Function at 0x140001344
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xe0
xor ebx, ebx
xorps xmm0, xmm0
mov rdi, rdx
mov dword [rbp + 3], ebx
xor eax, eax
mov dword [rbp + 0x10], ebx
lea rdx, [rsp + 0x40]
mov word [rbp + 0x14], bx
mov byte [rbp + 0x16], bl
mov r15, rcx
mov qword [rbp - 0x69], rbx
mov qword [rsp + 0x40], rbx
mov qword [rbp - 0x51], rbx
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x29], rax
movups xmmword [rbp - 0x39], xmm0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov esi, eax
test eax, eax
jns 0x1400013f7
lea edi, [rbx + 0x4d]
xor edx, edx
mov ecx, edi
lea r8, [0x140003b30]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r9, [0x140003ce0]
mov dword [rsp + 0x20], 0x103
lea r8, [0x140003b50]
xor edx, edx
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r8, [0x140003cf0]
xor edx, edx
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x14000151c
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp - 0x51]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea r8, [rbp - 0x59]
mov rcx, rdi
lea rdx, [rbp - 0x69]
call fcn.140001a7c
test eax, eax
jns 0x140001439
lea rcx, [rbp - 0x51]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, 0xc0000001
jmp 0x140001930
mov r12, qword [rbp - 0x69]
mov eax, 0x5a4d
cmp word [r12], ax
je 0x1400014a4
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp - 0x51]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
xor edx, edx
lea r8, [0x140003b30]
lea edi, [rdx + 0x4d]
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r9, [0x140003ce0]
mov dword [rsp + 0x20], 0x116
lea r8, [0x140003b50]
xor edx, edx
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r8, [0x140003d10]
xor edx, edx
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov esi, 0xc000000d
jmp 0x14000151c
movsxd r14, dword [r12 + 0x3c]
mov eax, 0x8664
add r14, r12
cmp word [r14 + 4], ax
je 0x140001532
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp - 0x51]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
xor edx, edx
lea r8, [0x140003b30]
lea edi, [rdx + 0x4d]
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r9, [0x140003ce0]
mov dword [rsp + 0x20], 0x125
lea r8, [0x140003b50]
xor edx, edx
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r8, [0x140003d40]
xor edx, edx
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov esi, 0xc00000bb
lea r8, [0x140003b90]
xor edx, edx
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x14000192e
mov esi, dword [r14 + 0x50]
mov rcx, r15
mov edx, esi
mov qword [rbp - 0x59], rsi
call fcn.140001d68
mov qword [rbp - 0x61], rax
mov r13, rax
test rax, rax
jne 0x14000159f
lea edi, [rax + 0x4d]
xor edx, edx
mov ecx, edi
lea r8, [0x140003b30]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r9, [0x140003ce0]
mov dword [rsp + 0x20], 0x12f
lea r8, [0x140003b50]
xor edx, edx
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r8, [0x140003d70]
xor edx, edx
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov esi, 0xc0000017
jmp 0x140001886
xor eax, eax
mov rdi, r13
mov rcx, rsi
rep stosb byte [rdi], al
mov rax, qword [rbp + 0x6f]
mov qword [rbp - 0x19], rax
mov rax, qword [rbp + 0x77]
mov qword [rbp - 0x21], rax
mov rax, qword [0x140006390]
mov qword [rbp - 0x11], rax
mov dword [rbp - 1], ebx
mov qword [rbp - 9], r13
mov qword [rbp + 7], rbx
mov qword [rbp + 0x17], rsi
mov byte [rbp + 0xf], bl
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov r8, qword [rsp + 0x40]
lea rcx, [rbp - 0x79]
mov qword [rsp + 0x30], rcx
mov r9, r13
mov byte [rsp + 0x28], bl
mov rcx, rax
mov rdx, r12
mov qword [rsp + 0x20], 0x1000
mov qword [rbp - 0x71], rax
call sub.ntoskrnl.exe_MmCopyVirtualMemory
mov esi, eax
test eax, eax
jns 0x14000164f
xor edx, edx
lea r8, [0x140003b30]
lea edi, [rdx + 0x4d]
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov dword [rsp + 0x20], 0x14b
lea r9, [0x140003ce0]
xor edx, edx
lea r8, [0x140003b50]
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r8, [0x140003d90]
jmp 0x14000187c
movzx edi, word [r14 + 0x14]
mov r13d, ebx
add rdi, 0x24
cmp bx, word [r14 + 6]
jae 0x1400016ae
add rdi, r14
mov eax, dword [rdi + 4]
test eax, eax
je 0x14000169d
mov r9d, dword [rdi]
lea rcx, [rbp - 0x79]
mov edx, dword [rdi + 8]
mov r8, qword [rbp - 0x71]
add rdx, r12
add r9, qword [rbp - 0x61]
mov qword [rsp + 0x30], rcx
mov rcx, r8
mov byte [rsp + 0x28], bl
mov qword [rsp + 0x20], rax
call sub.ntoskrnl.exe_MmCopyVirtualMemory
mov esi, eax
test eax, eax
js 0x140001714
movzx eax, word [r14 + 6]
inc r13d
add rdi, 0x28
cmp r13d, eax
jl 0x140001665
mov edi, 0x1000
mov rcx, r15
mov edx, edi
call fcn.140001d68
mov r14, rax
test rax, rax
jne 0x140001735
lea edi, [rax + 0x4d]
xor edx, edx
mov ecx, edi
lea r8, [0x140003b30]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r9, [0x140003ce0]
mov dword [rsp + 0x20], 0x170
lea r8, [0x140003b50]
xor edx, edx
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r8, [0x140003d90]
xor edx, edx
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov esi, 0xc0000001
jmp 0x140001886
xor edx, edx
lea r8, [0x140003b30]
lea edi, [rdx + 0x4d]
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov dword [rsp + 0x20], 0x160
jmp 0x14000162b
mov r8, rdi
xor edx, edx
mov rcx, r14
call fcn.140003940
mov r8, qword [rsp + 0x40]
lea rax, [rbp - 0x79]
mov rcx, qword [rbp - 0x71]
lea rdx, [rbp - 0x21]
mov qword [rsp + 0x30], rax
mov r9, r14
mov byte [rsp + 0x28], bl
mov qword [rsp + 0x20], 0x40
call sub.ntoskrnl.exe_MmCopyVirtualMemory
mov esi, eax
test eax, eax
jns 0x1400017b3
xor edx, edx
lea r8, [0x140003b30]
lea edi, [rdx + 0x4d]
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r9, [0x140003ce0]
mov dword [rsp + 0x20], 0x17a
lea r8, [0x140003b50]
xor edx, edx
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r8, [0x140003db0]
jmp 0x14000187c
mov rdx, rdi
mov rcx, r15
call fcn.140001d68
mov r13, rax
test rax, rax
jne 0x140001803
lea edi, [rax + 0x4d]
xor edx, edx
mov ecx, edi
lea r8, [0x140003b30]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r9, [0x140003ce0]
mov dword [rsp + 0x20], 0x184
lea r8, [0x140003b50]
xor edx, edx
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r8, [0x140003dd0]
jmp 0x14000187c
mov edx, 0x1000
xor eax, eax
mov ecx, edx
mov rdi, r13
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x40]
lea rax, [rbp - 0x79]
mov rcx, qword [rbp - 0x71]
mov r9, r13
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], bl
mov qword [rsp + 0x20], rdx
lea rdx, [0x140003654]
call sub.ntoskrnl.exe_MmCopyVirtualMemory
mov esi, eax
test eax, eax
jns 0x1400018b3
xor edx, edx
lea r8, [0x140003b30]
lea edi, [rdx + 0x4d]
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r9, [0x140003ce0]
mov dword [rsp + 0x20], 0x18f
lea r8, [0x140003b50]
xor edx, edx
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r8, [0x140003e00]
xor edx, edx
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r8, [0x140003b90]
xor edx, edx
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp - 0x51]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
jmp 0x14000192e
mov r9, r13
lea rdx, [0x140001954]
mov r8, r14
mov rcx, r15
call section..text
mov rdi, qword [rbp - 0x59]
test rdi, rdi
je 0x1400018f7
mov r12, qword [rbp - 0x61]
lea rdx, [rbx + r12]
mov r8d, 0x18
mov rcx, r15
call fcn.140002904
add rbx, 0x1000
cmp rbx, rdi
jb 0x1400018d5
mov r12, qword [rbp - 0x69]
mov r8d, 0x18
mov rdx, r14
mov rcx, r15
call fcn.140002904
mov r8d, 0x18
mov rdx, r13
mov rcx, r15
call fcn.140002904
lea rcx, [rbp - 0x51]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
mov rbx, qword [rsp + 0x120]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret