Function at 0x19b6c
Capabilities:
Find process by pid

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3f8
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0x3e0], rax
mov rbx, qword [rsp + 0x468]
xor r15d, r15d
mov r12, r9
mov qword [rsp + 0x40], r9
mov r13d, r8d
mov rdi, rdx
mov byte [rsp + 0x31], r15b
mov qword [rsp + 0x38], rdx
mov rsi, rcx
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], r15
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, r15d
jl 0x19beb
mov rcx, qword [rsp + 0x50]
call fcn.00039bee
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor edx, edx
lea rcx, [rsp + 0x391]
mov byte [rsp + 0x30], r15b
lea r8d, [rdx + 0x4f]
mov byte [rsp + 0x34], r15b
mov dword [rsp + 0x48], r15d
mov byte [rsp + 0x390], r15b
call fcn.0003a1a0
mov r14d, dword [rsp + 0x460]
mov qword [rsp + 0x138], rdi
mov edi, 0x104
lea rcx, [rsp + 0x14d]
xor edx, edx
mov r8, rdi
mov dword [rsp + 0x149], r14d
mov byte [rsp + 0x33], r15b
mov qword [rsp + 0x130], rsi
mov byte [rsp + 0x140], r13b
mov qword [rsp + 0x141], r12
call fcn.0003a1a0
mov ebp, dword [rsp + 0x470]
cmp rbx, r15
je 0x19c8b
cmp ebp, r15d
je 0x19c8b
cmp ebp, edi
mov r8, rbp
lea rcx, [rsp + 0x14d]
cmova r8, rdi
mov rdx, rbx
call fcn.00039c50
lea rcx, [rsp + 0x130]
call fcn.0001cf60
mov edi, eax
mov rax, cr8
cmp al, r15b
je 0x19d0b
mov rax, cr8
lea r8, [0x0003ac50]
lea rcx, [rsp + 0x390]
movzx r9d, al
mov edx, 0x50
mov dword [rsp + 0x20], edi
call fcn.0001110c
call fcn.0003a0b0
mov ecx, 0x80001029
lea r9, [rsp + 0x390]
mov rdx, rsi
mov r8d, eax
call fcn.00034e5c
mov al, 1
mov rcx, qword [rsp + 0x3e0]
xor rcx, rsp
call fcn.00039b80
add rsp, 0x3f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, [rsp + 0x33]
call fcn.00033970
cmp al, r15b
je 0x19d49
cmp byte [rsp + 0x33], r15b
je 0x19d49
lea r8, [0x0003ac70]
lea rcx, [rsp + 0x390]
mov r9d, edi
mov edx, 0x50
call fcn.0001110c
call fcn.0003a0b0
mov ecx, 0x8000102a
jmp 0x19cd2
lea rdx, [0x0004cc10]
mov eax, r15d
mov rcx, rdx
cmp dword [rcx], edi
je 0x19d67
inc eax
add rcx, 0x10
cmp eax, 0x36
jb 0x19d56
jmp 0x19d6f
add rax, rax
mov r15d, dword [rdx + rax*8 + 4]
lea rcx, [rsp + 0x26c]
lea rdx, [rsp + 0x130]
mov r8d, 0x121
mov dword [rsp + 0x260], 0x12e
mov dword [rsp + 0x60], 0xd0
call fcn.00039c50
xor eax, eax
mov dword [rsp + 0x268], 0x121
mov dword [rsp + 0x264], 1
cmp qword [rsp + 0x38], rax
jne 0x19dda
lea r8, [rsp + 0x31]
mov edx, edi
mov rcx, rsi
call fcn.0001d240
xor ecx, ecx
cmp al, cl
je 0x19e41
mov al, byte [rsp + 0x31]
jmp 0x19ce7
cmp r13d, eax
jne 0x19e43
mov rbp, qword [rsp + 0x38]
mov rcx, rsi
mov byte [rsp + 0x32], 1
mov rdx, rbp
call fcn.00034da4
xor ebx, ebx
mov r12, rax
cmp rax, rbx
je 0x19f08
mov edx, dword [rsp + 0x40]
lea r9, [rsp + 0x32]
mov r8, rsi
mov rcx, rax
call fcn.00021a6c
movzx ecx, byte [rsp + 0x32]
mov bl, al
xor eax, eax
movzx ebp, al
cmp bl, al
cmovne ebp, ecx
mov rcx, r12
call fcn.00035504
xor ecx, ecx
cmp bl, cl
je 0x19f0f
mov al, bpl
jmp 0x19ce7
xor eax, eax
cmp r13d, 0x16
jne 0x19ead
cmp rbx, rax
je 0x19f14
cmp ebp, eax
je 0x19f14
cmp byte [rbx], al
je 0x19f14
lea edx, [r13 + 0x46]
mov rcx, rbx
call sub.ntoskrnl.exe_strrchr
xor ecx, ecx
cmp rax, rcx
je 0x19e7a
inc rax
jmp 0x19e7d
mov rax, rbx
mov edx, 0x2e
mov rcx, rax
call sub.ntoskrnl.exe_strrchr
xor ebx, ebx
cmp rax, rbx
je 0x19f16
lea rdx, [0x0003ac80]
mov rcx, rax
call sub.ntoskrnl.exe__stricmp
cmp eax, ebx
jne 0x19f16
jmp 0x19ce5
cmp r13d, 5
jne 0x19ee6
cmp r12, 5
jne 0x19f14
lea rdx, [0x0003a960]
mov rcx, rsi
call fcn.00031798
xor ebx, ebx
cmp al, bl
je 0x19f16
lea rdx, [0x0003acb0]
mov rcx, rsi
call fcn.0003191c
cmp al, bl
je 0x19f16
jmp 0x19ce5
cmp r13d, 0xb
jne 0x19f14
call fcn.00030c68
xor ebx, ebx
cmp al, bl
je 0x19f16
lea rcx, [0x0003d300]
call fcn.00030630
cmp rax, rsi
jmp 0x19ea6
mov r12, qword [rsp + 0x40]
jmp 0x19f1b
mov r12, qword [rsp + 0x40]
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
mov rcx, rsi
call fcn.000198b4
cmp al, bl
jne 0x19ce5
cmp qword [0x0004ed80], rbx
je 0x19fae
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x19f4d
lea rcx, [0x0003a930]
call fcn.00030998
jmp 0x19f5c
lea rdx, [0x0003a930]
mov rcx, rsi
call fcn.00031798
cmp al, bl
je 0x19fae
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x19f7b
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, rax
call sub.ntoskrnl.exe_PsGetProcessInheritedFromUniqueProcessId
jmp 0x19f83
mov rcx, rsi
call fcn.000309d8
cmp rax, rbx
jne 0x19f8d
mov rax, rbx
jmp 0x19f95
mov rcx, rax
call fcn.000309d8
cmp rax, qword [0x0004ed80]
jne 0x19fae
mov rcx, rsi
call fcn.00022c9c
cmp al, bl
je 0x19ce5
lea rax, [rsp + 0x34]
mov r9, rsi
mov r8d, r14d
mov rdx, r12
mov ecx, edi
mov qword [rsp + 0x20], rax
call fcn.00022b34
cmp al, bl
je 0x19fff
mov bl, byte [rsp + 0x34]
xor r12d, r12d
cmp rbp, r12
jne 0x19ff4
cmp edi, 0x1b
je 0x19ff4
cmp edi, 0x27
je 0x19ff4
cmp edi, 0x38
je 0x19ff4
mov r8b, bl
mov edx, edi
mov rcx, rsi
call fcn.0001d318
cmp bl, r12b
setne al
jmp 0x19ce7
cmp r13d, 6
jne 0x1a081
call fcn.0002abe8
cmp al, bl
je 0x1a081
mov al, byte [0x0004ec0f]
cmp al, bl
je 0x1a081
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x1a058
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, rax
call fcn.00030a20
cmp al, bl
je 0x1a039
mov al, 1
jmp 0x1a076
lea rcx, [0x0003d2e0]
call fcn.00030630
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rbx, rax
sete al
xor ebx, ebx
jmp 0x1a076
lea rcx, [0x0003d2e0]
call fcn.00030630
cmp rax, rsi
je 0x1a035
mov rcx, rsi
call fcn.00030a20
cmp al, bl
setne al
cmp al, bl
je 0x1a081
mov bl, 1
jmp 0x1a133
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x1a093
call fcn.0003173c
jmp 0x1a09b
mov rcx, rsi
call fcn.000316e0
cmp al, bl
je 0x1a12f
cmp r13d, 0x24
je 0x1a12f
cmp r13d, 0x27
jne 0x1a0d0
lea rcx, [0x0003d2e0]
call fcn.00030630
cmp rax, rsi
je 0x1a12f
mov rcx, rsi
call fcn.00030a20
cmp al, bl
jne 0x1a12f
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, rax
call fcn.00030a20
cmp al, bl
jne 0x1a102
lea rcx, [0x0003d2e0]
call fcn.00030630
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rbx, rax
je 0x1a102
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp edi, 0x1b
je 0x19ce5
cmp edi, 0x27
je 0x19ce5
cmp edi, 0x38
je 0x19ce5
mov r8b, 1
mov edx, edi
mov rcx, rsi
call fcn.0001d318
jmp 0x19ce5
mov bl, byte [rsp + 0x30]
mov r9, r12
mov r8d, r13d
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r14d
call fcn.0001a884
xor r14d, r14d
cmp al, r14b
jne 0x19ce5
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, rax
call fcn.00035348
cmp rax, r14
je 0x1a174
mov rcx, rax
call fcn.00035504
call fcn.0002abe8
cmp al, r14b
jne 0x1a1f5
cmp r13d, r14d
jne 0x1a1df
cmp r12, 0x101
je 0x1a1df
cmp r12, 0x100
jne 0x1a1f0
lea rcx, [0x0003acb0]
call fcn.00030e60
cmp al, r14b
jne 0x19ce5
call fcn.00030c68
cmp al, r14b
je 0x1a1f0
lea rcx, [0x0003a9c0]
call fcn.00030e60
cmp al, r14b
jne 0x19ce5
lea rcx, [0x0003d320]
call fcn.00030e60
cmp al, r14b
je 0x1a1f0
jmp 0x19ce5
cmp r13d, 3
jne 0x1a1ea
cmp r12, r14
je 0x1a1f0
cmp r13d, 0xc
jne 0x1a1f5
call fcn.0001a5e0
call fcn.0002abe8
cmp al, r14b
je 0x19ce5
mov ecx, r15d
call fcn.0001cecc
cmp al, r14b
je 0x19ce5
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, qword [0x0004ed80]
cmp rcx, rax
je 0x19ce5
cmp rcx, rsi
je 0x19ce5
cmp bl, r14b
jne 0x1a28d
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x1a24c
call fcn.00039c36
mov ebx, eax
jmp 0x1a281
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov qword [rsp + 0x40], r14
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, r14d
jge 0x1a269
mov ebx, r14d
jmp 0x1a281
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessSessionId]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp dword [0x0004ed7c], ebx
jne 0x19ce5
mov r8b, 1
mov edx, 0x40
mov rcx, rsi
call fcn.0001e72c
lea r9, [rsp + 0x60]
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x48]
mov r8d, 0x12e
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0xd0
call fcn.0002aa24
cmp al, r14b
jne 0x1a31b
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x19ce5
mov rcx, qword gs:[0x188]
call qword [sym.imp.ntoskrnl.exe_PsIsThreadTerminating]
cmp al, r14b
je 0x19ce5
mov rcx, rsi
call fcn.00033624
mov rbx, rax
call fcn.0003a0b0
mov r9, rbx
mov rdx, rsi
mov ecx, 0x1002
mov r8d, eax
call fcn.00034e5c
jmp 0x1a4ae
cmp dword [rsp + 0x64], 4
jne 0x19ce5
mov eax, dword [rsp + 0x68]
mov ebx, 0x3f
cmp eax, 2
je 0x1a33e
cmp eax, 8
je 0x1a33e
cmp eax, 7
jne 0x1a37c
cmp rbp, r14
jne 0x1a367
cmp edi, 0x1b
je 0x1a37c
cmp edi, 0x27
je 0x1a37c
cmp edi, 0x38
je 0x1a37c
mov edx, ebx
cmp eax, 2
mov r8b, 1
cmove edx, edi
mov rcx, rsi
call fcn.0001d318
jmp 0x1a378
mov r9b, 1
mov r8d, r12d
mov rdx, rbp
mov rcx, rsi
call fcn.0001a820
mov eax, dword [rsp + 0x68]
cmp eax, 4
je 0x1a38b
cmp eax, 6
je 0x1a38b
cmp eax, 5
jne 0x1a3ce
cmp rbp, r14
jne 0x1a3b4
cmp edi, 0x1b
je 0x1a3ce
cmp edi, 0x27
je 0x1a3ce
cmp edi, 0x38
je 0x1a3ce
cmp eax, 4
mov rcx, rsi
cmove ebx, edi
xor r8d, r8d
mov edx, ebx
call fcn.0001d318
jmp 0x1a3ca
cmp r13d, r14d
jne 0x1a3ce
xor r9d, r9d
mov r8d, r12d
mov rdx, rbp
mov rcx, rsi
call fcn.0001a820
mov eax, dword [rsp + 0x68]
cmp edi, 0x1f
je 0x1a405
cmp edi, 0x20
je 0x1a405
cmp edi, 0x12
je 0x1a405
cmp edi, 0x13
je 0x1a405
cmp edi, 0x11
je 0x1a405
cmp edi, 0x14
je 0x1a405
cmp edi, 0x2f
je 0x1a405
cmp edi, 0x3c
je 0x1a405
cmp edi, 0x40
je 0x1a405
cmp edi, 0x41
je 0x1a405
cmp edi, 0x28
jne 0x1a42a
cmp eax, 3
jne 0x1a42a
cmp edi, 0x1b
je 0x1a42a
cmp edi, 0x27
je 0x1a42a
cmp edi, 0x38
je 0x1a42a
xor r8d, r8d
mov edx, edi
mov rcx, rsi
call fcn.0001d318
mov eax, dword [rsp + 0x68]
cmp edi, 0x1f
je 0x1a461
cmp edi, 0x20
je 0x1a461
cmp edi, 0x12
je 0x1a461
cmp edi, 0x13
je 0x1a461
cmp edi, 0x11
je 0x1a461
cmp edi, 0x14
je 0x1a461
cmp edi, 0x2f
je 0x1a461
cmp edi, 0x3c
je 0x1a461
cmp edi, 0x40
je 0x1a461
cmp edi, 0x41
je 0x1a461
cmp edi, 0x28
jne 0x1a492
cmp eax, 1
jne 0x1a492
cmp edi, 0x1b
je 0x19ce5
cmp edi, 0x27
je 0x19ce5
cmp edi, 0x38
je 0x19ce5
mov r8b, al
mov edx, edi
mov rcx, rsi
call fcn.0001d318
mov eax, dword [rsp + 0x68]
cmp eax, r14d
jbe 0x1a4ae
cmp eax, 2
jbe 0x19ce5
cmp eax, 6
jbe 0x1a4ae
cmp eax, 8
jbe 0x19ce5
xor al, al
jmp 0x19ce7