Function at 0x483534
Capabilities:
Attach user process memory

Disassembly:
push 0x6c
push 0x48d830
call fcn.004011b4
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x5c], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x54], eax
and dword [ebp - 0x50], 0
mov edi, dword [ecx + 4]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x6c], edi
push 0x4b8f
call fcn.004355f2
mov dword [ebp - 0x68], eax
push 0x4b14
call fcn.004355f2
mov dword [ebp - 0x60], eax
test eax, eax
je 0x483828
push 0x240
push 1
call fcn.00478d6e
mov ebx, eax
mov dword [ebp - 0x74], ebx
test ebx, ebx
je 0x483828
push 0x1000
push 1
call fcn.00478d6e
mov esi, eax
mov dword [ebp - 0x64], esi
test esi, esi
je 0x483822
push 0
push edi
call fcn.0044eb80
cmp al, 1
jne 0x48381c
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp eax, edi
setne byte [ebp - 0x35]
mov eax, dword [ebp - 0x48]
lea ecx, [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 0x70], eax
and dword [ebp - 0x58], 0
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x70]
jae 0x48381c
cmp dword [ebp + 0x14], 0
jbe 0x48381c
mov eax, dword [ebp - 0x5c]
push dword [eax]
movzx eax, word [ecx]
push eax
call fcn.0047b25e
cmp al, 1
jne 0x48380e
push 0x240
push 0
push ebx
call sub.ntoskrnl.exe_memset
add esp, 0xc
cmp byte [ebp - 0x35], 1
jne 0x48365e
push edi
call fcn.00479046
mov byte [ebp - 0x3d], al
push 0x19
call fcn.00477546
mov byte [ebp - 0x4c], al
push 0xe
call fcn.00477546
mov byte [ebp - 0x7c], al
lea eax, [ebp - 0x34]
push eax
push edi
call sub.ntoskrnl.exe_KeStackAttachProcess
push dword [ebp - 0x7c]
push 0xe
call fcn.0047769a
push dword [ebp - 0x4c]
push 0x19
call fcn.0047769a
mov ecx, dword [ebp - 0x48]
movzx eax, word [ecx + 6]
mov dword [ebx + 0x234], eax
mov eax, dword [ecx + 8]
mov dword [ebx + 0x238], eax
movzx eax, byte [ecx + 4]
mov dword [ebx + 0x230], eax
mov eax, dword [ebx + 0x238]
sub eax, 0x18
mov dword [ebp - 0x3c], eax
push eax
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, 1
jne 0x4836b3
mov eax, dword [ebp - 0x3c]
add eax, 0x17
push eax
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, 1
jne 0x4836b3
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
mov dword [ebx + 0x23c], eax
jmp 0x4836ba
and dword [ebx + 0x23c], 0
push edi
call fcn.00479022
cmp al, 1
jne 0x483788
mov eax, dword [ebx + 0x234]
mov dword [ebp - 0x3c], eax
push 0x914
call fcn.004355f2
cmp eax, 0x1db0
jb 0x483700
mov ecx, dword [ebp - 0x68]
test ecx, ecx
je 0x483700
mov ecx, dword [ecx]
mov eax, dword [ebp - 0x5c]
cmp ecx, dword [eax + 4]
mov eax, dword [ebp - 0x3c]
jne 0x483703
or eax, 0x80000000
mov dword [ebp - 0x3c], eax
jmp 0x483703
mov eax, dword [ebp - 0x3c]
push 0
push 0x1000
push esi
push 2
push eax
call dword [ebp - 0x60]
test eax, eax
js 0x48373d
movzx edi, word [esi]
shr edi, 1
je 0x48373a
cmp edi, 0x13
jbe 0x483724
push 0x13
pop edi
lea eax, [edi + edi]
push eax
push dword [esi + 4]
push ebx
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
xor eax, eax
mov word [ebx + edi*2], ax
mov edi, dword [ebp - 0x44]
push 0
push 0x1000
push esi
push 1
push dword [ebp - 0x3c]
call dword [ebp - 0x60]
test eax, eax
js 0x483782
movzx edi, word [esi]
shr edi, 1
je 0x48377f
cmp edi, 0x103
jbe 0x483765
mov edi, 0x103
lea eax, [edi + edi]
push eax
push dword [esi + 4]
lea eax, [ebx + 0x28]
push eax
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
xor eax, eax
mov word [ebx + edi*2 + 0x28], ax
mov edi, dword [ebp - 0x44]
push edi
call fcn.00478e94
cmp byte [ebp - 0x35], 1
jne 0x4837cb
push 0x19
call fcn.00477546
mov byte [ebp - 0x4c], al
push 0xf
call fcn.00477546
mov byte [ebp - 0x78], al
lea eax, [ebp - 0x34]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
push dword [ebp - 0x78]
push 0xf
call fcn.0047769a
push dword [ebp - 0x4c]
push 0x19
call fcn.0047769a
cmp byte [ebp - 0x3d], 1
jne 0x4837cb
push edi
call fcn.004790ec
and dword [ebp - 4], 0
mov ecx, 0x90
mov esi, ebx
mov edi, dword [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
add dword [ebp - 0x54], 0x240
dec dword [ebp + 0x14]
inc dword [ebp - 0x50]
mov dword [ebp - 4], 0xfffffffe
mov edi, dword [ebp - 0x44]
jmp 0x48380b
mov esi, dword [ebp - 0x64]
inc dword [ebp - 0x58]
mov ecx, dword [ebp - 0x48]
add ecx, 0x10
jmp 0x4835de
push esi
call fcn.00478d8c
push ebx
call fcn.00478d8c
mov eax, dword [ebp - 0x50]
call fcn.004011fc
ret 0x10