Function at 0x401000
Capabilities:
Check if file exists
Check mutex on windows
Copy file
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6d0
push ebx
push esi
push edi
push 9
pop ecx
mov esi, str.4BC77975_B2E0_4a8f_88EB_A4B514E86261
lea edi, [ebp - 0x90]
and byte [ebp - 0x6d0], 0
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x8a
xor eax, eax
lea edi, [ebp - 0x6cf]
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x90]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401291
and byte [ebp - 0x4a4], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x4a3]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x4a4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x4a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
and byte [ebp - 0x3a0], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x39f]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x4a4]
push str.autorun.inf
push eax
mov ebx, str._s_s
lea eax, [ebp - 0x3a0]
push ebx
push eax
call esi
lea eax, [ebp - 0x6d0]
push eax
lea eax, [ebp - 0x3a0]
push eax
call fcn.0040129a
add esp, 0x18
test eax, eax
je 0x401291
and byte [ebp - 0x68], 0
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x67]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x5cb]
push eax
call fcn.0040130d
pop ecx
test eax, eax
pop ecx
je 0x401125
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x4c6]
push eax
call fcn.004013c6
pop ecx
test eax, eax
pop ecx
jle 0x401291
and byte [ebp - 0x29c], 0
push 0x41
pop ecx
xor eax, eax
lea edi, [ebp - 0x29b]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x29c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x29c]
push eax
call sub.MSVCRT.dll_strlen
cmp byte [ebp + eax - 0x29d], 0x5c
pop ecx
jne 0x401177
lea eax, [ebp - 0x29c]
push eax
call sub.MSVCRT.dll_strlen
and byte [ebp + eax - 0x29d], 0
pop ecx
and byte [ebp - 0x194], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x193]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x6d0]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x194]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4011c7
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x6d0]
push eax
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebp - 0x3a0]
push ebx
push eax
call esi
add esp, 0x10
xor ebx, ebx
lea eax, [ebp - 0x194]
push ebx
push eax
lea eax, [ebp - 0x3a0]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0xe
mov dword [ebp - 8], eax
pop ecx
xor eax, eax
cmp dword [ebp - 8], ebx
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x40
mov dword [ebp - 0x3c], ebx
lea eax, [ebp - 0x194]
jne 0x401228
lea eax, [ebp - 0x3a0]
mov dword [ebp - 0x34], eax
mov eax, 0x4030a0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x2c], ebx
push eax
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x24], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0x7d0
test eax, eax
je 0x401273
push 0xffffffffffffffff
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp - 8], ebx
je 0x401291
push edi
call esi
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10