Function at 0x140003de0
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword ss:[rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x10c0]
mov eax, 0x11c0
call fcn.1400091c0
sub rsp, rax
mov eax, dword [0x14000d850]
lea r8, [0x14000a120]
mov dword [rsp + 0x28], eax
mov rsi, rdx
mov qword [rsp + 0x20], rdx
mov rdi, rcx
xor edx, edx
mov r9, rcx
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
test rdi, rdi
je 0x140004235
nop dword [rax + rax]
test rsi, rsi
je 0x140004235
cmp dword [0x14000d850], 0
je 0x140004235
lea rax, [fcn.140003de0]
mov r15d, 0x190
mov r8d, r15d
mov dword [rbp + 0x10e0], eax
xor edx, edx
lea rcx, [rbp + 0x760]
call fcn.140009540
mov rcx, qword gs:[0x188]
call qword [sym.imp.ntoskrnl.exe_PsGetThreadCreateTime]
lea rcx, [rbp + 0x10e0]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_RtlRandomEx]
lea r8, [0x14000a140]
mov qword [rsp + 0x20], rbx
mov r9d, eax
lea rcx, [rbp + 0x760]
mov edx, r15d
call fcn.140003b60
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0xc8
call fcn.140009540
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x760]
call fcn.140003c40
mov r8d, r15d
lea rcx, [rbp + 0x8f0]
xor edx, edx
call fcn.140009540
lea rax, [rsp + 0x70]
mov edx, r15d
mov qword [rsp + 0x28], rax
lea r9, [0x14000d930]
mov rax, qword [0x14000d8b8]
lea r8, [0x14000a150]
lea rcx, [rbp + 0x8f0]
mov qword [rsp + 0x20], rax
call fcn.140003b60
mov r8d, r15d
lea rcx, [rbp + 0xa80]
xor edx, edx
call fcn.140009540
lea rdx, ds:[rbp + 0xa80]
lea rcx, [rbp + 0x8f0]
call fcn.140003be4
mov r8d, r15d
lea rcx, [rbp + 0xc10]
xor edx, edx
call fcn.140009540
lea r9, [rbp + 0xa80]
mov edx, r15d
lea r8, [0x14000a180]
lea rcx, [rbp + 0xc10]
call fcn.140003b60
mov r8d, r15d
lea rcx, [rbp + 0x2b0]
xor edx, edx
call fcn.140009540
mov r8d, r15d
lea rcx, [rbp + 0x5d0]
xor edx, edx
call fcn.140009540
mov ecx, dword [0x14000d850]
lea rdx, [rbp + 0x10f0]
and qword [rbp + 0x10f0], 0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword ds:[rbp + 0x10f0]
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r8d, 0x7fffffff
mov edx, r15d
mov rcx, rdi
call fcn.14000756c
test eax, eax
js 0x140003ffe
lfence
lea r9, [rbp + 0xc10]
mov qword [rsp + 0x20], 0x7ffffffe
xor r8d, r8d
mov edx, r15d
mov rcx, rdi
call fcn.1400073d0
jmp 0x140004001
mov byte [rdi], 0
xor ebx, ebx
cmp byte [rsi], 0
jne 0x140004019
mov ecx, 0x1f4
call fcn.1400031e0
inc ebx
cmp ebx, 0xf
jl 0x140004003
mov r8d, 0x7fffffff
lea rcx, [rbp + 0x2b0]
mov rdx, r15
call fcn.14000756c
test eax, eax
js 0x140004055
lfence
mov r9, rsi
mov qword [rsp + 0x20], 0x7ffffffe
xor r8d, r8d
lea rcx, [rbp + 0x2b0]
mov rdx, r15
call fcn.1400073d0
jmp 0x14000405c
mov byte [rbp + 0x2b0], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
lea rdx, [rbp + 0x5d0]
lea rcx, [rbp + 0x2b0]
call fcn.140003bbc
mov ebx, 0xc8
lea rcx, [rbp + 0x40]
mov r8d, ebx
xor edx, edx
call fcn.140009540
lea rdx, [rbp + 0x40]
lea rcx, [0x14000a1e0]
call fcn.140003c40
mov r8, r15
lea rcx, [rbp + 0xda0]
xor edx, edx
call fcn.140009540
lea rax, [rbp + 0x40]
mov rdx, r15
mov qword [rsp + 0x30], rax
lea r9, [0x14000d930]
mov rax, qword [0x14000d8b8]
lea r8, [0x14000a1f0]
mov qword [rsp + 0x28], rax
lea rcx, [rbp + 0xda0]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call fcn.140003b60
mov r8d, ebx
lea rcx, [rbp + 0x110]
xor edx, edx
call fcn.140009540
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0xda0]
call fcn.140003c40
mov r8, r15
lea rcx, [rbp + 0xf30]
xor edx, edx
call fcn.140009540
lea rax, [0x14000a1c0]
mov rdx, r15
lea r9, [rbp + 0x110]
mov qword [rsp + 0x20], rax
lea r8, [0x14000a200]
lea rcx, [rbp + 0xf30]
call fcn.140003b60
mov r8d, ebx
lea rcx, [rbp + 0x1e0]
xor edx, edx
call fcn.140009540
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0xf30]
call fcn.140003c40
mov r8, r15
lea rcx, [rbp + 0x440]
xor edx, edx
call fcn.140009540
lea rax, [0x14000a1b0]
mov rdx, r15
lea r9, [rbp + 0x1e0]
mov qword [rsp + 0x20], rax
lea r8, [0x14000a200]
lea rcx, [rbp + 0x440]
call fcn.140003b60
lea rax, [rbp + 0x5d0]
lea r8, [rbp + 0x440]
sub r8, rax
movzx edx, byte ds:[rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400041cb
inc rax
test ecx, ecx
jne 0x1400041b7
lea r9, [rbp + 0x5d0]
test edx, edx
jne 0x140004204
mov rax, qword [0x14000d080]
lea r8, [0x14000a210]
add rax, 0x1c4
mov qword [rsp + 0x28], rax
mov qword [0x14000d080], rax
lea rax, [rbp + 0x440]
mov qword [rsp + 0x20], rax
jmp 0x140004223
mov rcx, qword [0x14000d080]
lea r8, [0x14000a230]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x440]
mov qword [rsp + 0x20], rcx
xor edx, edx
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, 1
jmp 0x140004237
xor eax, eax
lea r11, [rsp + 0x11c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret