Function at 0x40122f
Capabilities:
Check os version
Create thread
Link many functions at runtime
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x40b040
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.DLL_OpenMutexA]
mov dword [0x40ca64], eax
cmp dword [0x40ca64], 0
je 0x40125f
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push str.isalreadyruns_prkiller
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov dword [0x40ca64], eax
push 0x80
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_SetPriorityClass]
mov eax, dword [ebp + 8]
mov dword [0x40ca58], eax
mov dword [0x40ca54], 1
push 0x3c00
push 0
push 0x411e68
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x3c00
push 0
push 0x40e268
call sub.MSVCRT.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.DLL_GetVersion]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0xff
xor edx, edx
cmp ecx, 4
sete dl
test edx, edx
je 0x4012ff
mov eax, dword [ebp - 4]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
and eax, 0x8000
test eax, eax
je 0x4012ff
mov dword [ebp - 0x30], 1
jmp 0x401306
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp - 0x30]
mov dword [0x40ca60], ecx
mov edx, dword [ebp - 4]
and edx, 0xff
xor eax, eax
cmp edx, 5
setl al
test eax, eax
je 0x401349
mov ecx, dword [ebp - 4]
shr ecx, 0x10
and ecx, 0xffff
and ecx, 0xffff
and ecx, 0x8000
test ecx, ecx
jne 0x401349
mov dword [ebp - 0x34], 1
jmp 0x401350
mov dword [ebp - 0x34], 0
mov edx, dword [ebp - 0x34]
mov dword [0x40ca5c], edx
cmp dword [0x40ca60], 0
jne 0x401378
push 1
call fcn.00405d6f
add esp, 4
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_SetProcessShutdownParameters]
jmp 0x40139f
push 0x40b070
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [ebp - 0x28], eax
push str.RegisterServiceProcess
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 0x24], eax
push 1
push 0
call dword [ebp - 0x24]
push 3
push 0
push 0
push 0x2001
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
cmp dword [0x40ca60], 0
jne 0x401434
push str.psapi.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [0x40c454], eax
push str.GetModuleFileNameExA
mov ecx, dword [0x40c454]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x40c3d4], eax
push str.GetModuleBaseNameA
mov edx, dword [0x40c454]
push edx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x40c3d0], eax
push str.EnumProcessModules
mov eax, dword [0x40c454]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x40c3cc], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [0x40c44c], eax
push str.NtQuerySystemInformation
mov ecx, dword [0x40c44c]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x40c3d8], eax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [0x40c450], eax
cmp dword [0x40ca5c], 0
jne 0x4014be
push str.CreateToolhelp32Snapshot
mov edx, dword [0x40c450]
push edx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x40c3c8], eax
push str.Process32First
mov eax, dword [0x40c450]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x40c3c4], eax
push str.Process32Next
mov ecx, dword [0x40c450]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x40c3c0], eax
push str.Thread32First
mov edx, dword [0x40c450]
push edx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x40c3bc], eax
push str.Thread32Next
mov eax, dword [0x40c450]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x40c3b8], eax
push str.OpenThread
mov ecx, dword [0x40c450]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x40c3a4], eax
push str.user32
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x40c448], eax
push str.GetShellWindow
mov edx, dword [0x40c448]
push edx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x40c3b4], eax
cmp dword [0x40ca60], 0
je 0x40151d
push str.IsHungThread
mov eax, dword [0x40c448]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x40c3ac], eax
jmp 0x401534
push str.IsHungAppWindow
mov ecx, dword [0x40c448]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x40c3b0], eax
push str.SwitchToThisWindow
mov edx, dword [0x40c448]
push edx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x40c3a8], eax
call fcn.0040527d
cmp dword [0x40ca60], 0
jne 0x40157a
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
push 0x408690
push 0x186a0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x401633
push 0xa
push 1
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x40c46c], eax
push 0x40168a
push 0x64
push 2
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x40c468], eax
push 0xc0
push 6
push 1
push 0
call dword [sym.imp.USER32.dll_RegisterHotKey]
push 0
push 0
push 0
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x40162a
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 0x312
je 0x4015dc
jmp 0x4015f4
mov eax, dword [ebp - 0x18]
and eax, 0xffff
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
je 0x4015ef
jmp 0x4015f4
call fcn.00403cee
cmp dword [0x40ca54], 0
jne 0x401614
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [0x40ca50]
push edx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
je 0x401614
jmp 0x4015b7
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4015b7
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0x10