Function at 0x19688
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r13
push r14
sub rsp, 0x30
mov r13d, r8d
mov r14, rdx
mov rsi, rcx
mov r12d, 0x20
mov edi, r12d
mov edx, 0xc0
mov ecx, 1
mov r8d, 0x6e65654b
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
jne 0x196dd
add edi, 0xffffffff
jne 0x196b3
mov qword [rsp + 0x68], rax
jmp 0x196f2
xor edx, edx
mov r8d, 0xc0
mov rcx, rax
call fcn.000407c0
mov qword [rsp + 0x68], rbx
test rbx, rbx
jne 0x196fe
xor eax, eax
jmp 0x1993b
xor edx, edx
mov r8d, 0xc0
mov rcx, rbx
call fcn.000407c0
nop
or dword [rbx], r13d
lea rax, [rbx + 0x30]
mov qword [rax + 8], rax
mov qword [rax], rax
lea rax, [rbx + 0x40]
mov qword [rax + 8], rax
mov qword [rax], rax
test r13b, 1
jne 0x197b8
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], r14
lea rdx, [rbx + 0x18]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x19750
and qword [rbx + 0x18], 0
lea rdx, [rbx + 0x94]
mov esi, 0x10
mov r8d, esi
mov rcx, qword [rbx + 0x18]
call fcn.0001e4a8
lea rdx, [rbx + 0x20]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x1977e
and qword [rbx + 0x20], 0
lea rdx, [rbx + 0xa8]
mov r8d, esi
mov rcx, qword [rbx + 0x20]
call fcn.0001e4a8
cmp qword [rbx + 0x20], 0
je 0x197a0
mov rcx, rbx
call fcn.00019594
mov rax, qword [0x00062090]
test rax, rax
je 0x1991a
inc dword [rax + 0x28]
jmp 0x1991a
inc dword [rbx + 0x28]
or r14, 0xffffffffffffffff
mov qword [rbx + 0x10], r14
mov qword [rbx + 8], r14
xor eax, eax
mov rcx, r14
lea rdi, [0x00041190]
repne scasw ax, word [rdi]
not rcx
lea r13, [rcx + rcx]
mov edi, r12d
mov dword [rsp + 0x20], r12d
test edi, edi
je 0x1981c
mov r8d, 0x6e65654b
mov rdx, r13
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
je 0x19814
mov r8, r13
xor edx, edx
mov rcx, rax
call fcn.000407c0
jmp 0x1981e
dec edi
mov dword [rsp + 0x20], edi
jmp 0x197e5
xor esi, esi
mov qword [rbx + 0x78], rsi
test rsi, rsi
je 0x1986d
xor eax, eax
mov rcx, r14
lea r13, [0x00041190]
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx + rcx - 2]
mov rdx, r13
mov rcx, rsi
call fcn.00040300
mov rdx, qword [rbx + 0x78]
lea rcx, [rbx + 0x70]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbx + 0x50]
mov r8b, 1
lea rdx, [rbx + 0x70]
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
jmp 0x19874
lea r13, [0x00041190]
xor eax, eax
mov rcx, r14
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx + rcx]
mov dword [rsp + 0x24], r12d
test r12d, r12d
je 0x198c5
mov r8d, 0x6e65654b
mov rdx, rdi
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
je 0x198bb
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.000407c0
jmp 0x198c7
dec r12d
mov dword [rsp + 0x24], r12d
jmp 0x1988b
xor esi, esi
mov qword [rbx + 0x88], rsi
test rsi, rsi
je 0x1991a
xor eax, eax
mov rcx, r14
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx + rcx - 2]
mov rdx, r13
mov rcx, rsi
call fcn.00040300
mov rdx, qword [rbx + 0x88]
lea rcx, [rbx + 0x80]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbx + 0x60]
mov r8b, 1
lea rdx, [rbx + 0x80]
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
nop
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x19929
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x19938
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop r13
pop r12
ret