Function at 0x1400685f0
Capabilities:
Check processdebugport

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
mov rcx, rdi
xor edx, edx
mov r8d, 0x88
call fcn.1400e43c0
xor r14d, r14d
lea r8, [rbp + 0x30]
mov rcx, rsi
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 8]
lea edx, [r14 + 0x1a]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ebx, eax
test eax, eax
js 0x140068647
cmp qword [rbp + 0x30], r14
setne al
jmp 0x14006864b
movzx eax, byte [rbp + 0x30]
test ebx, ebx
js 0x14006865a
test al, al
jne 0x14006865a
mov edx, 5
jmp 0x1400686a1
mov r9d, 4
mov qword [rsp + 0x20], r14
lea r8, [rbp + 0x30]
mov rcx, rsi
lea edx, [r9 + 0x1e]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ebx, eax
test eax, eax
jns 0x140068681
mov edx, dword [rbp + 0x30]
jmp 0x1400686a1
mov ecx, dword [rbp + 0x30]
movzx eax, cl
not al
movzx edx, al
shr edx, 1
and edx, 1
test cl, 4
je 0x140068699
or edx, 2
test cl, 8
je 0x1400686a1
or edx, 4
test ebx, ebx
js 0x1400686c3
and dword [rdi + 0x58], 0xfffffffc
lea rcx, [rdi + 0x58]
mov eax, edx
mov ebx, r14d
and eax, 3
shr edx, 2
or dword [rcx], eax
and dl, 1
mov byte [rdi + 0x5c], dl
mov qword [rdi], rcx
mov r9d, 8
mov dword [rbp + 0x30], 1
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, eax
test eax, eax
jns 0x1400686f8
cmp ebx, 0xc0000073
jne 0x140068701
mov ebx, eax
jmp 0x140068701
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rdi + 0x60], eax
test ecx, ecx
js 0x14006870d
lea rax, [rdi + 0x60]
mov qword [rdi + 8], rax
mov r9d, 8
mov dword [rbp + 0x30], 2
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, eax
test eax, eax
jns 0x140068742
cmp ebx, 0xc0000073
jne 0x14006874b
mov ebx, eax
jmp 0x14006874b
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rdi + 0x70], eax
test ecx, ecx
js 0x140068757
lea rax, [rdi + 0x70]
mov qword [rdi + 0x10], rax
mov r9d, 8
mov dword [rbp + 0x30], 3
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, eax
test eax, eax
jns 0x14006878c
cmp ebx, 0xc0000073
jne 0x140068795
mov ebx, eax
jmp 0x140068795
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rdi + 0x64], eax
test ecx, ecx
js 0x1400687a1
lea rax, [rdi + 0x64]
mov qword [rdi + 0x18], rax
mov r9d, 8
mov dword [rbp + 0x30], 4
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, eax
test eax, eax
jns 0x1400687d6
cmp ebx, 0xc0000073
jne 0x1400687df
mov ebx, eax
jmp 0x1400687df
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rdi + 0x68], eax
test ecx, ecx
js 0x1400687eb
lea rax, [rdi + 0x68]
mov qword [rdi + 0x20], rax
mov r9d, 8
mov dword [rbp + 0x30], 6
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, eax
test eax, eax
jns 0x140068820
cmp ebx, 0xc0000073
jne 0x140068829
mov ebx, eax
jmp 0x140068829
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rdi + 0x6c], eax
test ecx, ecx
js 0x140068835
lea rax, [rdi + 0x6c]
mov qword [rdi + 0x30], rax
mov r9d, 8
mov dword [rbp + 0x30], 7
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, eax
test eax, eax
jns 0x14006886a
cmp ebx, 0xc0000073
jne 0x140068873
mov ebx, eax
jmp 0x140068873
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rdi + 0x74], eax
test ecx, ecx
js 0x14006887f
lea rax, [rdi + 0x74]
mov qword [rdi + 0x38], rax
mov r9d, 8
mov dword [rbp + 0x30], 8
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, eax
test eax, eax
jns 0x1400688b4
cmp ebx, 0xc0000073
jne 0x1400688bd
mov ebx, eax
jmp 0x1400688bd
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rdi + 0x78], eax
test ecx, ecx
js 0x1400688c9
lea rax, [rdi + 0x78]
mov qword [rdi + 0x40], rax
mov r9d, 8
mov dword [rbp + 0x30], 9
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, eax
test eax, eax
jns 0x1400688fe
cmp ebx, 0xc0000073
jne 0x140068907
mov ebx, eax
jmp 0x140068907
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rdi + 0x7c], eax
test ecx, ecx
js 0x140068913
lea rax, [rdi + 0x7c]
mov qword [rdi + 0x48], rax
mov r9d, 8
mov dword [rbp + 0x30], 0xa
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, eax
test eax, eax
jns 0x140068948
cmp ebx, 0xc0000073
jne 0x140068954
mov ebx, eax
jmp 0x140068954
mov eax, dword [rbp + 0x34]
mov ebx, r14d
mov dword [rdi + 0x80], eax
mov eax, ebx
test ecx, ecx
js 0x140068965
lea rcx, [rdi + 0x80]
mov qword [rdi + 0x50], rcx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret