Function at 0x1400032c8
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov eax, dword [0x140006054]
mov ecx, 8
mov qword [rbp + 0x48], rcx
cmp eax, 6
jne 0x140003366
mov eax, dword [0x140006058]
cmp eax, 1
jne 0x140003323
lea edi, [rcx + 0x66]
lea esi, [rcx + 0x73]
mov r12d, 0x10
lea r15d, [r12 + 0x2c]
lea ebx, [r12 + 4]
lea r14d, [r12 + 0xc]
lea r13d, [r12 - 9]
jmp 0x140003455
cmp eax, 2
jne 0x140003345
lea edi, [rax + 0x6c]
mov r13d, ecx
lea ebx, [rax + 0x13]
lea esi, [rax + 0x79]
lea r15d, [rax + 0x3b]
lea r12d, [rax + 0xf]
lea r14d, [rax + 0x1b]
jmp 0x140003455
cmp eax, 3
jne 0x1400034e2
lea ebx, [rax + 0x13]
lea r15d, [rax + 0x3b]
lea r12d, [rax + 0xf]
lea r14d, [rax + 0x1b]
lea r13d, [rax + 6]
jmp 0x14000344d
mov r13d, 0xa
cmp eax, r13d
jne 0x1400034e2
cmp dword [0x140006058], 0
jne 0x1400034e2
mov ecx, dword [0x14000605c]
cmp ecx, 0x2800
jne 0x1400033af
mov edi, 0x70
lea ebx, [rdi - 0x59]
lea esi, [rdi + 0xd]
lea r15d, [rdi - 0x31]
lea r12d, [rdi - 0x5d]
lea ecx, [rdi - 0x68]
lea r14d, [rdi - 0x51]
jmp 0x140003455
cmp ecx, 0x295a
je 0x140003390
cmp ecx, 0x3839
je 0x140003390
cmp ecx, 0x3ad7
je 0x140003439
cmp ecx, 0x3fab
je 0x140003439
cmp ecx, 0x42ee
je 0x140003439
cmp ecx, 0x4563
je 0x140003439
lea eax, [rcx - 0x47ba]
cmp eax, 1
jbe 0x140003439
lea eax, [rcx - 0x4a61]
cmp eax, 4
jbe 0x140003429
cmp ecx, 0x55f0
je 0x140003409
cmp ecx, 0x585d
jne 0x1400034e2
mov edi, 0x67
lea ebx, [rdi - 0x55]
lea esi, [rdi + 0xd]
lea r15d, [rdi - 0x30]
lea r12d, [rdi - 0x59]
lea ecx, [rdi - 0x5f]
lea r14d, [rdi - 0x4d]
lea r13d, [rdi - 0x62]
jmp 0x140003455
mov edi, 0x6c
lea esi, [rdi + 0xd]
lea ecx, [rdi - 0x64]
jmp 0x140003304
mov ebx, 0x17
lea r15d, [rbx + 0x28]
lea r12d, [rbx - 4]
lea ecx, [rbx - 0xf]
lea r14d, [rbx + 8]
mov esi, 0x7c
lea edi, [rsi - 0xd]
and qword [rbp + 0x40], 0
lea rdx, [rbp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400034c9
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
test rax, rax
jne 0x1400034bf
xor edx, edx
lea r8d, [rax + 0x30]
lea rcx, [rbp - 0x30]
call fcn.140003dc0
mov rcx, qword [rbp + 0x40]
lea rdx, [rbp - 0x30]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rax, qword [rbp + 0x40]
jne 0x1400034bf
mov rcx, qword [0x140006038]
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x1400034fc
lea rcx, [rbp - 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rbp + 0x48]
add rcx, 4
mov qword [rbp + 0x48], rcx
cmp rcx, 0x32000
jl 0x14000345a
xor al, al
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [0x140006038]
mov edx, edi
mov rcx, qword [rcx + 0x20]
call fcn.1400016ac
mov rcx, qword [0x140006038]
mov edx, r15d
mov qword [0x140006198], rax
mov rcx, qword [rcx + 0x20]
call fcn.1400016ac
mov rcx, qword [0x140006038]
mov edx, r12d
mov qword [0x1400061a0], rax
mov rcx, qword [rcx + 0x20]
call fcn.1400016ac
mov rcx, qword [0x140006038]
mov edx, ebx
mov qword [0x1400061a8], rax
mov rcx, qword [rcx + 0x20]
call fcn.1400016ac
mov rcx, qword [0x140006038]
mov edx, r14d
mov qword [0x1400061b0], rax
mov rcx, qword [rcx + 0x20]
call fcn.1400016ac
mov rcx, qword [0x140006038]
mov edx, r14d
mov qword [0x1400061b8], rax
mov rcx, qword [rcx + 0x20]
call fcn.1400016ac
mov rcx, qword [0x140006038]
mov edx, esi
mov qword [0x1400061c0], rax
mov rcx, qword [rcx + 0x20]
call fcn.1400016ac
mov rcx, qword [0x140006038]
mov edx, r13d
mov qword [0x1400061c8], rax
mov rcx, qword [rcx + 0x20]
call fcn.1400016ac
lea rcx, [rbp - 0x30]
mov qword [0x1400061d0], rax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor eax, eax
cmp qword [0x140006198], rax
je 0x1400034e2
cmp qword [0x1400061a0], rax
je 0x1400034e2
cmp qword [0x1400061a8], rax
je 0x1400034e2
cmp qword [0x1400061b0], rax
je 0x1400034e2
cmp qword [0x1400061b8], rax
je 0x1400034e2
cmp qword [0x1400061c0], rax
je 0x1400034e2
cmp qword [0x1400061c8], rax
je 0x1400034e2
cmp qword [0x1400061d0], rax
je 0x1400034e2
mov al, 1
jmp 0x1400034e4