Function at 0x486d02
Capabilities:
Attach user process memory

Disassembly:
push 0x60
push 0x48d9b0
call fcn.004011b4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x3c], 0
push 0x4ac0
call fcn.004355f2
mov dword [ebp - 0x44], eax
push 3
call fcn.004355f2
mov dword [ebp - 0x4c], eax
push 2
call fcn.004355f2
mov dword [ebp - 0x50], eax
push 0x4a9c
call fcn.004355f2
mov dword [ebp - 0x58], eax
push 0x4b05
call fcn.004355f2
mov esi, eax
push 0x1cf
call fcn.004355f2
mov edi, eax
push 0x1d1
call fcn.004355f2
mov ebx, eax
push 0x3c
call fcn.004355f2
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x44], 0
je 0x4871d4
cmp dword [ebp - 0x4c], 0
je 0x4871d4
cmp dword [ebp - 0x50], 0
je 0x4871d4
cmp dword [ebp - 0x58], 0
je 0x4871d4
test esi, esi
je 0x4871d4
test edi, edi
je 0x4871d4
test ebx, ebx
je 0x4871d4
test eax, eax
je 0x4871d4
xor eax, eax
inc eax
mov dword [ebp - 0x3c], eax
mov esi, dword [ebp - 0x40]
test esi, esi
je 0x4871d7
xor eax, eax
push eax
push eax
push eax
push esi
call fcn.00452aa0
test al, al
je 0x4871d4
mov dword [ebp - 0x70], esi
mov eax, dword [ebp - 0x54]
mov eax, dword [esi + eax]
mov dword [ebp - 0x68], eax
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x64], eax
push esi
call dword [ebp - 0x44]
mov dword [ebp - 0x54], eax
push eax
call fcn.00479046
mov byte [ebp - 0x45], al
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x54]
call sub.ntoskrnl.exe_KeStackAttachProcess
push esi
call fcn.0047988e
cmp al, byte [ebp - 0x3c]
jne 0x486ec0
mov esi, dword [esi + edi]
mov edi, dword [ebp - 0x40]
mov edi, dword [edi + ebx]
mov dword [ebp - 0x44], edi
mov ebx, dword [ebp - 0x3c]
push ebx
lea eax, [esi - 1]
push eax
call fcn.0045afde
cmp al, bl
jne 0x486ec0
push ebx
push edi
call fcn.0045afde
cmp al, bl
jne 0x486ec0
mov ebx, 0x914
push ebx
call fcn.004355f2
cmp eax, 0xa28
jne 0x486f05
mov ecx, edi
cmp edi, esi
jae 0x486eaf
lea eax, [ecx + 0x30]
cmp eax, esi
ja 0x486eaf
mov eax, dword [ebp - 0x40]
cmp eax, dword [ecx]
jne 0x486ea8
cmp dword [ecx + 4], 0
jne 0x486ea8
mov eax, dword [ecx + 0xc]
cmp eax, edi
jbe 0x486ea8
cmp eax, esi
jae 0x486ea8
mov ebx, dword [ecx + 0x10]
mov eax, dword [ebp - 0x4c]
cmp ebx, eax
jbe 0x486ea8
add eax, dword [ebp - 0x50]
cmp ebx, eax
mov edi, dword [ebp - 0x44]
jb 0x486f00
add ecx, 4
cmp ecx, esi
jb 0x486e75
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x58]
cmp ecx, dword [eax]
sbb eax, eax
not eax
and eax, ecx
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x34]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov eax, dword [ebp - 0x3c]
cmp byte [ebp - 0x45], al
jne 0x486edc
push dword [ebp - 0x54]
call fcn.004790ec
mov eax, dword [ebp - 0x3c]
and dword [ebp - 4], 0
lea esi, [ebp - 0x70]
mov ecx, dword [ebp - 0x60]
mov edi, dword [ecx]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add dword [ecx], 0x10
mov ecx, dword [ebp - 0x5c]
inc dword [ecx]
mov dword [ebp - 4], 0xfffffffe
jmp 0x4871d7
mov ecx, dword [ecx + 8]
jmp 0x486eb2
push ebx
call fcn.004355f2
cmp eax, 0x1db0
je 0x487171
push ebx
call fcn.004355f2
cmp eax, 0x1db1
je 0x487171
push ebx
call fcn.004355f2
cmp eax, 0x23f0
jne 0x486f83
lea ecx, [edi + 0x28]
cmp ecx, esi
jae 0x486eaf
mov edx, dword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
lea eax, [ecx + 0x50]
cmp eax, esi
ja 0x486eaf
mov eax, dword [ebp - 0x40]
cmp eax, dword [ecx]
jne 0x486f6f
cmp dword [ecx + 4], 0
jne 0x486f6f
mov eax, dword [ecx + 0x1c]
cmp eax, dword [ecx + 0x20]
jne 0x486f6f
cmp eax, dword [edx]
jb 0x486f6f
cmp dword [ecx + 0x2c], 0xfffffffe
je 0x486f7b
add ecx, 4
cmp ecx, esi
jb 0x486f45
jmp 0x486eaf
mov ecx, dword [ecx + 0x14]
