Function at 0x98500
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9c840
push 0x9b56a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x19], 0
push 0x487d
call fcn.00049640
mov esi, eax
push 3
call fcn.00049640
mov ecx, eax
push 2
call fcn.00049640
mov edx, eax
push 0x4859
call fcn.00049640
mov dword [ebp - 0x28], eax
push 0x48c2
call fcn.00049640
mov ebx, eax
push 0x1cf
call fcn.00049640
mov dword [ebp - 0x20], eax
push 0x1d1
call fcn.00049640
mov dword [ebp - 0x24], eax
push 0x3c
call fcn.00049640
mov edi, eax
test esi, esi
je 0x988a1
test ecx, ecx
je 0x988a1
test edx, edx
je 0x988a1
cmp dword [ebp - 0x28], 0
je 0x988a1
test ebx, ebx
je 0x988a1
cmp dword [ebp - 0x20], 0
je 0x988a1
cmp dword [ebp - 0x24], 0
je 0x988a1
test edi, edi
je 0x988a1
mov byte [ebp - 0x19], 1
cmp dword [ebp + 8], 0
je 0x988a1
push 0
push 0
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.00068540
test al, al
je 0x988a1
mov eax, dword [edi + ebx]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0
push ebx
call esi
mov esi, eax
mov dword [ebp - 0x2c], esi
mov edx, esi
call fcn.0008a7b0
mov byte [ebp + 0xb], al
lea ecx, [ebp - 0x54]
push ecx
push esi
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov edx, ebx
call fcn.0008bd80
cmp al, 1
jne 0x9884c
mov edx, dword [ebp - 0x20]
mov edi, dword [edx + ebx]
mov eax, dword [ebp - 0x24]
mov esi, dword [eax + ebx]
push 1
lea ecx, [edi - 1]
push ecx
call fcn.00071e70
cmp al, 1
jne 0x9884c
push 1
push esi
call fcn.00071e70
cmp al, 1
jne 0x9884c
mov edx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
movzx eax, word [edx]
mov ecx, 0x2800
cmp cx, ax
je 0x98784
mov edx, 0x295a
cmp dx, ax
je 0x98784
mov ecx, 0x3839
cmp cx, ax
je 0x98784
mov edx, 0x3ad7
cmp dx, ax
jne 0x98701
lea eax, [esi + 0x28]
cmp eax, edi
jae 0x9883b
mov edx, dword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
lea ecx, [eax + 0x3c]
cmp ecx, edi
ja 0x9883b
cmp dword [eax], 0
jne 0x986f5
mov ecx, dword [edx]
cmp dword [eax - 4], ecx
jbe 0x986f5
cmp dword [eax + 4], ecx
jbe 0x986f5
cmp dword [eax + 8], ecx
jbe 0x986f5
cmp dword [eax + 0xc], 0
je 0x986f5
cmp dword [eax + 0x10], 0
jne 0x986f5
cmp dword [eax + 0x14], ecx
jbe 0x986f5
cmp dword [eax + 0x18], ecx
jbe 0x986f5
cmp dword [eax + 0x1c], ecx
jbe 0x986f5
cmp dword [eax + 0x20], ecx
jbe 0x986f5
cmp dword [eax + 0x24], 0
jne 0x986f5
cmp dword [eax + 0x28], 0
je 0x98779
add eax, 4
cmp eax, edi
jb 0x986a4
jmp 0x9883b
mov ecx, 0x3fab
cmp cx, ax
jne 0x9883b
lea eax, [esi + 0x28]
cmp eax, edi
jae 0x9883b
mov edx, dword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
lea ecx, [eax + 0x3c]
cmp ecx, edi
ja 0x9883b
cmp dword [eax], 0
jne 0x9876d
mov ecx, dword [edx]
cmp dword [eax - 4], ecx
jbe 0x9876d
cmp dword [eax + 4], ecx
jbe 0x9876d
cmp dword [eax + 8], ecx
jbe 0x9876d
cmp dword [eax + 0xc], 0
je 0x9876d
cmp dword [eax + 0x10], 0
jne 0x9876d
cmp dword [eax + 0x14], ecx
jbe 0x9876d
cmp dword [eax + 0x18], ecx
jbe 0x9876d
cmp dword [eax + 0x1c], ecx
jbe 0x9876d
cmp dword [eax + 0x20], ecx
jbe 0x9876d
cmp dword [eax + 0x24], 0
jne 0x9876d
cmp dword [eax + 0x28], 0
je 0x98779
add eax, 4
cmp eax, edi
jb 0x98720
jmp 0x9883b
mov edx, dword [eax + 0x1c]
mov dword [ebp - 0x38], edx
jmp 0x9883b
lea eax, [esi + 0x28]
cmp eax, edi
jae 0x9883b
mov esi, dword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
lea ecx, [eax + 0x50]
cmp ecx, edi
ja 0x9883b
cmp ebx, dword [eax]
jne 0x98828
mov edx, dword [eax - 0xc]
test edx, edx
jne 0x987eb
cmp dword [eax - 8], edx
jne 0x987eb
cmp dword [eax - 4], edx
jne 0x987eb
mov ecx, dword [esi]
cmp dword [eax - 0x10], ecx
jbe 0x987eb
cmp dword [eax + 4], edx
jne 0x98828
cmp dword [eax + 0xc], edx
jne 0x98828
cmp dword [eax + 0x10], edx
jne 0x98828
cmp dword [eax + 0x14], ecx
jbe 0x98828
cmp dword [eax + 0x1c], ecx
jbe 0x98828
cmp dword [eax + 0x24], ecx
jbe 0x98828
cmp dword [eax + 0x2c], ecx
jbe 0x98828
mov edx, dword [eax + 0x2c]
mov dword [ebp - 0x38], edx
jmp 0x9883b
cmp ebx, edx
jne 0x98828
cmp dword [eax - 8], 0
jne 0x98828
cmp dword [eax - 4], 0
jne 0x98828
mov ecx, dword [esi]
cmp dword [eax - 0x10], ecx
jbe 0x98828
cmp dword [eax + 0x10], 0
jne 0x98828
cmp dword [eax + 0x14], 0
jne 0x98828
cmp dword [eax + 0x18], 0
jne 0x98828
cmp dword [eax + 4], ecx
jbe 0x98828
cmp dword [eax + 8], ecx
jbe 0x98828
cmp dword [eax + 0xc], ecx
jbe 0x98828
cmp dword [eax + 0x2c], ecx
ja 0x98835
add eax, 4
cmp eax, edi
jb 0x98795
jmp 0x9883b
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x38]
cmp edx, dword [ecx]
jae 0x9884c
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
cmp byte [ebp + 0xb], 1
jne 0x98864
mov ecx, dword [ebp - 0x2c]
call fcn.0008a870
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [eax], ebx
mov edx, dword [ebp - 0x38]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x34]
mov dword [eax + 8], edx
xor edx, edx
mov dword [eax + 0xc], edx
add dword [ecx], 0x10
mov eax, dword [ebp + 0x10]
inc dword [eax]
jmp 0x9889a
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x19]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10