Function at 0x48765e
Capabilities:
Attach user process memory

Disassembly:
push 0x5c
push 0x48d9d0
call fcn.004011b4
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x3c], 0
push 0x4ac0
call fcn.004355f2
mov dword [ebp - 0x44], eax
push 3
call fcn.004355f2
mov esi, eax
push 2
call fcn.004355f2
mov edi, eax
push 0x4a9c
call fcn.004355f2
mov dword [ebp - 0x48], eax
push 0x4b05
call fcn.004355f2
mov dword [ebp - 0x38], eax
push 0x1cf
call fcn.004355f2
mov ebx, eax
push 0x1d1
call fcn.004355f2
mov dword [ebp - 0x5c], eax
push 0x3c
call fcn.004355f2
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x44], 0
je 0x487bd8
test esi, esi
je 0x487bd8
test edi, edi
je 0x487bd8
cmp dword [ebp - 0x48], 0
je 0x487bd8
cmp dword [ebp - 0x38], 0
je 0x487bd8
test ebx, ebx
je 0x487bd8
mov esi, dword [ebp - 0x5c]
test esi, esi
je 0x487bd8
test eax, eax
je 0x487bd8
xor eax, eax
inc eax
mov dword [ebp - 0x3c], eax
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x487bdb
xor eax, eax
push eax
push eax
push eax
push edi
call fcn.00452aa0
test al, al
je 0x487bd8
mov dword [ebp - 0x6c], edi
mov eax, dword [ebp - 0x58]
mov eax, dword [edi + eax]
mov dword [ebp - 0x64], eax
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x68], eax
and dword [ebp - 0x60], eax
push edi
call dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
push eax
call fcn.00479046
mov byte [ebp - 0x3d], al
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x44]
call sub.ntoskrnl.exe_KeStackAttachProcess
push edi
call fcn.0047988e
mov ecx, dword [ebp - 0x3c]
cmp al, cl
jne 0x48787a
mov edi, dword [edi + ebx]
mov ebx, dword [ebp - 0x4c]
mov esi, dword [ebx + esi]
push ecx
lea eax, [edi - 1]
push eax
call fcn.0045afde
mov ecx, dword [ebp - 0x3c]
cmp al, cl
jne 0x48787a
push ecx
push esi
call fcn.0045afde
cmp al, byte [ebp - 0x3c]
jne 0x48787a
push 0x914
call fcn.004355f2
cmp eax, 0x2800
je 0x487b22
push 0x914
call fcn.004355f2
cmp eax, 0x295a
je 0x487b22
push 0x914
call fcn.004355f2
cmp eax, 0x3839
je 0x487b22
push 0x914
call fcn.004355f2
cmp eax, 0x3ad7
jne 0x4878bf
lea ecx, [esi + 0x28]
cmp ecx, edi
jae 0x487869
mov edx, dword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
xor ebx, ebx
lea eax, [ecx + 0x3c]
cmp eax, edi
ja 0x487869
cmp dword [ecx], ebx
jne 0x487862
mov eax, dword [edx]
cmp dword [ecx - 4], eax
jbe 0x487862
cmp dword [ecx + 4], eax
jbe 0x487862
cmp dword [ecx + 8], eax
jbe 0x487862
cmp dword [ecx + 0xc], ebx
je 0x487862
cmp dword [ecx + 0x10], ebx
jne 0x487862
cmp dword [ecx + 0x14], eax
jbe 0x487862
cmp dword [ecx + 0x18], eax
jbe 0x487862
cmp dword [ecx + 0x1c], eax
jbe 0x487862
cmp dword [ecx + 0x20], eax
jbe 0x487862
cmp dword [ecx + 0x24], ebx
jne 0x487862
cmp dword [ecx + 0x28], ebx
je 0x4878ba
add ecx, 4
cmp ecx, edi
jb 0x48781e
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x48]
cmp edx, dword [eax]
sbb eax, eax
not eax
and eax, edx
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x34]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov eax, dword [ebp - 0x3c]
cmp byte [ebp - 0x3d], al
jne 0x487896
push dword [ebp - 0x44]
call fcn.004790ec
mov eax, dword [ebp - 0x3c]
and dword [ebp - 4], 0
lea esi, [ebp - 0x6c]
mov ecx, dword [ebp - 0x50]
mov edi, dword [ecx]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add dword [ecx], 0x10
mov ecx, dword [ebp - 0x54]
inc dword [ecx]
mov dword [ebp - 4], 0xfffffffe
jmp 0x487bdb
mov edx, dword [ecx + 0x1c]
jmp 0x48786c
push 0x914
call fcn.004355f2
cmp eax, 0x3fab
je 0x487ab7
push 0x914
call fcn.004355f2
cmp eax, 0x42ee
je 0x487ab7
push 0x914
call fcn.004355f2
cmp eax, 0x4563
je 0x487ab7
push 0x914
call fcn.004355f2
cmp eax, 0x47ba
je 0x487ab7
push 0x914
call fcn.004355f2
cmp eax, 0x47bb
je 0x487ab7
push 0x914
call fcn.004355f2
cmp eax, 0x4a61
jb 0x4879ea
push 0x914
call fcn.004355f2
cmp eax, 0x4a65
ja 0x4879ea
add esi, 0x28
jmp 0x4879d2
lea eax, [esi + 0x3c]
cmp eax, edi
ja 0x487869
xor edx, edx
cmp dword [esi], edx
jne 0x4879cf
mov eax, dword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
mov eax, dword [eax]
cmp dword [esi - 4], eax
jbe 0x4879cf
cmp dword [esi + 4], eax
jbe 0x4879cf
cmp dword [esi + 8], eax
jbe 0x4879cf
cmp dword [esi + 0xc], edx
je 0x4879cf
cmp dword [esi + 0x10], edx
jne 0x4879cf
cmp dword [esi + 0x14], eax
jbe 0x4879cf
cmp dword [esi + 0x18], eax
jbe 0x4879cf
mov ecx, dword [esi + 0x1c]
cmp ecx, eax
jbe 0x4879cf
cmp dword [esi + 0x20], eax
jbe 0x4879cf
cmp dword [esi + 0x24], edx
jne 0x4879cf
cmp dword [esi + 0x28], edx
jne 0x4879cf
mov ebx, dword [ebp - 0x3c]
push ebx
push ecx
call fcn.0045afde
cmp al, bl
jne 0x4879e2
push ebx
mov eax, dword [esi + 0x1c]
add eax, 4
push eax
call fcn.0045afde
cmp al, bl
jne 0x4879e2
mov eax, dword [esi + 0x1c]
cmp dword [eax], 0
jne 0x4879db
add esi, 4
cmp esi, edi
jb 0x487957
jmp 0x487869
mov edx, eax
jmp 0x48786c
mov edx, dword [esi + 0x1c]
jmp 0x48786c
push 0x914
call fcn.004355f2
cmp eax, 0x55f0
je 0x487a10
push 0x914
call fcn.004355f2
cmp eax, 0x585d
jne 0x487869
lea ecx, [esi + 0x28]
cmp ecx, edi
jae 0x487869
mov esi, dword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
lea eax, [ecx + 0x3c]
cmp eax, edi
ja 0x487869
mov edx, dword [ecx]
cmp ebx, edx
jne 0x487a98
mov eax, dword [esi]
cmp dword [ecx + 4], eax
jbe 0x487a68
cmp dword [ecx - 4], eax
jbe 0x487a68
cmp dword [ecx + 0x20], eax
jbe 0x487a68
cmp dword [ecx + 0x24], eax
jbe 0x487a68
xor eax, eax
cmp dword [ecx - 0x10], eax
jne 0x487a68
cmp dword [ecx - 0x18], eax
jne 0x487a68
cmp dword [ecx - 0x20], eax
jne 0x487aa4
cmp dword [ecx - 0x24], eax
jne 0x487aa4
cmp dword [ecx - 0x28], eax
jne 0x487aa4
cmp dword [ecx - 0x2c], eax
jne 0x487aa4
cmp ebx, edx
jne 0x487a98
mov eax, dword [esi]
cmp dword [ecx + 4], eax
jbe 0x487a98
cmp dword [ecx - 4], eax
jbe 0x487a98
cmp dword [ecx + 8], eax
jbe 0x487a98
cmp dword [ecx + 0xc], 0
jne 0x487a98
cmp dword [ecx + 0x1c], eax
jbe 0x487a98
cmp dword [ecx - 0x10], 0
jne 0x487a98
cmp dword [ecx - 0x14], eax
jbe 0x487a98
cmp dword [ecx - 0x18], eax
ja 0x487aaf
add ecx, 4
cmp ecx, edi
jb 0x487a21
jmp 0x487869
mov edx, dword [ecx - 0xc]
cmp edx, dword [esi]
ja 0x48786c
mov edx, dword [ecx + 4]
jmp 0x48786c
lea ecx, [esi + 0x28]
cmp ecx, edi
jae 0x487869
mov edx, dword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
xor ebx, ebx
lea eax, [ecx + 0x3c]
cmp eax, edi
ja 0x487869
cmp dword [ecx], ebx
jne 0x487b16
mov eax, dword [edx]
cmp dword [ecx - 4], eax
jbe 0x487b16
cmp dword [ecx + 4], eax
jbe 0x487b16
cmp dword [ecx + 8], eax
jbe 0x487b16
cmp dword [ecx + 0xc], ebx
je 0x487b16
cmp dword [ecx + 0x10], ebx
jne 0x487b16
cmp dword [ecx + 0x14], eax
jbe 0x487b16
cmp dword [ecx + 0x18], eax
jbe 0x487b16
cmp dword [ecx + 0x1c], eax
jbe 0x487b16
cmp dword [ecx + 0x20], eax
jbe 0x487b16
cmp dword [ecx + 0x24], ebx
jne 0x487b16
cmp dword [ecx + 0x28], ebx
je 0x4878ba
add ecx, 4
cmp ecx, edi
jb 0x487aca
jmp 0x487869
lea ecx, [esi + 0x28]
cmp ecx, edi
jae 0x487869
mov esi, dword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
lea eax, [ecx + 0x50]
cmp eax, edi
ja 0x487869
cmp ebx, dword [ecx]
jne 0x487bb2
mov edx, dword [ecx - 0xc]
test edx, edx
jne 0x487b78
cmp dword [ecx - 8], edx
jne 0x487b78
cmp dword [ecx - 4], edx
jne 0x487b78
mov eax, dword [esi]
cmp dword [ecx - 0x10], eax
jbe 0x487b78
cmp dword [ecx + 4], edx
jne 0x487bb2
cmp dword [ecx + 0xc], edx
jne 0x487bb2
cmp dword [ecx + 0x10], edx
jne 0x487bb2
cmp dword [ecx + 0x14], eax
jbe 0x487bb2
cmp dword [ecx + 0x1c], eax
jbe 0x487bb2
cmp dword [ecx + 0x24], eax
jmp 0x487bab
cmp ebx, edx
jne 0x487bb2
xor edx, edx
cmp dword [ecx - 8], edx
jne 0x487bb2
cmp dword [ecx - 4], edx
jne 0x487bb2
mov eax, dword [esi]
cmp dword [ecx - 0x10], eax
jbe 0x487bb2
cmp dword [ecx + 0x10], edx
jne 0x487bb2
cmp dword [ecx + 0x14], edx
jne 0x487bb2
cmp dword [ecx + 0x18], edx
jne 0x487bb2
cmp dword [ecx + 4], eax
jbe 0x487bb2
cmp dword [ecx + 8], eax
jbe 0x487bb2
cmp dword [ecx + 0xc], eax
jbe 0x487bb2
cmp dword [ecx + 0x2c], eax
ja 0x487bc2
add ecx, 4
cmp ecx, edi
jb 0x487b33
jmp 0x487869
mov edx, dword [ecx + 0x2c]
jmp 0x48786c
mov eax, dword [ebp - 0x3c]
call fcn.004011fc
ret 0x10