Function at 0x82fb0
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push 0x61
call fcn.00049640
mov esi, eax
mov dword [ebp - 0x10], esi
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp eax, esi
jne 0x82fd8
mov dword [ebp - 0x10], 0
jmp 0x82fe7
test esi, esi
je 0x82fe7
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
push 0x4969
call fcn.00049640
push 0x4966
mov esi, eax
call fcn.00049640
push 0x496c
mov edi, eax
call fcn.00049640
mov edx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov ecx, 0x893
mov ebx, eax
mov dword [ebp - 4], ebx
cmp cx, word [edx]
jne 0x83033
test esi, esi
jne 0x83033
call fcn.00082470
push 0x4969
call fcn.00049640
mov esi, eax
push 0x234
call fcn.00049640
mov dword [ebp - 8], eax
test eax, eax
jne 0x83056
call fcn.00091080
push 0x234
call fcn.00049640
mov dword [ebp - 8], eax
push 0x236
call fcn.00049640
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x83079
call fcn.000907f0
push 0x236
call fcn.00049640
mov dword [ebp - 0xc], eax
mov ecx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov eax, 0x2800
cmp word [ecx], ax
jae 0x831b2
test esi, esi
je 0x830f3
push 0x213
call fcn.00049640
mov edx, eax
test edx, edx
jne 0x830d3
mov eax, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov edx, 0x1770
cmp word [eax], dx
push 0x213
mov edx, esi
jae 0x830be
call fcn.000822a0
jmp 0x830c3
call fcn.00082350
push 0x213
call fcn.00049640
mov edx, eax
test edx, edx
je 0x830f3
push 0x48aa
call fcn.00049640
test eax, eax
je 0x830f3
mov ecx, 0x824f0
mov ebx, 0x216
call fcn.00081060
mov ebx, dword [ebp - 4]
test edi, edi
je 0x8314a
push 0x214
call fcn.00049640
test eax, eax
jne 0x83136
mov edx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov ecx, 0x1770
cmp word [edx], cx
push 0x214
mov edx, edi
jae 0x83123
call fcn.000822a0
jmp 0x83128
call fcn.00082350
push 0x214
call fcn.00049640
test eax, eax
je 0x8314a
mov ecx, 0x824f0
mov ebx, 0x217
mov edx, eax
call fcn.00081060
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x831b2
push 0x215
call fcn.00049640
test eax, eax
jne 0x8318c
mov ecx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov eax, 0x23f0
mov edx, ebx
cmp word [ecx], ax
jae 0x83172
push 0
jmp 0x83174
push 1
push 0x215
call fcn.000810e0
push 0x215
call fcn.00049640
test eax, eax
je 0x831b2
mov ecx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov edx, 0x23f0
cmp word [ecx], dx
mov ebx, 0x218
mov edx, eax
mov ecx, 0x82730
jb 0x831ad
mov ecx, 0x82ac0
call fcn.00081060
mov edx, dword [ebp - 8]
test edx, edx
je 0x8322b
mov ecx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov eax, 0x3ad7
cmp word [ecx], ax
jae 0x8322b
push 0x238
call fcn.00049640
test eax, eax
jne 0x83205
mov ecx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov eax, 0x23f0
cmp word [ecx], ax
jae 0x831eb
push 0
jmp 0x831ed
push 1
push 0x238
call fcn.000810e0
push 0x238
call fcn.00049640
test eax, eax
je 0x8322b
mov ecx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov edx, 0x23f0
cmp word [ecx], dx
mov ebx, 0x23a
mov edx, eax
mov ecx, 0x82d60
jb 0x83226
mov ecx, 0x82e80
call fcn.00081060
mov edx, dword [ebp - 0xc]
test edx, edx
je 0x83290
mov eax, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
movzx eax, word [eax]
mov ecx, 0x23f0
cmp ax, cx
jb 0x83258
mov ecx, 0x3839
cmp cx, ax
je 0x83258
mov ecx, 0x3ad7
cmp cx, ax
jne 0x83290
push 0x239
call fcn.00049640
test eax, eax
jne 0x8327f
push eax
push 0x239
call fcn.000810e0
push 0x239
call fcn.00049640
test eax, eax
je 0x83290
mov ecx, 0x82d60
mov ebx, 0x23b
mov edx, eax
call fcn.00081060
cmp dword [ebp - 0x10], 0
je 0x832a0
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret