Function at 0x15460
Capabilities:
Attach user process memory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x30f04]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x33da8], 1
je 0x157b6
call fcn.0001608c
mov dword [ebp - 0x2f8], eax
test eax, eax
je 0x157b6
push ebx
push esi
push edi
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0xe4]
rep stosd dword es:[edi], eax
push 0x10
lea eax, [ebp - 0xe4]
push eax
push 0x2a18c
call fcn.0001189e
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push 0x2a1b4
call fcn.0001189e
mov edi, 0x80
push edi
lea eax, [ebp - 0xc4]
push 0
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x40
lea eax, [ebp - 0xc4]
push eax
push 0x2a334
call fcn.0001189e
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xe4]
push eax
push 0x292c8
mov esi, 0x104
push esi
push 0x2d86c
call fcn.00012e72
push edi
lea eax, [ebp - 0xc4]
push 0
push eax
call sub.ntoskrnl.exe_memset
add esp, 0x24
push 0x40
lea eax, [ebp - 0xc4]
push eax
push 0x2a348
call fcn.0001189e
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x33e38
mov ebx, 0x2940c
push ebx
push esi
push 0x2da90
call fcn.00012e72
push edi
lea eax, [ebp - 0xc4]
push 0
push eax
call sub.ntoskrnl.exe_memset
add esp, 0x24
push 0x40
lea eax, [ebp - 0xc4]
push eax
push 0x2a364
call fcn.0001189e
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x33e38
push ebx
push esi
push 0x2dcb4
call fcn.00012e72
push edi
lea eax, [ebp - 0xc4]
push 0
push eax
call sub.ntoskrnl.exe_memset
add esp, 0x24
push 0x40
lea eax, [ebp - 0xc4]
push eax
push 0x2a384
call fcn.0001189e
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x33e38
push ebx
push esi
push 0x2ded8
call fcn.00012e72
add esp, 0x18
mov dword [ebp - 0x2f0], 0x2d868
lea eax, [ebp - 0x300]
push eax
mov eax, dword [ebp - 0x2f0]
push esi
add eax, 4
push eax
call fcn.0001759c
mov ecx, dword [ebp - 0x2f0]
mov eax, dword [ebp - 0x300]
add eax, eax
mov word [ecx], ax
add eax, 2
mov word [ecx + 2], ax
add ecx, 0x224
cmp ecx, 0x2e0f8
mov dword [ebp - 0x2f0], ecx
jl 0x155f8
lea eax, [ebp - 0x318]
push eax
push dword [ebp - 0x2f8]
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and dword [ebp - 0x2f4], 0
push edi
lea eax, [ebp - 0xc4]
push 0
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x40
lea eax, [ebp - 0xc4]
push eax
mov eax, dword [ebp - 0x2f4]
push dword [eax*4 + 0x3054c]
call fcn.0001189e
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x33e38
push ebx
lea eax, [ebp - 0x2ec]
push esi
push eax
call fcn.00012e72
add esp, 0x18
lea eax, [ebp - 0x2fc]
push eax
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x2ec]
push eax
push dword [ebp - 0x2f8]
call fcn.00012434
test eax, eax
jne 0x1576d
push dword [ebp - 0x2fc]
push dword [ebp - 0x2f0]
push dword [ebp - 0x2f4]
call fcn.00014374
mov eax, dword [ebp - 0x2f4]
imul eax, eax, 0x224
cmp dword [ebp - 0x2f4], 0
mov dword [eax + 0x2d858], 1
jne 0x1576d
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0x2a44c
call fcn.000118fc
mov eax, dword [ebp - 0x2f0]
lea ecx, [ebp - 0x44]
push ecx
push eax
mov dword [0x33d54], eax
call fcn.000168fe
add eax, dword [ebp - 0x2f0]
push 0x20
mov dword [0x33d58], eax
add eax, 0x10
mov dword [0x33d5c], eax
lea eax, [ebp - 0x44]
push eax
push 0x2a924
call fcn.000118fc
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x2f0]
call fcn.000168fe
add eax, dword [ebp - 0x2f0]
mov dword [0x33d60], eax
add eax, 0x800
mov dword [0x33d64], eax
inc dword [ebp - 0x2f4]
cmp dword [ebp - 0x2f4], 4
jl 0x15655
call fcn.000234ec
push dword [ebp - 0x2f8]
call fcn.0001b548
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov ecx, dword [ebp - 0x2f8]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
pop edi
pop esi
mov dword [0x33da8], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0002738c
leave
ret