Function at 0x409cb8
Capabilities:
Attach user process memory

Disassembly:
push 0x68
push 0x48b7b0
call fcn.004011b4
mov esi, dword [ebp + 8]
mov dword [ebp - 0x50], esi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
xor ebx, ebx
mov byte [ebp - 0x37], bl
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 0x39], bl
mov byte [ebp - 0x36], bl
push 0x50
call fcn.004355f2
test eax, eax
je 0x409cf1
cmp eax, esi
jne 0x409cf1
mov byte [ebp - 0x36], 1
push 0x914
call fcn.004355f2
cmp eax, 0x2800
jb 0x409d38
cmp byte [ebp - 0x36], bl
jne 0x409d57
push 0x8f6
call fcn.004355f2
test eax, eax
je 0x409d1d
cmp eax, esi
jne 0x409d1d
mov byte [ebp - 0x36], 1
cmp byte [ebp - 0x36], bl
jne 0x409d57
push 0x8f4
call fcn.004355f2
test eax, eax
je 0x409d38
cmp eax, esi
jne 0x409d38
mov byte [ebp - 0x36], 1
cmp byte [ebp - 0x36], bl
jne 0x409d57
push 0x61
call fcn.004355f2
mov dword [ebp - 0x5c], eax
test eax, eax
je 0x409d63
lea ecx, [ebp - 0x34]
push ecx
push eax
call sub.ntoskrnl.exe_KeStackAttachProcess
jmp 0x409d63
lea eax, [ebp - 0x34]
push eax
call fcn.0047b276
mov byte [ebp - 0x39], al
push 0x4bc5
call fcn.004355f2
mov edi, eax
mov dword [ebp - 0x70], edi
push 0x4bc8
call fcn.004355f2
mov dword [ebp - 0x68], eax
push 0x4c91
call fcn.004355f2
mov dword [ebp - 0x60], eax
push 0x4bcb
call fcn.004355f2
mov dword [ebp - 0x58], eax
push 0x4bce
call fcn.004355f2
mov dword [ebp - 0x64], eax
push 0x4c94
call fcn.004355f2
mov dword [ebp - 0x6c], eax
push 0x4bd1
call fcn.004355f2
mov dword [ebp - 0x78], eax
test esi, esi
je 0x409fcb
test edi, edi
je 0x409fcb
cmp dword [ebp - 0x68], ebx
je 0x409fcb
cmp dword [ebp - 0x60], ebx
je 0x409fcb
cmp dword [ebp - 0x58], ebx
je 0x409fcb
cmp dword [ebp - 0x64], ebx
je 0x409fcb
cmp dword [ebp - 0x6c], ebx
je 0x409fcb
test eax, eax
je 0x409fcb
push 6
call fcn.00477546
mov byte [ebp - 0x74], al
mov eax, esi
and eax, 0xfff
mov edi, 0x1000
sub edi, eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x54], edi
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x4c], eax
jae 0x409fc1
sub eax, dword [ebp - 0x4c]
cmp eax, edi
jae 0x409e3b
mov edi, eax
mov dword [ebp - 0x54], edi
mov al, bl
mov byte [ebp - 0x35], al
mov byte [ebp - 0x41], al
push ebx
push esi
call fcn.0045afde
cmp al, 1
jne 0x409f70
push ebx
push ebx
push ebx
push 0x1000
mov eax, esi
and eax, 0xfffff000
push eax
call dword [ebp - 0x70]
mov dword [ebp - 0x48], eax
test eax, eax
je 0x409f9b
push 0x914
call fcn.004355f2
cmp eax, 0x42ee
jae 0x409ec9
push dword [ebp - 0x48]
call dword [ebp - 0x68]
push 0x10
push ebx
push ebx
push 1
push ebx
push dword [ebp - 0x48]
call dword [ebp - 0x58]
mov dword [ebp - 0x50], eax
test eax, eax
je 0x409f3f
push edi
mov ecx, esi
and ecx, 0xfff
add ecx, eax
push ecx
push dword [ebp - 0x40]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov byte [ebp - 0x37], 1
mov byte [ebp - 0x35], 1
push dword [ebp - 0x48]
push dword [ebp - 0x50]
call dword [ebp - 0x64]
jmp 0x409f3f
mov byte [ebp - 0x38], bl
mov dword [ebp - 4], ebx
push ebx
push ebx
push dword [ebp - 0x48]
call dword [ebp - 0x60]
mov byte [ebp - 0x38], 1
mov dword [ebp - 4], 0xfffffffe
jmp 0x409f03
cmp byte [ebp - 0x38], 1
jne 0x409f3f
push dword [ebp - 0x58]
push 0x10
push dword [ebp - 0x48]
call fcn.00478e5a
test eax, eax
je 0x409f39
push edi
mov ecx, esi
and ecx, 0xfff
add ecx, eax
push ecx
push dword [ebp - 0x40]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov byte [ebp - 0x37], 1
mov byte [ebp - 0x35], 1
push dword [ebp - 0x48]
call dword [ebp - 0x6c]
cmp byte [ebp - 0x35], 0
jne 0x409f6a
lea eax, [edi - 1]
add eax, esi
push eax
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, 1
jne 0x409f6a
push edi
push esi
push dword [ebp - 0x40]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov byte [ebp - 0x37], 1
mov byte [ebp - 0x35], 1
push dword [ebp - 0x48]
call dword [ebp - 0x78]
mov al, byte [ebp - 0x35]
test al, al
jne 0x409f84
push edi
push ebx
push dword [ebp - 0x40]
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov ecx, 0x1000
mov edi, ecx
add dword [ebp - 0x4c], ecx
add esi, ecx
mov dword [ebp - 0x50], esi
add dword [ebp - 0x40], ecx
jmp 0x409e20
push 1
lea eax, [edi - 1]
add eax, esi
push eax
call fcn.0045afde
cmp al, 1
jne 0x409f70
push edi
push esi
push dword [ebp - 0x40]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov byte [ebp - 0x37], 1
mov al, 1
jmp 0x409f73
push dword [ebp - 0x74]
push 6
call fcn.0047769a
cmp byte [ebp - 0x36], 0
jne 0x409fe2
cmp dword [ebp - 0x5c], 0
je 0x409ff1
lea eax, [ebp - 0x34]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
jmp 0x409ff1
cmp byte [ebp - 0x39], 1
jne 0x409ff1
lea eax, [ebp - 0x34]
push eax
call fcn.0047b318
mov al, byte [ebp - 0x37]
call fcn.004011fc
ret 0xc