Function at 0x14000bd20
Capabilities:
Attach user process memory

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov r12, r8
mov qword [rsp + 0x38], r8
mov dword [rsp + 0x40], edx
mov rsi, rcx
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x58], edx
mov qword [rsp + 0x80], r8
xor r13b, r13b
mov byte [rsp + 0x31], r13b
xor r14d, r14d
mov qword [rsp + 0x60], r14
mov byte [rsp + 0x33], r13b
xor bl, bl
mov byte [rsp + 0x32], bl
lea ecx, [r14 + 0x50]
call fcn.140029ab4
lea edi, [r14 + 1]
test rax, rax
je 0x14000bd9f
movzx ebx, bl
cmp rax, rsi
cmove ebx, edi
mov byte [rsp + 0x32], bl
mov ecx, 0x914
call fcn.140029ab4
cmp eax, 0x2800
jb 0x14000bdfa
test bl, bl
jne 0x14000be27
mov ecx, 0x8f6
call fcn.140029ab4
mov rcx, rax
test rax, rax
je 0x14000bdd5
movzx eax, bl
cmp rcx, rsi
cmove eax, edi
mov bl, al
mov byte [rsp + 0x32], al
test bl, bl
jne 0x14000be27
mov ecx, 0x8f4
call fcn.140029ab4
mov rcx, rax
test rax, rax
je 0x14000bdfa
movzx eax, bl
cmp rcx, rsi
cmove eax, edi
mov bl, al
mov byte [rsp + 0x32], al
test bl, bl
jne 0x14000be27
mov ecx, 0x61
call fcn.140029ab4
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000be3d
lea rdx, [rsp + 0xb0]
mov rcx, rax
call sub.ntoskrnl.exe_KeStackAttachProcess
jmp 0x14000be3d
lea rcx, [rsp + 0xb0]
call fcn.14007a610
mov r15b, al
mov byte [rsp + 0x33], al
jmp 0x14000be42
mov r15b, byte [rsp + 0x33]
mov ecx, 0x429b
call fcn.140029ab4
mov qword [rsp + 0x88], rax
mov ecx, 0x429e
call fcn.140029ab4
mov qword [rsp + 0x98], rax
mov ecx, 0x4367
call fcn.140029ab4
mov qword [rsp + 0x90], rax
mov ecx, 0x42a1
call fcn.140029ab4
mov qword [rsp + 0x48], rax
mov ecx, 0x42a4
call fcn.140029ab4
mov qword [rsp + 0x78], rax
mov ecx, 0x436a
call fcn.140029ab4
mov qword [rsp + 0x68], rax
mov ecx, 0x42a7
call fcn.140029ab4
mov qword [rsp + 0xa8], rax
test rsi, rsi
je 0x14000c18c
cmp qword [rsp + 0x88], 0
je 0x14000c18c
cmp qword [rsp + 0x98], 0
je 0x14000c18c
cmp qword [rsp + 0x90], 0
je 0x14000c18c
cmp qword [rsp + 0x48], 0
je 0x14000c18c
cmp qword [rsp + 0x78], 0
je 0x14000c18c
cmp qword [rsp + 0x68], 0
je 0x14000c18c
test rax, rax
je 0x14000c18c
mov eax, esi
and eax, 0xfff
mov r15d, 0x1000
sub r15d, eax
xor ecx, ecx
mov dword [rsp + 0x44], ecx
mov eax, dword [rsp + 0x40]
cmp ecx, eax
jae 0x14000c187
sub eax, ecx
cmp eax, r15d
cmovb r15d, eax
mov dword [rsp + 0x50], r15d
xor al, al
mov byte [rsp + 0x30], al
mov byte [rsp + 0x35], al
xor edx, edx
mov rcx, rsi
call fcn.14005976c
cmp al, dil
jne 0x14000c149
mov rcx, rsi
and rcx, 0xfffffffffffff000
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1000
call qword [rsp + 0x88]
mov r12, rax
mov qword [rsp + 0xa0], rax
test rax, rax
je 0x14000c112
mov ecx, 0x914
call fcn.140029ab4
cmp eax, 0x42ee
jae 0x14000c014
mov rcx, r12
call qword [rsp + 0x98]
mov dword [rsp + 0x28], 0x10
and dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, edi
xor edx, edx
mov rcx, r12
call qword [rsp + 0x48]
mov r13, rax
test rax, rax
je 0x14000c0bd
mov r8d, r15d
mov rdx, rsi
and edx, 0xfff
add rdx, rax
mov rcx, qword [rsp + 0x38]
call fcn.1400010a0
mov al, dil
mov byte [rsp + 0x31], al
mov byte [rsp + 0x30], dil
mov rdx, r12
mov rcx, r13
call qword [rsp + 0x78]
jmp 0x14000c0bd
mov byte [rsp + 0x34], 0
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [rsp + 0x90]
mov al, dil
mov byte [rsp + 0x34], al
mov r13, qword [rsp + 0x38]
jmp 0x14000c077
cmp al, dil
jne 0x14000c0bd
mov r8, qword [rsp + 0x48]
mov edx, 0x10
mov rcx, r12
call fcn.14007769c
test rax, rax
je 0x14000c0b6
mov r8d, r15d
mov rdx, rsi
and edx, 0xfff
add rdx, rax
mov rcx, r13
call fcn.1400010a0
mov al, dil
mov byte [rsp + 0x31], al
mov byte [rsp + 0x30], dil
mov rcx, r12
call qword [rsp + 0x68]
cmp byte [rsp + 0x30], 0
jne 0x14000c0f8
mov r13d, r15d
lea rcx, [rsi - 1]
add rcx, r13
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, dil
jne 0x14000c0f8
mov r8d, r13d
mov rdx, rsi
mov rcx, qword [rsp + 0x38]
call fcn.1400010a0
mov r13b, dil
mov byte [rsp + 0x31], dil
mov byte [rsp + 0x30], dil
jmp 0x14000c0fd
mov r13b, byte [rsp + 0x31]
mov rcx, r12
call qword [rsp + 0xa8]
mov r12, qword [rsp + 0x38]
mov al, byte [rsp + 0x30]
jmp 0x14000c14b
mov r12d, r15d
lea rcx, [rsi - 1]
add rcx, r12
mov dl, dil
call fcn.14005976c
cmp al, dil
jne 0x14000c107
mov r8d, r12d
mov rdx, rsi
mov r12, qword [rsp + 0x38]
mov rcx, r12
call fcn.1400010a0
mov r13b, dil
mov byte [rsp + 0x31], dil
mov al, dil
jmp 0x14000c14b
xor al, al
test al, al
jne 0x14000c15c
mov r8d, r15d
xor edx, edx
mov rcx, r12
call fcn.1400013f0
mov edx, 0x1000
mov r15d, edx
mov ecx, dword [rsp + 0x44]
add ecx, edx
add rsi, rdx
mov qword [rsp + 0x70], rsi
add r12, rdx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x80], r12
jmp 0x14000bf2c
mov r15b, byte [rsp + 0x33]
test bl, bl
jne 0x14000c1a4
test r14, r14
je 0x14000c1b6
lea rcx, [rsp + 0xb0]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
jmp 0x14000c1b6
cmp r15b, dil
jne 0x14000c1b6
lea rcx, [rsp + 0xb0]
call fcn.14007a6dc
mov al, r13b
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.14008c320
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret