Function at 0x140084290
Capabilities:
Attach user process memory

Disassembly:
mov dword [rsp + 0x20], r9d
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd8
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x58], r8
mov r14, rdx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x68], r8
xor esi, esi
mov r12d, esi
mov dword [rsp + 0x34], esi
mov r13, qword [rcx + 8]
mov qword [rsp + 0x80], r13
mov ecx, 0x4265
call fcn.140029ab4
mov qword [rsp + 0x70], rax
mov ecx, 0x41ea
call fcn.140029ab4
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140084668
mov edx, 0x250
lea ecx, [rsi + 1]
call fcn.140077530
mov rdi, rax
mov qword [rsp + 0x90], rax
test rax, rax
je 0x140084668
mov edx, 0x1000
lea ecx, [rsi + 1]
call fcn.140077530
mov r15, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x140084660
xor edx, edx
mov rcx, r13
call fcn.14004a18c
cmp al, 1
jne 0x140084658
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rax, r13
setne byte [rsp + 0x30]
lea r12, [r14 + 8]
mov ecx, dword [r14]
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x48], ecx
mov eax, esi
mov r14d, dword [rsp + 0x128]
mov dword [rsp + 0x3c], eax
mov qword [rsp + 0x40], r12
cmp eax, ecx
jae 0x140084653
test r14d, r14d
je 0x140084653
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax]
movzx ecx, word [r12]
call fcn.14007a600
cmp al, 1
jne 0x140084640
xor edx, edx
mov r8d, 0x250
mov rcx, rdi
call fcn.1400013f0
cmp byte [rsp + 0x30], 1
jne 0x1400843ed
mov rcx, r13
call fcn.140077928
mov byte [rsp + 0x31], al
lea rdx, [rsp + 0x98]
mov rcx, r13
call sub.ntoskrnl.exe_KeStackAttachProcess
movzx eax, word [r12 + 6]
mov qword [rdi + 0x238], rax
mov r14, qword [r12 + 8]
mov qword [rdi + 0x240], r14
movzx eax, byte [r12 + 4]
mov dword [rdi + 0x230], eax
lea rcx, [r14 - 0x30]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, 1
jne 0x14008443a
lea rcx, [r14 - 1]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, 1
jne 0x14008443a
mov eax, dword [r14 - 0x30]
mov dword [rdi + 0x248], eax
jmp 0x140084440
mov dword [rdi + 0x248], esi
mov rcx, r13
call fcn.1400778ec
cmp al, 1
jne 0x140084526
mov r12, qword [rdi + 0x238]
mov ecx, 0x914
call fcn.140029ab4
cmp eax, 0x1db0
jb 0x140084487
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140084487
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 8]
cmp qword [rcx], rax
jne 0x140084487
or r12, 0xffffffff80000000
mov qword [rsp + 0x20], rsi
mov r9d, 0x1000
mov r8, r15
mov edx, 2
mov rcx, r12
call qword [rsp + 0x60]
test eax, eax
js 0x1400844cf
movzx r14d, word [r15]
shr r14d, 1
je 0x1400844cf
mov eax, 0x13
cmp r14d, eax
cmova r14d, eax
lea r8d, [r14 + r14]
mov rdx, qword [r15 + 8]
mov rcx, rdi
call fcn.1400010a0
mov word [rdi + r14*2], si
mov qword [rsp + 0x20], rsi
mov r9d, 0x1000
mov r8, r15
mov edx, 1
mov rcx, r12
call qword [rsp + 0x60]
test eax, eax
js 0x140084519
movzx r14d, word [r15]
shr r14d, 1
je 0x140084519
mov eax, 0x103
cmp r14d, eax
cmova r14d, eax
lea r8d, [r14 + r14]
lea rcx, [rdi + 0x28]
mov rdx, qword [r15 + 8]
call fcn.1400010a0
mov word [rdi + r14*2 + 0x28], si
mov rcx, r13
call fcn.1400776fc
mov r12, qword [rsp + 0x40]
cmp byte [rsp + 0x30], 1
jne 0x14008454a
lea rcx, [rsp + 0x98]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
cmp byte [rsp + 0x31], 1
jne 0x14008454a
mov rcx, r13
call fcn.140077a00
nop
mov r8, qword [rsp + 0x58]
mov rax, r8
mov rcx, rdi
mov edx, 4
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
dec rdx
jne 0x14008455a
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
add r8, 0x250
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x68], r8
dec dword [rsp + 0x128]
inc dword [rsp + 0x34]
mov r14d, dword [rsp + 0x128]
mov ecx, dword [rsp + 0x38]
jmp 0x140084644
mov ecx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x3c]
inc eax
add r12, 0x18
jmp 0x140084386
mov r12d, dword [rsp + 0x34]
mov rcx, r15
call fcn.140077564
mov rcx, rdi
call fcn.140077564
mov eax, r12d
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.14008c320
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret