Function at 0x140006520
Capabilities:
Attach user process memory
Print debug messages

Disassembly:
sub rsp, 0xe8
mov qword [rsp + 0x48], 0
mov byte [rsp + 0x21], 0
mov byte [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x40], 0
call fcn.14000ee60
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x140006575
jmp 0x14000682b
mov rcx, qword [rsp + 0x60]
call fcn.140005360
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140006591
jmp 0x14000682b
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
jne 0x1400065a8
jmp 0x14000682b
mov rcx, qword [rsp + 0x38]
call fcn.1400059b0
movzx eax, al
test eax, eax
je 0x1400065be
jmp 0x14000682b
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov byte [rsp + 0x20], 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x1400065ff
lea rcx, [0x140025b80]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14000682b
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000682b
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14000682b
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov rax, qword [rsp + 0x30]
sub rax, 0x10
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x140006800
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x60]
lea rcx, [0x140025bc0]
sub rcx, rax
movzx edx, word [rax]
cmp dx, word [rax + rcx]
jne 0x1400066a4
add rax, 2
test dx, dx
jne 0x14000668e
xor eax, eax
jmp 0x1400066a9
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140006800
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400066cc
jmp 0x14000681d
lea rdx, [0x140025be0]
mov rcx, qword [rsp + 0x28]
call fcn.140012730
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x1400066fb
mov rcx, qword [rsp + 0x68]
call fcn.1400064a0
mov qword [0x14002ba50], rax
lea rdx, [0x140025bf0]
mov rcx, qword [rsp + 0x28]
call fcn.140012730
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
je 0x14000672a
mov rcx, qword [rsp + 0x70]
call fcn.1400064a0
mov qword [0x14002ba58], rax
lea rdx, [0x140025c00]
mov rcx, qword [rsp + 0x28]
call fcn.140012730
mov qword [0x14002bac0], rax
cmp qword [0x14002bac0], 0
je 0x14000675f
mov rcx, qword [0x14002bac0]
call fcn.1400064a0
mov qword [0x14002ba60], rax
lea rdx, [0x140025c20]
mov rcx, qword [rsp + 0x28]
call fcn.140012730
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
je 0x14000678e
mov rcx, qword [rsp + 0x78]
call fcn.1400064a0
mov qword [0x14002ba70], rax
lea rdx, [0x140025c40]
mov rcx, qword [rsp + 0x28]
call fcn.140012730
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x1400067c6
mov rcx, qword [rsp + 0x80]
call fcn.1400064a0
mov qword [0x14002ba78], rax
lea rdx, [0x140025c60]
mov rcx, qword [rsp + 0x28]
call fcn.140012730
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0
je 0x1400067fe
mov rcx, qword [rsp + 0x88]
call fcn.1400064a0
mov qword [0x14002ba68], rax
jmp 0x14000681d
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x30], rax
jne 0x140006661
jmp 0x140006821
xor eax, eax
test eax, eax
jne 0x14000655e
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x140006842
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
add rsp, 0xe8
ret