Function at 0x402a90
Capabilities:
Acquire debug privileges
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x46c
mov eax, dword [0x535008]
xor eax, esp
mov dword [esp + 0x468], eax
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, 1
mov dword [esp + 8], ecx
push esi
push edi
mov dword [esp + 0x14], 0
cmp dword [ebp + 8], ebx
jle 0x402c9b
mov edi, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov esi, dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsnbicmp]
push 8
push 0x51fb60
push dword [ecx + ebx*4]
call esi
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov ecx, dword [ecx + ebx*4]
test eax, eax
jne 0x402b7b
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402af7
sub ecx, edx
add ecx, 0xfffffff9
call fcn.00403e30
mov edi, eax
mov eax, dword [esp + 0x10]
mov esi, edi
mov edx, dword [eax + ebx*4]
add edx, 8
mov cl, byte [edx]
lea edx, [edx + 1]
mov byte [esi], cl
lea esi, [esi + 1]
test cl, cl
jne 0x402b16
push 0x51fb6c
push edi
call dword [sym.imp.SHLWAPI.dll_StrTrimA]
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402b35
sub ecx, edx
cmp ecx, 0xff
ja 0x402eff
mov edx, 0x537ba0
mov ecx, edi
sub edx, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x402b53
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov esi, dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsnbicmp]
add esp, 4
mov edi, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
jmp 0x402c8c
push 4
push str._id
push ecx
call esi
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov ecx, dword [ecx + ebx*4]
test eax, eax
jne 0x402bc1
add ecx, 4
lea edx, [esp + 0x70]
sub edx, ecx
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x402ba0
lea eax, [esp + 0x70]
push eax
call edi
add esp, 4
mov dword [0x5380d8], eax
jmp 0x402c8c
push 7
push str._debug
push ecx
call esi
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov ecx, dword [ecx + ebx*4]
test eax, eax
jne 0x402c29
add ecx, 7
mov byte [0x53851b], 1
lea edx, [esp + 0x70]
sub edx, ecx
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x402bf0
push 0x51fb6c
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_StrTrimA]
lea eax, [esp + 0x70]
push eax
call edi
add esp, 4
mov dword [0x53851c], eax
test eax, eax
jg 0x402c8c
mov byte [0x53851b], 0
jmp 0x402c8c
push 0x14
push str._selfcheck_interval
push ecx
call esi
add esp, 0xc
test eax, eax
jne 0x402c8c
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x70]
mov ecx, dword [eax + ebx*4]
add ecx, 0x14
sub edx, ecx
nop word [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x402c50
push 0x51fb6c
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_StrTrimA]
lea eax, [esp + 0x70]
push eax
call edi
add esp, 4
lea eax, [eax + eax*2]
add eax, eax
mov dword [0x535020], eax
imul eax, eax, 0x2710
mov dword [0x535028], eax
inc ebx
cmp ebx, dword [ebp + 8]
jge 0x402c9b
mov ecx, dword [esp + 0x10]
jmp 0x402ad6
cmp byte [0x53851b], 0
je 0x402ccf
push dword [0x535028]
push dword [0x53851c]
push dword [0x5380d8]
push 0x537ba0
push str.Commandline_args:__config_s__dwID_d___debug_d___selfcheck_interval_d
push 0
push 0x537ba0
call fcn.00401e80
add esp, 0x1c
cmp dword [0x5380d8], 0
je 0x402ee8
lea eax, [esp + 0x14]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x402d3d
lea eax, [esp + 0x44]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
lea eax, [esp + 0x18]
mov dword [esp + 0x40], 1
push eax
lea eax, [esp + 0x54]
mov dword [esp + 0x50], 2
push eax
push 0x10
lea eax, [esp + 0x4c]
mov dword [esp + 0x24], 0
push eax
push 0
push dword [esp + 0x28]
call edi
push dword [0x5380d8]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x5384f0], eax
test eax, eax
jne 0x402d7d
cmp byte [0x53851b], al
je 0x402ec6
push str.hCIUMonProcess__NULL___exiting...
push eax
push 0x537ba0
call fcn.00401e80
add esp, 0xc
jmp 0x402ec6
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x30]
mov ecx, 0x5380f0
mov dword [0x535024], eax
call fcn.00401c00
mov ecx, 0x537cc8
call fcn.004014f0
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x538520
call esi
push 0x53853c
call esi
push ecx
mov ecx, 0x537ba0
call fcn.00401ce0
add esp, 4
mov dword [0x5384f4], eax
cmp eax, 0xffffffff
jne 0x402de5
push str.CIUMonSelfCheck_failed_to_open_mailslot_to_receive_of_CIUMon_messages
push 0
push 0x537ba0
call fcn.00401e80
add esp, 0xc
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x5380e8], eax
test eax, eax
jne 0x402e55
mov eax, dword [0x5384f4]
cmp eax, 0xffffffff
je 0x402e0d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x538520], 0
mov esi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [0x5384f4], 0
je 0x402e2d
push 0x538520
call esi
cmp dword [0x53853c], 0
je 0x402e3d
push 0x53853c
call esi
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x468]
xor ecx, esp
call fcn.0051023c
mov esp, ebp
pop ebp
ret
call fcn.00402f30
test al, al
jne 0x402e7b
call fcn.004039e0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x468]
xor ecx, esp
call fcn.0051023c
mov esp, ebp
pop ebp
ret
mov eax, dword [0x537ca0]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [esp + 0x60], eax
mov eax, dword [0x537cb8]
mov dword [esp + 0x64], eax
mov eax, dword [0x5380c8]
mov dword [esp + 0x68], eax
mov eax, dword [0x537cac]
mov dword [esp + 0x6c], eax
push 0x3e8
push 0
lea eax, [esp + 0x68]
push eax
push 4
call esi
cmp eax, 3
ja case.default.0x402eba
jmp dword [eax*4 + 0x402f18]
call fcn.004039e0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x402ee8
push 0
push 0
push 0
lea ecx, [esp + 0x5c]
push ecx
push 0
push eax
call edi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x474]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0051023c
mov esp, ebp
pop ebp
ret
push 0xff
push edi
push 0x537ba0
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsnbcpy]
add esp, 0xc
call fcn.0051036e
shr dword [esi], 0x40
add cl, al
inc eax
add cl, al
inc eax
add cl, al
inc eax
add ah, cl
int3