Function at 0x15380
Capabilities:
Find process by pid

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x220
mov rax, qword [0x0001a100]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov byte [rsp + 0x1f8], 0
xor eax, eax
mov word [rsp + 0x40], ax
lea rdi, [rsp + 0x42]
xor eax, eax
mov ecx, 0x1ae
rep stosb byte [rdi], al
mov qword [rsp + 0x1f0], 0
lea rdx, [0x00018240]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x153fc
mov byte [rsp + 0x1f8], 1
jmp 0x15985
lea rdx, [0x00018260]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x1541f
jmp 0x156ac
lea rdx, [0x00018280]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x1544a
mov byte [rsp + 0x1f8], 1
jmp 0x15985
lea rdx, [0x000182a0]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x15475
mov byte [rsp + 0x1f8], 1
jmp 0x15985
lea rdx, [0x000182c0]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x154a0
mov byte [rsp + 0x1f8], 1
jmp 0x15985
lea rdx, [0x000182f0]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x154cb
mov byte [rsp + 0x1f8], 1
jmp 0x15985
lea rdx, [0x00017be0]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x154f6
mov byte [rsp + 0x1f8], 1
jmp 0x15985
lea rdx, [0x00018310]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x15521
mov byte [rsp + 0x1f8], 1
jmp 0x15985
lea rdx, [0x00018340]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x1554c
mov byte [rsp + 0x1f8], 1
jmp 0x15985
lea rdx, [0x00018370]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x15577
mov byte [rsp + 0x1f8], 1
jmp 0x15985
lea rdx, [0x00018390]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x155a2
mov byte [rsp + 0x1f8], 1
jmp 0x15985
lea rdx, [0x000183b0]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x155cd
mov byte [rsp + 0x1f8], 1
jmp 0x15985
lea rdx, [0x000183d0]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x155f8
mov byte [rsp + 0x1f8], 1
jmp 0x15985
lea rdx, [0x000183f0]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x15620
mov byte [rsp + 0x1f8], 1
jmp 0x15985
lea rdx, [0x00017d30]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x15648
mov byte [rsp + 0x1f8], 1
jmp 0x15985
lea rdx, [0x00018410]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x15665
jmp 0x156ac
lea rdx, [0x00018430]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
je 0x156ac
jmp 0x15985
nop
mov ecx, dword [rsp + 0x230]
lea rdx, [rsp + 0x1f0]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jl 0x1595a
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x1f0]
call fcn.00016b90
cmp qword [rsp + 0x1f0], 0
je 0x156f5
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, qword [rsp + 0x238]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x240]
mov r8d, dword [rsp + 0x230]
lea rdx, [rsp + 0x40]
lea rcx, [0x00018450]
call fcn.00013920
lea rdx, [0x00017b60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x15779
mov rax, qword [rsp + 0x238]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x240]
mov r8d, dword [rsp + 0x230]
lea rdx, [rsp + 0x40]
lea rcx, [0x00018450]
call fcn.00013920
mov byte [rsp + 0x1f8], 1
jmp 0x15985
lea rdx, [0x00017b80]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x157cf
mov rax, qword [rsp + 0x238]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x240]
mov r8d, dword [rsp + 0x230]
lea rdx, [rsp + 0x40]
lea rcx, [0x00018450]
call fcn.00013920
mov byte [rsp + 0x1f8], 1
jmp 0x15985
lea rdx, [0x00017ba0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x15825
mov rax, qword [rsp + 0x238]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x240]
mov r8d, dword [rsp + 0x230]
lea rdx, [rsp + 0x40]
lea rcx, [0x00018450]
call fcn.00013920
mov byte [rsp + 0x1f8], 1
jmp 0x15985
lea rdx, [0x00017bc0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x1587b
mov rax, qword [rsp + 0x238]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x240]
mov r8d, dword [rsp + 0x230]
lea rdx, [rsp + 0x40]
lea rcx, [0x00018450]
call fcn.00013920
mov byte [rsp + 0x1f8], 1
jmp 0x15985
lea rdx, [0x00017be0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x158d1
mov rax, qword [rsp + 0x238]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x240]
mov r8d, dword [rsp + 0x230]
lea rdx, [rsp + 0x40]
lea rcx, [0x00018450]
call fcn.00013920
mov byte [rsp + 0x1f8], 1
jmp 0x15985
lea rdx, [0x00017c00]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x15921
mov rax, qword [rsp + 0x238]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x240]
mov r8d, dword [rsp + 0x230]
lea rdx, [rsp + 0x40]
lea rcx, [0x00018450]
call fcn.00013920
mov byte [rsp + 0x1f8], 1
jmp 0x15985
lea rdx, [0x00017b40]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x1595a
lea rdx, [0x00018260]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x1595a
mov byte [rsp + 0x1f8], 1
jmp 0x15985
jmp 0x15985
mov al, byte [rsp + 0x1f8]
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.00017030
add rsp, 0x220
pop rdi
ret