Function at 0x404c30
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor ebx, ebx
xor ecx, ecx
push esi
push edi
mov edi, edx
mov dword [ebp - 8], ebx
mov byte [ebp - 2], bl
mov dword [ebp - 0x14], ecx
cmp byte [0x47069b], cl
jne 0x404c5d
call fcn.00404a10
test al, al
je 0x404e87
mov esi, dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
push edi
mov byte [0x47069b], 1
call esi
test al, al
je 0x404e87
push 0x401a00
call esi
test al, al
je 0x404e87
mov al, byte [edi - 5]
cmp al, 0xcc
jne 0x404c9f
cmp byte [edi - 4], al
jne 0x404c9f
cmp byte [edi - 3], al
jne 0x404c9f
cmp byte [edi - 2], al
jne 0x404c9f
cmp byte [edi - 1], al
je 0x404cb7
cmp al, 0x90
jne 0x404cbb
cmp byte [edi - 4], al
jne 0x404cbb
cmp byte [edi - 3], al
jne 0x404cbb
cmp byte [edi - 2], al
jne 0x404cbb
cmp byte [edi - 1], al
jne 0x404cbb
mov byte [ebp - 2], 1
push ecx
push 1
push ecx
mov edx, edi
call fcn.00404b30
test al, al
jne 0x404e69
push 0x2074656a
push 0x66
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x404e87
push 0x66
push 0
push esi
call sub.ntoskrnl.exe_memset
mov eax, 0x401a00
mov dword [esi + 0xc], 0x65747573
sub eax, esi
mov dword [esi], 1
sub eax, 0x15
mov dword [esi + 8], 0x401a00
mov dword [esi + 0x11], eax
add esp, 0xc
cmp byte [ebp - 2], bl
lea eax, [esi + 0x15]
mov dword [ebp - 0xc], eax
mov ecx, 2
mov eax, 5
mov byte [esi + 0x10], 0xe9
cmovne eax, ecx
xor esi, esi
mov dword [ebp - 0x18], eax
jmp 0x404d40
lea ecx, [ebx + edi]
lea edx, [ebp - 8]
call fcn.00406300
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov byte [ebp - 1], 1
lea ecx, [esi + eax]
mov al, byte [edx]
add ecx, ebx
cmp al, 0xe8
jb 0x404d9a
cmp al, 0xe9
jbe 0x404d88
cmp al, 0xeb
jne 0x404d9a
mov byte [ecx], 0xe9
lea esi, [esi*2 + 3]
movzx eax, byte [edx + 1]
sub eax, ecx
add eax, 0xfffffffd
add eax, edx
mov dword [ecx + 1], eax
mov al, byte [ebp - 1]
jmp 0x404d9f
mov byte [ecx], 0xe8
mov eax, dword [edx + 1]
sub eax, ecx
add eax, edx
mov dword [ecx + 1], eax
mov al, byte [ebp - 1]
jmp 0x404d9f
xor al, al
mov byte [ebp - 1], al
test al, al
jne 0x404db7
push dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, esi
push edx
add eax, ebx
push eax
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
add ebx, dword [ebp - 0x10]
cmp ebx, dword [ebp - 0x18]
jb 0x404d40
mov dword [ebp - 0x10], esi
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x1c]
add ecx, 0x15
add ecx, esi
add ecx, ebx
sub eax, ecx
add eax, 0xfffffffb
add eax, edi
mov byte [ecx], 0xe9
mov dword [ecx + 1], eax
mov byte [esi + 0x55], bl
mov dword [esi + 4], edi
cmp ebx, 0x10
jbe 0x404df0
xor bl, bl
jmp 0x404e7b
push ebx
lea eax, [esi + 0x56]
push edi
push eax
call sub.ntoskrnl.exe_memcpy
mov eax, dword [sym.imp.ntoskrnl.exe_KeNumberProcessors]
add esp, 0xc
mov dword [0x47068c], esi
cmp byte [eax], 1
jle 0x404e26
cmp dword [0x4706b0], 0
je 0x404e26
mov eax, dword [sym.imp.ntoskrnl.exe_KeNumberProcessors]
movsx eax, byte [eax]
push eax
call dword [0x4706b0]
lea ecx, [ebp - 0x14]
call fcn.00404800
test al, al
je 0x404e74
sub esi, edi
cmp byte [ebp - 2], 0
je 0x404e4e
mov eax, 0xf9eb
mov byte [edi - 5], 0xe9
add esi, 0x10
mov word [edi], ax
mov dword [edi - 4], esi
jmp 0x404e57
add esi, 0xb
mov byte [edi], 0xe9
mov dword [edi + 1], esi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov cr0, eax
sti
call fcn.00404860
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov bl, byte [ebp - 1]
test bl, bl
jne 0x404e87
push 0x2074656a
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0xc