Function at 0x180002480
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov rdi, qword [r9]
xor eax, eax
mov r15, qword [rdx + 0x18]
sub rdi, 8
mov qword [rbp + 0x50], rax
mov r14, r9
mov eax, dword [rdx]
mov r13, r8
mov qword [rbp + 0x60], r15
mov rsi, rdx
movzx r12d, cl
mov ebx, 0xc000000d
cmp eax, 8
jb 0x1800024d0
cmp qword [0x180005220], 0
je 0x180002715
mov rcx, rax
lea rdx, [rbp + 0x58]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x18000271c
mov rax, qword [0x180005220]
test rax, rax
je 0x18000250c
mov rcx, qword [rbp + 0x58]
call rax
mov ebx, eax
test eax, eax
jns 0x18000250c
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x18000271a
mov rcx, qword [rbp + 0x58]
lea rdx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
or r15, 0xffffffff80000000
lea rax, [rbp + 0x50]
cmp dword [rsi], 8
cmovae r15, qword [rbp + 0x60]
setae r9b
xor ebx, ebx
xor r8d, r8d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
js 0x180002563
mov rcx, qword [rbp + 0x50]
cmp rcx, qword [rsi + 8]
je 0x180002563
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov qword [rbp + 0x50], rbx
mov rax, qword [0x180005228]
test rax, rax
je 0x180002575
mov rcx, qword [rbp + 0x58]
call rax
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp qword [rbp + 0x50], rbx
jne 0x180002599
lea rcx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, 0xc0000022
jmp 0x18000271c
xor r9d, r9d
lea rax, [rbp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, r15
lea edx, [r9 + 2]
call qword [sym.imp.ntoskrnl.exe_ZwQueryObject]
mov ebx, eax
cmp eax, 0xc0000004
jne 0x1800026fd
mov edx, dword [rbp + 0x48]
mov ecx, 1
mov r8d, 0x58637250
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
jne 0x1800025fc
mov rcx, qword [rbp + 0x50]
mov ebx, 0xc0000017
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea rcx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x180002715
mov r9d, dword [rbp + 0x48]
mov r8, rsi
mov edx, 2
mov qword [rsp + 0x20], 0
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_ZwQueryObject]
mov ebx, eax
test eax, eax
js 0x1800026f2
test r12b, r12b
je 0x180002686
lea eax, [rdi - 2]
mov dword [rbp + 0x48], eax
mov r15d, eax
movzx ecx, word [rsi]
cmp eax, ecx
jbe 0x180002641
mov dword [rbp + 0x48], ecx
mov eax, ecx
mov r15d, ecx
xor r12d, r12d
mov r8d, eax
mov word [r13 + 4], r12w
lea rcx, [r13 + 4]
mov rdx, qword [rsi + 8]
call fcn.180002c40
mov eax, r15d
shr rax, 1
mov word [r13 + rax*2 + 4], r12w
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [r13 + rax*2 + 6], r12w
lea rax, [rax + 1]
jne 0x180002670
lea rax, [rax*2 + 0xa]
jmp 0x1800026ef
mov r8b, 1
lea rcx, [rbp - 0x48]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
mov ebx, eax
test eax, eax
js 0x1800026f2
movzx ecx, word [rbp - 0x48]
mov eax, ecx
cmp rdi, rcx
ja 0x1800026aa
lea eax, [rdi - 1]
mov rdx, qword [rbp - 0x40]
lea rcx, [r13 + 4]
mov r8d, eax
mov dword [rbp + 0x48], eax
mov byte [r13 + 4], 0
call qword [sym.imp.ntoskrnl.exe_strncpy]
mov eax, dword [rbp + 0x48]
lea rcx, [rbp - 0x48]
mov byte [rax + r13 + 4], 0
call qword [sym.imp.ntoskrnl.exe_RtlFreeAnsiString]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [r13 + rax + 4], 0
jne 0x1800026e0
add rax, 9
mov qword [r14], rax
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea rcx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test ebx, ebx
jns 0x18000271a
xor eax, eax
mov qword [r14], rax
mov eax, ebx
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret