Function at 0x4018a0
Capabilities:
Check mutex on windows
Create process on windows
Get common file path
Get session user name
Hide graphical window
Query or enumerate registry value
Read .ini file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4295b2
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x412c
call fcn.00415fe0
mov eax, dword [0x434c44]
xor eax, esp
mov dword [esp + 0x4128], eax
push ebx
push esi
push edi
mov eax, dword [0x434c44]
xor eax, esp
push eax
lea eax, [esp + 0x4140]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
push 0
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xdfe]
push ecx
mov word [esp + 0xe00], ax
call fcn.00414210
add esp, 0xc
cmp dword [ebp + 8], 1
jle 0x401989
mov eax, dword [esi + 4]
push eax
lea edx, [esp + 0xdf8]
push 0x104
push edx
call fcn.0041200f
add esp, 0xc
mov ecx, str._LockScreen
lea eax, [esp + 0xdf4]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40196c
test dx, dx
je 0x401968
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40196c
add eax, 4
add ecx, 4
test dx, dx
jne 0x401946
xor eax, eax
jmp 0x401971
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401989
push 0
push str.rundll32.exe_user32.dll_LockWorkStation
call dword [sym.imp.KERNEL32.dll_WinExec]
push 1
call fcn.00411f77
mov esi, dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor eax, eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
push 1
lea eax, [esp + 0x68]
push eax
mov dword [esp + 0x40], 0xc
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0
push 0
push 1
lea ecx, [esp + 0x70]
push ecx
call edi
push str.GlobalNet_Protector_:_PANTAGENT
push 0
lea eax, [esp + 0x40]
lea edx, [esp + 0x6c]
push eax
mov dword [esp + 0x48], edx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_OpenEventW]
cmp eax, 0xb7
jne 0x401a17
push str.GlobalWAITING_FOR_PARALLEL_PANTAGENT
push 0
push 0x1f0003
call ebx
mov dword [0x438b50], eax
test eax, eax
je 0x401a17
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
call fcn.00411f77
xor eax, eax
push 1
lea ecx, [esp + 0x4c]
push ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
call esi
test eax, eax
je 0x401a71
push 0
push 0
push 1
lea edx, [esp + 0x54]
push edx
call edi
test eax, eax
je 0x401a71
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x2c], 0xc
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 0
push str.GlobalWAITING_FOR_PARALLEL_PANTAGENT
push 0
push 0x1f0003
call ebx
mov dword [0x438b50], eax
test eax, eax
jne 0x401aa1
push str.GlobalWAITING_FOR_PARALLEL_PANTAGENT
push 1
push 1
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x438b50], eax
cmp dword [ebp + 8], 1
jle 0x402328
call fcn.004074da
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x401ac5
push 0x80004005
call fcn.00405380
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x7e6]
mov dword [esp + 0x4150], 0
push edx
mov word [esp + 0x7e8], cx
call fcn.00414210
add esp, 0xc
push 0x104
lea eax, [esp + 0x7e0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx + 4]
test ecx, ecx
jne 0x401b24
xor eax, eax
jmp 0x401b3f
mov eax, ecx
lea esi, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x401b30
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x28]
call fcn.00405080
mov esi, dword [esp + 0x20]
cmp dword [esi - 0xc], 0
jl 0x4022fa
push str.ADD_
push esi
call fcn.00412178
add esp, 8
test eax, eax
je 0x401ced
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x401ced
call fcn.00402a00
mov edi, dword [0x438d74]
test edi, edi
jne 0x401ba6
push 4
call fcn.004070e0
add esp, 4
test eax, eax
je 0x401b9c
mov dword [eax], edi
jmp 0x401b9e
xor eax, eax
mov edi, eax
mov dword [0x438d74], edi
push edi
push str.SOFTWAREMessage_LabsNet_Protector2FactAuth
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x401c13
lea esi, [esp + 0x18]
mov edx, edi
call fcn.004055c0
test eax, eax
jne 0x401c0a
cmp dword [esp + 0x18], 1
jbe 0x401c05
push str.SOFTWAREMessage_LabsNet_Protector2FactAuth
push 0x104
push 0x438b68
call fcn.0041200f
mov edx, dword [edi]
add esp, 0xc
push edx
mov dword [0x438b64], 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401c34
mov eax, dword [edi]
push eax
jmp 0x401c0d
