Function at 0x140007730
Capabilities:
Attach user process memory

Disassembly:
push rbx
push rbp
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x14003cf48]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r15d, r8d
mov rbp, r9
mov rbx, rdx
mov r14d, ecx
test rdx, rdx
je 0x14000777f
call fcn.140009ec0
test rax, rax
jne 0x14000779c
cmp byte [0x14003dcf0], al
je 0x14000777f
mov edx, r14d
lea rcx, [0x1400125f0]
call fcn.14000ca70
xor al, al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14000ed70
add rsp, 0x88
pop r15
pop r14
pop rbp
pop rbx
ret
mov qword [rsp + 0x80], rsi
xorps xmm0, xmm0
mov qword [rsp + 0x78], rdi
mov rdi, r15
mov sil, 1
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
cmp r14d, 4
je 0x140007821
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
test r15d, r15d
je 0x1400077ef
lea rcx, [rbx + r15]
cmp rcx, rbx
jb 0x1400077fe
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
cmp rcx, qword [rax]
ja 0x1400077fe
mov rdx, rdi
mov rcx, rbx
call fcn.140007d00
test al, al
jne 0x14000784f
cmp byte [0x14003dcf0], 0
je 0x140007819
mov r8d, r15d
lea rcx, [0x140012630]
mov rdx, rbx
call fcn.14000ca70
xor sil, sil
jmp 0x1400079d1
mov rdx, rdi
mov rcx, rbx
call fcn.140007d00
test al, al
jne 0x14000784f
cmp byte [0x14003dcf0], al
je 0x140007847
mov rdx, rbx
lea rcx, [0x140012680]
call fcn.14000ca70
xor sil, sil
jmp 0x1400079dc
mov rdx, rdi
mov qword [rsp + 0x70], r12
mov rcx, rbx
call fcn.140007d00
test al, al
jne 0x140007883
cmp byte [0x14003dcf0], al
je 0x1400079c3
mov rdx, rbx
lea rcx, [0x1400124e0]
call fcn.14000ca70
jmp 0x1400079c3
mov rdx, rdi
mov rcx, rbp
call fcn.140007d00
test al, al
jne 0x1400078b2
cmp byte [0x14003dcf0], al
je 0x1400079c3
mov rdx, rbp
lea rcx, [0x140012520]
call fcn.14000ca70
jmp 0x1400079c3
mov edx, r15d
mov rcx, rbx
call fcn.1400061c0
mov edx, r15d
mov rcx, rbp
call fcn.1400061c0
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
mov edx, r15d
mov rcx, rbx
movzx r12d, sil
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
test rax, rax
jne 0x14000790c
cmp byte [0x14003dcf0], al
je 0x1400079c3
lea rcx, [0x140012560]
call fcn.14000ca70
jmp 0x1400079c3
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
xor r9d, r9d
mov dword [rsp + 0x28], 0x10
xor edx, edx
mov dword [rsp + 0x20], 0
mov rcx, rbx
lea r8d, [r9 + 1]
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov r15, rax
test rax, rax
jne 0x140007960
cmp byte [0x14003dcf0], al
je 0x140007955
xor edx, edx
lea rcx, [0x140012590]
call fcn.14000ca70
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
jmp 0x1400079c3
mov eax, dword [rsp + 0xd0]
cmp eax, 2
jne 0x14000797c
mov r8, rdi
mov rdx, r15
mov rcx, rbp
call fcn.14000ff00
jmp 0x1400079a9
cmp eax, 3
jne 0x140007991
mov r8, rdi
mov rdx, rbp
mov rcx, r15
call fcn.14000ff00
jmp 0x1400079a9
cmp byte [0x14003dcf0], 0
je 0x1400079a6
lea rcx, [0x1400125c0]
call fcn.14000ca70
xor r12b, r12b
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
test r12b, r12b
jne 0x1400079c6
xor sil, sil
mov r12, qword [rsp + 0x70]
cmp r14d, 4
je 0x1400079dc
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rdi, qword [rsp + 0x78]
movzx eax, sil
mov rsi, qword [rsp + 0x80]
jmp 0x140007781