0x1400011d2
mov rcx, qword [rsp + 0x70]
call sub.ntoskrnl.exe_PsGetProcessImageFileName
lea rdx, [0x140002d80]
mov rcx, rax
call sub.ntoskrnl.exe__stricmp
test eax, eax
jne 0x1400011d2
mov r15, qword [rsp + 0x70]
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_PsGetProcessId]
movsxd rcx, dword [0x140004114]
mov r14, rax
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rcx + rdx]
jmp 0x1400011d7
mov rdx, qword [rsp + 0x70]
test r12, r12
jne 0x14000121f
mov rcx, rdx
call sub.ntoskrnl.exe_PsGetProcessImageFileName
lea rdx, [0x140002d90]
mov rcx, rax
call sub.ntoskrnl.exe__stricmp
test eax, eax
jne 0x14000121a
mov r12, qword [rsp + 0x70]
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_PsGetProcessId]
movsxd rcx, dword [0x140004114]
mov r13, rax
mov rdx, qword [rsp + 0x70]
mov rdi, qword [rcx + rdx]
jmp 0x14000121f
mov rdx, qword [rsp + 0x70]
mov rcx, rdx
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test r15, r15
je 0x140001232
test r12, r12
jne 0x140001241
add ebx, 4
cmp ebx, 0x30d40
jl 0x14000114c
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rdi
test r15, r15
je 0x14000160a
test r12, r12
je 0x14000160a
xor ebx, ebx
mov rax, rsi
sub rax, rdi
mov rbp, rdi
mov qword [rsp + 0x78], rax
movsxd rdi, ebx
add rsi, rdi
je 0x140001286
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x140001288
xor al, al
test al, al
je 0x1400012e9
mov rax, qword [rsp + 0x88]
add rdi, rax
je 0x1400012a4
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x1400012a6
xor al, al
test al, al
je 0x1400012e9
lea rcx, [rsi + 3]
test rcx, rcx
je 0x1400012bb
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x1400012bd
xor al, al
test al, al
je 0x1400012e9
lea rcx, [rdi + 3]
test rcx, rcx
je 0x1400012d2
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x1400012d4
xor al, al
test al, al
je 0x1400012e9
mov rax, qword [rsp + 0x78]
cmp dword [rax + rbp], r14d
jne 0x1400012e9
cmp dword [rbp], r13d
je 0x140001302
add ebx, 4
add rbp, 4
cmp ebx, 0x60
jge 0x140001308
mov rsi, qword [rsp + 0x80]
jmp 0x140001273
mov dword [0x140004118], ebx
cmp dword [0x140004118], 0
je 0x14000160a
mov r13, qword [rsp + 0x88]
xor ebx, ebx
mov rdi, r13
mov rax, qword [rsp + 0x80]
movsxd r14, ebx
lea rsi, [r14 + rax]
test rsi, rsi
je 0x140001341
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x140001343
xor al, al
test al, al
je 0x1400013da
lea rbp, [r14 + r13]
test rbp, rbp
je 0x14000135f
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x140001361
xor al, al
test al, al
je 0x1400013da
lea rcx, [rsi + 7]
test rcx, rcx
je 0x140001376
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x140001378
xor al, al
test al, al
je 0x1400013da
lea rcx, [rbp + 7]
test rcx, rcx
je 0x14000138d
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x14000138f
xor al, al
mov rbp, qword [rsp + 0x78]
test al, al
je 0x1400013df
cmp qword [rdi + rbp], r15
jne 0x1400013df
cmp qword [rdi], r12
jne 0x1400013df
mov dword [0x14000411c], ebx
cmp dword [0x14000411c], 0
je 0x14000160a
mov r15, qword [rsp + 0x80]
xor esi, esi
xor r14d, r14d
movsxd rbx, esi
lea rdi, [rbx + r15]
test rdi, rdi
je 0x1400013f0
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x1400013f2
mov rbp, qword [rsp + 0x78]
add ebx, 4
add rdi, 4
cmp ebx, 0x60
jge 0x1400013a9
jmp 0x140001322
xor al, al
test al, al
je 0x1400015f3
add rbx, r13
je 0x14000140a
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x14000140c
xor al, al
test al, al
je 0x1400015f3
lea rcx, [rdi + 7]
test rcx, rcx
je 0x140001425
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x140001427
xor al, al
test al, al
je 0x1400015f3
lea rcx, [rbx + 7]
test rcx, rcx
je 0x140001440
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x140001442
xor al, al
test al, al
je 0x1400015f3
lea rcx, [rdi + 0xf]
test rcx, rcx
je 0x14000145b
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x14000145d
xor al, al
test al, al
je 0x1400015f3
lea rcx, [rbx + 0xf]
test rcx, rcx
je 0x140001476
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x140001478
xor al, al
test al, al
je 0x1400015f3
mov rcx, qword [r15 + r14 + 8]
mov rbx, qword [r14 + r13 + 8]
test rcx, rcx
je 0x140001497
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x140001499
xor al, al
test al, al
je 0x1400015f3
test rbx, rbx
je 0x1400014b1
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x1400014b3
xor al, al
test al, al
je 0x1400015f3
lea rax, [r14 + r13]
mov rdi, qword [rax + rbp]
mov rbx, qword [rax]
test rdi, rdi
je 0x1400014d6
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x1400014d8
xor al, al
test al, al
je 0x1400015f3
test rbx, rbx
je 0x1400014f0
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x1400014f2
xor al, al
test al, al
je 0x1400015f3
movsxd rax, dword [0x14000411c]
sub rax, r14
add rbx, rax
add rdi, rax
je 0x140001517
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x140001519
xor al, al
test al, al
je 0x1400015f3
test rbx, rbx
je 0x140001531
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x140001533
xor al, al
test al, al
je 0x1400015f3
lea rcx, [rdi + 7]
test rcx, rcx
je 0x14000154c
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x14000154e
xor al, al
test al, al
je 0x1400015f3
lea rcx, [rbx + 7]
test rcx, rcx
je 0x140001567
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x140001569
xor al, al
test al, al
je 0x1400015f3
mov rcx, qword [rdi]
test rcx, rcx
je 0x140001581
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x140001583
xor al, al
test al, al
je 0x1400015b2
mov rcx, qword [rdi]
sub rcx, 0x18
je 0x140001598
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x14000159a
xor al, al
test al, al
je 0x1400015b2
mov rcx, qword [rdi]
call sub.ntoskrnl.exe_ObGetObjectType
mov rcx, qword [sym.imp.ntoskrnl.exe_PsProcessType]
cmp rax, qword [rcx]
je 0x140001604
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400015c2
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x1400015c4
xor al, al
test al, al
je 0x1400015f3
mov rcx, qword [rbx]
sub rcx, 0x18
je 0x1400015d9
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x1400015db
xor al, al
test al, al
je 0x1400015f3
mov rcx, qword [rbx]
call sub.ntoskrnl.exe_ObGetObjectType
mov rcx, qword [sym.imp.ntoskrnl.exe_PsProcessType]
cmp rax, qword [rcx]
je 0x140001604
add esi, 4
add r14, 4
cmp esi, 0x60
jge 0x14000160a
jmp 0x1400013c3
mov dword [0x140004120], esi
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret