Function at 0x408035
Capabilities:
Check mutex on windows
Copy file
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18c
mov eax, dword [0x49d2e0]
xor eax, esp
mov dword [esp + 0x188], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x2c
mov dword [esp + 0x28], ebx
call fcn.0041ea52
pop ecx
test eax, eax
je 0x408073
mov ecx, eax
call fcn.0040e88a
mov esi, eax
mov dword [esp + 0x28], esi
jmp 0x408079
mov esi, ebx
mov dword [esp + 0x28], ebx
push 1
call fcn.0041ea52
pop ecx
push 0x28
mov dword [esp + 0x14], eax
call fcn.0041ea52
pop ecx
test eax, eax
je 0x4080a0
mov ecx, eax
call fcn.0040e04a
mov edi, eax
mov dword [esp + 0x14], edi
jmp 0x4080a6
mov edi, ebx
mov dword [esp + 0x14], ebx
mov ecx, esi
call fcn.0040e942
test al, al
jne 0x40811f
push ecx
push ebx
push ecx
mov esi, esp
push ecx
mov ecx, esp
push str.Out_Of_Period_Access
call fcn.00401668
push ecx
mov ecx, esp
push 0x4881c0
call fcn.00401668
push edi
push esi
call fcn.0040d1d2
call fcn.0040d0b1
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x4080ea
push ecx
call fcn.00408a6a
push ecx
push ebx
push ecx
mov esi, esp
push ecx
mov ecx, esp
push str.Self_Terminate_Treatment
call fcn.00401668
push ecx
mov ecx, esp
push 0x4881e0
call fcn.00401668
push edi
push esi
call fcn.0040d1d2
call fcn.0040d0b1
call fcn.0040e9f1
jmp 0x40892a
test esi, esi
je 0x40812b
push ecx
mov ecx, esi
call fcn.00408a6a
push 0x24
call fcn.0041ea52
pop ecx
test eax, eax
je 0x408144
mov ecx, eax
call fcn.0040a8d4
mov dword [esp + 0x28], eax
jmp 0x408148
mov dword [esp + 0x28], ebx
push 0x40000
push 0x4881e4
push 0x4881f0
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x486b73
mov ecx, 0x4a22e0
call fcn.00409ad4
test eax, eax
je 0x408176
call fcn.0040cf0d
push ecx
push ebx
push ecx
mov esi, esp
push ecx
mov ecx, esp
push str.Origin_Malware_Start
call fcn.00401668
push ecx
mov ecx, esp
push 0x488224
call fcn.00401668
push edi
push esi
call fcn.0040d1d2
call fcn.0040d0b1
push str.fsiDrill
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0xfe
mov dword [esp + 0x24], eax
lea eax, [esp + 0x95]
push ebx
push eax
mov byte [esp + 0x9c], bl
call fcn.004235f0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push ebx
push 0x410
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x408214
push 0xfe
lea eax, [esp + 0x94]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xff
jae 0x408a64
push 0x49e1e8
lea ecx, [esp + 0x1c]
mov byte [esp + esi + 0x94], bl
call fcn.00401743
push str.4022
lea eax, [esp + 0x1c]
push str._s.exe
push eax
call fcn.00403011
add esp, 0xc
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x1c]
call fcn.00409ad4
mov esi, dword [esp + 0x18]
test eax, eax
je 0x4082d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x408281
push ecx
lea ecx, [esi - 0x10]
mov edi, esp
call fcn.00401f3d
add eax, 0x10
mov dword [edi], eax
call fcn.00407f92
pop ecx
cmp eax, 1
jne 0x4082d1
push ebx
push str.APT
push 0x488250
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ecx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.Mutex_Duplicate_execution_
call fcn.00401668
push ecx
mov ecx, esp
push 0x4882d0
call fcn.00401668
mov ecx, dword [esp + 0x28]
push ecx
push edi
call fcn.0040d1d2
call fcn.0040d0b1
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x408922
push 0xc
call fcn.0041ea52
pop ecx
test eax, eax
je 0x4082ec
mov ecx, eax
call fcn.00401fdd
mov edi, eax
mov dword [esp + 0x18], edi
jmp 0x4082f2
mov edi, ebx
mov dword [esp + 0x18], ebx
mov ecx, edi
call fcn.0040219f
cmp al, 1
jne 0x408342
push str.false
push ecx
push ecx
mov ecx, esp
push str.isConfigInit
mov dword [esp + 0x34], 1
call fcn.00401668
push ecx
mov ecx, esp
push str.drill
call fcn.00401668
lea eax, [esp + 0x30]
push eax
mov ecx, edi
call fcn.0040210f
pop ecx
mov ecx, eax
call fcn.00409ad4
mov byte [esp + 0x1f], 1
test eax, eax
je 0x408346
mov byte [esp + 0x1f], bl
test byte [esp + 0x24], 1
je 0x408359
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00401253
push ecx
cmp byte [esp + 0x23], bl
je 0x4086ce
mov ecx, dword [esp + 0x18]
mov edi, esp
mov ecx, dword [ecx + 0x18]
sub ecx, 0x10
call fcn.00401f3d
push ecx
add eax, 0x10
mov ecx, esp
push str.trn_id
mov dword [edi], eax
call fcn.00401668
push ecx
mov ecx, esp
push str.Computer_Information
call fcn.00401668
mov ecx, dword [esp + 0x24]
call fcn.00402052
mov eax, dword [esp + 0x14]
push ecx
mov ecx, dword [eax + 0x20]
sub ecx, 0x10
mov edi, esp
call fcn.00401f3d
push ecx
add eax, 0x10
mov ecx, esp
push str.template_Id
mov dword [edi], eax
call fcn.00401668
push ecx
mov ecx, esp
push str.Computer_Information
call fcn.00401668
mov ecx, dword [esp + 0x24]
call fcn.00402052
mov eax, dword [esp + 0x14]
push ecx
mov ecx, dword [eax + 0x1c]
sub ecx, 0x10
mov edi, esp
call fcn.00401f3d
push ecx
add eax, 0x10
mov ecx, esp
push str.malware_Id
mov dword [edi], eax
call fcn.00401668
push ecx
mov ecx, esp
push str.Computer_Information
call fcn.00401668
mov ecx, dword [esp + 0x24]
call fcn.00402052
mov eax, dword [esp + 0x14]
push ecx
mov ecx, dword [eax + 0x24]
sub ecx, 0x10
mov edi, esp
call fcn.00401f3d
push ecx
add eax, 0x10
mov ecx, esp
push str.user_Id
mov dword [edi], eax
call fcn.00401668
push ecx
mov ecx, esp
push str.Computer_Information
call fcn.00401668
mov ecx, dword [esp + 0x24]
call fcn.00402052
push 0x486b73
mov ecx, 0x4a22e0
call fcn.00409ad4
test eax, eax
je 0x408518
mov ebx, 0x49e1e8
push ebx
lea ecx, [esp + 0x24]
call fcn.00401743
push ebx
lea ecx, [esp + 0x30]
call fcn.00401743
push 1
lea eax, [esp + 0x30]
push 0x486e60
push eax
call fcn.00403011
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
mov edx, str.LogServer
lea ecx, [esp + 0x10]
call fcn.00402fa9
pop ecx
push eax
lea ecx, [esp + 0x24]
call fcn.00401dc6
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff0
call fcn.00401253
push ecx
mov ebx, esp
push ecx
mov ecx, dword [0x4a22e0]
add ecx, 0xfffffff0
mov edi, esp
call fcn.00401f3d
add eax, 0x10
push ebx
mov dword [edi], eax
call fcn.0040cea3
mov ebx, dword [esp + 0x24]
push ecx
lea ecx, [ebx - 0x10]
mov edi, esp
call fcn.00401f3d
push ecx
add eax, 0x10
mov ecx, esp
push str.connect
mov dword [edi], eax
call fcn.00401668
mov ecx, dword [esp + 0x24]
call fcn.00402052
mov ecx, dword [esp + 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00401253
lea ecx, [ebx - 0x10]
call fcn.00401253
xor ebx, ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.Treatment
call fcn.00401668
push ecx
mov ecx, esp
push 0x488300
call fcn.00401668
push dword [esp + 0x20]
push edi
call fcn.0040d1d2
push ecx
mov ecx, esp
push str.malChecker
call fcn.00401668
push ecx
mov ecx, esp
push str.Computer_Information
call fcn.00401668
mov edi, dword [esp + 0x24]
