Function at 0x402662
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x406004]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], 0x403e40
push 0x16
pop eax
mov word [ebp - 0x48], ax
mov edi, 0x200
push 0x18
pop eax
mov dword [edx], ebx
mov word [ebp - 0x46], ax
mov dword [ebp - 0x60], eax
mov eax, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], ebx
movzx ecx, word [eax]
mov dword [ebp - 0x40], edx
mov byte [ebp - 0x34], bl
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], ebx
cmp ecx, 0x1770
jae 0x40270a
mov esi, 0xece
cmp ecx, esi
je 0x4026f3
cmp ecx, 0xa28
je 0x4026f3
push 0x403e58
call fcn.00401df8
pop ecx
mov eax, 0xc00000bb
jmp 0x4028bb
xor eax, eax
cmp ecx, esi
setne al
lea eax, [eax*8 + 0x240]
mov dword [edx], eax
xor eax, eax
jmp 0x4028bb
push 0x64726854
mov esi, 0x4000
push esi
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebx, eax
mov dword [ebp - 0x28], ebx
test ebx, ebx
jne 0x40272f
mov eax, 0xc0000017
jmp 0x4028bb
push esi
push 0xffffffffffffffff
push ebx
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.004025aa
mov esi, eax
test esi, esi
js 0x402860
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x38]
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
xor ecx, ecx
xor eax, eax
push ecx
push ecx
push ecx
push ecx
inc eax
push eax
push ecx
push ecx
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x60]
push 0xffffffffffffffff
push eax
push 0x20
lea eax, [ebp - 0x20]
push eax
call fcn.00402caa
mov esi, eax
test esi, esi
js 0x402860
push 0
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [sym.imp.ntoskrnl.exe_PsThreadType]
push 0
push dword [eax]
push 0x20
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov esi, eax
test esi, esi
js 0x402860
mov ecx, dword [ebp - 0x2c]
mov eax, edi
lea ebx, [ecx + 0xfff]
and ebx, 0xfffff000
sub ebx, ecx
cmp ebx, edi
jbe 0x4027e2
mov edx, dword [eax + ecx]
test dl, 5
mov dword [ebp - 0x3c], edx
mov edx, dword [ebp - 0x28]
jne 0x4027db
mov ecx, dword [ebp - 0x3c]
mov dword [edx + eax*4], ecx
mov ecx, dword [ebp - 0x2c]
add eax, 4
cmp eax, ebx
jb 0x4027c4
push 0
push 0
push 0x11
push dword [ebp - 0x20]
call fcn.00402df0
mov esi, eax
mov dword [ebp - 0x3c], esi
test esi, esi
js 0x40285d
cmp ebx, edi
jbe 0x402848
mov edx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x28]
mov eax, dword [esi + edi*4]
cmp eax, 0xffffffff
je 0x402821
or eax, 4
cmp dword [edi + edx], eax
mov eax, dword [ebp - 0x24]
jne 0x402824
mov ecx, edi
inc eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], eax
jmp 0x402827
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
add edi, 4
cmp edi, ebx
jb 0x402803
mov esi, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x34]
jne 0x40284b
mov eax, dword [ebp - 0x40]
push ecx
push 0x403ef6
mov dword [eax], ecx
call fcn.00401df8
jmp 0x40285b
mov eax, dword [ebp - 0x24]
push eax
push 0x403e92
call fcn.00401df8
mov esi, 0xc0000225
pop ecx
pop ecx
mov ebx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x40286d
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp dword [ebp - 0x20], 0
je 0x402890
push 0
push dword [ebp - 0x20]
call fcn.00402e42
call dword [sym.imp.ntoskrnl.exe_ExGetPreviousMode]
movzx eax, al
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ObCloseHandle]
cmp byte [ebp - 0x34], 0
je 0x4028a0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x4028ad
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push 0x64726854
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403362
leave
ret 4