Function at 0x140003c00
Capabilities:
Allocate or change rwx memory
Allocate user process rwx memory
Attach user process memory
Contain obfuscated stackstrings
Find process by pid
Free user process memory
Parse pe header

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x1a0
mov rax, qword [0x14000e500]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp qword [rsp + 0x1c0], 0
jne 0x140003c43
mov eax, 0xc0000001
jmp 0x1400046c2
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x88], 0
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x1b0]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x140003c82
lfence
mov eax, dword [rsp + 0x30]
jmp 0x1400046c2
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessExitStatus]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x103
je 0x140003cb0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, 0xc0000001
jmp 0x1400046c2
mov rdx, qword [rsp + 0x1c0]
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x1c0]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.140006900
mov r8, qword [rsp + 0x1c0]
mov rdx, qword [rsp + 0x1b8]
mov rcx, qword [rsp + 0x60]
call fcn.140006640
lea rax, [rsp + 0xf0]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rax, qword [rsp + 0x60]
mov r9d, dword [rax]
lea r8, [0x140007120]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xa8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov eax, dword [rax + 0x50]
mov qword [rsp + 0xb8], rax
mov r9, qword [rsp + 0xb8]
lea r8, [0x140007140]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov qword [rsp + 0x38], 0
mov rax, qword [rsp + 0x1c0]
add rax, 0x1000
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x58], 0
cmp dword [rsp + 0x1d0], 1
jne 0x140003dd7
mov qword [rsp + 0x58], 0xe60
jmp 0x140003de0
mov qword [rsp + 0x58], 0xe10
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessId]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
lea r8, [0x140007160]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x1000
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov dword [rsp + 0x30], eax
mov r8, qword [rsp + 0x58]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.140006900
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
call fcn.140005020
mov rax, cr3
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xc0]
mov cr3, rax
cmp dword [rsp + 0x30], 0
jge 0x140003e78
jmp 0x140004671
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x1000
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, [rsp + 0x38]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x140003ecf
mov r9d, 0x8000
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
jmp 0x140004671
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessId]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x30]
lea r8, [0x140007180]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov r8, qword [rsp + 0x68]
xor edx, edx
mov rcx, qword [rsp + 0x38]
call fcn.140006900
cmp dword [rsp + 0x1d0], 1
jne 0x140003f36
mov r8d, 0xe60
lea rdx, [0x14000d420]
mov rcx, qword [rsp + 0x40]
call fcn.140006640
jmp 0x140003f4d
mov r8d, 0xe10
lea rdx, [0x14000c610]
mov rcx, qword [rsp + 0x40]
call fcn.140006640
mov r8, qword [rsp + 0x1c0]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
call fcn.140006640
mov r9, qword [rsp + 0x40]
lea r8, [0x1400071b0]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x68]
lea rax, [rax + rcx - 0x1000]
mov qword [rsp + 0x48], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x48]
mov qword [rcx + rax], 0
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
mov qword [rcx + rax], rdx
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax], rdx
mov eax, 8
imul rax, rax, 3
mov rcx, qword [rsp + 0x48]
mov qword [rcx + rax], 0
mov byte [rsp + 0x120], 0x48
mov byte [rsp + 0x121], 0x81
mov byte [rsp + 0x122], 0xec
mov byte [rsp + 0x123], 0xa8
mov byte [rsp + 0x124], 0
mov byte [rsp + 0x125], 0
mov byte [rsp + 0x126], 0
mov byte [rsp + 0x127], 0x50
mov byte [rsp + 0x128], 0x51
mov byte [rsp + 0x129], 0x52
mov byte [rsp + 0x12a], 0x53
mov byte [rsp + 0x12b], 0x54
mov byte [rsp + 0x12c], 0x55
mov byte [rsp + 0x12d], 0x56
mov byte [rsp + 0x12e], 0x57
mov byte [rsp + 0x12f], 0x41
mov byte [rsp + 0x130], 0x50
mov byte [rsp + 0x131], 0x41
mov byte [rsp + 0x132], 0x51
mov byte [rsp + 0x133], 0x41
mov byte [rsp + 0x134], 0x52
mov byte [rsp + 0x135], 0x41
mov byte [rsp + 0x136], 0x53
mov byte [rsp + 0x137], 0x41
mov byte [rsp + 0x138], 0x54
mov byte [rsp + 0x139], 0x41
mov byte [rsp + 0x13a], 0x55
mov byte [rsp + 0x13b], 0x41
mov byte [rsp + 0x13c], 0x56
mov byte [rsp + 0x13d], 0x41
mov byte [rsp + 0x13e], 0x57
mov byte [rsp + 0x13f], 0x48
mov byte [rsp + 0x140], 0xb8
mov byte [rsp + 0x141], 0x89
mov byte [rsp + 0x142], 0x67
mov byte [rsp + 0x143], 0x45
mov byte [rsp + 0x144], 0x23
mov byte [rsp + 0x145], 1
mov byte [rsp + 0x146], 0
mov byte [rsp + 0x147], 0
mov byte [rsp + 0x148], 0
mov byte [rsp + 0x149], pe_nt_image_headers64
mov byte [rsp + 0x14a], 0xf
mov byte [rsp + 0x14b], 0xba
mov byte [rsp + 0x14c], 0x28
mov byte [rsp + 0x14d], 1
mov byte [rsp + 0x14e], 0x72
mov byte [rsp + 0x14f], 0xa
mov byte [rsp + 0x150], 0x48
mov byte [rsp + 0x151], 0x8b
mov byte [rsp + 0x152], 0x48
mov byte [rsp + 0x153], 8
mov byte [rsp + 0x154], 0x48
mov byte [rsp + 0x155], 0x8b
mov byte [rsp + 0x156], 0x40
mov byte [rsp + 0x157], 0x10
mov byte [rsp + 0x158], 0xff
mov byte [rsp + 0x159], 0xd0
mov byte [rsp + 0x15a], 0x49
mov byte [rsp + 0x15b], 0xbe
mov byte [rsp + 0x15c], 0x89
mov byte [rsp + 0x15d], 0x67
mov byte [rsp + 0x15e], 0x45
mov byte [rsp + 0x15f], 0x23
mov byte [rsp + 0x160], 1
mov byte [rsp + 0x161], 0
mov byte [rsp + 0x162], 0
mov byte [rsp + 0x163], 0
mov byte [rsp + 0x164], 0x49
mov byte [rsp + 0x165], 0x89
mov byte [rsp + 0x166], 6
mov byte [rsp + 0x167], 0x41
mov byte [rsp + 0x168], 0x5f
mov byte [rsp + 0x169], 0x41
mov byte [rsp + 0x16a], 0x5e
mov byte [rsp + 0x16b], 0x41
mov byte [rsp + 0x16c], 0x5d
mov byte [rsp + 0x16d], 0x41
mov byte [rsp + 0x16e], 0x5c
mov byte [rsp + 0x16f], 0x41
mov byte [rsp + 0x170], 0x5b
mov byte [rsp + 0x171], 0x41
mov byte [rsp + 0x172], 0x5a
mov byte [rsp + 0x173], 0x41
mov byte [rsp + 0x174], 0x59
mov byte [rsp + 0x175], 0x41
mov byte [rsp + 0x176], 0x58
mov byte [rsp + 0x177], 0x5f
mov byte [rsp + 0x178], 0x5e
mov byte [rsp + 0x179], 0x5d
mov byte [rsp + 0x17a], 0x5c
mov byte [rsp + 0x17b], 0x5b
mov byte [rsp + 0x17c], 0x5a
mov byte [rsp + 0x17d], 0x59
mov byte [rsp + 0x17e], 0x58
mov byte [rsp + 0x17f], 0x48
mov byte [rsp + 0x180], 0x81
mov byte [rsp + 0x181], 0xc4
mov byte [rsp + 0x182], 0xa8
mov byte [rsp + 0x183], 0
mov byte [rsp + 0x184], 0
mov byte [rsp + 0x185], 0
mov byte [rsp + 0x186], 0x41
mov byte [rsp + 0x187], 0xff
mov byte [rsp + 0x188], 0xe2
mov qword [rsp + 0x80], 0
mov eax, 1
imul rax, rax, 0x21
movzx ecx, byte [rsp + 0x48]
mov byte [rsp + rax + 0x120], cl
lea rax, [rsp + 0x141]
mov r8d, 8
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.140006640
mov rax, qword [rsp + 0x48]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x15c]
mov r8d, 8
lea rdx, [rsp + 0x78]
mov rcx, rax
call fcn.140006640
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessId]
lea r9, [rsp + 0x80]
mov r8d, 0x69
lea rdx, [rsp + 0x120]
mov rcx, rax
call fcn.140005400
mov dword [rsp + 0xa0], 0
xor eax, eax
cmp eax, 1
je 0x14000440e
mov ecx, 0x32
call qword [sym.imp.HAL.dll_KeStallExecutionProcessor]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
jne 0x1400043f5
jmp 0x14000440e
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x48]
cmp qword [rcx + rax], 0
je 0x14000440c
jmp 0x14000440e
jmp 0x1400043cf
cmp dword [rsp + 0x1d0], 1
jne 0x140004485
xor eax, eax
cmp eax, 1
je 0x140004485
mov ecx, 0x32
call qword [sym.imp.HAL.dll_KeStallExecutionProcessor]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
jne 0x14000443e
jmp 0x140004485
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax]
cmp eax, 8
jne 0x140004483
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 8]
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x70], eax
mov edx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0xc8]
call fcn.140005020
mov rax, qword [rsp + 0x38]
mov byte [rax], 1
jmp 0x140004485
jmp 0x140004418
mov qword [rsp + 0xd0], 0
mov r9d, 8
lea r8, [rsp + 0xd0]
mov edx, 0x28
mov rcx, 0xffffffffffffffff
call sub.ntoskrnl.exe_ZwSetInformationProcess
lea rax, [rsp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov qword [rsp + 0x90], 0xfffffffffe363c80
lea r8, [rsp + 0x90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_KeDelayExecutionThread]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x140004506
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
mov qword [rsp + 0x88], rax
jmp 0x14000450b
jmp 0x140004671
cmp dword [rsp + 0x1d0], 2
jne 0x140004542
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0xe8], rax
lea rcx, [rsp + 0xe0]
call fcn.140004f50
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x140004567
mov r8, qword [rsp + 0x68]
xor edx, edx
mov rcx, qword [rsp + 0x38]
call fcn.140006900
jmp 0x14000456c
jmp 0x140004671
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x140004591
mov r8, qword [rsp + 0x58]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.140006900
jmp 0x140004596
jmp 0x140004671
mov qword [rsp + 0x98], 0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x1400045da
mov r9d, 0x8000
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
mov dword [rsp + 0x30], eax
jmp 0x1400045df
jmp 0x140004671
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x140004617
mov r9d, 0x8000
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x38]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
mov dword [rsp + 0x30], eax
jmp 0x140004619
jmp 0x140004671
mov qword [rsp + 0xd8], 0x1000
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x140004663
mov r9d, 0x8000
lea r8, [rsp + 0xd8]
lea rdx, [rsp + 0x80]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
mov dword [rsp + 0x30], eax
jmp 0x140004665
jmp 0x140004671
jmp 0x140004671
lea rcx, [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rax, qword [rsp + 0x1c8]
mov rcx, qword [rsp + 0x88]
mov qword [rax], rcx
lea r8, [0x1400071d0]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140006420
add rsp, 0x1a0
pop rdi
ret