mov ecx, edi
call fcn.00402052
mov ecx, dword [esp + 0x14]
push edi
call fcn.0040e136
push ecx
mov ecx, esp
push str.true
call fcn.00401668
push ecx
mov ecx, esp
push str.isConfigInit
call fcn.00401668
push ecx
mov ecx, esp
push str.drill
call fcn.00401668
mov ecx, edi
call fcn.00402052
push 1
call fcn.0041ea52
mov edi, eax
pop ecx
lea eax, [esp + 0x24]
push eax
call fcn.00401510
push 0x486b73
lea ecx, [esp + 0x28]
call fcn.00409ad4
test eax, eax
je 0x408628
push 0x49e1e8
lea ecx, [esp + 0x24]
call fcn.00401743
push dword [esp + 0x24]
lea eax, [esp + 0x24]
push str.Reversing_Detect_Tool:_s_
push eax
call fcn.00403011
pop ecx
pop ecx
push ebx
mov ebx, dword [esp + 0x28]
push ecx
mov dword [esp + 0x18], esp
push ecx
lea ecx, [ebx - 0x10]
mov edi, esp
call fcn.00401f3d
push ecx
add eax, 0x10
mov ecx, esp
push 0x488320
mov dword [edi], eax
call fcn.00401668
push dword [esp + 0x28]
push dword [esp + 0x24]
call fcn.0040d1d2
call fcn.0040d0b1
lea ecx, [ebx - 0x10]
call fcn.00401253
jmp 0x408691
mov ecx, edi
call fcn.0040126f
cmp al, 1
jne 0x408642
push ecx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.Reversing_Detect_MemoryBP_
jmp 0x408670
call fcn.0040137d
test eax, eax
jle 0x40865a
push ecx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.Reversing_Detect_HardwareBP_
jmp 0x408670
call fcn.00401408
cmp al, 1
jne 0x408691
push ecx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.Reversing_Detect_ProcessDebugFlags_
call fcn.00401668
push ecx
mov ecx, esp
push 0x488320
call fcn.00401668
push dword [esp + 0x28]
push edi
call fcn.0040d1d2
call fcn.0040d0b1
push ecx
push 0
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.ConfigFileInitSuccess
call fcn.00401668
push ecx
mov ecx, esp
push 0x48839c
call fcn.00401668
push dword [esp + 0x28]
push edi
call fcn.0040d1d2
call fcn.0040d0b1
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.00401253
jmp 0x4086fb
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.ConfigFileInitFail
call fcn.00401668
push ecx
mov ecx, esp
push 0x4883b4
call fcn.00401668
push dword [esp + 0x28]
push edi
call fcn.0040d1d2
call fcn.0040d0b1
push str.false
push ecx
push ecx
mov ecx, esp
push str.isInit
call fcn.00401668
push ecx
mov ecx, esp
push str.drill
call fcn.00401668
mov edi, dword [esp + 0x28]
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call fcn.0040210f
pop ecx
mov ecx, eax
call fcn.00409ad4
mov ecx, dword [esp + 0xc]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.00401253
push ecx
inc bl
je 0x408795
mov ecx, esp
push str.true
call fcn.00401668
push ecx
mov ecx, esp
push str.isInit
call fcn.00401668
push ecx
mov ecx, esp
push str.drill
call fcn.00401668
mov ecx, edi
call fcn.00402052
push ecx
xor ebx, ebx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.Init
call fcn.00401668
push ecx
mov ecx, esp
push 0x4883c0
jmp 0x4087b0
xor ebx, ebx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.start
call fcn.00401668
push ecx
mov ecx, esp
push 0x488224
call fcn.00401668
push dword [esp + 0x28]
push edi
call fcn.0040d1d2
call fcn.0040d0b1
or dword [esp + 0x34], 0xffffffff
xor eax, eax
lea edi, [esp + 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [esp + 0x28]
push dword [edi + 0x1c]
lea eax, [edi + 0xc]
mov ecx, eax
mov dword [esp + 0x10], eax
call fcn.00409ad4
test eax, eax
je 0x408830
push 1
push dword [edi + 0xc]
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ecx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
test eax, eax
jne 0x408943
push str.ProgramCopyFail
call fcn.00401668
push ecx
mov ecx, esp
push 0x4883dc
call fcn.00401668
push dword [esp + 0x28]
push edi
call fcn.0040d1d2
call fcn.0040d0b1
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40883f
push eax
call fcn.0041dede
pop ecx
mov edi, dword [esp + 0x14]
test edi, edi
je 0x408855
mov ecx, edi
call fcn.0040e346
push edi
call fcn.0041dede
pop ecx
mov eax, dword [esp + 0x18]
test eax, eax
je 0x408865
push ecx
mov ecx, eax
call fcn.00408ad7
mov edi, dword [esp + 0x28]
mov ecx, edi
call fcn.0040a9c6
push edi
call fcn.0041dede
pop ecx
push 0x10
call fcn.0041ea52
mov dword [esp + 0x34], eax
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [esp + 0x30]
mov eax, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [esp + 0x30]
mov eax, dword [ebp + 0x10]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x30]
mov ecx, dword [ebp + 0x14]
push ebx
push ebx
mov dword [eax + 0xc], ecx
lea eax, [esp + 0x38]
push eax
push 0x408b19
push ebx
push ebx
call edi
push ebx
push ebx
push ebx
push 0x4094f5
push ebx
push ebx
mov dword [esp + 0x4c], eax
call edi
push ebx
push ebx
push ebx
push 0x409775
push ebx
push ebx
mov dword [esp + 0x50], eax
call edi
push ebx
push ebx
push ebx
push 0x409775
push ebx
push ebx
mov dword [esp + 0x54], eax
call edi
push ebx
push ebx
push ebx
push 0x40977a
push ebx
push ebx
mov dword [esp + 0x58], eax
call edi
mov dword [esp + 0x44], eax
mov eax, dword [esp + ebx*4 + 0x34]
test eax, eax
je 0x40891c
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 5
jl 0x408900
lea ecx, [esi - 0x10]
call fcn.00401253
mov ecx, dword [esp + 0x194]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0041dee3
mov esp, ebp
pop ebp
ret 0x10
push str.ProgramCopySuccess
call fcn.00401668
push ecx
mov ecx, esp
push 0x4883f4
call fcn.00401668
push dword [esp + 0x28]
push edi
call fcn.0040d1d2
call fcn.0040d0b1
push ecx
mov ecx, esp
push str.true
call fcn.00401668
push ecx
mov ecx, esp
push str.isCopy
call fcn.00401668
push ecx
mov ecx, esp
push str.drill
call fcn.00401668
mov ecx, dword [esp + 0x24]
call fcn.00402052
push 0x44
pop edi
push edi
lea eax, [esp + 0x4c]
push ebx
push eax
call fcn.004235f0
mov dword [esp + 0x54], edi
xor eax, eax
lea edi, [esp + 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 0x486b73
lea ecx, [esp + 0x28]
stosd dword es:[edi], eax
call fcn.00401668
mov edi, dword [esp + 0xc]
push edi
lea ecx, [esp + 0x28]
call fcn.00401dc6
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x4c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [edi]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x408a04
mov ecx, dword [esp + 0x24]
lea ecx, [ecx - 0x10]
call fcn.00401253
jmp 0x408922
push ecx
mov ecx, esp
push str.true
call fcn.00401668
push ecx
mov ecx, esp
push str.isExcute
call fcn.00401668
push ecx
mov ecx, esp
push str.drill
call fcn.00401668
mov ecx, dword [esp + 0x24]
call fcn.00402052
push ecx
push ebx
push ecx
mov edi, esp
push ecx
mov ecx, esp
push str.CreateProcessSuccess
call fcn.00401668
push ecx
mov ecx, esp
push 0x488410
call fcn.00401668
push dword [esp + 0x28]
push edi
call fcn.0040d1d2
call fcn.0040d0b1
jmp 0x4089f3
call fcn.0041ff70
int3