Function at 0x140006f9c
Capabilities:
Find process by pid
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7f0]
sub rsp, 0x8f0
mov rax, qword [0x140076ea0]
xor rax, rsp
mov qword [rbp + 0x7e0], rax
mov qword [rsp + 0x78], rcx
lea rcx, [0x1400158f0]
mov qword [rbp - 0x68], rdx
mov dword [rsp + 0x40], 0x10000
call fcn.140011164
mov edx, dword [rsp + 0x40]
mov r13d, 0x656e6864
mov r8d, r13d
xor ecx, ecx
mov r14d, eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor r12d, r12d
mov rbx, rax
test rax, rax
je 0x140007415
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call fcn.140015340
mov r8d, dword [rsp + 0x40]
lea esi, [r12 + 0x10]
mov ecx, esi
lea r9, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov r15d, 0xc0000004
jmp 0x14000708c
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [rsp + 0x40]
mov r8d, r13d
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x140007415
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call fcn.140015340
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, rbx
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov edi, eax
cmp eax, r15d
je 0x140007041
test eax, eax
jns 0x14000709e
mov eax, edi
jmp 0x14000741a
mov eax, dword [0x14001a008]
mov ecx, 1
mov r15d, dword [rbx]
mov r8d, 0x6d7467
imul rdx, rax, 0x640
mov qword [rsp + 0x70], r15
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
jne 0x1400070d6
mov eax, 0xc0000023
jmp 0x14000741a
mov eax, dword [0x14001a008]
xor edx, edx
imul r8, rax, 0x640
mov rcx, rsi
call fcn.140015340
xor r9d, r9d
mov r13d, r9d
test r15, r15
je 0x1400073df
movzx r8d, r14b
mov rcx, r15
mov dword [rsp + 0x44], r8d
lea r14, [rbx + 0xc]
movzx eax, byte [r14]
xorps xmm1, xmm1
movzx r15d, word [r14 + 2]
xorps xmm0, xmm0
mov rdx, qword [r14 + 4]
mov qword [rbp - 0x70], r15
mov dword [rsp + 0x54], eax
mov qword [rbp - 0x78], rdx
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x60], r9
mov dword [rsp + 0x50], r9d
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm1
movups xmmword [rbp - 0x40], xmm1
movups xmmword [rbp - 0x30], xmm1
cmp eax, r8d
jne 0x1400073cc
movzx ebx, word [r14 - 4]
lea r8, [rbp - 0x50]
mov qword [rbp - 0x58], r9
lea rcx, [rsp + 0x68]
mov qword [rbp - 0x48], r9
mov edx, 0x40
mov dword [rbp - 0x38], r9d
mov qword [rbp - 0x40], r9
lea r9, [rbp - 0x60]
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x60], rbx
mov dword [rbp - 0x50], 0x30
movdqu xmmword [rbp - 0x30], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
xor r9d, r9d
mov edi, eax
test eax, eax
js 0x14000739c
mov rcx, qword [rsp + 0x68]
or r8, 0xffffffffffffffff
mov dword [rsp + 0x30], 2
mov edx, r15d
mov dword [rsp + 0x28], r9d
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 0x1fffff
call qword [sym.imp.ntoskrnl.exe_ZwDuplicateObject]
xor r9d, r9d
mov edi, eax
test eax, eax
js 0x14000739c
mov edi, 0x400
mov r8d, 0x656e6864
mov edx, edi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor r9d, r9d
mov r15, rax
test rax, rax
jne 0x140007204
mov edi, 0xc00000a0
jmp 0x14000739c
mov r8, rdi
xor edx, edx
mov rcx, r15
call fcn.140015340
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
mov r9d, edi
mov qword [rsp + 0x20], rax
mov r8, r15
mov edx, 1
call qword [sym.imp.ntoskrnl.exe_ZwQueryObject]
mov edi, eax
xor eax, eax
cmp word [r15], ax
jbe 0x14000738b
xor edx, edx
lea rcx, [rbp - 0x20]
mov r8d, 0x400
call fcn.140015340
xor edx, edx
lea rcx, [rbp + 0x3e0]
mov r8d, 0x400
call fcn.140015340
mov rax, qword [rsp + 0x78]
or r8, 0xffffffffffffffff
xor ecx, ecx
inc r8
cmp word [rax + r8*2], cx
jne 0x14000726f
mov rdx, rax
lea rcx, [rbp - 0x20]
call sub.ntoskrnl.exe_wcsncpy
mov rcx, qword [r15 + 8]
lea rdx, [rbp + 0x3e0]
call fcn.14000e694
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x3e0]
call sub.ntoskrnl.exe_wcsstr
xor ecx, ecx
test rax, rax
je 0x14000738b
mov qword [rsp + 0x48], rcx
lea rdx, [rsp + 0x48]
mov rcx, rbx
inc r13d
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x14000738b
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessImageFileName]
xor edi, edi
mov ebx, r13d
test rax, rax
je 0x1400072fc
imul rcx, rbx, 0x640
lea rdx, [rsi + 0x208]
add rdx, rcx
mov rcx, rax
call fcn.14000271c
mov rax, qword [rbp - 0x80]
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
imul rbx, rbx, 0x640
mov qword [rsp + 0x58], rdi
add rbx, rsi
mov qword [rbx + 0x618], rax
mov rax, qword [rbp - 0x78]
mov qword [rbx + 0x630], rax
mov rax, qword [rbp - 0x70]
mov qword [rbx + 0x628], rax
mov eax, dword [rsp + 0x54]
mov dword [rbx + 0x638], eax
mov qword [rbx + 0x620], rcx
call sub.ntoskrnl.exe_SeLocateProcessImageName
mov edi, eax
test eax, eax
js 0x140007363
mov rcx, qword [rsp + 0x58]
mov rdx, rbx
mov rcx, qword [rcx + 8]
call fcn.14000e694
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [r15 + 8]
lea rdx, [rbx + 0x410]
call fcn.14000e694
mov edx, 0x656e6864
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor r9d, r9d
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400073af
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor r9d, r9d
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400073c2
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor r9d, r9d
mov r8d, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x70]
inc r12d
add r14, 0x18
movsxd rax, r12d
cmp rax, rcx
jb 0x14000710c
mov rcx, qword [rbp - 0x68]
lea eax, [r13 + 1]
mov dword [rsi + 0x63c], eax
mov rdx, rsi
mov eax, dword [0x14001a008]
imul r8, rax, 0x640
call fcn.140015080
mov edx, 0x6d7467
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140007097
mov eax, 0xc00000a0
mov rcx, qword [rbp + 0x7e0]
xor rcx, rsp
call fcn.140014fb0
mov rbx, qword [rsp + 0x940]
add rsp, 0x8f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret