Function at 0x405a00
Capabilities:
Attach user process memory

Disassembly:
push 0x4c
push 0x48b5a8
call fcn.004011b4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x50], ecx
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0x4c], ebx
xor edx, edx
mov esi, edx
mov dword [eax], edx
mov dword [ecx], edx
mov dword [ebx], edx
cmp byte [ebp + 0xc], dl
jne 0x405a41
push 0x2b
call fcn.004355f2
push 0x312
jmp 0x405a50
push 0x810
call fcn.004355f2
push 0x313
mov dword [ebp - 0x38], eax
call fcn.004355f2
mov edi, eax
push 0x314
call fcn.004355f2
mov dword [ebp - 0x54], eax
test eax, eax
je 0x405c6f
test edi, edi
je 0x405c6f
shl eax, 2
push eax
push 1
call fcn.00478d6e
mov dword [ebx], eax
test eax, eax
je 0x405c6f
mov eax, dword [ebp - 0x38]
cmp eax, 0xffffffff
je 0x405c64
add eax, dword [ebp - 0x44]
mov dword [ebp - 0x38], eax
push eax
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, 1
jne 0x405c64
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
test eax, eax
je 0x405c64
push dword [ebp - 0x44]
call fcn.00479046
mov byte [ebp - 0x39], al
push 0x19
call fcn.00477546
mov byte [ebp - 0x38], al
push 0xe
call fcn.00477546
mov byte [ebp - 0x5c], al
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x44]
call sub.ntoskrnl.exe_KeStackAttachProcess
push dword [ebp - 0x5c]
push 0xe
call fcn.0047769a
push dword [ebp - 0x38]
push 0x19
call fcn.0047769a
and dword [ebp - 4], esi
mov eax, dword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x40]
cmp ecx, edx
jae 0x405c06
lea eax, [ecx + 0x30]
cmp eax, edx
jae 0x405c06
lea eax, [ecx + 0x2c]
mov edx, dword [ebp - 0x58]
mov dword [edx], eax
mov eax, dword [eax]
mov edx, dword [ebp - 0x50]
mov dword [edx], eax
mov ecx, dword [ecx + 0xc]
mov eax, dword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov edx, dword [eax]
cmp byte [ebp + 0xc], 0
jne 0x405ba0
cmp ecx, edx
jae 0x405c06
lea eax, [ecx + 0x28]
cmp eax, edx
jae 0x405c06
lea eax, [ecx + 0xc]
push 0
push eax
call fcn.00406244
mov esi, eax
mov dword [ebp - 0x48], esi
test esi, esi
je 0x405c01
mov ecx, dword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov ecx, dword [ecx]
cmp esi, ecx
jae 0x405c01
lea eax, [edi + esi]
cmp eax, ecx
jae 0x405c01
mov edx, dword [ebp - 0x54]
shl edx, 2
lea eax, [edx + edi]
mov dword [ebp - 0x40], eax
add eax, esi
cmp eax, ecx
jae 0x405c01
cmp edi, ecx
jae 0x405c01
cmp edx, ecx
jae 0x405c01
cmp dword [ebp - 0x40], ecx
jmp 0x405bee
cmp ecx, edx
jae 0x405c06
lea eax, [ecx + 0x28]
cmp eax, edx
jae 0x405c06
lea eax, [ecx + 0xc]
push 0
push eax
call fcn.00406244
mov esi, eax
mov dword [ebp - 0x48], esi
test esi, esi
je 0x405c01
mov eax, dword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov ecx, dword [eax]
cmp esi, ecx
jae 0x405c01
lea eax, [edi + esi]
cmp eax, ecx
jae 0x405c01
mov edx, dword [ebp - 0x54]
shl edx, 2
lea eax, [edx + edi]
mov dword [ebp - 0x40], eax
add eax, esi
cmp eax, ecx
jae 0x405c01
cmp edi, ecx
jae 0x405c01
cmp edx, ecx
jae 0x405c01
cmp dword [ebp - 0x40], ecx
jae 0x405c01
push edx
lea eax, [edi + esi]
push eax
push dword [ebx]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
jmp 0x405c06
xor esi, esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x405c25
push 0x19
call fcn.00477546
mov byte [ebp - 0x38], al
push 0xf
call fcn.00477546
mov byte [ebp - 0x4c], al
lea eax, [ebp - 0x34]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
push dword [ebp - 0x4c]
push 0xf
call fcn.0047769a
push dword [ebp - 0x38]
push 0x19
call fcn.0047769a
cmp byte [ebp - 0x39], 1
jne 0x405c64
push dword [ebp - 0x44]
call fcn.004790ec
test esi, esi
jne 0x405c6f
push dword [ebx]
call fcn.00478d8c
mov eax, esi
call fcn.004011fc
ret 0x14