mov ecx, dword [edi]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SOFTWAREVB_and_VBA_Program_Settings2FactAuth
push 0x104
push 0x438b68
call fcn.0041200f
add esp, 0xc
mov dword [0x438b64], 0x80000001
xor eax, eax
push edi
mov dword [esp + 0x7e], eax
mov dword [esp + 0x82], eax
mov dword [esp + 0x86], eax
mov dword [esp + 0x8a], eax
mov word [esp + 0x8e], ax
mov eax, dword [0x438b64]
push 0x438b68
xor edx, edx
mov esi, 1
push eax
mov word [esp + 0x84], dx
mov ebx, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x401ccd
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x7c]
push edx
push eax
push eax
mov eax, dword [edi]
push str.PrevSetting
push eax
mov dword [esp + 0x28], 0xa
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401ccd
xor ecx, ecx
mov eax, 0x31
cmp word [esp + 0x78], ax
sete cl
xor ebx, ebx
cmp word [esp + 0x7a], ax
sete bl
xor edx, edx
cmp word [esp + 0x7c], ax
mov esi, ecx
sete dl
mov eax, edx
jmp 0x401ccf
mov eax, ebx
push eax
push ebx
push esi
lea ecx, [esp + 0x7e8]
call fcn.00405b00
test al, al
jne 0x401a10
push 1
call fcn.00411f77
cmp dword [esi - 0xc], 0
jl 0x4022fa
push str._AutoStart
push esi
call fcn.00412178
add esp, 8
test eax, eax
je 0x4022fa
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x4022fa
xor eax, eax
push 0x3e
push eax
lea ecx, [esp + 0x96]
push ecx
mov word [esp + 0x98], ax
call fcn.00414210
mov ebx, 0x20
add esp, 0xc
mov dword [esp + 0x1c], ebx
call fcn.00405590
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
push esi
push str.SOFTWAREMessage_LabsNet_ProtectorConfig
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x401d8a
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x90]
push eax
push 0
push 0
mov dword [esp + 0x2c], ebx
mov ecx, dword [esi]
push str.LicenseCode
push ecx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esi]
push edx
jmp 0x401dc5
push esi
push str.SOFTWAREVB_and_VBA_Program_SettingsSPYWAREPROTECTIONConfig
push SysReAllocString
call edi
test eax, eax
jne 0x401dcb
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x90]
push ecx
push 0
push 0
mov dword [esp + 0x2c], ebx
mov edx, dword [esi]
push str.LicenseCode
push edx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esi]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00401000
push 0x103
lea ecx, [esp + 0xd1]
push 0
push ecx
mov dword [esp + 0x1c], eax
mov byte [esp + 0xd8], 0
call fcn.00414210
add esp, 0xc
push 0x2327
lea edx, [esp + 0x1e11]
push 0
push edx
mov byte [esp + 0x1e18], 0
call fcn.00414210
add esp, 0xc
push 0
call fcn.00412255
mov dword [esp + 0x60], eax
add esp, 4
lea eax, [esp + 0x5c]
push eax
mov esi, str._Y__m__d__H:_M:_S
lea edi, [esp + 0x1c]
mov dword [esp + 0x64], edx
call fcn.00404b20
mov byte [esp + 0x4148], 1
mov ecx, dword [esp + 0x18]
push ecx
push str.txtCurrDateTime_S
lea edx, [esp + 0xd4]
call fcn.00404a10
mov esi, dword [esp + 0x18]
add esp, 8
lea ebx, [esp + 0x1e0c]
lea edi, [esp + 0xcc]
mov ecx, esi
call fcn.004010f0
lea edx, [esp + 0x1e12]
push edx
call fcn.00412848
add esp, 4
cmp eax, 0xa
jge 0x4022bd
call fcn.00404170
call fcn.00403080
call fcn.00402a00
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x9ee]
push ecx
mov word [esp + 0x9f0], ax
call fcn.00414210
add esp, 0xc
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x9e8]
push eax
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 1
push 1
push 1
lea ecx, [esp + 0x7e8]
call fcn.00405b00
test al, al
jne 0x401a10
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0xbf6]
push edx
mov word [esp + 0xbf8], cx
call fcn.00414210
add esp, 0xc
push 0
push 0x23
lea eax, [esp + 0xbf4]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.Net_ProtectorSAUNOTIFY.INI
lea ecx, [esp + 0xbf0]
push 0x104
push ecx
call fcn.0041207e
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x1006]
push eax
mov word [esp + 0x1008], dx
call fcn.00414210
add esp, 0xc
lea ecx, [esp + 0xbec]
push ecx
push 0x104
lea edx, [esp + 0x1004]
push edx
push str.Pantagent_npav_am812_gmail.com
push str.Email
push str.DETAILS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x140e]
push ecx
mov word [esp + 0x1410], ax
call fcn.00414210
lea edx, [esp + 0x20]
add esp, 0xc
push edx
call fcn.004035a0
mov eax, dword [eax]
add esp, 4
push eax
lea eax, [esp + 0x1408]
push 0x104
push eax
call fcn.0041200f
add esp, 0xc
lea ecx, [esp + 0x14]
call fcn.00405250
lea ecx, [esp + 0x28]
call fcn.00405290
lea ecx, [esp + 0x24]
call fcn.00405290
lea ecx, [esp + 0x14]
call fcn.00405290
lea ecx, [esp + 0x1404]
push ecx
lea edx, [esp + 0x9e8]
push edx
lea eax, [esp + 0x30]
push str._nPC_UserName_:___s___br_Password_:___s
mov bl, 4
push eax
mov byte [esp + 0x4158], bl
call fcn.00404b00
push str._br__br_
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x5c]
push edx
call fcn.004046f0
add esp, 0x1c
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x414c], 5
call fcn.004043d0
lea ecx, [esp + 0x44]
mov byte [esp + 0x4148], bl
call fcn.00405250
push 0x1ff
lea eax, [esp + 0x5e1]
push 0
push eax
mov byte [esp + 0x5e8], 0
call fcn.00414210
add esp, 0xc
lea ecx, [esp + 0xffc]
push ecx
push 0x42e3fc
lea edx, [esp + 0x5e4]
call fcn.00404a30
push 0x7ff
lea edx, [esp + 0x1619]
push 0
push edx
mov byte [esp + 0x1620], 0
call fcn.00414210
mov eax, dword [esp + 0x38]
add esp, 0x14
push eax
lea ecx, [esp + 0x18]
push str.Hello_sir_mam__br__br_You_are_receiving_this_email_because_we_detect_suspicious_hacking_activity_in_your_machine._br__br_Please_use_below_credentials_for_login_into_machine_account._br__br__s__br__br_Regards___br_Team_NPAV
push ecx
call fcn.00404b00
mov edx, dword [esp + 0x20]
add esp, 0xc
push edx
push 0x42e3fc
lea eax, [esp + 0x1614]
push 0x800
push eax
call fcn.00412b19
mov ecx, dword [str.2fa_npav.net]
mov edx, dword [0x42e5c4]
mov eax, dword [0x42e5c8]
push 0x1f3
mov dword [esp + 0x3f4], edx
mov dword [esp + 0x3f0], ecx
mov cl, byte [0x42e5cc]
lea edx, [esp + 0x3fd]
push 0
push edx
mov dword [esp + 0x400], eax
mov byte [esp + 0x404], cl
call fcn.00414210
mov ecx, 0xb
mov esi, str.Login_credential_for_2_factor_authentication
lea edi, [esp + 0x1220]
rep movsd dword es:[edi], dword [esi]
add esp, 0x1c
push 0x1d3
lea eax, [esp + 0x1235]
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.00414210
add esp, 0xc
lea ecx, [esp + 0x160c]
push ecx
lea edx, [esp + 0x1208]
push edx
lea edx, [esp + 0x5e4]
lea ecx, [esp + 0x3e4]
call fcn.00404260
push str.yogeshg_npav.net
lea eax, [esp + 0x5e8]
push 0x200
push eax
call fcn.00412f0e
add esp, 0x14
lea ecx, [esp + 0x160c]
push ecx
lea edx, [esp + 0x1208]
push edx
lea edx, [esp + 0x5e4]
lea ecx, [esp + 0x3e4]
call fcn.00404260
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x98]
push ecx
push str.npavkey_StxtCurrDateTime_S
lea edx, [esp + 0xe0]
call fcn.00404a10
mov ecx, dword [esp + 0x24]
add esp, 0x14
lea ebx, [esp + 0x1e0c]
lea edi, [esp + 0xcc]
call fcn.004010f0
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x1de]
push eax
mov word [esp + 0x1e0], dx
call fcn.00414210
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
add esp, 0xc
push 0x208
lea ecx, [esp + 0x1d8]
push ecx
push 0
call esi
lea edx, [esp + 0x1d4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x1d4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push str.PANTA.EXE__taskremove
lea ecx, [esp + 0x1d8]
push 0x104
push ecx
call fcn.0041207e
add esp, 0xc
push str.SYSTEM
lea edx, [esp + 0x9e8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x401975
lea ecx, [esp + 0x1d4]
call fcn.00402910
push 0x208
lea eax, [esp + 0x1d8]
push eax
push 0
call esi
push str.__LockScreen
lea ecx, [esp + 0x1d8]
push 0x104
push ecx
call fcn.0041207e
add esp, 0xc
lea edx, [esp + 0x1d4]
push 0
push edx
call fcn.004014c0
add esp, 8
jmp 0x401982
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x90]
push ecx
push str.npavkey_StxtCurrDateTime_S
lea edx, [esp + 0xd8]
call fcn.00404a10
add esp, 0xc
lea ebx, [esp + 0x1e0c]
lea edi, [esp + 0xcc]
mov ecx, esi
call fcn.004010f0
push 0
call fcn.00411f77
call fcn.00402650
lea eax, [esi - 0x10]
mov dword [esp + 0x4148], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40232d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x40232d
call fcn.00402650
xor eax, eax
mov ecx, dword [esp + 0x4140]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4128]
xor ecx, esp
call fcn.00411cc8
mov esp, ebp
pop ebp
ret