Function at 0x10950
Capabilities:
Attach user process memory
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10c98
push 0x10bbe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x108b0
call sub.ntoskrnl.exe_DbgPrint
add esp, 0x14
cmp dword [ebp + 8], 0
jne 0x109b2
push 0x10904
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
mov eax, 0xc0000001
jmp 0x10b99
mov dword [ebp - 0x3c], 0xc0000001
mov dword [ebp - 0x38], 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
push 0x30
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jge 0x109ff
mov ecx, dword [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push 0x1090c
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
mov eax, 0xc0000001
jmp 0x10b99
push 0x537973
mov eax, dword [ebp + 0x14]
push eax
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x10a45
mov ecx, dword [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push 0
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push 0x10914
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
mov eax, 0xc0000001
jmp 0x10b99
mov edx, dword [ebp - 0x38]
mov dword [edx], 1
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x10aca
mov dword [ebp - 4], 0
push 1
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp - 0x38]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], 0xffffffff
jmp 0x10ac8
jmp 0x10ade
mov dword [ebp - 0x3c], 0xc0000001
push 0x10924
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
cmp dword [ebp - 0x3c], 0
jl 0x10b74
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x10b60
mov dword [ebp - 4], 1
push 1
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.ntoskrnl.exe_ProbeForWrite]
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp - 0x38]
mov edi, dword [ebp + 0x10]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], 0xffffffff
jmp 0x10b5e
jmp 0x10b74
mov dword [ebp - 0x3c], 0xc0000001
push 0x10934
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
mov ecx, dword [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push 0
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push 0x1093c
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10