Function at 0x10ee0
Capabilities:
Attach user process memory
Get system information on windows
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
push edi
xor eax, eax
mov word [ebp - 0x24], ax
lea edi, [ebp - 0x22]
stosd dword es:[edi], eax
xor ecx, ecx
stosw word es:[edi], ax
xor edi, edi
mov ebx, 0x46494c45
push ebx
inc edi
push edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
push ecx
jmp 0x10f50
push edi
push 0
push dword [ebp - 0x10]
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0
push edi
push dword [ebp - 0x10]
push 0x10
call dword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov dword [ebp - 0x14], eax
test eax, eax
jge 0x10f8c
cmp eax, 0xc0000004
jne 0x10f6e
push 0
push dword [ebp - 0x10]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push ebx
add edi, edi
push edi
push 0
call esi
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x10f15
push 0x1b3aa
call sub.ntoskrnl.exe_DbgPrint
pop ecx
mov eax, 0xc0000001
jmp KeSetEvent
push 0x1b388
call sub.ntoskrnl.exe_DbgPrint
pop ecx
push 0
push dword [ebp - 0x10]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp - 0x14]
jmp KeSetEvent
push 0x4f424a4e
push 0x500
push 0
call esi
xor ebx, ebx
mov dword [ebp - 0x34], eax
cmp eax, ebx
jne 0x10faf
mov dword [ebp - 0x18], 0xc0000001
jmp 0x112fe
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x5c003f
mov esi, dword [edi]
mov dword [ebp - 0x3c], esi
jne 0x10fe6
cmp dword [eax], 0x3f005c
jne 0x10fe6
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.000107a0
test eax, eax
jl IoFileObjectType
mov dword [ebp - 0x38], 1
jmp 0x10ff4
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x2c], ebx
cmp esi, ebx
jbe 0x112fe
mov ebx, dword [sym.imp.ntoskrnl.exe_ZwClose]
add edi, 4
mov dword [ebp - 0x30], edi
mov esi, dword [ebp - 0x30]
lea edi, [ebp - 0x70]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x6c]
movzx ecx, al
cmp ecx, dword [section..data]
jne 0x1128e
movzx ecx, word [ebp - 0x70]
shr eax, 0x10
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x60]
push eax
xor edi, edi
push 0x40
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x60], 0x18
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
test eax, eax
jl 0x1128e
push 2
push edi
push 0x1f0fff
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x28]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwDuplicateObject]
test eax, eax
jge 0x11099
push 0x1b36c
call sub.ntoskrnl.exe_DbgPrint
pop ecx
jmp 0x11289
push edi
lea eax, [ebp - 8]
push eax
push edi
push edi
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
jge 0x110c8
push dword [ebp - 0xc]
call ebx
push dword [ebp - 4]
call ebx
push 0x1b2d4
call sub.ntoskrnl.exe_DbgPrint
pop ecx
jmp 0x1128e
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x68]
je 0x110da
push dword [ebp - 0xc]
call ebx
jmp 0x11289
mov esi, dword [ebp - 0x34]
lea eax, [ebp - 0x40]
push eax
push 0x500
push esi
push 2
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ZwQueryObject]
test eax, eax
jge 0x1110e
push dword [ebp - 0xc]
call ebx
push dword [ebp - 4]
call ebx
mov ecx, dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x1128e
push 4
push 0x1b304
push dword [esi + 4]
call dword [sym.imp.ntoskrnl.exe__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x110f6
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
cmp dword [eax + 0x2c], 7
jne 0x110f6
mov esi, dword [ebp - 0x1c]
cmp esi, edi
jne 0x1115a
movzx eax, word [ebp - 0x24]
push 0x42756f44
lea eax, [eax + eax + 0x28]
push eax
push edi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x112a5
mov esi, eax
lea eax, [esi + 8]
mov dword [esi + 4], eax
mov cx, word [ebp - 0x24]
mov word [esi], cx
mov cx, word [ebp - 0x22]
mov word [esi + 2], cx
movzx ecx, word [esi]
push ecx
push eax
push dword [ebp - 8]
call fcn.0001aea2
cmp eax, edi
je 0x111a5
cmp eax, 0xc0000023
je 0x1119d
lea eax, [ebp - 0x40]
push eax
movzx eax, word [ebp - 0x24]
lea eax, [eax + eax + 0x18]
push eax
push esi
push dword [ebp - 8]
call sub.ntoskrnl.exe_ObQueryNameString
cmp eax, edi
jne 0x110f6
push 1
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
push dword [ebp - 0xc]
test eax, eax
jne 0x1127e
call ebx
push dword [ebp - 4]
call fcn.00010972
push 1
push dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
push eax
call fcn.000109ae
test eax, eax
jl 0x11280
cmp dword [ebp + 0xc], edi
je 0x1122f
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp eax, dword [ebp - 0x14]
jne IoAllocateIrp
push dword [ebp + 8]
call fcn.00010a3e
push 0x106a8
push dword [ebp - 0x28]
call fcn.00010580
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
cmp dword [ebp - 0x14], edi
jl RtlInitUnicodeString
push 3
push edi
push 0x1f0fff
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x28]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwDuplicateObject]
test eax, eax
jge 0x11266
mov ecx, dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push dword [ebp - 4]
call ebx
cmp dword [ebp + 0xc], edi
jne 0x112ef
jmp 0x1128e
push dword [ebp - 0xc]
call ebx
mov ecx, dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push dword [ebp - 4]
call ebx
mov dword [ebp - 0x18], edi
jmp 0x1125b
call ebx
mov ecx, dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push dword [ebp - 4]
call ebx
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x30], 0x10
cmp eax, dword [ebp - 0x3c]
jb KeInitializeEvent
xor edi, edi
jmp 0x112bf
push dword [ebp - 0xc]
call ebx
push dword [ebp - 4]
call ebx
mov ecx, dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov dword [ebp - 0x18], 0xc0000001
mov esi, dword [ebp - 0x1c]
jmp 0x112ef
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], 0xc0000001
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push dword [ebp - 4]
call ebx
jmp 0x112ef
mov ecx, dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push dword [ebp - 4]
call ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
cmp esi, edi
je 0x112fc
push 0
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor ebx, ebx
cmp dword [ebp - 0x38], ebx
je 0x11312
cmp dword [ebp - 0x20], ebx
je 0x11312
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp dword [ebp - 0x10], ebx
je IoFileObjectType
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp dword [ebp - 0x34], ebx
je 0x11330
push ebx
push dword [ebp - 0x34]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 8