Function at 0x409790
Capabilities:
Check mutex on windows
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525d1e
mov eax, dword fs:[0]
push eax
sub esp, 0xbc0
mov eax, dword [0x57f82c]
xor eax, ebp
mov dword [ebp - 0x48], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb48], ecx
push 0x200
push 0x582f50
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp dword [0x5882e0], 2
jne 0x409df2
mov eax, dword [ebp - 0xb48]
mov ecx, dword [eax + 0x48]
movsx edx, byte [ecx + 1]
cmp edx, 0x78
jne 0x409df2
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 0x854], 0
push 0x3ff
push 0
lea eax, [ebp - 0x853]
push eax
call fcn.0050c7f0
add esp, 0xc
mov byte [ebp - 0x44c], 0
push 0x3ff
push 0
lea ecx, [ebp - 0x44b]
push ecx
call fcn.0050c7f0
add esp, 0xc
lea edx, [ebp - 0x854]
push edx
push 0x538b24
push 0x538b30
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00407ff0
add esp, 0x10
cmp eax, 0xffffffff
jne 0x409865
mov byte [ebp - 0x854], 0
push 0
push 0x538b40
push 0x538b4c
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00407f70
add esp, 0x10
mov dword [ebp - 0x44], eax
push 0
push 0x538b5c
push 0x538b68
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00407f70
add esp, 0x10
mov dword [ebp - 0x85c], eax
push 0
push 0x538b78
push 0x538b88
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00407f70
add esp, 0x10
mov dword [ebp - 0x858], eax
push 0
push 0x538b98
push 0x538ba4
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00407f70
add esp, 0x10
mov dword [ebp - 0x450], eax
lea eax, [ebp - 0x44c]
push eax
push 0x538bb4
push 0x538bc0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00407ff0
add esp, 0x10
cmp eax, 0xffffffff
jne 0x409908
mov byte [ebp - 0x44c], 0
push 0x538bd0
lea ecx, [ebp - 0x454]
call fcn.00401020
mov dword [ebp - 4], 0
push 0x5384e7
push 0x538be0
lea ecx, [ebp - 0x454]
call fcn.0040a1d0
cmp dword [ebp - 0x450], 0
je 0x409949
mov dword [ebp - 0xb4c], 0x538c10
jmp 0x409953
mov dword [ebp - 0xb4c], 0x5384ea
cmp dword [ebp - 0x858], 0
je 0x409968
mov dword [ebp - 0xb50], 0x538c14
jmp 0x409972
mov dword [ebp - 0xb50], 0x5384eb
cmp dword [ebp - 0x85c], 0
je 0x409987
mov dword [ebp - 0xb54], 0x538c1c
jmp 0x409991
mov dword [ebp - 0xb54], 0x5384f2
cmp dword [ebp - 0x44], 0
je 0x4099a3
mov dword [ebp - 0xb58], 0x538c20
jmp 0x4099ad
mov dword [ebp - 0xb58], 0x5384f3
push str._.exe
lea ecx, [ebp - 0x854]
push ecx
push 0x538bf0
push str._Y__m__d__H__M__S
lea edx, [ebp - 0xb00]
push edx
lea eax, [ebp - 0xafc]
push eax
call fcn.00409340
mov ecx, eax
call fcn.00409380
mov dword [ebp - 0xb5c], eax
mov ecx, dword [ebp - 0xb5c]
mov dword [ebp - 0xb60], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0xb60]
push edx
push 0x538c0c
lea eax, [ebp - 0x44c]
push eax
mov ecx, dword [ebp - 0xb4c]
push ecx
mov edx, dword [ebp - 0xb50]
push edx
mov eax, dword [ebp - 0xb54]
push eax
mov ecx, dword [ebp - 0xb58]
push ecx
lea ecx, [ebp - 0xb04]
call fcn.00401020
mov dword [ebp - 0xb64], eax
mov edx, dword [ebp - 0xb64]
mov dword [ebp - 0xb68], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xb68]
push eax
push 0x538c24
lea ecx, [ebp - 0x454]
push ecx
lea edx, [ebp - 0xb08]
push edx
call fcn.00407880
add esp, 0xc
mov dword [ebp - 0xb6c], eax
mov eax, dword [ebp - 0xb6c]
mov dword [ebp - 0xb70], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0xb70]
push ecx
lea edx, [ebp - 0xb0c]
push edx
call fcn.0040a790
add esp, 0xc
mov dword [ebp - 0xb74], eax
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0xb78], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0xb78]
push ecx
lea edx, [ebp - 0xb10]
push edx
call fcn.00407880
add esp, 0xc
mov dword [ebp - 0xb7c], eax
mov eax, dword [ebp - 0xb7c]
mov dword [ebp - 0xb80], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0xb80]
push ecx
lea edx, [ebp - 0xb14]
push edx
call fcn.00407880
add esp, 0xc
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xb84]
mov dword [ebp - 0xb88], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0xb88]
push ecx
lea edx, [ebp - 0xb18]
push edx
call fcn.00407880
add esp, 0xc
mov dword [ebp - 0xb8c], eax
mov eax, dword [ebp - 0xb8c]
mov dword [ebp - 0xb90], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0xb90]
push ecx
lea edx, [ebp - 0xb1c]
push edx
call fcn.00407880
add esp, 0xc
mov dword [ebp - 0xb94], eax
mov eax, dword [ebp - 0xb94]
mov dword [ebp - 0xb98], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0xb98]
push ecx
lea edx, [ebp - 0xb20]
push edx
call fcn.00407880
add esp, 0xc
mov dword [ebp - 0xb9c], eax
mov eax, dword [ebp - 0xb9c]
mov dword [ebp - 0xba0], eax
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0xba0]
push ecx
lea edx, [ebp - 0xb24]
push edx
call fcn.0040a790
add esp, 0xc
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0xba4]
mov dword [ebp - 0xba8], eax
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0xba8]
push ecx
lea edx, [ebp - 0xb28]
push edx
call fcn.00407880
add esp, 0xc
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xbb0], eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0xbb0]
push ecx
lea edx, [ebp - 0xb2c]
push edx
call fcn.00407880
add esp, 0xc
mov dword [ebp - 0xbb4], eax
mov eax, dword [ebp - 0xbb4]
mov dword [ebp - 0xbb8], eax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0xbb8]
push ecx
lea edx, [ebp - 0x860]
push edx
call fcn.00407880
add esp, 0xc
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xb2c]
call fcn.004019f0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xb28]
call fcn.004019f0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xb24]
call fcn.004019f0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xb20]
call fcn.004019f0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xb1c]
call fcn.004019f0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xb18]
call fcn.004019f0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0xb14]
call fcn.004019f0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xb10]
call fcn.004019f0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xb0c]
call fcn.004019f0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xb08]
call fcn.004019f0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xb04]
call fcn.004019f0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xb00]
call fcn.004019f0
push 0x538c28
push str._Y__m__d
lea eax, [ebp - 0xb38]
push eax
lea ecx, [ebp - 0xb34]
push ecx
call fcn.00409340
mov ecx, eax
call fcn.00409380
mov dword [ebp - 0xbbc], eax
mov edx, dword [ebp - 0xbbc]
mov dword [ebp - 0xbc0], edx
mov byte [ebp - 4], 0x1a
mov eax, dword [ebp - 0xbc0]
push eax
push str.Z:TEST_
lea ecx, [ebp - 0xb3c]
push ecx
call fcn.00407950
add esp, 0xc
mov dword [ebp - 0xbc4], eax
mov edx, dword [ebp - 0xbc4]
mov dword [ebp - 0xbc8], edx
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0xbc8]
push eax
lea ecx, [ebp - 0x40]
push ecx
call fcn.00407880
add esp, 0xc
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xb3c]
call fcn.004019f0
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xb38]
call fcn.004019f0
push 0
lea ecx, [ebp - 0x40]
call fcn.00401750
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea edx, [ebp - 0x860]
push edx
lea ecx, [ebp - 0x40]
call fcn.0040a190
push 0
lea ecx, [ebp - 0x40]
call fcn.00401750
push eax
push 0x582f50
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004081c0
mov dword [ebp - 0xb40], 0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x40]
call fcn.004019f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x860]
call fcn.004019f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x454]
call fcn.004019f0
mov eax, dword [ebp - 0xb40]
jmp 0x40a086
push 1
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 1
push 0
push 1
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], 0xc
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
push str.GlobalTC_SETUP
lea ecx, [ebp - 0xb44]
call fcn.00401020
mov dword [ebp - 0xbcc], eax
mov ecx, dword [ebp - 0xbcc]
call fcn.00401750
push eax
push 0
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0xb44]
call fcn.004019f0
mov dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x409e84
mov dword [ebp - 0x28], 1
cmp dword [ebp - 0x24], 0
je 0x409e94
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp - 0x28], 0
je 0x409ea1
xor eax, eax
jmp 0x40a086
call fcn.00407d50
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.00407ee0
add esp, 4
mov dword [0x583198], eax
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x10], 0xff
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, dword [ebp - 0xb48]
call fcn.00418fca
push 0
call fcn.0041cf37
add esp, 4
push 0x538c54
mov ecx, dword [ebp - 0xb48]
call fcn.0041c459
cmp dword [0x5882e0], 2
jne 0x409f5d
mov ecx, dword [ebp - 0xb48]
mov edx, dword [ecx + 0x48]
movsx eax, byte [edx + 1]
cmp eax, 0x63
jne 0x409f5d
push 0
lea ecx, [ebp - 0x9c4]
call fcn.0040ae50
mov dword [ebp - 4], 0x1f
mov ecx, dword [ebp - 0xb48]
lea edx, [ebp - 0x9c4]
mov dword [ecx + 0x20], edx
lea ecx, [ebp - 0x9c4]
call fcn.0040fb63
mov dword [ebp - 0x864], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c4]
call fcn.0040a0a0
jmp 0x40a084
mov dword [ebp - 0x9c8], 0
push 0x538c88
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x9c8], eax
cmp dword [ebp - 0x9c8], 0
jne 0x409f96
push 0x538c9c
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x9c8], eax
cmp dword [ebp - 0x9c8], 0
je 0x40a027
push 1
push 1
push 0x13d4
mov eax, dword [ebp - 0x9c8]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov dword [ebp - 0x9cc], 0
jmp 0x409fd4
mov ecx, dword [ebp - 0x9cc]
add ecx, 1
mov dword [ebp - 0x9cc], ecx
cmp dword [ebp - 0x9cc], 0x258
jge 0x40a027
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x538cb0
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x9c8], eax
cmp dword [ebp - 0x9c8], 0
jne 0x40a01a
push 0x538cc4
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x9c8], eax
cmp dword [ebp - 0x9c8], 0
jne 0x40a025
jmp 0x40a027
jmp 0x409fc5
call fcn.00409480
movzx edx, byte [0x58319c]
test edx, edx
je 0x40a03e
call fcn.004085e0
jmp 0x40a084
push 0
lea ecx, [ebp - 0xaf4]
call fcn.004073a0
mov dword [ebp - 4], 0x20
mov eax, dword [ebp - 0xb48]
lea ecx, [ebp - 0xaf4]
mov dword [eax + 0x20], ecx
lea ecx, [ebp - 0xaf4]
call fcn.0040fb63
mov dword [ebp - 0x9d0], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaf4]
call fcn.004075b0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x48]
xor ecx, ebp
call fcn.0050c6c0
mov esp, ebp
pop ebp
ret