Function at 0x14000632c
Capabilities:
Access pe header
Allocate or change rwx memory
Attach user process memory
Execute shellcode via indirect call
Find process by pid

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x130
mov rsi, rcx
and dword [rax + 8], 0
and qword [rax + 0x18], 0
mov ecx, dword [rcx + 0x808]
lea rdx, [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
mov dword [rsp + 0x50], eax
test eax, eax
js 0x14000681d
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor r14d, r14d
xor r15d, r15d
mov qword [rsp + 0x70], r15
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
test rax, rax
setne r12b
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, rax
call fcn.140001c40
test al, al
je 0x1400063bf
mov rcx, qword [rsp + 0x170]
test rcx, rcx
je 0x1400063b5
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, 0xc000010a
jmp 0x140006832
cmp dword [rsi], 2
jne 0x140006436
mov rcx, qword [rsi + 0x818]
test rcx, rcx
je 0x140006436
mov edx, dword [rsi + 0x820]
mov r8d, 1
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov edx, dword [rsi + 0x820]
mov ecx, 1
mov r8d, 0x2a6cf6e7
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r15, rax
mov qword [rsp + 0x70], rax
mov r8d, dword [rsi + 0x820]
mov rdx, qword [rsi + 0x818]
mov rcx, rax
call fcn.1400022c0
jmp 0x140006436
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea rdx, [rsi + 4]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x14000a230]
lea rcx, [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
cmp dword [rsi], 2
jne 0x1400064f0
xor edx, edx
lea r8d, [rdx + 0x58]
lea rcx, [rsp + 0xd0]
call fcn.1400021c0
nop
lea rax, [rsi + 0x404]
mov r9d, dword [rsi + 0x820]
lea rcx, [rsp + 0xd0]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov eax, dword [rsi + 0x804]
mov dword [rsp + 0x30], eax
mov eax, dword [rsi + 0x810]
mov dword [rsp + 0x28], eax
mov al, byte [rsi + 0x824]
mov byte [rsp + 0x20], al
mov r8, r15
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x170]
call fcn.1400080e4
mov edi, eax
mov dword [rsp + 0x50], eax
jmp 0x14000680f
mov r8b, r12b
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x170]
call fcn.140006b80
mov r15d, 0xc0000225
test rax, rax
cmove edi, r15d
test edi, edi
js 0x14000653d
xor r9d, r9d
mov r8, qword [rsp + 0x170]
lea rdx, [0x14000a250]
mov rcx, rax
call fcn.140006844
mov r14, rax
test rax, rax
cmove edi, r15d
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.ntoskrnl.exe_PsIsProtectedProcess]
test al, al
je 0x140006572
mov eax, dword [rsi + 0x808]
mov dword [rsp + 0x60], eax
and dword [rsp + 0x64], 0
and dword [rsp + 0x68], 0
and dword [rsp + 0x6c], 0
lea rcx, [rsp + 0x60]
call fcn.140009d14
test edi, edi
js 0x1400067e6
and qword [rsp + 0x58], 0
lea rdx, [rsp + 0x78]
mov rcx, r14
test r12b, r12b
je 0x140006594
call fcn.1400061f8
jmp 0x140006599
call fcn.140006088
mov qword [rsp + 0x178], rax
cmp dword [rsi], 0
jne 0x1400066d4
lea rcx, [rsp + 0x160]
mov qword [rsp + 0x20], rcx
mov r9b, byte [rsi + 0x80c]
mov r14d, 4
mov r8d, r14d
xor edx, edx
mov rcx, rax
call fcn.140001498
mov edi, eax
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x178]
cmp dword [rsp + 0x160], 0
jge 0x1400065f5
mov edi, dword [rsp + 0x160]
jmp 0x1400066d9
cmp qword [rax + 0x5e0], 0
je 0x1400066dd
cmp dword [rsi + 0x804], 0
je 0x1400066dd
add rax, 0x210
lea rcx, [rsi + 0x404]
mov edx, 7
lea r8d, [rdx + 0x79]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
add rax, r8
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
add rcx, r8
sub rdx, 1
jne 0x140006626
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
mov rax, qword [rsp + 0x178]
lea rdx, [rax + 0x210]
mov ecx, dword [rsi + 0x804]
add rcx, qword [rax + 0x5e0]
lea rax, [rsp + 0x160]
mov qword [rsp + 0x20], rax
mov r9b, 1
mov r8d, r14d
call fcn.140001498
mov rax, qword [rsp + 0x178]
jmp 0x1400066dd
mov edi, 0xc000000d
mov dword [rsp + 0x50], edi
test edi, edi
js 0x1400067c9
cmp byte [rsi + 0x80d], 0
je 0x14000670d
mov r8b, r12b
mov rdx, qword [rax + 0x5e0]
mov rcx, qword [rsp + 0x170]
call fcn.140006fa8
mov rax, qword [rsp + 0x178]
cmp byte [rsi + 0x80e], 0
je 0x1400067c9
mov rcx, qword [rax + 0x5e0]
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
test rax, rax
je 0x1400067c3
and dword [rsp + 0x168], 0
mov eax, dword [rax + 0x54]
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x178]
add rdx, 0x5e0
lea rax, [rsp + 0x168]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8, [rsp + 0x58]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwProtectVirtualMemory]
test eax, eax
js 0x1400067c3
mov r8, qword [rsp + 0x58]
xor edx, edx
mov rcx, qword [rsp + 0x178]
mov rcx, qword [rcx + 0x5e0]
call fcn.1400021c0
mov rdx, qword [rsp + 0x178]
add rdx, 0x5e0
lea rax, [rsp + 0x168]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x168]
lea r8, [rsp + 0x58]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwProtectVirtualMemory]
jmp 0x1400067c9
mov r9d, 0x8000
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x178]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
cmp dword [rsp + 0x60], 0
je 0x14000680f
mov dword [rsp + 0x64], 1
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x6c], 1
lea rcx, [rsp + 0x60]
call fcn.140009d14
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x170]
test rcx, rcx
je 0x140006830
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
add rsp, 0x130
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret