Function at 0x5abd0
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
push 0x61
mov byte [ebp - 1], 0
call fcn.00049640
mov dword [ebp - 0x28], eax
test eax, eax
je 0x5abf6
lea ecx, [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
push 0x49b7
call fcn.00049640
push 0x20
mov ecx, eax
call fcn.00049640
push 0x21
mov ebx, eax
call fcn.00049640
mov esi, eax
push 0x22
mov dword [ebp - 0x18], esi
call fcn.00049640
push 3
mov edx, eax
call fcn.00049640
mov edi, eax
push 2
mov dword [ebp - 0x1c], edi
call fcn.00049640
test ecx, ecx
je 0x5ae08
cmp ecx, esi
jae 0x5ae08
test ebx, ebx
je 0x5ae08
test edx, edx
je 0x5ae08
test esi, esi
je 0x5ae08
test edi, edi
je 0x5ae08
test eax, eax
je 0x5ae08
push 0x4a47
call fcn.00049640
push 0x4a4a
mov dword [ebp - 0x20], eax
call fcn.00049640
mov edx, dword [edx + 0x34]
mov dword [ebp - 0x24], eax
mov eax, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
movzx eax, word [eax]
lea edi, [ebx + ecx]
add esi, ebx
mov ecx, 0x1db0
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], 2
cmp ax, cx
jb 0x5acbd
mov edx, 0x1db1
cmp ax, dx
ja 0x5acbd
mov dword [ebp - 0xc], 3
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x10]
push eax
lea esi, [ebp - 0x64]
mov ecx, edi
call fcn.00032c70
test al, al
je 0x5ae08
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ecx]
add edi, dword [ebp - 0x4c]
cmp ecx, 0x10cd
jne 0x5acfe
mov eax, dword [ebp - 0x58]
sub eax, ebx
add eax, edi
cmp dword [ebp - 0x20], eax
je 0x5acfe
cmp dword [ebp - 0x24], eax
je 0x5acfe
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x5ad14
cmp ecx, 0x10ab
jl 0x5ad14
cmp ecx, 0x10b2
jle 0x5ad27
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, 0x100
jb 0x5acc4
jmp 0x5ae08
mov eax, dword [ebp - 0x54]
test eax, eax
jle 0x5ae08
mov ecx, dword [ebp - 0x14]
cmp eax, ecx
jbe 0x5ae08
sub eax, ecx
cmp eax, dword [ebp - 0x18]
jae 0x5ae08
add eax, dword [ebp - 0x1c]
push eax
push 0x2b8
call fcn.00049620
mov byte [ebp - 1], 0
mov dword [ebp - 8], 0
mov ebx, dword [ebp - 0x10]
push ebx
lea esi, [ebp - 0x64]
mov ecx, edi
call fcn.00032c70
test al, al
je 0x5ae08
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
add edi, dword [ebp - 0x4c]
cmp eax, 0x10ab
jl 0x5ade2
cmp eax, 0x10b2
jg 0x5ade2
mov eax, dword [ebp - 0x54]
test eax, eax
jle 0x5ade2
mov ecx, dword [ebp - 0x14]
cmp eax, ecx
jbe 0x5ade2
sub eax, ecx
cmp eax, dword [ebp - 0x18]
jae 0x5ade2
add eax, dword [ebp - 0x1c]
push ebx
mov ecx, edi
mov dword [ebp - 0x24], eax
call fcn.00032c70
test al, al
je 0x5ae08
mov edx, dword [ebp - 0x44]
add edi, dword [ebp - 0x4c]
cmp dword [edx], 0x1282
jne 0x5ade2
push ebx
mov ecx, edi
call fcn.00032c70
test al, al
je 0x5ae08
mov eax, dword [ebp - 0x44]
add edi, dword [ebp - 0x4c]
cmp dword [eax], 0x1151
jne 0x5ade2
cmp byte [ebp - 0x60], 1
je 0x5adf6
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, 0x300
jb 0x5ad61
jmp 0x5ae08
mov ecx, dword [ebp - 0x24]
push ecx
push 0x2ba
call fcn.00049620
mov byte [ebp - 1], 1
cmp dword [ebp - 0x28], 0
je 0x5ae18
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret