Function at 0x1b1f0
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
push ebx
push esi
push edi
push 0x50
mov edi, eax
mov byte [esp + 0x10], 0
mov byte [esp + 0x13], 0
mov byte [esp + 0x11], 0
call fcn.00049640
test eax, eax
je 0x1b221
cmp eax, edi
jne 0x1b221
mov byte [esp + 0xd], 1
mov ecx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov eax, 0x2800
cmp word [ecx], ax
jb 0x1b32d
cmp byte [esp + 0xd], 0
jne 0x1b26d
push 0x8f6
call fcn.00049640
test eax, eax
je 0x1b24e
cmp eax, edi
je 0x1b268
push 0x8f4
call fcn.00049640
test eax, eax
je 0x1b338
cmp eax, edi
jne 0x1b338
mov byte [esp + 0xd], 1
lea eax, [esp + 0x38]
push eax
call fcn.0008a6e0
mov byte [esp + 0xf], al
push 0x4982
call fcn.00049640
mov ebx, eax
push 0x4985
mov dword [esp + 0x20], ebx
call fcn.00049640
mov ecx, eax
push 0x4988
mov dword [esp + 0x24], ecx
call fcn.00049640
mov edx, eax
push 0x498b
mov dword [esp + 0x28], edx
call fcn.00049640
mov esi, eax
push 0x498e
mov dword [esp + 0x2c], esi
call fcn.00049640
mov dword [esp + 0x2c], eax
test edi, edi
je 0x1b461
test ebx, ebx
je 0x1b461
test ecx, ecx
je 0x1b461
test edx, edx
je 0x1b461
test esi, esi
je 0x1b461
test eax, eax
je 0x1b461
push 6
call fcn.00088910
mov ecx, edi
and ecx, 0xfff
mov esi, 0x1000
mov byte [esp + 0x30], al
mov eax, dword [ebp + 8]
sub esi, ecx
xor ecx, ecx
mov dword [esp + 0x18], ecx
test eax, eax
je 0x1b455
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x10], edx
jmp 0x1b364
cmp byte [esp + 0xd], 0
jne 0x1b26d
push 0x61
call fcn.00049640
mov dword [esp + 0x34], eax
test eax, eax
je 0x1b27b
lea edx, [esp + 0x38]
push edx
push eax
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
jmp 0x1b27b
mov ebx, dword [esp + 0x1c]
sub eax, ecx
cmp eax, esi
jae 0x1b36c
mov esi, eax
push 0
push edi
mov byte [esp + 0x16], 0
call fcn.00071e70
cmp al, 1
jne 0x1b425
push 0
push 0
push 0
mov eax, edi
push 0x1000
and eax, 0xfffff000
push eax
call ebx
mov ebx, eax
mov dword [esp + 0x14], ebx
test ebx, ebx
je 0x1b487
push ebx
call dword [esp + 0x24]
push 0x10
push 0
push 0
push 1
push 0
push ebx
call dword [esp + 0x3c]
mov ebx, eax
test ebx, ebx
je 0x1b3ed
mov edx, dword [esp + 0x10]
mov ecx, edi
and ecx, 0xfff
push esi
add ecx, ebx
push ecx
push edx
call sub.ntoskrnl.exe_memcpy
mov eax, dword [esp + 0x20]
add esp, 0xc
push eax
push ebx
mov byte [esp + 0x14], 1
mov byte [esp + 0x16], 1
call dword [esp + 0x30]
jmp 0x1b415
lea ecx, [esi + edi - 1]
push ecx
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, 1
jne 0x1b415
mov edx, dword [esp + 0x10]
push esi
push edi
push edx
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov byte [esp + 0xc], 1
mov byte [esp + 0xe], 1
mov eax, dword [esp + 0x14]
push eax
call dword [esp + 0x30]
cmp byte [esp + 0xe], 0
jne 0x1b435
mov eax, dword [esp + 0x10]
push esi
push 0
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov ecx, dword [esp + 0x18]
mov eax, dword [ebp + 8]
mov esi, 0x1000
add dword [esp + 0x10], esi
add ecx, esi
add edi, esi
mov dword [esp + 0x18], ecx
cmp ecx, eax
jb 0x1b360
mov ecx, dword [esp + 0x30]
push ecx
push 6
call fcn.00088aa0
cmp byte [esp + 0xd], 0
jne 0x1b4aa
cmp dword [esp + 0x34], 0
je 0x1b4c6
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov al, byte [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 1
lea ecx, [esi + edi - 1]
push ecx
call fcn.00071e70
cmp al, 1
jne 0x1b425
mov edx, dword [esp + 0x10]
push esi
push edi
push edx
call sub.ntoskrnl.exe_memcpy
mov byte [esp + 0x18], 1
jmp 0x1b432
cmp byte [esp + 0xf], 1
jne 0x1b4c6
push 0x4943
call fcn.00049640
test eax, eax
je 0x1b4c6
lea ecx, [esp + 0x38]
push ecx
call eax
mov al, byte [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8