Function at 0x83f10
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
push esi
push edi
push 0x61
call fcn.00049640
mov edi, eax
mov dword [ebp - 4], edi
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp eax, edi
jne 0x83f3e
mov dword [ebp - 4], 0
mov edi, dword [ebp - 4]
jmp 0x83f50
test edi, edi
je 0x83f50
lea eax, [ebp - 0xe0]
push eax
push edi
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
push 0x21
call fcn.00049640
mov ecx, eax
push 3
mov dword [ebp - 0xc], ecx
call fcn.00049640
mov dword [ebp - 8], eax
test ecx, ecx
je 0x84276
test eax, eax
je 0x84276
push 0xb4
lea ecx, [ebp - 0xc8]
push 0
push ecx
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov dword [ebp - 0xc8], 0x48d9
mov dword [ebp - 0xc4], 0x16e
mov dword [ebp - 0xc0], 0x39
mov dword [ebp - 0xbc], 0x48dc
mov dword [ebp - 0xb8], 0x16f
mov dword [ebp - 0xb4], 0x3a
mov dword [ebp - 0xb0], 0x48df
mov dword [ebp - 0xac], 0x170
mov dword [ebp - 0xa8], 0x3b
mov dword [ebp - 0xa4], 0x48e2
mov dword [ebp - 0xa0], 0x171
mov dword [ebp - 0x9c], 0x3c
mov dword [ebp - 0x98], 0x48eb
mov dword [ebp - 0x94], 0x172
mov dword [ebp - 0x90], 0x3d
mov dword [ebp - 0x8c], 0x48ee
mov dword [ebp - 0x88], 0x173
mov dword [ebp - 0x84], 0x3e
mov dword [ebp - 0x80], 0x48f1
mov dword [ebp - 0x7c], 0x174
mov dword [ebp - 0x78], 0x3f
mov dword [ebp - 0x74], 0x48f4
mov dword [ebp - 0x70], 0x175
mov dword [ebp - 0x6c], 0x40
mov dword [ebp - 0x68], 0x48f7
mov dword [ebp - 0x64], 0x176
mov dword [ebp - 0x60], 0x41
mov dword [ebp - 0x5c], 0x48fa
mov dword [ebp - 0x58], 0x177
mov dword [ebp - 0x54], 0x42
mov dword [ebp - 0x50], 0x48fd
mov dword [ebp - 0x4c], 0x178
mov dword [ebp - 0x48], 0x43
mov dword [ebp - 0x44], 0x4993
mov dword [ebp - 0x40], 0x290
mov dword [ebp - 0x3c], 0x63
mov dword [ebp - 0x38], 0x4996
mov dword [ebp - 0x34], 0x291
mov dword [ebp - 0x30], 0x64
mov dword [ebp - 0x2c], 0x4999
mov dword [ebp - 0x28], 0x292
mov dword [ebp - 0x24], 0x65
lea ebx, [ebp - 0xc4]
mov edi, edi
mov esi, dword [ebx - 4]
test esi, esi
jne 0x84100
cmp dword [ebx], esi
jne 0x84100
cmp dword [ebx + 4], esi
je 0x84169
push 0x20
mov edi, 0x1000000
call fcn.00049640
push 0x21
mov ecx, eax
call fcn.00049640
push esi
mov edx, eax
call fcn.00049640
test ecx, ecx
je 0x8413c
test edx, edx
je 0x8413c
test eax, eax
je 0x8413c
cmp eax, edx
jae 0x8413c
lea esi, [eax + 5]
cmp esi, edx
ja 0x8413c
mov edi, dword [eax + ecx + 1]
test edi, edi
je 0x84161
call fcn.0008b350
test eax, eax
je 0x84161
cmp eax, dword [ebp - 0xc]
jae 0x84161
mov edx, dword [ebp - 8]
lea edi, [eax + edx]
mov eax, dword [ebx]
push edi
push eax
call fcn.00049620
mov eax, dword [ebx + 4]
call fcn.00088810
mov edi, dword [ebp - 4]
add ebx, 0xc
jmp 0x840f0
mov edx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov ecx, 0x23f0
cmp word [edx], cx
jae 0x84180
call fcn.00034520
jmp 0x84185
call fcn.00034680
call fcn.00035000
mov ecx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov eax, 0x1db0
cmp word [ecx], ax
jae 0x841a1
call fcn.00035360
jmp 0x841a6
call fcn.00035500
mov eax, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov edx, 0x23f0
cmp word [eax], dx
jae 0x841bc
call fcn.00035b50
jmp 0x841c1
call fcn.00035d00
call fcn.00035e90
call fcn.00036050
mov edx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov ecx, 0x23f0
cmp word [edx], cx
jae 0x841e2
call fcn.00036220
jmp 0x841e7
call fcn.00036400
mov eax, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
movzx eax, word [eax]
mov ecx, 0x1db0
cmp ax, cx
jae 0x84200
call fcn.00036560
jmp 0x84216
mov edx, 0x3fab
cmp ax, dx
jae 0x84211
call fcn.00036740
jmp 0x84216
call fcn.000368e0
mov eax, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
movzx eax, word [eax]
mov ecx, 0x1db0
cmp ax, cx
jae 0x8422f
call fcn.00036a50
jmp 0x8423e
mov edx, 0x1db1
cmp ax, dx
ja 0x8423e
call fcn.00036c10
mov ecx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov eax, 0x1db0
cmp word [ecx], ax
jae 0x84253
call fcn.00036d30
mov eax, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov edx, 0x1770
cmp word [eax], dx
jb 0x84276
call fcn.00036e80
call fcn.00036ff0
call fcn.000351d0
call fcn.00035b10
call fcn.000346f0
test edi, edi
je 0x8428c
lea ecx, [ebp - 0xe0]
push ecx
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret