Function at 0x41b970
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xc0
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
mov qword [rsp + 0x68], 0
cmp qword [0x004ca5c8], 0
je 0x41b9c5
mov rcx, qword [0x004ca5c8]
call sub.ntoskrnl.exe_MmIsAddressValid
movzx eax, al
test eax, eax
jne 0x41b9d6
mov dword [rsp + 0x60], 0x80
mov eax, dword [rsp + 0x60]
jmp 0x41bc8f
mov r8d, 0x486e7367
mov rax, qword [rsp + 0xd0]
mov rdx, qword [rax + 0x18]
xor ecx, ecx
call sub.ntoskrnl.exe_ExAllocatePoolWithTag
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
jne 0x41ba06
mov eax, 0xc0000001
jmp 0x41bc8f
mov rax, qword [rsp + 0xd0]
mov r8, qword [rax + 0x18]
xor edx, edx
mov rcx, qword [rsp + 0x68]
call fcn.00431d40
mov rax, qword [rsp + 0xd0]
mov r8, qword [rax + 0x18]
mov rax, qword [rsp + 0xd0]
mov rdx, qword [rax + 0x20]
mov rcx, qword [rsp + 0x68]
call fcn.004319d0
nop
mov qword [rsp + 0x78], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0x88], 0
lea rax, [rsp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
mov dword [rsp + 0x70], 0xfe
mov dword [rsp + 0x80], 0x101
lea rdx, [rsp + 0x30]
mov rcx, qword [0x004ca5c8]
call sub.ntoskrnl.exe_KeStackAttachProcess
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x30
lea r9, [rsp + 0x88]
xor r8d, r8d
mov rax, qword [rsp + 0xd0]
mov rdx, qword [rax + 0x10]
mov rcx, 0xffffffffffffffff
call sub.ntoskrnl.exe_ZwQueryVirtualMemory
test eax, eax
jl 0x41bc83
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0xac]
and ecx, eax
mov eax, ecx
test eax, eax
je 0x41bb00
mov eax, dword [rsp + 0x80]
mov ecx, dword [rsp + 0xac]
and ecx, eax
mov eax, ecx
test eax, eax
je 0x41bb05
jmp 0x41bc83
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax + 0x10]
mov rcx, qword [rsp + 0xd0]
mov rcx, qword [rcx + 0x18]
lea rax, [rax + rcx - 1]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x30
lea r9, [rsp + 0x88]
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffffffffffff
call sub.ntoskrnl.exe_ZwQueryVirtualMemory
test eax, eax
jl 0x41bc83
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0xac]
and ecx, eax
mov eax, ecx
test eax, eax
je 0x41bb7f
mov eax, dword [rsp + 0x80]
mov ecx, dword [rsp + 0xac]
and ecx, eax
mov eax, ecx
test eax, eax
je 0x41bb84
jmp 0x41bc83
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rax, qword [rsp + 0xd0]
mov edx, dword [rax + 0x18]
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rax + 0x10]
call sub.ntoskrnl.exe_IoAllocateMdl
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
je 0x41bc83
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x78]
call sub.ntoskrnl.exe_MmProbeAndLockPages
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x78]
call sub.ntoskrnl.exe_MmMapLockedPagesSpecifyCache
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0
je 0x41bc83
mov rax, qword [rsp + 0xd0]
mov r8, qword [rax + 0x18]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0xb8]
call fcn.004319d0
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0xb8]
call sub.ntoskrnl.exe_MmUnmapLockedPages
mov rcx, qword [rsp + 0x78]
call sub.ntoskrnl.exe_MmUnlockPages
mov rcx, qword [rsp + 0x78]
call sub.ntoskrnl.exe_IoFreeMdl
lea rcx, [rsp + 0x30]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
jmp 0x41bc66
cmp qword [rsp + 0x68], 0
je 0x41bc7d
mov edx, 0x486e7367
mov rcx, qword [rsp + 0x68]
call sub.ntoskrnl.exe_ExFreePoolWithTag
mov eax, dword [rsp + 0x60]
jmp 0x41bc8f
lea rcx, [rsp + 0x30]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
jmp 0x41bc66
add rsp, 0xc0
pop rdi
ret