Function at 0x20b3c
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rsi
push rdi
push r13
sub rsp, 0xd0
mov r13, rdx
mov esi, ecx
xor ebx, ebx
mov qword [rax + 0x20], rbx
mov qword [rax - 0x60], rbx
mov qword [rax + 0x18], rbx
or qword [rax - 0x68], 0xffffffffffffffff
mov edi, ebx
cmp ecx, 0xc
jae 0x20b7a
mov rcx, rdx
call fcn.00021408
jmp 0x20e2d
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp esi, eax
je 0x20bf0
mov qword [rsp + 0x78], rbx
mov rcx, rsi
lea rdx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, ebx
jl 0x20e2d
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], bl
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov r9d, 0x80000000
xor r8d, r8d
mov edx, 0x200
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov edi, eax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp edi, ebx
jge 0x20bf0
mov eax, edi
jmp 0x20e2d
mov edx, 0x400
mov dword [rsp + 0xf0], edx
mov ecx, 1
mov r8d, 0x75505349
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
mov qword [rsp + 0x88], rax
cmp rax, rbx
je 0x20dde
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xf0]
mov r8, rsi
mov edx, 0x1b
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
mov edi, eax
mov dword [rsp + 0x70], eax
cmp eax, 0xc0000004
jne 0x20cb7
mov edx, 0x75505349
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [rsp + 0xf0]
mov ecx, 1
mov r8d, 0x75505349
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xf0]
mov r8, rsi
mov edx, 0x1b
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
mov edi, eax
mov dword [rsp + 0x70], eax
cmp edi, ebx
jl 0x20dde
mov dword [rsp + 0xa0], 0x30
mov qword [rsp + 0xa8], rbx
mov dword [rsp + 0xb8], 0x240
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xc8], rbx
mov dword [rsp + 0x68], 0x100
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x90]
lea r8, [rsp + 0xa0]
mov edx, 0x80000000
lea rcx, [rsp + 0x108]
call qword [sym.imp.ntoskrnl.exe_IoCreateFile]
mov edi, eax
mov dword [rsp + 0x70], eax
cmp eax, ebx
jl 0x20dde
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x100]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov r8, qword [r8]
xor edx, edx
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov edi, eax
mov dword [rsp + 0x70], eax
cmp eax, ebx
jl 0x20dde
mov qword [rsp + 0x78], rbx
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.ntoskrnl.exe_IoQueryFileDosDeviceName]
mov edi, eax
cmp eax, ebx
jge 0x20dbe
mov dword [rsp + 0x70], eax
jmp 0x20dd1
lea rdx, [rsp + 0x78]
mov rcx, r13
call fcn.000215ac
mov edi, eax
mov dword [rsp + 0x70], eax
cmp edi, ebx
jl 0x20dde
mov rcx, r13
call fcn.0002146c
nop
mov rcx, qword [rsp + 0x100]
cmp rcx, rbx
je 0x20df1
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x108]
cmp rcx, rbx
je 0x20e04
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp rsi, rbx
je 0x20e17
mov edx, 0x75505349
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x80]
cmp rcx, 0xffffffffffffffff
je 0x20e2b
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
mov rbx, qword [rsp + 0xf8]
add rsp, 0xd0
pop r13
pop rdi
pop rsi
ret