Function at 0x1909e
Capabilities:
Find process by pid

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x548
mov eax, dword [0x1a6a0]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
cmp word [eax], 0x1770
push esi
push edi
jl 0x190de
mov esi, dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
push 0x1a690
call esi
push 0x1a698
mov dword [0x1a710], eax
call esi
mov dword [0x1a714], eax
push 0x10
call fcn.00019042
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0x51c], eax
je 0x1942a
cmp dword [eax], ecx
mov dword [ebp - 0x528], ecx
jbe 0x19423
mov edi, dword [sym.imp.ntoskrnl.exe_ZwQueryObject]
lea esi, [eax + 0xa]
mov ebx, 0x500
jmp 0x19115
xor ecx, ecx
mov dword [ebp - 0x548], 0x18
mov dword [ebp - 0x544], ecx
mov dword [ebp - 0x53c], 0x200
mov dword [ebp - 0x540], ecx
mov dword [ebp - 0x538], ecx
mov dword [ebp - 0x534], ecx
movzx eax, word [esi - 6]
mov dword [ebp - 0x524], eax
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x548]
push eax
push 0x40
lea eax, [ebp - 0x508]
push eax
mov dword [ebp - 0x520], ecx
call dword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
test eax, eax
jl 0x19406
push 2
push 0
push 0
lea eax, [ebp - 0x50c]
push eax
movzx eax, word [esi]
push 0xffffffffffffffff
push eax
push dword [ebp - 0x508]
call dword [sym.imp.ntoskrnl.exe_ZwDuplicateObject]
xor ecx, ecx
cmp eax, ecx
jge 0x19346
mov eax, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
cmp word [eax], 0x1770
jl 0x193fa
cmp dword [0x1a710], ecx
je 0x193fa
cmp dword [0x1a714], ecx
je 0x193fa
lea eax, [ebp - 0x518]
push eax
push dword [ebp - 0x524]
mov dword [ebp - 0x510], ecx
mov dword [ebp - 0x530], ecx
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
mov dword [ebp - 0x52c], eax
jl 0x193fa
push dword [ebp - 0x518]
call dword [0x1a710]
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 0
jge 0x19220
mov ecx, dword [ebp - 0x518]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x193fa
push dword [ebp - 0x518]
call dword [sym.imp.ntoskrnl.exe_KeAttachProcess]
xor eax, eax
push eax
lea ecx, [ebp - 0x510]
push ecx
push eax
push eax
movzx eax, word [esi]
push 0x80000000
push eax
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
jl 0x192ee
mov eax, dword [ebp - 0x510]
cmp eax, dword [esi + 2]
jne 0x192ee
lea eax, [ebp - 0x514]
push eax
push ebx
lea eax, [ebp - 0x504]
push eax
movzx eax, word [esi]
push 2
push eax
call edi
test eax, eax
jl 0x192ee
cmp dword [ebp - 0x500], 0
je 0x192ee
push 9
push str.ALPC_Port
push dword [ebp - 0x500]
call dword [sym.imp.ntoskrnl.exe__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x192ee
lea eax, [ebp - 0x514]
push eax
push ebx
lea eax, [ebp - 0x504]
push eax
movzx eax, word [esi]
push 1
push eax
call edi
test eax, eax
jl 0x192ee
cmp dword [ebp - 0x500], 0
je 0x192ee
cmp word [ebp - 0x504], 0
je 0x192ee
push 0x10
push str.WindowsApiPort
push dword [ebp - 0x500]
call dword [sym.imp.ntoskrnl.exe__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x192ee
mov dword [ebp - 0x530], 1
mov ecx, dword [ebp - 0x510]
test ecx, ecx
je 0x192fe
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push dword [ebp - 0x518]
call dword [0x1a714]
call dword [sym.imp.ntoskrnl.exe_KeDetachProcess]
mov ecx, dword [ebp - 0x518]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push dword [ebp - 0x508]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp dword [ebp - 0x530], 0
je 0x193fa
push dword [ebp - 0x51c]
call dword [sym.imp.ntoskrnl.exe_ExFreePool]
jmp 0x1945b
lea eax, [ebp - 0x514]
push eax
push ebx
lea eax, [ebp - 0x504]
push eax
push 2
push dword [ebp - 0x50c]
call edi
test eax, eax
jl 0x193ee
cmp dword [ebp - 0x500], 0
je 0x193ee
push 4
push str.Port
push dword [ebp - 0x500]
call dword [sym.imp.ntoskrnl.exe__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x193a4
push 9
push str.ALPC_Port
push dword [ebp - 0x500]
call dword [sym.imp.ntoskrnl.exe__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x193ee
lea eax, [ebp - 0x514]
push eax
push ebx
lea eax, [ebp - 0x504]
push eax
push 1
push dword [ebp - 0x50c]
call edi
test eax, eax
jl 0x193ee
cmp dword [ebp - 0x500], 0
je 0x193ee
cmp word [ebp - 0x504], 0
je 0x193ee
push 0x10
push dword [ebp - 0x500]
push str.WindowsApiPort
call dword [sym.imp.ntoskrnl.exe_wcsncmp]
add esp, 0xc
test eax, eax
je 0x19439
push dword [ebp - 0x50c]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push dword [ebp - 0x508]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
inc dword [ebp - 0x528]
mov eax, dword [ebp - 0x51c]
mov ecx, dword [ebp - 0x528]
add esi, 0x10
cmp ecx, dword [eax]
jb 0x19113
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePool]
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.0001a2c3
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 0x51c]
call dword [sym.imp.ntoskrnl.exe_ExFreePool]
push dword [ebp - 0x50c]
mov esi, dword [sym.imp.ntoskrnl.exe_ZwClose]
call esi
push dword [ebp - 0x508]
call esi
mov eax, dword [ebp - 0x524]
jmp 0x1942c