Function at 0x10650
Capabilities:
Attach user process memory
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10c80
push 0x10bbe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x105a0
call sub.ntoskrnl.exe_DbgPrint
add esp, 0x18
cmp dword [ebp + 8], 0
jne 0x106b6
push 0x10600
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
mov eax, 0xc0000001
jmp 0x1089d
mov dword [ebp - 0x3c], 0xc0000001
mov dword [ebp - 0x1c], 0
push 0
lea edx, [ebp - 0x20]
push edx
push 0
push 0
push 0x30
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jge 0x10703
mov ecx, dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push 0x10608
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
mov eax, 0xc0000001
jmp 0x1089d
push 0x537973
mov ecx, dword [ebp + 0x14]
push ecx
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x10749
mov ecx, dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push 0
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push 0x10610
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
mov eax, 0xc0000001
jmp 0x1089d
mov eax, dword [ebp - 0x1c]
mov dword [eax], 1
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx edx, al
test edx, edx
je 0x107c0
mov dword [ebp - 4], 0
push 1
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp - 0x1c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], 0xffffffff
jmp 0x107be
jmp 0x107d4
push 0x10620
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
mov dword [ebp - 0x3c], 0xc0000001
cmp dword [ebp - 0x3c], 0
jl 0x10878
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x1085a
mov dword [ebp - 4], 1
push 1
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.ntoskrnl.exe_ProbeForWrite]
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp + 0xc]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], 0xffffffff
jmp 0x10858
jmp 0x1086e
push 0x10630
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
mov dword [ebp - 0x3c], 0xc0000001
lea ecx, [ebp - 0x38]
push ecx
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov ecx, dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push 0
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push 0x10638
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10