Function at 0x16c20
Capabilities:
Find process by pid
Print debug messages

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0xb0
mov qword [rsp + 0xa0], rsp
call fcn.000164f0
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x90], 0
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x48], 0
cmp qword [rsp + 0x50], 0
jne 0x16c88
lea rcx, [0x00024860]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x178bb
cmp qword [rsp + 0xd0], fcn.00012000
jne 0x16c9e
mov dword [rsp + 0x48], 1
cmp qword [rsp + 0xc8], 0
jne 0x16cc6
mov ecx, dword [rsp + 0xc0]
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jge 0x16cc6
xor al, al
jmp 0x178bb
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
and rcx, 0xfffffffffffff000
mov rax, qword [rsp + 0xe8]
mov qword [rax], rcx
mov rax, qword [rsp + 0xe0]
mov qword [rax], 0
mov rax, qword [rsp + 0xd8]
mov dword [rax], 0
lea rdi, [rsp + 0x58]
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov rax, qword [rsp + 0xe8]
movabs rcx, 0xffffffffffff
mov rax, qword [rax]
and rax, rcx
shr rax, 0xc
movsxd rcx, dword [0x000322ac]
imul rax, rcx
add rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [0x00031d40]
cmp qword [rsp + 0x40], rax
jae 0x177d6
movabs rcx, 0xffffffffffff
mov rax, qword [rsp + 0x40]
and rax, rcx
shr rax, 0xc
movsxd rcx, dword [0x000322ac]
imul rax, rcx
add rax, qword [rsp + 0x50]
mov qword [rsp + 0x88], rax
cmp dword [0x000322ac], 8
jne 0x16dcb
movabs rcx, 0xffffffffffff
mov rax, qword [rsp + 0x88]
and rax, rcx
shr rax, 0xc
movsxd rcx, dword [0x000322ac]
imul rax, rcx
add rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
jmp 0x16dd4
mov qword [rsp + 0x20], 0
movabs rcx, 0xffffffffffff
mov rax, qword [rsp + 0x20]
and rax, rcx
shr rax, 0xc
movsxd rcx, dword [0x000322ac]
imul rax, rcx
add rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x16e19
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
and eax, 1
test eax, eax
je 0x175a6
cmp qword [rsp + 0x20], 0
je 0x16e33
mov rax, qword [rsp + 0x20]
mov eax, dword [rax]
and eax, 1
test eax, eax
je 0x173e4
mov rax, qword [rsp + 0x88]
mov eax, dword [rax]
and eax, 1
test eax, eax
je 0x1727d
mov rax, qword [rsp + 0x88]
mov eax, dword [rax]
shr eax, 7
and eax, 1
cmp eax, 1
jne 0x1702a
mov rax, qword [rsp + 0xd8]
cmp dword [rax], 0
jne 0x16f43
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x88]
sub rax, rcx
movsxd rcx, dword [0x000322ac]
xor edx, edx
div rcx
mov rcx, rax
shl rcx, 0xc
call fcn.000164b0
mov rdx, rax
mov rax, qword [rsp + 0xe8]
mov qword [rax], rdx
mov rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rax]
sub rax, rcx
movsxd rcx, dword [0x000322ac]
xor edx, edx
div rcx
mov rcx, rax
shl rcx, 0xc
call fcn.000164b0
mov rdx, rax
mov rax, qword [rsp + 0xe8]
mov qword [rax], rdx
mov rcx, qword [rsp + 0xe8]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0xd0]
sub rax, rcx
mov rcx, qword [0x00032fe0]
sub rcx, rax
mov rax, qword [rsp + 0xe0]
mov qword [rax], rcx
mov rax, qword [rsp + 0x88]
mov eax, dword [rax]
shr eax, 1
and eax, 1
cmp eax, 1
jne 0x16f30
mov rax, qword [rsp + 0xd8]
mov dword [rax], 0x40
jmp 0x16f3e
mov rax, qword [rsp + 0xd8]
mov dword [rax], 0x20
jmp 0x16fd9
mov rax, qword [rsp + 0x88]
mov eax, dword [rax]
shr eax, 1
and eax, 1
cmp eax, 1
jne 0x16f80
mov rax, qword [rsp + 0xd8]
cmp dword [rax], 0x40
je 0x16f80
mov byte [rsp + 0x94], 0
lea rdx, [0x00017875]
mov rcx, qword [rsp + 0xa0]
call sub.ntoskrnl.exe__local_unwind
mov rax, qword [rsp + 0x88]
mov eax, dword [rax]
shr eax, 1
and eax, 1
test eax, eax
jne 0x16fbc
mov rax, qword [rsp + 0xd8]
cmp dword [rax], 0x20
je 0x16fbc
mov byte [rsp + 0x95], 0
lea rdx, [0x0001787e]
mov rcx, qword [rsp + 0xa0]
call sub.ntoskrnl.exe__local_unwind
mov rcx, qword [rsp + 0xe0]
mov rcx, qword [rcx]
add rcx, 0x1000
mov rax, qword [rsp + 0xe0]
mov qword [rax], rcx
movsxd rcx, dword [0x000322ac]
mov rax, qword [rsp + 0x88]
add rax, rcx
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x88]
sub rax, rcx
movsxd rcx, dword [0x000322ac]
xor edx, edx
div rcx
mov rcx, rax
shl rcx, 0xc
call fcn.000164b0
mov qword [rsp + 0x40], rax
jmp 0x16d52
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
and eax, 1
test eax, eax
je 0x1718b
mov rax, qword [rsp + 0xd8]
cmp dword [rax], 0
jne 0x170dd
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x40]
sub rax, rcx
movsxd rcx, dword [0x000322ac]
xor edx, edx
div rcx
mov rcx, rax
shl rcx, 0xc
call fcn.000164b0
mov rdx, rax
mov rax, qword [rsp + 0xe8]
mov qword [rax], rdx
mov rcx, qword [rsp + 0xe8]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0xd0]
sub rax, rcx
mov ecx, 0x1000
sub rcx, rax
mov rax, qword [rsp + 0xe0]
mov qword [rax], rcx
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
shr eax, 1
and eax, 1
cmp eax, 1
jne 0x170ca
mov rax, qword [rsp + 0xd8]
mov dword [rax], 0x40
jmp 0x170d8
mov rax, qword [rsp + 0xd8]
mov dword [rax], 0x20
jmp 0x1716d
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
shr eax, 1
and eax, 1
cmp eax, 1
jne 0x17117
mov rax, qword [rsp + 0xd8]
cmp dword [rax], 0x40
je 0x17117
mov byte [rsp + 0x96], 0
lea rdx, [0x00017887]
mov rcx, qword [rsp + 0xa0]
call sub.ntoskrnl.exe__local_unwind
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
shr eax, 1
and eax, 1
test eax, eax
jne 0x17150
mov rax, qword [rsp + 0xd8]
cmp dword [rax], 0x20
je 0x17150
mov byte [rsp + 0x97], 0
lea rdx, [0x00017890]
mov rcx, qword [rsp + 0xa0]
call sub.ntoskrnl.exe__local_unwind
mov rcx, qword [rsp + 0xe0]
mov rcx, qword [rcx]
add rcx, 0x1000
mov rax, qword [rsp + 0xe0]
mov qword [rax], rcx
movsxd rcx, dword [0x000322ac]
mov rax, qword [rsp + 0x40]
add rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x16d52
cmp dword [rsp + 0x48], 0
je 0x1719e
lea rcx, [0x000248a0]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [rsp + 0xd8]
cmp dword [rax], 0
jne 0x17217
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x40]
sub rax, rcx
movsxd rcx, dword [0x000322ac]
xor edx, edx
div rcx
mov rcx, rax
shl rcx, 0xc
call fcn.000164b0
mov rdx, rax
mov rax, qword [rsp + 0xe8]
mov qword [rax], rdx
mov rcx, qword [rsp + 0xe8]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0xd0]
sub rax, rcx
mov ecx, 0x1000
sub rcx, rax
mov rax, qword [rsp + 0xe0]
mov qword [rax], rcx
mov rax, qword [rsp + 0xd8]
mov dword [rax], 1
jmp 0x1725f
mov rax, qword [rsp + 0xd8]
cmp dword [rax], 1
jne 0x17243
mov rcx, qword [rsp + 0xe0]
mov rcx, qword [rcx]
add rcx, 0x1000
mov rax, qword [rsp + 0xe0]
mov qword [rax], rcx
jmp 0x1725f
mov byte [rsp + 0x98], 0
lea rdx, [0x00017899]
mov rcx, qword [rsp + 0xa0]
call sub.ntoskrnl.exe__local_unwind
movsxd rcx, dword [0x000322ac]
mov rax, qword [rsp + 0x40]
add rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x16d52
cmp dword [rsp + 0x48], 0
je 0x17290
lea rcx, [0x000248c0]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [rsp + 0xd8]
cmp dword [rax], 0
jne 0x1734b
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x88]
sub rax, rcx
movsxd rcx, dword [0x000322ac]
xor edx, edx
div rcx
mov rcx, rax
shl rcx, 0xc
call fcn.000164b0
mov rdx, rax
mov rax, qword [rsp + 0xe8]
mov qword [rax], rdx
mov rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rax]
sub rax, rcx
movsxd rcx, dword [0x000322ac]
xor edx, edx
div rcx
mov rcx, rax
shl rcx, 0xc
call fcn.000164b0
mov rdx, rax
mov rax, qword [rsp + 0xe8]
mov qword [rax], rdx
mov rcx, qword [rsp + 0xe8]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0xd0]
sub rax, rcx
mov rcx, qword [0x00032fe0]
sub rcx, rax
mov rax, qword [rsp + 0xe0]
mov qword [rax], rcx
mov rax, qword [rsp + 0xd8]
mov dword [rax], 1
jmp 0x17393
mov rax, qword [rsp + 0xd8]
cmp dword [rax], 1
jne 0x17377
mov rcx, qword [rsp + 0xe0]
mov rcx, qword [rcx]
add rcx, qword [0x00032fe0]
mov rax, qword [rsp + 0xe0]
mov qword [rax], rcx
jmp 0x17393
mov byte [rsp + 0x99], 0
lea rdx, [0x000178a2]
mov rcx, qword [rsp + 0xa0]
call sub.ntoskrnl.exe__local_unwind
movsxd rcx, dword [0x000322ac]
mov rax, qword [rsp + 0x88]
add rax, rcx
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x88]
sub rax, rcx
movsxd rcx, dword [0x000322ac]
xor edx, edx
div rcx
mov rcx, rax
shl rcx, 0xc
call fcn.000164b0
mov qword [rsp + 0x40], rax
jmp 0x16d52
cmp dword [rsp + 0x48], 0
je 0x173f7
lea rcx, [0x000248e0]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [rsp + 0xd8]
cmp dword [rax], 0
jne 0x174e6
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x20]
sub rax, rcx
movsxd rcx, dword [0x000322ac]
xor edx, edx
div rcx
mov rcx, rax
shl rcx, 0xc
call fcn.000164b0
mov rdx, rax
mov rax, qword [rsp + 0xe8]
mov qword [rax], rdx
mov rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rax]
sub rax, rcx
movsxd rcx, dword [0x000322ac]
xor edx, edx
div rcx
mov rcx, rax
shl rcx, 0xc
call fcn.000164b0
mov rdx, rax
mov rax, qword [rsp + 0xe8]
mov qword [rax], rdx
mov rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rax]
sub rax, rcx
movsxd rcx, dword [0x000322ac]
xor edx, edx
div rcx
mov rcx, rax
shl rcx, 0xc
call fcn.000164b0
mov rdx, rax
mov rax, qword [rsp + 0xe8]
mov qword [rax], rdx
mov rcx, qword [rsp + 0xe8]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0xd0]
sub rax, rcx
mov ecx, 0x40000000
sub rcx, rax
mov rax, qword [rsp + 0xe0]
mov qword [rax], rcx
mov rax, qword [rsp + 0xd8]
mov dword [rax], 1
jmp 0x1752e
mov rax, qword [rsp + 0xd8]
cmp dword [rax], 1
jne 0x17512
mov rcx, qword [rsp + 0xe0]
mov rcx, qword [rcx]
add rcx, 0x40000000
mov rax, qword [rsp + 0xe0]
mov qword [rax], rcx
jmp 0x1752e
mov byte [rsp + 0x9a], 0
lea rdx, [0x000178ab]
mov rcx, qword [rsp + 0xa0]
call sub.ntoskrnl.exe__local_unwind
movsxd rcx, dword [0x000322ac]
mov rax, qword [rsp + 0x20]
add rax, rcx
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x20]
sub rax, rcx
movsxd rcx, dword [0x000322ac]
xor edx, edx
div rcx
mov rcx, rax
shl rcx, 0xc
call fcn.000164b0
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x88]
sub rax, rcx
movsxd rcx, dword [0x000322ac]
xor edx, edx
div rcx
mov rcx, rax
shl rcx, 0xc
call fcn.000164b0
mov qword [rsp + 0x40], rax
jmp 0x16d52
cmp dword [rsp + 0x48], 0
je 0x175b9
lea rcx, [0x00024900]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [rsp + 0xd8]
cmp dword [rax], 0
jne 0x176e6
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
sub rax, rcx
movsxd rcx, dword [0x000322ac]
xor edx, edx
div rcx
mov rcx, rax
shl rcx, 0xc
call fcn.000164b0
mov rdx, rax
mov rax, qword [rsp + 0xe8]
mov qword [rax], rdx
mov rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rax]
sub rax, rcx
movsxd rcx, dword [0x000322ac]
xor edx, edx
div rcx
mov rcx, rax
shl rcx, 0xc
call fcn.000164b0
mov rdx, rax
mov rax, qword [rsp + 0xe8]
mov qword [rax], rdx
mov rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rax]
sub rax, rcx
movsxd rcx, dword [0x000322ac]
xor edx, edx
div rcx
mov rcx, rax
shl rcx, 0xc
call fcn.000164b0
mov rdx, rax
mov rax, qword [rsp + 0xe8]
mov qword [rax], rdx
mov rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rax]
sub rax, rcx
movsxd rcx, dword [0x000322ac]
xor edx, edx
div rcx
mov rcx, rax
shl rcx, 0xc
call fcn.000164b0
mov rdx, rax
mov rax, qword [rsp + 0xe8]
mov qword [rax], rdx
mov rcx, qword [rsp + 0xe8]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0xd0]
sub rax, rcx
movabs rcx, 0x8000000000
sub rcx, rax
mov rax, qword [rsp + 0xe0]
mov qword [rax], rcx
mov rax, qword [rsp + 0xd8]
mov dword [rax], 1
jmp 0x17734
mov rax, qword [rsp + 0xd8]
cmp dword [rax], 1
jne 0x17718
mov rcx, qword [rsp + 0xe0]
mov rcx, qword [rcx]
movabs rax, 0x8000000000
add rcx, rax
mov rax, qword [rsp + 0xe0]
mov qword [rax], rcx
jmp 0x17734
mov byte [rsp + 0x9b], 0
lea rdx, [0x000178b4]
mov rcx, qword [rsp + 0xa0]
call sub.ntoskrnl.exe__local_unwind
movsxd rcx, dword [0x000322ac]
mov rax, qword [rsp + 0x30]
add rax, rcx
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
sub rax, rcx
movsxd rcx, dword [0x000322ac]
xor edx, edx
div rcx
mov rcx, rax
shl rcx, 0xc
call fcn.000164b0
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x20]
sub rax, rcx
movsxd rcx, dword [0x000322ac]
xor edx, edx
div rcx
mov rcx, rax
shl rcx, 0xc
call fcn.000164b0
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x88]
sub rax, rcx
movsxd rcx, dword [0x000322ac]
xor edx, edx
div rcx
mov rcx, rax
shl rcx, 0xc
call fcn.000164b0
mov qword [rsp + 0x40], rax
jmp 0x16d52
mov dword [rsp + 0x90], 0
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
cmp qword [rsp + 0xc8], 0
jne 0x177fd
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x17871
xor al, al
jmp 0x178bb
add rsp, 0xb0
pop rdi
ret