jmp 0x486eb2
push ebx
call fcn.004355f2
cmp eax, 0x2580
jne 0x487042
lea ebx, [edi + 0x28]
jmp 0x487035
lea eax, [ebx + 0x50]
cmp eax, esi
ja 0x486eaf
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebx]
jne 0x487032
mov eax, dword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
mov eax, dword [eax]
cmp dword [ebx + 4], eax
jbe 0x487032
cmp dword [ebx + 8], eax
jbe 0x487032
xor edx, edx
cmp dword [ebx + 0xc], edx
jne 0x487032
mov ecx, dword [ebx + 0x10]
cmp ecx, eax
jbe 0x487032
test dword [ebx + 0x14], 0xffff0000
jne 0x487032
cmp dword [ebx + 0x18], edx
jne 0x487032
cmp dword [ebx + 0x1c], edx
jne 0x487032
cmp dword [ebx + 0x20], edx
jne 0x487032
push dword [ebp - 0x3c]
push ecx
call fcn.0045afde
mov ecx, dword [ebp - 0x3c]
cmp al, cl
jne 0x487032
push ecx
mov eax, dword [ebx + 0x10]
add eax, 0xf
push eax
call fcn.0045afde
cmp al, byte [ebp - 0x3c]
jne 0x487032
mov ecx, dword [ebx + 0x10]
mov eax, dword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
mov eax, dword [eax]
cmp dword [ecx + 4], eax
jbe 0x487032
mov edx, dword [ecx]
test edx, edx
je 0x487024
cmp edx, eax
jbe 0x487032
cmp dword [ecx + 8], eax
jbe 0x487032
cmp dword [ecx + 0xc], eax
ja 0x486f00
add ebx, 4
cmp ebx, esi
jb 0x486f9c
jmp 0x486eaf
push ebx
call fcn.004355f2
cmp eax, 0x1770
jb 0x4870c0
push ebx
call fcn.004355f2
cmp eax, 0x1772
ja 0x4870c0
mov ecx, edi
cmp edi, esi
jae 0x486eaf
lea eax, [ecx + 0x30]
cmp eax, esi
ja 0x486eaf
mov eax, dword [ebp - 0x40]
cmp eax, dword [ecx]
jne 0x48709d
cmp dword [ecx + 4], 0
jne 0x48709d
mov eax, dword [ecx + 0x28]
cmp eax, edi
jbe 0x48709d
cmp eax, esi
jae 0x48709d
mov ebx, dword [ecx + 0x2c]
mov eax, dword [ebp - 0x4c]
cmp ebx, eax
jbe 0x48709d
add eax, dword [ebp - 0x50]
cmp ebx, eax
mov edi, dword [ebp - 0x44]
jb 0x4870a9
add ecx, 4
cmp ecx, esi
jb 0x487066
jmp 0x486eaf
mov ecx, dword [ecx + 0x20]
mov eax, dword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
cmp ecx, dword [eax]
jae 0x486eb2
xor ecx, ecx
jmp 0x486eb2
push ebx
call fcn.004355f2
mov ecx, edi
cmp eax, 0xece
jne 0x487122
cmp edi, esi
jae 0x486eaf
lea eax, [ecx + 0x30]
cmp eax, esi
ja 0x486eaf
mov eax, dword [ebp - 0x40]
cmp eax, dword [ecx]
jne 0x48710e
cmp dword [ecx + 4], 0
jne 0x48710e
mov eax, dword [ecx + 0x1c]
cmp eax, edi
jbe 0x48710e
cmp eax, esi
jae 0x48710e
mov ebx, dword [ecx + 0x20]
mov eax, dword [ebp - 0x4c]
cmp ebx, eax
jbe 0x48710e
add eax, dword [ebp - 0x50]
cmp ebx, eax
mov edi, dword [ebp - 0x44]
jb 0x48711a
add ecx, 4
cmp ecx, esi
jb 0x4870d7
jmp 0x486eaf
mov ecx, dword [ecx + 0x18]
jmp 0x486eb2
cmp edi, esi
jae 0x486eaf
lea eax, [ecx + 0x30]
cmp eax, esi
ja 0x486eaf
mov eax, dword [ebp - 0x40]
cmp eax, dword [ecx]
jne 0x487165
cmp dword [ecx + 4], 0
jne 0x487165
mov eax, dword [ecx + 0x10]
cmp eax, edi
jbe 0x487165
cmp eax, esi
jae 0x487165
mov ebx, dword [ecx + 0x14]
mov eax, dword [ebp - 0x4c]
cmp ebx, eax
jbe 0x487165
add eax, dword [ebp - 0x50]
cmp ebx, eax
mov edi, dword [ebp - 0x44]
jb 0x486f00
add ecx, 4
cmp ecx, esi
jb 0x48712a
jmp 0x486eaf
mov ecx, edi
cmp edi, esi
jae 0x486eaf
lea eax, [ecx + 0x50]
cmp eax, esi
ja 0x486eaf
mov eax, dword [ebp - 0x40]
cmp eax, dword [ecx]
jne 0x4871b2
cmp dword [ecx + 4], 0
jne 0x4871b2
mov eax, dword [ecx + 0x40]
cmp eax, edi
jbe 0x4871b2
cmp eax, esi
jae 0x4871b2
mov ebx, dword [ecx + 0x44]
mov eax, dword [ebp - 0x4c]
cmp ebx, eax
jbe 0x4871b2
add eax, dword [ebp - 0x50]
cmp ebx, eax
mov edi, dword [ebp - 0x44]
jb 0x4871be
add ecx, 4
cmp ecx, esi
jb 0x48717b
jmp 0x486eaf
mov ecx, dword [ecx + 0x28]
jmp 0x486eb2
mov eax, dword [ebp - 0x3c]
call fcn.004011fc
ret 0x14