Function at 0x450f24
Capabilities:
Attach user process memory

Disassembly:
push 0x44
push 0x48c980
call fcn.004011b4
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4c], eax
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x3c], esi
xor ebx, ebx
cmp byte [ebp + 0xc], bl
jne 0x450f58
push 0x2b
call fcn.004355f2
mov ecx, dword [ebp - 0x44]
jmp 0x450f5b
or eax, 0xffffffff
cmp eax, 0xffffffff
je 0x451145
lea edi, [ecx + eax]
push edi
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, 1
jne 0x451145
mov edi, dword [edi]
test edi, edi
je 0x451145
push esi
push 1
call fcn.00478d6e
mov esi, eax
mov dword [ebp - 0x50], esi
test esi, esi
je 0x451145
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ecx]
mov dword [ebp - 0x40], eax
test eax, eax
je 0x450fbb
dec eax
imul eax, eax, 0x210
add eax, 0x214
push eax
push ecx
push esi
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x40]
mov dword [esi], eax
push ebx
push dword [ebp - 0x44]
call fcn.0044eb80
cmp al, 1
jne 0x451120
push dword [ebp - 0x44]
call fcn.00479046
mov byte [ebp - 0x36], al
push 0x19
call fcn.00477546
mov byte [ebp - 0x40], al
push 0xe
call fcn.00477546
mov byte [ebp - 0x54], al
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x44]
call sub.ntoskrnl.exe_KeStackAttachProcess
push dword [ebp - 0x54]
push 0xe
call fcn.0047769a
push dword [ebp - 0x40]
push 0x19
call fcn.0047769a
mov dword [ebp - 4], ebx
mov eax, dword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov ecx, dword [eax]
cmp byte [ebp + 0xc], 0
jne 0x45106b
cmp edi, ecx
jae 0x4510be
lea eax, [edi + 0x30]
cmp eax, ecx
jae 0x4510be
mov edi, dword [edi + 0xc]
cmp edi, ecx
jae 0x4510be
lea eax, [edi + 0x28]
cmp eax, ecx
jae 0x4510be
push ebx
push dword [ebp - 0x3c]
push esi
push ebx
push ebx
lea eax, [edi + 0xc]
push eax
call fcn.00451d6a
push ebx
push dword [ebp - 0x3c]
push esi
push ebx
push 8
lea eax, [edi + 0x14]
push eax
call fcn.00451d6a
push ebx
push dword [ebp - 0x3c]
push esi
push ebx
jmp 0x4510ae
cmp edi, ecx
jae 0x4510be
lea eax, [edi + 0x30]
cmp eax, ecx
jae 0x4510be
mov edi, dword [edi + 0xc]
cmp edi, ecx
jae 0x4510be
lea eax, [edi + 0x28]
cmp eax, ecx
jae 0x4510be
push ebx
push dword [ebp - 0x3c]
push esi
push 1
push ebx
lea eax, [edi + 0xc]
push eax
call fcn.00451d6a
push ebx
push dword [ebp - 0x3c]
push esi
push 1
push 8
lea eax, [edi + 0x14]
push eax
call fcn.00451d6a
push ebx
push dword [ebp - 0x3c]
push esi
push 1
push 0x10
lea eax, [edi + 0x1c]
push eax
call fcn.00451d6a
mov bl, 1
mov byte [ebp - 0x35], bl
mov dword [ebp - 4], 0xfffffffe
mov edi, dword [ebp - 0x44]
jmp 0x4510e3
push 0x19
call fcn.00477546
mov byte [ebp - 0x40], al
push 0xf
call fcn.00477546
mov byte [ebp - 0x48], al
lea eax, [ebp - 0x34]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
push dword [ebp - 0x48]
push 0xf
call fcn.0047769a
push dword [ebp - 0x40]
push 0x19
call fcn.0047769a
cmp byte [ebp - 0x36], 1
jne 0x451120
push edi
call fcn.004790ec
mov eax, dword [esi]
test eax, eax
je 0x45113f
dec eax
imul eax, eax, 0x210
add eax, 0x214
push eax
push esi
push dword [ebp - 0x4c]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
push esi
call fcn.00478d8c
mov al, bl
call fcn.004011fc
ret 0x10