Function at 0x140009150
Capabilities:
Access pe header
Allocate or change rwx memory
Allocate user process rwx memory
Attach user process memory
Execute shellcode via indirect call
Find process by pid
Free user process memory

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x188
mov rax, qword [0x140006090]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov dword [rsp + 0x50], 0
mov dword [rsp + 0xa0], 0
mov qword [rsp + 0x90], 0
mov rax, qword [rsp + 0x1a0]
mov eax, dword [rax + 0x808]
lea rdx, [rsp + 0x90]
mov ecx, eax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jl 0x140009a34
lea rax, [rsp + 0xb0]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x78], 0
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
test rax, rax
je 0x14000920b
mov dword [rsp + 0x58], 1
jmp 0x140009213
mov dword [rsp + 0x58], 0
movzx eax, byte [rsp + 0x58]
mov byte [rsp + 0x54], al
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, rax
call fcn.140003190
movzx eax, al
test eax, eax
je 0x140009281
mov rax, qword [rsp + 0x1a0]
mov eax, dword [rax + 0x808]
mov dword [rsp + 0x20], eax
lea r9, [0x140015320]
lea r8, [0x140015330]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
cmp qword [rsp + 0x90], 0
je 0x140009277
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, 0xc000010a
jmp 0x140009a77
mov rax, qword [rsp + 0x1a0]
cmp dword [rax], 2
jne 0x140009395
mov rax, qword [rsp + 0x1a0]
cmp qword [rax + 0x818], 0
je 0x140009395
mov rax, qword [rsp + 0x1a0]
mov eax, dword [rax + 0x820]
mov r8d, 1
mov edx, eax
mov rax, qword [rsp + 0x1a0]
mov rcx, qword [rax + 0x818]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rax, qword [rsp + 0x1a0]
mov eax, dword [rax + 0x820]
mov r8d, 0x656e6f42
mov edx, eax
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x1a0]
mov eax, dword [rax + 0x820]
mov rcx, qword [rsp + 0x1a0]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rcx + 0x818]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
jmp 0x140009395
lea rdx, [rsp + 0xe0]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rax, qword [rsp + 0x1a0]
add rax, 4
mov rdx, rax
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x1400153a0]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rax, qword [rsp + 0x1a0]
cmp dword [rax], 2
jne 0x1400094e2
lea rax, [rsp + 0x110]
mov rdi, rax
xor eax, eax
mov ecx, 0x58
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x1a0]
add rax, 0x404
mov rcx, qword [rsp + 0x1a0]
mov ecx, dword [rcx + 0x820]
lea rdx, [rsp + 0x110]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x1a0]
mov eax, dword [rax + 0x804]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x1a0]
mov eax, dword [rax + 0x810]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x1a0]
movzx eax, byte [rax + 0x824]
mov byte [rsp + 0x20], al
mov r9d, ecx
mov r8, qword [rsp + 0x78]
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x90]
call fcn.14000dda0
mov dword [rsp + 0x50], eax
jmp 0x1400094b2
lea rcx, [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
cmp qword [rsp + 0x90], 0
je 0x1400094d9
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [rsp + 0x50]
jmp 0x140009a77
movzx r8d, byte [rsp + 0x54]
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x90]
call fcn.14000a200
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
jne 0x140009533
lea r9, [0x140015320]
lea r8, [0x140015410]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov dword [rsp + 0x50], 0xc0000225
cmp dword [rsp + 0x50], 0
jl 0x14000958c
lfence
xor r9d, r9d
mov r8, qword [rsp + 0x90]
lea rdx, [0x140015440]
mov rcx, qword [rsp + 0x80]
call fcn.140009aa0
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x14000958c
lea r9, [0x140015320]
lea r8, [0x140015450]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov dword [rsp + 0x50], 0xc0000225
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_PsIsProtectedProcess]
movzx eax, al
test eax, eax
je 0x1400095e4
mov rax, qword [rsp + 0x1a0]
mov eax, dword [rax + 0x808]
mov dword [rsp + 0xb0], eax
mov dword [rsp + 0xb4], 0
mov dword [rsp + 0xb8], 0
mov dword [rsp + 0xbc], 0
lea rcx, [rsp + 0xb0]
call fcn.1400144a0
cmp dword [rsp + 0x50], 0
jl 0x1400099ec
mov qword [rsp + 0xa8], 0
movzx eax, byte [rsp + 0x54]
test eax, eax
je 0x140009623
lfence
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x60]
call fcn.140008f00
mov qword [rsp + 0x88], rax
jmp 0x140009640
lfence
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x60]
call fcn.140008be0
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x1a0]
cmp dword [rax], 0
jne 0x14000979a
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x1a0]
movzx r9d, byte [rax + 0x80c]
mov r8d, 4
xor edx, edx
mov rcx, qword [rsp + 0x98]
call fcn.140001b80
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0xa0], 0
jge 0x1400096d4
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x20], eax
lea r9, [0x140015320]
lea r8, [0x140015490]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x140009798
mov rax, qword [rsp + 0x98]
cmp qword [rax + 0x5e0], 0
je 0x14000976b
mov rax, qword [rsp + 0x1a0]
cmp dword [rax + 0x804], 0
je 0x14000976b
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x1a0]
lea rdi, [rax + 0x210]
lea rsi, [rcx + 0x404]
mov ecx, 0x3d0
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x98]
add rax, 0x210
mov rcx, qword [rsp + 0x1a0]
mov ecx, dword [rcx + 0x804]
mov rdx, qword [rsp + 0x98]
add rcx, qword [rdx + 0x5e0]
lea rdx, [rsp + 0xa0]
mov qword [rsp + 0x20], rdx
mov r9b, 1
mov r8d, 4
mov rdx, rax
call fcn.140001b80
jmp 0x140009798
mov rax, qword [rsp + 0x98]
cmp qword [rax + 0x5e0], 0
jne 0x140009798
lea r9, [0x140015320]
lea r8, [0x1400154d0]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x140009813
mov rax, qword [rsp + 0x1a0]
cmp dword [rax], 1
jne 0x1400097e2
mov rax, qword [rsp + 0x1a0]
add rax, 0x404
mov r9, rax
mov rax, qword [rsp + 0x1a0]
mov r8d, dword [rax + 0x804]
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x98]
call fcn.140008940
mov dword [rsp + 0x50], eax
jmp 0x140009813
mov rax, qword [rsp + 0x1a0]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
lea r9, [0x140015320]
lea r8, [0x140015500]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov dword [rsp + 0x50], 0xc000000d
cmp dword [rsp + 0x50], 0
jl 0x1400099c9
mov rax, qword [rsp + 0x1a0]
movzx eax, byte [rax + 0x80d]
test eax, eax
je 0x140009856
lfence
movzx r8d, byte [rsp + 0x54]
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax + 0x5e0]
mov rcx, qword [rsp + 0x90]
call fcn.14000b4b0
mov rax, qword [rsp + 0x1a0]
movzx eax, byte [rax + 0x80e]
test eax, eax
je 0x1400099c9
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax + 0x5e0]
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x140009984
mov dword [rsp + 0xa4], 0
mov rax, qword [rsp + 0x68]
movzx eax, word [rax + 0x18]
cmp eax, 0x10b
jne 0x1400098bc
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x54]
mov dword [rsp + 0x5c], eax
jmp 0x1400098c8
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x54]
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x5c]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x98]
add rax, 0x5e0
lea rcx, [rsp + 0xa4]
mov qword [rsp + 0x20], rcx
mov r9d, 0x40
lea r8, [rsp + 0xa8]
mov rdx, rax
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwProtectVirtualMemory]
test eax, eax
jl 0x140009982
mov rax, qword [rsp + 0x98]
mov rdi, qword [rax + 0x5e0]
xor eax, eax
mov rcx, qword [rsp + 0xa8]
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x98]
add rax, 0x5e0
lea rcx, [rsp + 0xa4]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rsp + 0xa4]
lea r8, [rsp + 0xa8]
mov rdx, rax
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwProtectVirtualMemory]
lea r9, [0x140015320]
lea r8, [0x140015540]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x14000999f
lea r9, [0x140015320]
lea r8, [0x140015570]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x1400099c9
mov r9d, 0x8000
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0x98]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
cmp dword [rsp + 0xb0], 0
je 0x140009a24
mov dword [rsp + 0xb4], 1
mov dword [rsp + 0xb8], 1
mov dword [rsp + 0xbc], 1
lea rcx, [rsp + 0xb0]
call fcn.1400144a0
lea rcx, [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x140009a5a
lfence
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x20], eax
lea r9, [0x140015320]
lea r8, [0x1400155f0]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
cmp qword [rsp + 0x90], 0
je 0x140009a73
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140003e80
add rsp, 0x188
pop rdi
pop rsi
ret