Function at 0x19b48
Capabilities:
Find process by pid

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3f8
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0x3e0], rax
mov rbx, qword [rsp + 0x468]
xor r15d, r15d
mov r12, r9
mov qword [rsp + 0x40], r9
mov r13d, r8d
mov rdi, rdx
mov byte [rsp + 0x31], r15b
mov qword [rsp + 0x38], rdx
mov rsi, rcx
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], r15
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, r15d
jl 0x19bc7
mov rcx, qword [rsp + 0x50]
call fcn.00039b5e
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor edx, edx
lea rcx, [rsp + 0x391]
mov byte [rsp + 0x30], r15b
lea r8d, [rdx + 0x4f]
mov byte [rsp + 0x34], r15b
mov dword [rsp + 0x48], r15d
mov byte [rsp + 0x390], r15b
call fcn.0003a110
mov r14d, dword [rsp + 0x460]
mov qword [rsp + 0x138], rdi
mov edi, 0x104
lea rcx, [rsp + 0x14d]
xor edx, edx
mov r8, rdi
mov dword [rsp + 0x149], r14d
mov byte [rsp + 0x33], r15b
mov qword [rsp + 0x130], rsi
mov byte [rsp + 0x140], r13b
mov qword [rsp + 0x141], r12
call fcn.0003a110
mov ebp, dword [rsp + 0x470]
cmp rbx, r15
je 0x19c67
cmp ebp, r15d
je 0x19c67
cmp ebp, edi
mov r8, rbp
lea rcx, [rsp + 0x14d]
cmova r8, rdi
mov rdx, rbx
call fcn.00039bc0
lea rcx, [rsp + 0x130]
call fcn.0001cf3c
mov edi, eax
mov rax, cr8
cmp al, r15b
je 0x19ce7
mov rax, cr8
lea r8, [0x0003abc0]
lea rcx, [rsp + 0x390]
movzx r9d, al
mov edx, 0x50
mov dword [rsp + 0x20], edi
call fcn.0001110c
call fcn.0003a020
mov ecx, 0x80001029
lea r9, [rsp + 0x390]
mov rdx, rsi
mov r8d, eax
call fcn.00034e50
mov al, 1
mov rcx, qword [rsp + 0x3e0]
xor rcx, rsp
call fcn.00039af0
add rsp, 0x3f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, [rsp + 0x33]
call fcn.0003391c
cmp al, r15b
je 0x19d25
cmp byte [rsp + 0x33], r15b
je 0x19d25
lea r8, [0x0003abe0]
lea rcx, [rsp + 0x390]
mov r9d, edi
mov edx, 0x50
call fcn.0001110c
call fcn.0003a020
mov ecx, 0x8000102a
jmp 0x19cae
lea rdx, [0x0004a4b0]
mov eax, r15d
mov rcx, rdx
cmp dword [rcx], edi
je 0x19d43
inc eax
add rcx, 0x10
cmp eax, 0x36
jb 0x19d32
jmp 0x19d4b
add rax, rax
mov r15d, dword [rdx + rax*8 + 4]
lea rcx, [rsp + 0x26c]
lea rdx, [rsp + 0x130]
mov r8d, 0x121
mov dword [rsp + 0x260], 0x12e
mov dword [rsp + 0x60], 0xd0
call fcn.00039bc0
xor eax, eax
mov dword [rsp + 0x268], 0x121
mov dword [rsp + 0x264], 1
cmp qword [rsp + 0x38], rax
jne 0x19db6
lea r8, [rsp + 0x31]
mov edx, edi
mov rcx, rsi
call fcn.0001d21c
xor ecx, ecx
cmp al, cl
je 0x19e1d
mov al, byte [rsp + 0x31]
jmp 0x19cc3
cmp r13d, eax
jne 0x19e1f
mov rbp, qword [rsp + 0x38]
mov rcx, rsi
mov byte [rsp + 0x32], 1
mov rdx, rbp
call fcn.00034d98
xor ebx, ebx
mov r12, rax
cmp rax, rbx
je 0x19ee4
mov edx, dword [rsp + 0x40]
lea r9, [rsp + 0x32]
mov r8, rsi
mov rcx, rax
call fcn.00021a38
movzx ecx, byte [rsp + 0x32]
mov bl, al
xor eax, eax
movzx ebp, al
cmp bl, al
cmovne ebp, ecx
mov rcx, r12
call fcn.00035470
xor ecx, ecx
cmp bl, cl
je 0x19eeb
mov al, bpl
jmp 0x19cc3
xor eax, eax
cmp r13d, 0x16
jne 0x19e89
cmp rbx, rax
je 0x19ef0
cmp ebp, eax
je 0x19ef0
cmp byte [rbx], al
je 0x19ef0
lea edx, [r13 + 0x46]
mov rcx, rbx
call fcn.00039b76
xor ecx, ecx
cmp rax, rcx
je 0x19e56
inc rax
jmp 0x19e59
mov rax, rbx
mov edx, 0x2e
mov rcx, rax
call fcn.00039b76
xor ebx, ebx
cmp rax, rbx
je 0x19ef2
lea rdx, [0x0003abf0]
mov rcx, rax
call fcn.00039b46
cmp eax, ebx
jne 0x19ef2
jmp 0x19cc1
cmp r13d, 5
jne 0x19ec2
cmp r12, 5
jne 0x19ef0
lea rdx, [0x0003a8d0]
mov rcx, rsi
call fcn.00031744
xor ebx, ebx
cmp al, bl
je 0x19ef2
lea rdx, [0x0003ac20]
mov rcx, rsi
call fcn.000318c8
cmp al, bl
je 0x19ef2
jmp 0x19cc1
cmp r13d, 0xb
jne 0x19ef0
call fcn.00030c14
xor ebx, ebx
cmp al, bl
je 0x19ef2
lea rcx, [0x0003d270]
call fcn.000305dc
cmp rax, rsi
jmp 0x19e82
mov r12, qword [rsp + 0x40]
jmp 0x19ef7
mov r12, qword [rsp + 0x40]
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
mov rcx, rsi
call fcn.00019890
cmp al, bl
jne 0x19cc1
cmp qword [0x0004c4c0], rbx
je 0x19f8a
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x19f29
lea rcx, [0x0003a8a0]
call fcn.00030944
jmp 0x19f38
lea rdx, [0x0003a8a0]
mov rcx, rsi
call fcn.00031744
cmp al, bl
je 0x19f8a
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x19f57
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, rax
call fcn.0003a0fa
jmp 0x19f5f
mov rcx, rsi
call fcn.00030984
cmp rax, rbx
jne 0x19f69
mov rax, rbx
jmp 0x19f71
mov rcx, rax
call fcn.00030984
cmp rax, qword [0x0004c4c0]
jne 0x19f8a
mov rcx, rsi
call fcn.00022c94
cmp al, bl
je 0x19cc1
lea rax, [rsp + 0x34]
mov r9, rsi
mov r8d, r14d
mov rdx, r12
mov ecx, edi
mov qword [rsp + 0x20], rax
call fcn.00022b2c
cmp al, bl
je 0x19fdb
mov bl, byte [rsp + 0x34]
xor r12d, r12d
cmp rbp, r12
jne 0x19fd0
cmp edi, 0x1b
je 0x19fd0
cmp edi, 0x27
je 0x19fd0
cmp edi, 0x38
je 0x19fd0
mov r8b, bl
mov edx, edi
mov rcx, rsi
call fcn.0001d2f4
cmp bl, r12b
setne al
jmp 0x19cc3
cmp r13d, 6
jne 0x1a05d
call fcn.0002abe0
cmp al, bl
je 0x1a05d
mov al, byte [0x0004c34f]
cmp al, bl
je 0x1a05d
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x1a034
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, rax
call fcn.000309cc
cmp al, bl
je 0x1a015
mov al, 1
jmp 0x1a052
lea rcx, [0x0003d250]
call fcn.000305dc
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rbx, rax
sete al
xor ebx, ebx
jmp 0x1a052
lea rcx, [0x0003d250]
call fcn.000305dc
cmp rax, rsi
je 0x1a011
mov rcx, rsi
call fcn.000309cc
cmp al, bl
setne al
cmp al, bl
je 0x1a05d
mov bl, 1
jmp 0x1a10f
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x1a06f
call fcn.000316e8
jmp 0x1a077
mov rcx, rsi
call fcn.0003168c
cmp al, bl
je 0x1a10b
cmp r13d, 0x24
je 0x1a10b
cmp r13d, 0x27
jne 0x1a0ac
lea rcx, [0x0003d250]
call fcn.000305dc
cmp rax, rsi
je 0x1a10b
mov rcx, rsi
call fcn.000309cc
cmp al, bl
jne 0x1a10b
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, rax
call fcn.000309cc
cmp al, bl
jne 0x1a0de
lea rcx, [0x0003d250]
call fcn.000305dc
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rbx, rax
je 0x1a0de
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp edi, 0x1b
je 0x19cc1
cmp edi, 0x27
je 0x19cc1
cmp edi, 0x38
je 0x19cc1
mov r8b, 1
mov edx, edi
mov rcx, rsi
call fcn.0001d2f4
jmp 0x19cc1
mov bl, byte [rsp + 0x30]
mov r9, r12
mov r8d, r13d
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r14d
call fcn.0001a860
xor r14d, r14d
cmp al, r14b
jne 0x19cc1
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, rax
call fcn.000352b4
cmp rax, r14
je 0x1a150
mov rcx, rax
call fcn.00035470
call fcn.0002abe0
cmp al, r14b
jne 0x1a1d1
cmp r13d, r14d
jne 0x1a1bb
cmp r12, 0x101
je 0x1a1bb
cmp r12, 0x100
jne 0x1a1cc
lea rcx, [0x0003ac20]
call fcn.00030e0c
cmp al, r14b
jne 0x19cc1
call fcn.00030c14
cmp al, r14b
je 0x1a1cc
lea rcx, [0x0003a930]
call fcn.00030e0c
cmp al, r14b
jne 0x19cc1
lea rcx, [0x0003d290]
call fcn.00030e0c
cmp al, r14b
je 0x1a1cc
jmp 0x19cc1
cmp r13d, 3
jne 0x1a1c6
cmp r12, r14
je 0x1a1cc
cmp r13d, 0xc
jne 0x1a1d1
call fcn.0001a5bc
call fcn.0002abe0
cmp al, r14b
je 0x19cc1
mov ecx, r15d
call fcn.0001cea8
cmp al, r14b
je 0x19cc1
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, qword [0x0004c4c0]
cmp rcx, rax
je 0x19cc1
cmp rcx, rsi
je 0x19cc1
cmp bl, r14b
jne 0x1a269
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x1a228
call fcn.00039ba6
mov ebx, eax
jmp 0x1a25d
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov qword [rsp + 0x40], r14
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, r14d
jge 0x1a245
mov ebx, r14d
jmp 0x1a25d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessSessionId]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp dword [0x0004c4bc], ebx
jne 0x19cc1
mov r8b, 1
mov edx, 0x40
mov rcx, rsi
call fcn.0001e6f8
lea r9, [rsp + 0x60]
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x48]
mov r8d, 0x12e
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0xd0
call fcn.0002aa1c
cmp al, r14b
jne 0x1a2f7
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x19cc1
mov rcx, qword gs:[0x188]
call qword [sym.imp.ntoskrnl.exe_PsIsThreadTerminating]
cmp al, r14b
je 0x19cc1
mov rcx, rsi
call fcn.000335d0
mov rbx, rax
call fcn.0003a020
mov r9, rbx
mov rdx, rsi
mov ecx, 0x1002
mov r8d, eax
call fcn.00034e50
jmp 0x1a48a
cmp dword [rsp + 0x64], 4
jne 0x19cc1
mov eax, dword [rsp + 0x68]
mov ebx, 0x3f
cmp eax, 2
je 0x1a31a
cmp eax, 8
je 0x1a31a
cmp eax, 7
jne 0x1a358
cmp rbp, r14
jne 0x1a343
cmp edi, 0x1b
je 0x1a358
cmp edi, 0x27
je 0x1a358
cmp edi, 0x38
je 0x1a358
mov edx, ebx
cmp eax, 2
mov r8b, 1
cmove edx, edi
mov rcx, rsi
call fcn.0001d2f4
jmp 0x1a354
mov r9b, 1
mov r8d, r12d
mov rdx, rbp
mov rcx, rsi
call fcn.0001a7fc
mov eax, dword [rsp + 0x68]
cmp eax, 4
je 0x1a367
cmp eax, 6
je 0x1a367
cmp eax, 5
jne 0x1a3aa
cmp rbp, r14
jne 0x1a390
cmp edi, 0x1b
je 0x1a3aa
cmp edi, 0x27
je 0x1a3aa
cmp edi, 0x38
je 0x1a3aa
cmp eax, 4
mov rcx, rsi
cmove ebx, edi
xor r8d, r8d
mov edx, ebx
call fcn.0001d2f4
jmp 0x1a3a6
cmp r13d, r14d
jne 0x1a3aa
xor r9d, r9d
mov r8d, r12d
mov rdx, rbp
mov rcx, rsi
call fcn.0001a7fc
mov eax, dword [rsp + 0x68]
cmp edi, 0x1f
je 0x1a3e1
cmp edi, 0x20
je 0x1a3e1
cmp edi, 0x12
je 0x1a3e1
cmp edi, 0x13
je 0x1a3e1
cmp edi, 0x11
je 0x1a3e1
cmp edi, 0x14
je 0x1a3e1
cmp edi, 0x2f
je 0x1a3e1
cmp edi, 0x3c
je 0x1a3e1
cmp edi, 0x40
je 0x1a3e1
cmp edi, 0x41
je 0x1a3e1
cmp edi, 0x28
jne 0x1a406
cmp eax, 3
jne 0x1a406
cmp edi, 0x1b
je 0x1a406
cmp edi, 0x27
je 0x1a406
cmp edi, 0x38
je 0x1a406
xor r8d, r8d
mov edx, edi
mov rcx, rsi
call fcn.0001d2f4
mov eax, dword [rsp + 0x68]
cmp edi, 0x1f
je 0x1a43d
cmp edi, 0x20
je 0x1a43d
cmp edi, 0x12
je 0x1a43d
cmp edi, 0x13
je 0x1a43d
cmp edi, 0x11
je 0x1a43d
cmp edi, 0x14
je 0x1a43d
cmp edi, 0x2f
je 0x1a43d
cmp edi, 0x3c
je 0x1a43d
cmp edi, 0x40
je 0x1a43d
cmp edi, 0x41
je 0x1a43d
cmp edi, 0x28
jne 0x1a46e
cmp eax, 1
jne 0x1a46e
cmp edi, 0x1b
je 0x19cc1
cmp edi, 0x27
je 0x19cc1
cmp edi, 0x38
je 0x19cc1
mov r8b, al
mov edx, edi
mov rcx, rsi
call fcn.0001d2f4
mov eax, dword [rsp + 0x68]
cmp eax, r14d
jbe 0x1a48a
cmp eax, 2
jbe 0x19cc1
cmp eax, 6
jbe 0x1a48a
cmp eax, 8
jbe 0x19cc1
xor al, al
jmp 0x19cc3