Function at 0x406b10
Capabilities:
Access peb ldr_data
Check os version
Get kernel32 base address
Get process heap flags
Get process heap force flags
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x437040]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
call fcn.004068e0
mov dword [esp + 0xc], eax
test eax, eax
jns 0x406b7d
cmp eax, 0xc0000510
jne 0x4070b9
mov eax, dword [0x438ce4]
cmp word [eax], 2
jne 0x406d53
movzx eax, word [eax + 2]
test ax, ax
jns 0x406d53
mov ecx, 0x8001
cmp ax, cx
jne 0x406d53
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0040c1c5
mov esp, ebp
pop ebp
ret
mov eax, dword [0x438ce4]
mov ecx, 2
mov word [eax], cx
mov ecx, 0x8001
mov eax, dword [0x438ce4]
mov word [eax + 2], cx
mov eax, dword [0x438ce4]
mov dword [eax + 0x50], eax
mov eax, dword [0x438ce4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [esp + 0x24]
mov bl, 0xa
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.ntdll.dll_RtlGetNtVersionNumbers]
mov eax, dword [esp + 0x24]
test eax, 0xf0000000
je 0x406bd8
movzx eax, ax
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x20]
sub ecx, 5
je 0x406cc7
sub ecx, 1
je 0x406c64
sub ecx, 4
jne case.default.0x406c71
cmp dword [esp + 0x28], ecx
jne case.default.0x406c71
cmp eax, 0x2800
jb case.default.0x406c71
cmp eax, 0x3839
jb 0x406c51
cmp eax, 0x3ad7
jb 0x406c3e
cmp eax, 0x55f0
mov eax, dword [0x438ce4]
jb 0x406c30
mov edx, 0xb8
mov byte [eax + 0x14], 9
jmp 0x406d0e
mov edx, 0xa8
mov byte [eax + 0x14], 8
jmp 0x406d0e
mov eax, dword [0x438ce4]
mov edx, 0xa8
mov byte [eax + 0x14], 7
jmp 0x406d0e
mov eax, dword [0x438ce4]
mov edx, 0xa0
mov byte [eax + 0x14], 6
jmp 0x406d0e
mov ecx, dword [esp + 0x28]
cmp ecx, 3
ja case.default.0x406c71
jmp dword [ecx*4 + 0x4070f4]
sub eax, 0x1770
je 0x406c89
sub eax, 1
je 0x406c89
sub eax, 1
jne case.default.0x406c71
mov bl, 2
mov edx, 0x68
jmp 0x406d01
sub eax, 0x1db0
je 0x406c9e
sub eax, 1
jne case.default.0x406c71
mov bl, 3
mov edx, 0x80
jmp 0x406d01
cmp eax, 0x23f0
jne case.default.0x406c71
mov bl, 4
mov edx, 0x98
jmp 0x406d01
cmp eax, 0x2580
jne case.default.0x406c71
mov bl, 5
mov edx, 0xa0
jmp 0x406d01
mov ecx, dword [esp + 0x28]
cmp ecx, 1
jne 0x406ce1
cmp eax, 0xa28
je 0x406ced
mov eax, dword [0x438ce4]
mov byte [eax + 0x14], bl
jmp 0x406d3e
cmp ecx, 2
jne case.default.0x406c71
cmp eax, 0xece
jne case.default.0x406c71
mov eax, dword [0x438ce4]
mov edx, 0x50
mov byte [eax + 0x14], 1
jmp 0x406d0e
mov edx, dword [esp + 0xc]
mov eax, dword [0x438ce4]
mov byte [eax + 0x14], bl
cmp bl, 0xa
je 0x406d3e
mov ecx, dword [0x438ce4]
mov eax, dword [esp + 0x20]
mov dword [ecx + 8], eax
mov ecx, dword [0x438ce4]
mov eax, dword [esp + 0x28]
mov dword [ecx + 0xc], eax
mov ecx, dword [0x438ce4]
mov eax, dword [esp + 0x24]
mov dword [ecx + 0x10], eax
mov eax, dword [0x438ce4]
mov word [eax + 0x16], dx
mov ecx, dword [0x438ce4]
cmp byte [ecx + 0x14], 0xa
jne 0x406d6a
push ecx
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, 0xc00000bb
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0040c1c5
mov esp, ebp
pop ebp
ret
lea eax, [ecx + 0x5c]
mov dword [ecx + 0x3c], eax
mov ecx, dword [0x438ce4]
mov eax, dword [ecx + 0x3c]
add eax, 0x10
mov dword [ecx + 0x40], eax
mov ecx, dword [0x438ce4]
mov eax, dword [ecx + 0x40]
add eax, 4
mov dword [ecx + 0x44], eax
mov ecx, dword [0x438ce4]
mov eax, dword [ecx + 0x44]
add eax, 4
mov dword [ecx + 0x48], eax
mov ecx, dword [0x438ce4]
mov eax, dword [ecx + 0x48]
add eax, 0x4c
mov dword [ecx + 0x4c], eax
mov ecx, dword [0x438ce4]
mov eax, dword [ecx + 0x4c]
add eax, 0x5c
mov dword [ecx + 0x54], eax
mov ecx, dword [0x438ce4]
mov eax, dword [ecx + 0x54]
add eax, 0x14
mov dword [ecx + 0x58], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
mov esi, dword [ebx]
cmp esi, ebx
je 0x406e21
nop
mov edi, esi
mov esi, dword [esi]
movzx eax, word [edi + 0x2c]
shr eax, 1
sub eax, 4
push eax
push dword [edi + 0x30]
push 0x433db4
call fcn.00415dbf
add esp, 0xc
test eax, eax
je 0x406e23
movzx eax, word [edi + 0x2c]
shr eax, 1
push eax
push dword [edi + 0x30]
push 0x433db4
call fcn.00415dbf
add esp, 0xc
test eax, eax
je 0x406e23
cmp esi, ebx
jne 0x406de0
xor edi, edi
mov eax, dword [0x438ce4]
mov eax, dword [eax + 0x3c]
mov dword [eax + 4], edi
mov edx, dword [0x438ce4]
mov eax, dword [edx + 0x3c]
mov esi, dword [eax + 4]
mov dword [esp + 0x24], esi
test esi, esi
je 0x406f13
mov eax, dword [edx + 8]
cmp eax, 6
jne 0x406e5d
mov eax, dword [edx + 0xc]
cmp eax, 2
je 0x406e70
mov ecx, 2
jmp 0x406e62
mov ecx, 6
cmp ecx, eax
sbb eax, eax
neg eax
test eax, eax
je 0x406f13
lea eax, [esi + 0x68]
mov dword [esp + 0x20], eax
mov ecx, dword [eax + 8]
test ecx, 0xfffffff8
je 0x406e96
mov eax, ecx
and eax, 0xfffffff8
mov dword [esp + 0x20], eax
mov ecx, dword [eax + 8]
test ecx, 0xfffffff8
jne 0x406e82
test byte [eax + 8], 1
jne 0x406f13
mov ecx, dword [esi + 0x18]
lea eax, [esp + 0x20]
mov dword [esp + 0x10], eax
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movlpd qword [esp + 0x18], xmm0
push eax
mov edx, 0x433dac
mov dword [esp + 0x18], 4
xor bl, bl
call fcn.00404fd0
test eax, eax
js 0x406f0d
nop dword [eax]
mov al, bl
inc bl
test al, al
jne 0x406f0d
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x28]
mov edx, 0x433dac
mov ecx, dword [eax + 0x18]
call fcn.00404fd0
test eax, eax
jns 0x406ed0
test esi, esi
je 0x406f0d
cmp dword [esi], 0
je 0x406f0d
cmp dword [esi + 4], 0
je 0x406f0d
mov edx, dword [0x438ce4]
jmp 0x406f15
mov edx, dword [0x438ce4]
xor esi, esi
mov eax, dword [edx + 0x3c]
push str.RtlRbInsertNodeEx
mov dword [eax], esi
push dword [edi + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov ecx, dword [0x438ce4]
push str.RtlRbRemoveNode
mov ecx, dword [ecx + 0x3c]
mov dword [ecx + 8], eax
push dword [edi + 0x18]
call esi
mov ecx, dword [0x438ce4]
mov ecx, dword [ecx + 0x3c]
mov dword [ecx + 0xc], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 0xc]
add edx, 0x1c
mov ecx, dword [edx]
cmp edx, ecx
je 0x406f79
mov eax, dword [ecx + 0x2c]
lea esi, [ecx + 0x2c]
cmp eax, esi
je 0x406f73
cmp dword [eax], esi
je 0x4070cb
mov ecx, dword [ecx]
cmp edx, ecx
jne 0x406f61
xor ecx, ecx
mov eax, dword [0x438ce4]
mov eax, dword [eax + 0x44]
mov dword [eax], ecx
call fcn.00406560
mov ecx, dword [0x438ce4]
mov ecx, dword [ecx + 0x40]
mov dword [ecx], eax
mov eax, dword [0x438ce4]
mov dword [eax + 4], 0x65
mov ecx, dword [0x438ce4]
mov eax, dword [ecx + 0x3c]
cmp dword [eax], 0
je 0x406fb9
or dword [ecx + 4], 2
mov ecx, dword [0x438ce4]
mov eax, dword [ecx + 0x44]
cmp dword [eax], 0
je 0x406fcb
or dword [ecx + 4], 8
mov ecx, dword [0x438ce4]
mov eax, dword [ecx + 0x40]
cmp dword [eax], 0
je 0x406fdd
or dword [ecx + 4], 0x10
mov ecx, dword [0x438ce4]
mov eax, dword [ecx + 0x54]
mov dword [eax], fcn.00403100
mov eax, dword [0x438ce4]
mov eax, dword [eax + 0x54]
mov dword [eax + 4], fcn.00403c00
mov eax, dword [0x438ce4]
mov eax, dword [eax + 0x54]
mov dword [eax + 8], 0x403fd0
mov eax, dword [0x438ce4]
mov eax, dword [eax + 0x54]
mov dword [eax + 0xc], 0x409030
mov eax, dword [0x438ce4]
mov eax, dword [eax + 0x54]
mov dword [eax + 0x10], fcn.00408fa0
mov eax, dword [0x438ce4]
mov eax, dword [eax + 0x58]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [0x438ce4]
mov eax, dword [eax + 0x58]
mov dword [eax + 4], eax
mov dword [eax], eax
mov eax, dword [0x438ce4]
mov eax, dword [eax + 0x58]
add eax, 0x20
mov dword [eax + 4], eax
mov dword [eax], eax
mov eax, dword [0x438ce4]
mov ecx, dword [eax + 0x58]
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ecx + 0x28], eax
mov eax, dword [0x438ce4]
mov ecx, dword [eax + 0x58]
mov eax, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ecx + 0x2c], eax
mov eax, dword [0x438ce4]
mov eax, dword [eax + 0x58]
mov dword [eax + 0x30], 1
mov eax, dword [0x438ce4]
mov edx, dword [eax + 0x58]
mov eax, dword [edx + 4]
lea ecx, [edx + 0x20]
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov dword [eax], ecx
mov dword [edx + 4], ecx
call fcn.00409260
mov eax, dword [0x438ce4]
mov eax, dword [eax + 0x4c]
mov byte [eax + 0x28], 0
mov eax, dword [0x438ce4]
mov eax, dword [eax + 0x4c]
mov byte [eax + 0x29], 0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040c1c5
mov esp, ebp
pop ebp
ret
add ecx, 0x1c
mov edx, 1
call fcn.00404ac0
mov esi, dword [esi]
shl eax, 3
sub esi, eax
mov ecx, esi
call fcn.00406820
neg eax
sbb ecx, ecx
and ecx, esi
jmp 0x406f7b