Function at 0x14000f1bc
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
mov eax, 0x1020
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [0x1400d6a00]
xor rax, rsp
mov qword [rsp + 0x1010], rax
mov rdi, rcx
mov qword [rsp + 0x40], rcx
and qword [rsp + 0x20], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x38], 0
xor ebx, ebx
lea r13d, [rbx + 1]
mov r12d, 0x12c
mov dword [rsp + 0x28], ebx
cmp ebx, 0x50000
jae 0x14000f41f
mov ecx, ebx
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x14000f417
mov rsi, qword [rsp + 0x20]
xor r14b, r14b
test rsi, rsi
je 0x14000f289
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000f289
mov rcx, qword [0x1400d6b50]
add rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000f289
mov rax, qword [0x1400d6b50]
mov rcx, qword [rax + rsi]
test rcx, rcx
je 0x14000f289
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx r14d, r14b
test al, al
cmovne r14d, r13d
test r14b, r14b
je 0x14000f40c
xor edx, edx
mov r8d, 0xf88
lea rcx, [rsp + 0x80]
call fcn.14001ea80
mov dword [rsp + 0x80], ebx
mov rsi, qword [rsp + 0x20]
mov qword [rsp + 0x88], rsi
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_PsGetProcessInheritedFromUniqueProcessId]
mov dword [rsp + 0x84], eax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessCreateTimeQuadPart]
mov qword [rsp + 0xfe8], rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsIsProtectedProcess]
test eax, eax
setne byte [rsp + 0xfe0]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessImageFileName]
test rax, rax
je 0x14000f313
lea rdx, [rsp + 0x4a0]
mov rcx, rax
call fcn.140009e30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsReferenceProcessFilePointer]
test eax, eax
js 0x14000f371
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_IoQueryFileDosDeviceName]
test eax, eax
js 0x14000f371
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14000f366
movzx ecx, word [rax + 2]
cmp cx, r12w
mov r8, r12
ja 0x14000f359
mov r8d, ecx
lea rcx, [rsp + 0x90]
call fcn.14001e7c0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rsi, rax
test rax, rax
je 0x14000f3d5
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rdx, qword [rsi + 0x20]
test rdx, rdx
je 0x14000f3b3
movzx r8d, word [rdx + 0x72]
mov rdx, qword [rdx + 0x78]
lea rcx, [rsp + 0x6a8]
call fcn.14001e7c0
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x14000f3d5
mov edx, dword [rdi]
mov r8d, 0xf88
mov rcx, qword [rdi + 8]
call fcn.14001a630
mov qword [rdi + 8], rax
mov ecx, dword [rdi]
add rcx, rax
lea rdx, [rsp + 0x80]
mov r8d, 0xf88
call fcn.14001e7c0
add dword [rdi], 0xf88
add dword [rdi + 4], r13d
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add ebx, 4
jmp 0x14000f216
xor eax, eax
mov rcx, qword [rsp + 0x1010]
xor rcx, rsp
call fcn.14001e6e0
lea r11, [rsp + 0x1020]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret