Function at 0x140081da0
Capabilities:
Check processdebugport

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x30
mov rdi, rdx
mov qword [rsp + 0x50], rsi
mov rsi, rcx
xor edx, edx
mov rcx, rdi
mov r8d, 0xb0
call fcn.140131400
xor r14d, r14d
lea r8, [rbp + 0x30]
mov r9d, 8
mov qword [rsp + 0x20], r14
mov edx, 0x1a
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x140081e02
cmp qword [rbp + 0x30], r14
setne al
test al, al
jne 0x140081e02
mov r9d, 5
jmp 0x140081e58
mov r9d, 4
mov qword [rsp + 0x20], r14
lea r8, [rbp + 0x30]
mov edx, 0x22
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ebx, eax
test eax, eax
js 0x140081e50
mov r8d, dword [rbp + 0x30]
mov ecx, r8d
shr ecx, 1
not ecx
and ecx, 1
mov edx, ecx
or edx, 2
test r8b, 4
cmove edx, ecx
mov r9d, edx
or r9d, 4
test r8b, 8
cmove r9d, edx
jmp 0x140081e54
mov r9d, dword [rbp + 0x30]
test eax, eax
js 0x140081e8a
lea rdx, [rdi + 0x80]
mov ebx, r14d
mov ecx, dword [rdx]
xor ecx, r9d
mov qword [rdi], rdx
and ecx, 1
xor ecx, dword [rdx]
mov eax, ecx
xor eax, r9d
shr r9d, 2
and eax, 2
xor eax, ecx
and r9b, 1
mov dword [rdx], eax
mov byte [rdi + 0x84], r9b
mov r9d, 8
mov dword [rbp + 0x30], 1
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov edx, 0x34
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
jns 0x140081ebe
cmp ebx, 0xc0000073
jne 0x140081ed1
mov ebx, eax
jmp 0x140081ed1
mov eax, dword [rbp + 0x34]
lea rcx, [rdi + 0x88]
mov dword [rcx], eax
mov ebx, r14d
mov qword [rdi + 8], rcx
mov r9d, 8
mov dword [rbp + 0x30], 2
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov edx, 0x34
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
jns 0x140081f05
cmp ebx, 0xc0000073
jne 0x140081f18
mov ebx, eax
jmp 0x140081f18
mov eax, dword [rbp + 0x34]
lea rcx, [rdi + 0x98]
mov dword [rcx], eax
mov ebx, r14d
mov qword [rdi + 0x10], rcx
mov r9d, 8
mov dword [rbp + 0x30], 3
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov edx, 0x34
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
jns 0x140081f4c
cmp ebx, 0xc0000073
jne 0x140081f5f
mov ebx, eax
jmp 0x140081f5f
mov eax, dword [rbp + 0x34]
lea rcx, [rdi + 0x8c]
mov dword [rcx], eax
mov ebx, r14d
mov qword [rdi + 0x18], rcx
mov r9d, 8
mov dword [rbp + 0x30], 4
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov edx, 0x34
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
jns 0x140081f93
cmp ebx, 0xc0000073
jne 0x140081fa6
mov ebx, eax
jmp 0x140081fa6
mov eax, dword [rbp + 0x34]
lea rcx, [rdi + 0x90]
mov dword [rcx], eax
mov ebx, r14d
mov qword [rdi + 0x20], rcx
mov r9d, 8
mov dword [rbp + 0x30], 6
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov edx, 0x34
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
jns 0x140081fda
cmp ebx, 0xc0000073
jne 0x140081fed
mov ebx, eax
jmp 0x140081fed
mov eax, dword [rbp + 0x34]
lea rcx, [rdi + 0x94]
mov dword [rcx], eax
mov ebx, r14d
mov qword [rdi + 0x30], rcx
mov r9d, 8
mov dword [rbp + 0x30], 7
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov edx, 0x34
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
jns 0x140082021
cmp ebx, 0xc0000073
jne 0x140082034
mov ebx, eax
jmp 0x140082034
mov eax, dword [rbp + 0x34]
lea rcx, [rdi + 0x9c]
mov dword [rcx], eax
mov ebx, r14d
mov qword [rdi + 0x38], rcx
mov r9d, 8
mov dword [rbp + 0x30], 8
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov edx, 0x34
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
jns 0x140082068
cmp ebx, 0xc0000073
jne 0x14008207b
mov ebx, eax
jmp 0x14008207b
mov eax, dword [rbp + 0x34]
lea rcx, [rdi + 0xa0]
mov dword [rcx], eax
mov ebx, r14d
mov qword [rdi + 0x40], rcx
mov r9d, 8
mov dword [rbp + 0x30], 9
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov edx, 0x34
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
jns 0x1400820af
cmp ebx, 0xc0000073
jne 0x1400820c2
mov ebx, eax
jmp 0x1400820c2
mov eax, dword [rbp + 0x34]
lea rcx, [rdi + 0xa4]
mov dword [rcx], eax
mov ebx, r14d
mov qword [rdi + 0x48], rcx
mov r9d, 8
mov dword [rbp + 0x30], 0xa
lea r8, [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov edx, 0x34
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov rsi, qword [rsp + 0x50]
test eax, eax
jns 0x140082107
cmp ebx, 0xc0000073
je 0x14008211a
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret
mov ecx, dword [rbp + 0x34]
lea rdx, [rdi + 0xa8]
mov dword [rdx], ecx
mov eax, r14d
mov qword [rdi + 0x50], rdx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret