Function at 0x1507c
Capabilities:
Attach user process memory

Disassembly:
push 0x4c
push 0x2cc78
call fcn.00027450
xor ebx, ebx
mov dword [ebp - 0x20], ebx
xor esi, esi
mov dword [ebp - 0x3c], esi
call dword [sym.imp.ntoskrnl.exe_ExGetPreviousMode]
cmp al, 1
jne 0x15199
test dword [ebp + 0x14], 0x44
je 0x15199
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_PsGetProcessId]
mov edi, eax
mov dword [ebp - 0x24], edi
push edi
call fcn.00021670
test eax, eax
je 0x15199
mov dword [ebp - 0x28], ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0xc]
call fcn.0001441c
mov dword [ebp + 0x14], eax
cmp eax, 0xffffffff
jne 0x15104
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0xc]
push edi
call fcn.000219ba
mov dword [ebp + 0x14], eax
cmp eax, ebx
jl 0x15199
add dword [ebp + 0x14], 4
mov eax, dword [ebp - 0x28]
test dword [ebp + 0x18], eax
je 0x15199
mov dword [ebp - 4], ebx
cmp dword [0x33b1c], ebx
jne 0x1512b
mov dword [ebp - 0x1c], 0xc0000001
mov dword [ebp - 4], 0xfffffffe
jmp 0x151a0
push edi
call fcn.00021c04
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp esi, ebx
jne 0x15143
mov dword [ebp - 0x1c], 0x80000011
jmp 0x15122
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp dword [ebp + 8], eax
je 0x15162
mov dword [ebp - 0x20], 1
lea eax, [ebp - 0x5c]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
call dword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
push 7
pop ecx
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
push eax
push 0x1c
push esi
push eax
push dword [ebp + 0xc]
push 0xffffffffffffffff
call dword [0x33b1c]
mov dword [ebp - 0x1c], eax
test eax, eax
jl 0x15122
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 0xfffffffe
test al, 0x44
je 0x151a0
mov dword [ebp - 0x1c], 0xc0000001
test esi, esi
je 0x151ad
push esi
push dword [ebp - 0x24]
call fcn.00021c8a
cmp dword [ebp - 0x20], 1
jne 0x151bd
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
xor ebx, ebx
xor esi, esi
cmp dword [ebp - 0x1c], esi
jl 0x15444
push 0x6e6d6c5a
mov edi, 0x6a8
push edi
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebx, eax
cmp ebx, esi
je 0x15444
push edi
push esi
push ebx
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 1
push 0x20
push ebx
call dword [sym.imp.ntoskrnl.exe_RtlWalkFrameChain]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x15231
xor esi, esi
jmp 0x15444
lea eax, [ebx + 0x4a0]
push eax
push dword [ebp - 0x24]
call fcn.0002176a
cmp dword [ebp - 0x20], 1
jne 0x15265
call dword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov dword [ebp - 0x30], eax
lea eax, [ebx + 0x298]
push 0x104
push eax
push dword [ebp - 0x30]
call fcn.00019b94
jmp 0x15282
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
lea edi, [ebx + 0x298]
mov ecx, 0x82
lea esi, [ebx + 0x4a0]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [ebp + 0xc], esi
cmp dword [ebp - 0x2c], esi
jbe 0x152fd
mov dword [ebp + 0xc], esi
mov edi, dword [ebx + esi*4]
test edi, edi
je 0x152fd
push edi
call fcn.000143d4
test eax, eax
jne 0x152b0
cmp edi, dword [0x33d60]
jbe 0x152b0
cmp edi, dword [0x33d64]
jb 0x152f9
cmp eax, 0xffffffff
je 0x152bd
inc esi
cmp esi, dword [ebp - 0x2c]
jb 0x1528f
jmp 0x152fd
cmp dword [ebp - 0x20], 1
jne 0x152c9
or dword [ebp + 0xc], 0xffffffff
jmp 0x152fd
push edi
push dword [ebp - 0x24]
call fcn.0002194a
cmp eax, 0xffffffff
je 0x152c3
cmp eax, 4
je 0x152f9
cmp eax, 1
je 0x152f9
cmp eax, 2
je 0x152f9
test eax, eax
je 0x152f9
cmp eax, 5
je 0x152f9
cmp eax, 9
je 0x152f9
cmp eax, 8
jne 0x152c3
and dword [ebp + 0xc], 0
xor eax, eax
inc eax
mov dword [ebp + 0x18], eax
mov dword [ebp - 0x38], 0x204
cmp dword [ebp + 0x14], 4
jne 0x1531e
mov dword [ebp - 0x38], 0x201
cmp dword [ebp - 0x20], eax
jne 0x1532b
jmp 0x15324
test byte [ebp - 0x28], 1
je 0x1532b
mov dword [ebp + 0x18], 2
cmp dword [ebp + 0xc], 0xffffffff
jne 0x15204
cmp dword [ebp - 0x20], eax
jne 0x153f8
mov eax, 0x208
mov word [ebx + 0x82], ax
push 1
lea eax, [ebx + 0x80]
push eax
push dword [ebx + esi*4]
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
push eax
call fcn.000122e0
test eax, eax
je 0x15379
lea edi, [ebx + 0x88]
mov ecx, 0x82
lea esi, [ebx + 0x298]
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp + 0x14], 4
jne 0x15386
mov dword [ebp + 0x18], 2
lea eax, [ebx + 0x88]
push eax
lea eax, [ebx + 0x298]
push eax
lea eax, [ebx + 0x4a0]
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x24]
push dword [ebp + 0x10]
push dword [ebp - 0x34]
push dword [ebp + 0x14]
push dword [ebp + 0x18]
push dword [ebp - 0x38]
call fcn.0001451c
cmp dword [ebp + 0x14], 4
jne 0x15204
mov esi, 0xc0000005
jmp 0x15444
cmp dword [ebx + esi*4], 0
je 0x15441
mov eax, 0x208
mov word [ebx + 0x82], ax
push 1
lea eax, [ebx + 0x80]
push eax
push dword [ebx + esi*4]
push dword [ebp + 8]
call fcn.000122e0
mov dword [ebp - 0x1c], eax
test eax, eax
jge 0x153ff
and dword [ebp - 0x1c], 0
inc esi
cmp esi, dword [ebp - 0x2c]
jb 0x153c6
jmp 0x15441
lea esi, [ebx + 0x80]
call fcn.00012ede
test eax, eax
jne 0x15441
lea eax, [ebx + 0x88]
push eax
lea eax, [ebx + 0x298]
push eax
lea eax, [ebx + 0x4a0]
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x24]
push dword [ebp + 0x10]
push dword [ebp - 0x34]
push dword [ebp + 0x14]
push dword [ebp + 0x18]
push dword [ebp - 0x38]
call fcn.0001451c
and dword [ebp - 0x1c], 0
mov esi, dword [ebp - 0x1c]
test ebx, ebx
je 0x15451
push 0
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
call fcn.00027495
ret 0x14