Function at 0x14007a560
Capabilities:
Check processdebugport

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
mov rcx, rdi
xor edx, edx
mov r8d, 0xa8
call fcn.14010ed90
xor r14d, r14d
lea r8, [rbp + 0x30]
mov rcx, rsi
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 8]
lea edx, [r14 + 0x1a]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ebx, eax
test eax, eax
js 0x14007a5b7
cmp qword [rbp + 0x30], r14
setne al
jmp 0x14007a5bb
movzx eax, byte [rbp + 0x30]
test ebx, ebx
js 0x14007a5cb
test al, al
jne 0x14007a5cb
mov r9d, 5
jmp 0x14007a61d
mov r9d, 4
mov qword [rsp + 0x20], r14
lea r8, [rbp + 0x30]
mov rcx, rsi
lea edx, [r9 + 0x1e]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ebx, eax
test eax, eax
jns 0x14007a5f3
mov r9d, dword [rbp + 0x30]
jmp 0x14007a61d
mov r8d, dword [rbp + 0x30]
mov ecx, r8d
shr ecx, 1
mov eax, r8d
not ecx
and ecx, 1
mov edx, ecx
or edx, 2
and al, 4
cmove edx, ecx
mov r9d, edx
or r9d, 4
and r8b, 8
cmove r9d, edx
test ebx, ebx
js 0x14007a643
and dword [rdi + 0x70], 0xfffffffc
lea rcx, [rdi + 0x70]
mov eax, r9d
mov ebx, r14d
and eax, 3
shr r9d, 2
or dword [rcx], eax
and r9b, 1
mov byte [rdi + 0x74], r9b
mov qword [rdi], rcx
mov r9d, 8
mov dword [rbp + 0x30], 1
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
lea rcx, [rdi + 0x78]
mov edx, eax
test eax, eax
jns 0x14007a67b
cmp ebx, 0xc0000073
cmove ebx, eax
jmp 0x14007a683
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rcx], eax
test edx, edx
js 0x14007a68b
mov qword [rdi + 8], rcx
mov r9d, 8
mov dword [rbp + 0x30], 2
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
lea rcx, [rdi + 0x7c]
mov edx, eax
test eax, eax
jns 0x14007a6c3
cmp ebx, 0xc0000073
cmove ebx, eax
jmp 0x14007a6cb
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rcx], eax
test edx, edx
js 0x14007a6d3
mov qword [rdi + 0x10], rcx
mov r9d, 8
mov dword [rbp + 0x30], 3
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
lea rcx, [rdi + 0x80]
mov edx, eax
test eax, eax
jns 0x14007a70e
cmp ebx, 0xc0000073
cmove ebx, eax
jmp 0x14007a716
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rcx], eax
test edx, edx
js 0x14007a71e
mov qword [rdi + 0x18], rcx
mov r9d, 8
mov dword [rbp + 0x30], 4
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
lea rcx, [rdi + 0x84]
mov edx, eax
test eax, eax
jns 0x14007a759
cmp ebx, 0xc0000073
cmove ebx, eax
jmp 0x14007a761
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rcx], eax
test edx, edx
js 0x14007a769
mov qword [rdi + 0x20], rcx
mov r9d, 8
mov dword [rbp + 0x30], 6
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
lea rcx, [rdi + 0x88]
mov edx, eax
test eax, eax
jns 0x14007a7a4
cmp ebx, 0xc0000073
cmove ebx, eax
jmp 0x14007a7ac
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rcx], eax
test edx, edx
js 0x14007a7b4
mov qword [rdi + 0x30], rcx
mov r9d, 8
mov dword [rbp + 0x30], 7
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
lea rcx, [rdi + 0x8c]
mov edx, eax
test eax, eax
jns 0x14007a7ef
cmp ebx, 0xc0000073
cmove ebx, eax
jmp 0x14007a7f7
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rcx], eax
test edx, edx
js 0x14007a7ff
mov qword [rdi + 0x38], rcx
mov r9d, 8
mov dword [rbp + 0x30], 8
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
lea rcx, [rdi + 0x90]
mov edx, eax
test eax, eax
jns 0x14007a83a
cmp ebx, 0xc0000073
cmove ebx, eax
jmp 0x14007a842
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rcx], eax
test edx, edx
js 0x14007a84a
mov qword [rdi + 0x40], rcx
mov r9d, 8
mov dword [rbp + 0x30], 9
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
lea rcx, [rdi + 0x94]
mov edx, eax
test eax, eax
jns 0x14007a885
cmp ebx, 0xc0000073
cmove ebx, eax
jmp 0x14007a88d
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rcx], eax
test edx, edx
js 0x14007a895
mov qword [rdi + 0x48], rcx
mov r9d, 8
mov dword [rbp + 0x30], 0xa
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
lea rcx, [rdi + 0x98]
mov edx, eax
test eax, eax
jns 0x14007a8d0
cmp ebx, 0xc0000073
cmove ebx, eax
jmp 0x14007a8d8
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rcx], eax
test edx, edx
js 0x14007a8e0
mov qword [rdi + 0x50], rcx
mov r9d, 8
mov dword [rbp + 0x30], 0xb
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
lea rcx, [rdi + 0x9c]
mov edx, eax
test eax, eax
jns 0x14007a91b
cmp ebx, 0xc0000073
cmove ebx, eax
jmp 0x14007a923
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rcx], eax
test edx, edx
js 0x14007a92b
mov qword [rdi + 0x58], rcx
mov r9d, 8
mov dword [rbp + 0x30], 0xc
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
lea rcx, [rdi + 0xa0]
mov edx, eax
test eax, eax
jns 0x14007a966
cmp ebx, 0xc0000073
cmove ebx, eax
jmp 0x14007a96e
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rcx], eax
test edx, edx
js 0x14007a976
mov qword [rdi + 0x60], rcx
mov r9d, 8
mov dword [rbp + 0x30], 0xd
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
lea rcx, [rdi + 0xa4]
mov edx, eax
test eax, eax
jns 0x14007a9b1
cmp ebx, 0xc0000073
cmove ebx, eax
jmp 0x14007a9b9
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rcx], eax
mov eax, ebx
test edx, edx
js 0x14007a9c3
mov qword [rdi + 0x68], rcx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret