Function at 0x90590
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9ca40
push 0x9b56a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x74
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x4a8a
call fcn.00049640
mov ecx, eax
mov dword [ebp - 0x28], ecx
push 0x48c5
call fcn.00049640
mov esi, eax
push 0x48cb
call fcn.00049640
mov edx, eax
mov dword [ebp - 0x30], edx
push 0x48c8
call fcn.00049640
mov edi, eax
mov dword [ebp - 0x38], edi
push 0x27
call fcn.00049640
mov ebx, eax
push 0x48c2
call fcn.00049640
mov dword [ebp - 0x34], eax
test ecx, ecx
je 0x907cf
test esi, esi
je 0x907cf
test edx, edx
je 0x907cf
test edi, edi
je 0x907cf
test ebx, ebx
je 0x907cf
test eax, eax
je 0x907cf
push 0
mov eax, dword [ebp + 8]
call fcn.00063350
cmp al, 1
jne 0x907cf
push 0x2c
push 0
lea eax, [ebp - 0x84]
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
call dword [sym.imp.ntoskrnl.exe_KeGetCurrentThread]
mov edi, eax
push 7
call fcn.00088910
mov byte [ebp - 0x1d], al
mov cl, byte [edi + ebx]
mov byte [ebp - 0x19], cl
mov byte [edi + ebx], 0
push 0
push 0x2c
lea edx, [ebp - 0x84]
push edx
push 0
call esi
mov al, byte [ebp - 0x19]
mov byte [edi + ebx], al
mov ecx, dword [ebp - 0x1d]
push ecx
push 7
call fcn.00088aa0
mov ecx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x70]
cmp ecx, eax
jbe 0x906a5
mov ecx, eax
mov dword [ebp - 0x78], ecx
mov eax, dword [ebp - 0x7c]
imul ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
mov edx, dword [ebp + 8]
call fcn.0008a7b0
mov byte [ebp - 0x19], al
mov esi, 0x1000
mov dword [ebp - 0x24], esi
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
mov dword [ebp - 0x2c], eax
push 0x19
call fcn.00088910
mov byte [ebp - 0x1d], al
push 0xe
call fcn.00088910
mov byte [ebp - 0x28], al
lea ecx, [ebp - 0x58]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov eax, dword [ebp - 0x28]
push eax
push 0xe
call fcn.00088aa0
mov ecx, dword [ebp - 0x1d]
push ecx
push 0x19
call fcn.00088aa0
mov dword [ebp - 4], 0
lea ebx, [ebx]
cmp esi, dword [ebp - 0x2c]
jae 0x90786
push esi
call dword [ebp - 0x30]
mov edi, eax
mov ebx, edx
test edi, edi
jne 0x90725
test ebx, ebx
je 0x90772
cmp ebx, dword [ebp - 0x3c]
jg 0x90772
jl 0x90731
cmp edi, dword [ebp - 0x40]
jae 0x90772
push ebx
push edi
mov edx, dword [ebp - 0x34]
push edx
call fcn.00064560
cmp al, 1
jne 0x90772
push ebx
push edi
call dword [ebp - 0x38]
cmp esi, eax
jne 0x90772
push eax
push ebx
cli
mov eax, cr0
mov ebx, eax
and eax, 0xfffeffff
mov cr0, eax
push ecx
push edi
mov edi, dword [ebp - 0x24]
mov ecx, 0x400
mov eax, 0xcccccccc
repne stosd dword es:[edi], eax
pop edi
pop ecx
mov cr0, ebx
sti
pop ebx
pop eax
add esi, 0x1000
mov dword [ebp - 0x24], esi
jmp 0x90710
mov dword [ebp - 4], 0xffffffff
push 0x19
call fcn.00088910
mov byte [ebp - 0x1d], al
push 0xf
call fcn.00088910
mov byte [ebp - 0x38], al
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov ecx, dword [ebp - 0x38]
push ecx
push 0xf
call fcn.00088aa0
mov edx, dword [ebp - 0x1d]
push edx
push 0x19
call fcn.00088aa0
cmp byte [ebp - 0x19], 1
jne 0x907cf
mov ecx, dword [ebp + 8]
call fcn.0008a870
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4