Function at 0x44f592
Capabilities:
Attach user process memory

Disassembly:
push 0x48
push 0x48c940
call fcn.004011b4
mov edi, dword [ebp + 8]
mov dword [ebp - 0x58], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x35], 0
push 0x2b
call fcn.004355f2
mov ebx, dword [ebp + 0x10]
cmp ebx, 2
jb 0x44f7cb
cmp eax, 0xffffffff
je 0x44f7cb
lea esi, [edi + eax]
push esi
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, 1
jne 0x44f7cb
push ebx
push 0
push dword [ebp - 0x54]
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov esi, dword [esi]
push edi
call fcn.00479046
mov byte [ebp - 0x3d], al
push 0x19
call fcn.00477546
mov byte [ebp - 0x50], al
push 0xe
call fcn.00477546
mov byte [ebp - 0x4c], al
lea eax, [ebp - 0x34]
push eax
push edi
call sub.ntoskrnl.exe_KeStackAttachProcess
push dword [ebp - 0x4c]
push 0xe
call fcn.0047769a
push dword [ebp - 0x50]
push 0x19
call fcn.0047769a
and dword [ebp - 4], 0
test esi, esi
je 0x44f785
mov eax, dword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov edx, dword [eax]
cmp esi, edx
jae 0x44f785
lea eax, [esi + 0x30]
cmp eax, edx
jae 0x44f785
mov ecx, dword [esi + 0x10]
cmp ecx, edx
jae 0x44f785
lea eax, [ecx + 0x290]
cmp eax, edx
jae 0x44f785
mov edi, dword [ecx + 0x44]
movzx ecx, word [ecx + 0x40]
mov dword [ebp - 0x3c], ecx
test edi, edi
je 0x44f785
test ecx, ecx
je 0x44f785
cmp edi, edx
jae 0x44f785
lea eax, [ecx + edi]
cmp eax, edx
jae 0x44f785
cmp ecx, ebx
jbe 0x44f69c
mov ecx, ebx
mov dword [ebp - 0x3c], ecx
shr ecx, 1
mov dword [ebp - 0x3c], ecx
je 0x44f785
xor edx, edx
mov dword [ebp - 0x48], edx
push 0x22
pop eax
cmp ax, word [edi]
jne 0x44f6de
xor esi, esi
inc esi
mov dword [ebp - 0x44], esi
cmp esi, ecx
jae 0x44f6de
cmp ax, word [edi + esi*2]
jne 0x44f6db
lea edx, [edi + 2]
lea edx, [edx + esi*2]
mov dword [ebp - 0x48], edx
or ebx, 0xffffffff
mov eax, ebx
sub eax, esi
add ecx, eax
mov dword [ebp - 0x3c], ecx
jmp 0x44f6e1
inc esi
jmp 0x44f6b7
or ebx, 0xffffffff
test edx, edx
jne 0x44f6ea
mov edx, edi
mov dword [ebp - 0x48], edx
xor eax, eax
mov dword [ebp - 0x44], eax
cmp eax, ecx
jae 0x44f70f
lea esi, [edx + eax*2]
push 0x20
pop edi
cmp di, word [esi]
jne 0x44f75e
lea edx, [esi + 2]
mov dword [ebp - 0x48], edx
sub ebx, eax
add ecx, ebx
mov dword [ebp - 0x3c], ecx
cmp eax, ecx
jb 0x44f764
push 0x5c
pop esi
test ecx, ecx
je 0x44f727
mov eax, esi
sub ax, word [edx]
movzx eax, ax
neg eax
sbb eax, eax
and ecx, eax
mov dword [ebp - 0x3c], ecx
cmp ecx, 3
jbe 0x44f745
push 0x3a
pop eax
cmp ax, word [edx + 2]
jne 0x44f745
sub si, word [edx + 4]
movzx eax, si
neg eax
sbb eax, eax
and ecx, eax
mov dword [ebp - 0x3c], ecx
xor eax, eax
inc eax
mov dword [ebp - 0x44], eax
cmp eax, ecx
jae 0x44f764
push 0x2e
pop esi
cmp si, word [edx + eax*2]
jne 0x44f761
and dword [ebp - 0x3c], 0
jmp 0x44f778
inc eax
jmp 0x44f6ec
inc eax
jmp 0x44f748
test ecx, ecx
je 0x44f778
lea eax, [ecx + ecx]
push eax
push edx
push dword [ebp - 0x54]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov byte [ebp - 0x35], 1
jmp 0x44f785
mov dword [ebp - 4], 0xfffffffe
push 0x19
call fcn.00477546
mov byte [ebp - 0x50], al
push 0xf
call fcn.00477546
mov byte [ebp - 0x4c], al
lea eax, [ebp - 0x34]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
push dword [ebp - 0x4c]
push 0xf
call fcn.0047769a
push dword [ebp - 0x50]
push 0x19
call fcn.0047769a
cmp byte [ebp - 0x3d], 1
jne 0x44f7cb
push dword [ebp - 0x58]
call fcn.004790ec
mov al, byte [ebp - 0x35]
call fcn.004011fc
ret 0xc