Function at 0x15bc0
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9ca10
push 0x9b56a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor edi, edi
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
mov ecx, dword [ebp + 0x14]
mov dword [ecx], edi
mov edx, dword [ebp + 0x18]
mov dword [edx], edi
cmp byte [ebp + 0xc], 0
jne 0x15c0b
push 0x2b
call fcn.00049640
push 0x312
jmp 0x15c1a
push 0x810
call fcn.00049640
push 0x313
mov esi, eax
call fcn.00049640
mov dword [ebp - 0x20], eax
push 0x314
call fcn.00049640
mov ecx, eax
test ecx, ecx
je 0x15deb
cmp dword [ebp - 0x20], edi
je 0x15deb
push 0x877
call fcn.00049640
lea ebx, [ecx*4]
push eax
push ebx
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
test eax, eax
je 0x15deb
test esi, esi
je 0x15dd0
add esi, dword [ebp + 8]
push esi
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, 1
jne 0x15dd0
mov esi, dword [esi]
test esi, esi
je 0x15dd0
mov edx, dword [ebp + 8]
call fcn.0008a7b0
mov byte [ebp - 0x19], al
push 0x19
call fcn.00088910
mov byte [ebp - 0x28], al
push 0xe
call fcn.00088910
mov byte [ebp - 0x2c], al
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov edx, dword [ebp - 0x2c]
push edx
push 0xe
call fcn.00088aa0
mov eax, dword [ebp - 0x28]
push eax
push 0x19
call fcn.00088aa0
mov dword [ebp - 4], edi
mov ecx, dword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov eax, dword [ecx]
cmp esi, eax
jae 0x15d87
lea edx, [esi + 0x30]
cmp edx, eax
jae 0x15d87
lea eax, [esi + 0x2c]
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
mov eax, dword [eax]
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
mov esi, dword [esi + 0xc]
mov eax, dword [ecx]
cmp byte [ebp + 0xc], 0
jne 0x15d1e
cmp esi, eax
jae 0x15d87
lea ecx, [esi + 0x28]
cmp ecx, eax
jae 0x15d87
lea eax, [esi + 0xc]
push eax
call fcn.00015a40
jmp 0x15d32
cmp esi, eax
jae 0x15d87
lea ecx, [esi + 0x28]
cmp ecx, eax
jae 0x15d87
lea eax, [esi + 0xc]
push eax
call fcn.00015a40
mov edi, eax
test edi, edi
mov dword [ebp - 0x24], edi
je 0x15d82
mov edx, dword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov eax, dword [edx]
cmp edi, eax
jae 0x15d82
mov ecx, dword [ebp - 0x20]
lea edx, [ecx + edi]
cmp edx, eax
jae 0x15d82
add ecx, ebx
lea esi, [ecx + edi]
cmp esi, eax
jae 0x15d82
cmp dword [ebp - 0x20], eax
jae 0x15d82
cmp ebx, eax
jae 0x15d82
cmp ecx, eax
jae 0x15d82
push ebx
mov eax, dword [ebp + 0x18]
push edx
mov ecx, dword [eax]
push ecx
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
jmp 0x15d87
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], 0xffffffff
push 0x19
call fcn.00088910
mov byte [ebp - 0x28], al
push 0xf
call fcn.00088910
mov byte [ebp + 0xc], al
lea edx, [ebp - 0x44]
push edx
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, dword [ebp + 0xc]
push eax
push 0xf
call fcn.00088aa0
mov ecx, dword [ebp - 0x28]
push ecx
push 0x19
call fcn.00088aa0
cmp byte [ebp - 0x19], 1
jne 0x15dd0
mov ecx, dword [ebp + 8]
call fcn.0008a870
test edi, edi
jne 0x15deb
mov edx, dword [ebp + 0x18]
mov ecx, dword [edx]
push 0x877
call fcn.00049640
push eax
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14