Function at 0x1400127a4
Capabilities:
Attach user process memory

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x14002f6d0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], r8
mov r13, rdx
mov r15d, ecx
and qword [r11 - 0x70], 0
and qword [r11 - 0x80], 0
mov r9d, 1
mov r8d, 0x410
mov edx, ecx
lea rcx, [r11 - 0x80]
call fcn.140013268
mov edi, eax
test eax, eax
jns 0x14001283c
mov dword [rsp + 0x30], r15d
lea rax, [0x140021650]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
lea r9, [0x140021670]
mov r8d, 0x12d
lea rdx, [0x140021400]
mov ecx, 7
call fcn.14000944c
mov r14, qword [rsp + 0x48]
jmp 0x140012c15
mov r14, qword [rsp + 0x48]
mov rcx, r14
call fcn.140012f78
mov rsi, rax
test rax, rax
jne 0x140012887
mov dword [rsp + 0x30], r15d
lea rax, [0x140021690]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
lea r9, [0x140021670]
mov r8d, 0x139
lea rdx, [0x140021400]
lea ecx, [rsi + 7]
call fcn.14000944c
jmp 0x140012c15
mov rcx, r14
call fcn.1400131f8
mov r12d, eax
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov r8, qword [r8]
lea edx, [r9 + 0x10]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov edi, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x1400128f9
lea rax, [0x1400216c0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
lea r9, [0x140021670]
mov r8d, 0x14b
lea rdx, [0x140021400]
mov ecx, 7
call fcn.14000944c
jmp 0x140012c15
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
test r12d, r12d
je 0x140012a68
mov r15d, 4
mov edx, r15d
lea rcx, [rsi + 0xc]
call fcn.140005aa4
test eax, eax
jne 0x14001295d
lea rax, [0x1400216f0]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [0x140021670]
mov r8d, 0x160
lea rdx, [0x140021400]
lea ecx, [r15 - 3]
call fcn.14000944c
jmp 0x140012c0a
mov esi, dword [rsi + 0xc]
mov rdx, r15
lea rcx, [rsi + 0xc]
call fcn.140005aa4
test eax, eax
jne 0x1400129a5
lea rax, [0x1400216f0]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [0x140021670]
mov r8d, 0x168
lea rdx, [0x140021400]
mov ecx, 1
call fcn.14000944c
jmp 0x140012c0a
mov esi, dword [rsi + 0xc]
mov r15d, esi
mov edx, 0x48
mov rcx, rsi
call fcn.140005aa4
test eax, eax
jne 0x1400129f1
lea rax, [0x1400216f0]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [0x140021670]
mov r8d, 0x174
lea rdx, [0x140021400]
mov ecx, 1
call fcn.14000944c
jmp 0x140012c0a
movzx edx, word [rsi + 0x24]
mov ecx, dword [rsi + 0x28]
call fcn.140005aa4
test eax, eax
jne 0x140012a36
lea rax, [0x1400216f0]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [0x140021670]
mov r8d, 0x17a
lea rdx, [0x140021400]
mov ecx, 1
call fcn.14000944c
jmp 0x140012c0a
cmp dword [rsi + 0x18], 0
je 0x140012a50
mov r8, qword [rsp + 0x50]
mov edx, r12d
mov rcx, rsi
call r13
mov edi, eax
mov dword [rsp + 0x40], eax
mov esi, dword [rsi]
test edi, edi
js 0x140012bcd
cmp rsi, r15
jne 0x1400129ab
jmp 0x140012bb6
mov r15d, 8
mov edx, r15d
lea rcx, [rsi + 0x18]
call fcn.140005aa4
test eax, eax
jne 0x140012ab2
lea rax, [0x1400216f0]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [0x140021670]
mov r8d, 0x18f
lea rdx, [0x140021400]
lea ecx, [r15 - 7]
call fcn.14000944c
jmp 0x140012c0a
mov rsi, qword [rsi + 0x18]
mov rdx, r15
lea rcx, [rsi + 0x10]
call fcn.140005aa4
test eax, eax
jne 0x140012afb
lea rax, [0x1400216f0]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [0x140021670]
mov r8d, 0x197
lea rdx, [0x140021400]
mov ecx, 1
call fcn.14000944c
jmp 0x140012c0a
mov rsi, qword [rsi + 0x10]
mov r15, rsi
mov edx, 0x88
mov rcx, rsi
call fcn.140005aa4
test eax, eax
jne 0x140012b48
lea rax, [0x1400216f0]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [0x140021670]
mov r8d, 0x1a3
lea rdx, [0x140021400]
mov ecx, 1
call fcn.14000944c
jmp 0x140012c0a
movzx edx, word [rsi + 0x48]
mov rcx, qword [rsi + 0x50]
call fcn.140005aa4
test eax, eax
jne 0x140012b8b
lea rax, [0x1400216f0]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [0x140021670]
mov r8d, 0x1a9
lea rdx, [0x140021400]
mov ecx, 1
call fcn.14000944c
jmp 0x140012c0a
cmp qword [rsi + 0x30], 0
je 0x140012ba6
mov r8, qword [rsp + 0x50]
mov edx, r12d
mov rcx, rsi
call r13
mov edi, eax
mov dword [rsp + 0x40], eax
mov rsi, qword [rsi]
test edi, edi
js 0x140012bcd
cmp rsi, r15
jne 0x140012b02
test edi, edi
js 0x140012bcd
mov r8, qword [rsp + 0x50]
mov edx, r12d
xor ecx, ecx
call r13
mov edi, eax
mov dword [rsp + 0x40], eax
jmp 0x140012c0a
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test r14, r14
je 0x140012c23
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140012c33
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140015670
mov rsi, qword [rsp + 0xe8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
ret