Function at 0x140003bfc
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
lea rcx, [0x140020dc0]
call fcn.1400022dc
lea rdx, [0x140542128]
mov qword [0x140542130], rax
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
xor esi, esi
mov ebx, eax
test eax, eax
js 0x1400042fd
mov rcx, qword [0x140542128]
lea rdx, [rbp - 1]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea rdx, [rbp + 0x6f]
mov dword [rbp + 0x6f], esi
lea rcx, [0x140020dd0]
call fcn.140001c00
lea rdx, [rbp + 0x77]
mov rdi, rax
lea rcx, [0x140020df0]
call fcn.140001c00
mov rbx, rax
test rdi, rdi
je 0x140004261
test rax, rax
je 0x140004261
mov ecx, dword [rbp + 0x6f]
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
lea r8d, [rsi + 0x46]
mov qword [rsp + 0x20], rcx
mov r9, rdi
lea rcx, [0x140642420]
mov qword [rbp - 0x29], rsi
mov dl, 0xcc
call fcn.140001e74
test eax, eax
js 0x140004261
mov rax, qword [rbp - 0x29]
mov rcx, rdi
mov edx, dword [rbp + 0x6f]
mov qword [0x140542160], rax
call fcn.140004804
mov edx, dword [rbp + 0x77]
mov rcx, rbx
mov qword [0x140542148], rax
call fcn.140004eb8
mov edx, dword [rbp + 0x77]
mov rcx, rbx
mov qword [0x140542138], rax
call fcn.140004cb4
mov qword [0x140542140], rax
lea rcx, [0x140020e10]
mov eax, dword [rbp + 0x77]
xor edx, edx
add rax, rbx
mov qword [0x140542168], rbx
mov qword [0x140542170], rax
call fcn.140001c00
mov rbx, rax
test rax, rax
je 0x140004261
lea rdx, [0x140020e30]
mov rcx, rax
call fcn.140002074
lea rdx, [0x140020e40]
mov qword [0x140542158], rax
mov rcx, rbx
call fcn.140002074
lea ebx, [rsi + 4]
mov qword [0x140542150], rax
mov edx, ebx
mov ecx, 0xac8
call fcn.140001b04
mov edx, ebx
mov qword [0x140542178], rax
mov ecx, 0xb8
call fcn.140001b04
mov rbx, rax
test rax, rax
je 0x140003da7
xor edx, edx
mov r8d, 0xb0
mov rcx, rax
call fcn.140020100
mov dword [rbx + 0xb0], 0x1388
mov dword [rbx + 0xb4], 0x2710
jmp 0x140003daa
mov rbx, rsi
xor edx, edx
mov qword [0x140542188], rbx
mov ecx, 0x4a0
call fcn.140001b40
test rax, rax
je 0x140003dcc
mov rcx, rax
call fcn.140008d64
jmp 0x140003dcf
mov rax, rsi
xor edx, edx
mov qword [0x140542180], rax
mov ecx, 0x210
call fcn.140001b40
test rax, rax
je 0x140003df1
mov rcx, rax
call fcn.140008c88
jmp 0x140003df4
mov rax, rsi
xor edx, edx
mov qword [0x140542190], rax
mov ecx, 0xc8
call fcn.140001b40
mov rdi, rax
test rax, rax
je 0x140003e6d
mov rbx, qword [0x140542190]
xor edx, edx
mov r8d, 0xc8
mov dword [rax + 0x14], esi
mov rcx, rax
mov qword [rax + 0x18], rsi
mov dword [rax + 0x24], esi
mov qword [rax + 0x28], rsi
mov dword [rax + 0x5c], esi
mov qword [rax + 0x60], rsi
mov dword [rax + 0x6c], esi
mov qword [rax + 0x70], rsi
mov dword [rax + 0x7c], esi
mov qword [rax + 0x80], rsi
mov qword [rax + 0x8c], rsi
mov dword [rax + 0x94], esi
mov qword [rax + 0xb0], rsi
mov qword [rax + 0xb8], rsi
call fcn.140020100
mov qword [rdi + 0x38], rbx
jmp 0x140003e70
mov rdi, rsi
xor edx, edx
mov qword [0x140542198], rdi
lea ecx, [rdx + 0x38]
call fcn.140001b40
mov rbx, rax
test rax, rax
je 0x140003ea7
mov rcx, rax
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rsi
mov qword [rax + 0x28], rsi
mov qword [rax + 0x30], rsi
call fcn.14000b3f8
jmp 0x140003eaa
mov rbx, rsi
xor edx, edx
mov qword [0x1405421a0], rbx
lea ecx, [rdx + 0x10]
call fcn.140001b40
test rax, rax
je 0x140003ec9
mov qword [rax], rsi
mov qword [rax + 8], rsi
jmp 0x140003ecc
mov rax, rsi
mov rcx, qword [0x140542178]
lea r8, [0x140020e60]
mov qword [0x1405421a8], rax
mov r15d, 0x40
mov rax, qword [0x140542160]
mov edx, r15d
mov qword [rcx + 0xac0], rax
mov rax, qword [0x140542178]
mov dword [rax + 0xc], 0xdb6f6ddb
mov dword [rax + 0x10], 0x4e88ac77
mov dword [rax + 0x14], 0x9d815382
mov dword [rax + 0x18], 0x40f1bbf9
mov rax, qword [0x140542178]
mov dword [rax + 0x1c], 0x6f15aaf2
mov dword [rax + 0x20], 0x4e89d208
mov dword [rax + 0x24], 0x9548b49a
mov dword [rax + 0x28], 0x9c4fd335
mov rax, qword [0x140542178]
mov dword [rax + 0x2c], 0xcddea8
mov dword [rax + 0x30], 0x4b83939b
mov dword [rax + 0x34], 0x85a640a3
mov dword [rax + 0x38], 0xcc666622
mov rax, qword [0x140542178]
mov dword [rax + 0x3c], 0x54ec77fa
mov dword [rax + 0x40], 0x44e61377
mov dword [rax + 0x44], 0xfd88328c
mov dword [rax + 0x48], 0x4cc8445f
mov rax, qword [0x140542178]
mov dword [rax + 0x4c], 0x2411e7e1
mov dword [rax + 0x50], 0x4ccf12ac
mov dword [rax + 0x54], 0x989714bd
mov dword [rax + 0x58], 0xc04d53e8
mov rcx, qword [0x140542178]
add rcx, 0x100
call sub.ntoskrnl.exe_strcpy_s
mov rcx, qword [0x140542178]
lea r8, [0x140020e70]
add rcx, 0x140
mov edx, r15d
call sub.ntoskrnl.exe_strcpy_s
mov rcx, qword [0x140542178]
lea r8, [0x140020e80]
add rcx, 0x180
mov edx, r15d
call sub.ntoskrnl.exe_strcpy_s
mov rcx, qword [0x140542178]
lea rax, str.DXBC
add rcx, 0x52c
lea edx, [r15 - 0x3b]
lea r8d, [r15 + 0x40]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
add rcx, r8
movups xmm1, xmmword [rax + 0x70]
add rax, r8
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140004011
movups xmm0, xmmword [rax]
mov edi, 6
lea rdx, str.DXBCzT
movups xmmword [rcx], xmm0
mov eax, dword [rax + 0x10]
mov dword [rcx + 0x10], eax
mov eax, edi
mov rcx, qword [0x140542178]
add rcx, 0x1c0
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
add rcx, r8
movups xmm1, xmmword [rdx + 0x70]
add rdx, r8
movups xmmword [rcx - 0x10], xmm1
sub rax, 1
jne 0x140004083
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
mov rax, qword [rdx + 0x60]
mov qword [rcx + 0x60], rax
mov eax, dword [rdx + 0x68]
mov dword [rcx + 0x68], eax
and dword [0x140644e6c], esi
and dword [0x140644e70], esi
mov dword [0x140644e7c], 1
call fcn.140008b8c
call fcn.1400171cc
mov rcx, qword [0x140542160]
lea r9, [rbp + 0x67]
mov ebx, 0x20
mov dword [rbp + 0x67], esi
mov edx, ebx
mov r8d, r15d
call fcn.1400025d8
test al, al
je 0x140004261
mov rax, qword [0x140542160]
lea r8d, [rbx + 0x1d]
xor r9d, r9d
lea rdx, [0x140030010]
mov ecx, dword [rax]
mov byte [rax], 0xcc
mov rax, qword [0x140542160]
mov dword [rax], ecx
mov rcx, qword [0x140542160]
call fcn.14001a264
mov r8d, dword [rbp + 0x67]
lea r9, [rbp + 0x67]
mov rcx, qword [0x140542160]
mov edx, ebx
call fcn.1400025d8
mov rcx, qword [0x140542148]
lea r9, [rbp + 0x67]
mov r8d, r15d
mov edx, ebx
call fcn.1400025d8
test al, al
je 0x1400041fd
mov rax, qword [0x140542148]
lea rdx, [rbp + 0x7f]
xor r9d, r9d
mov r8, rdi
mov ecx, dword [rax]
mov byte [rax], 0xcc
mov rax, qword [0x140542148]
mov dword [rax], ecx
mov rcx, qword [0x140542148]
mov dword [rbp + 0x7f], 0x1b8
mov word [rbp + 0x83], 0xc300
call fcn.14001a264
mov r8d, dword [rbp + 0x67]
lea r9, [rbp + 0x67]
mov rcx, qword [0x140542148]
mov edx, ebx
call fcn.1400025d8
mov rdx, qword [0x140542160]
lea r8, [0x140002794]
add rdx, 0x3b
lea rcx, [rbp - 0x21]
xor r9d, r9d
call fcn.14000312c
mov rcx, qword [0x1405421a8]
lea rdx, [rbp - 0x21]
call fcn.140008a04
mov rcx, qword [0x140542138]
lea rdx, [0x140002758]
mov r9b, 1
mov r8b, r9b
call fcn.140008ab4
mov rcx, qword [0x140542140]
lea rdx, [0x140002758]
mov r9b, 1
mov r8b, r9b
call fcn.140008ab4
mov ebx, esi
jmp 0x140004266
mov ebx, 0xc0000001
mov rcx, qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov rax, rcx
cmp byte [rax], 0xe8
je 0x14000427d
inc rcx
cmp byte [rcx], 0xe8
jne 0x140004275
inc rcx
lea r8, [0x140642410]
mov r9b, 1
lea rdx, [0x140007dcc]
movsxd rax, dword [rcx]
add rax, 4
add rcx, rax
call fcn.14001a028
mov rcx, qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
lea r8, [0x140642408]
mov r9b, 1
lea rdx, [0x140008620]
call fcn.14001a028
mov rcx, qword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
lea r8, [0x140642400]
mov r9b, 1
lea rdx, [0x14000866c]
call fcn.14001a028
mov rcx, qword [0x140644db0]
lea rdx, [0x140007d4c]
mov r9b, 1
xor r8d, r8d
call fcn.14001a028
lea rcx, [rbp - 1]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, ebx
add rsp, 0x90
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret