Function at 0x4023f6
Capabilities:
Check mutex on windows
Create process on windows
Create thread
Delete file
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x408260
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push str.FjPasteMtxObj
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40243d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40246b
push 0x4076a4
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
je 0x402466
mov eax, dword [ebp - 0x158]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x4028d2
xor ecx, ecx
mov cl, byte [str.E1019635.exe]
test ecx, ecx
je 0x4024ab
xor edx, edx
mov dl, byte [str.X10196]
test edx, edx
je 0x4024ab
cmp dword [0x40714b], 0
je 0x4024ab
cmp dword [0x40714f], 2
jb 0x4024ab
cmp dword [0x40714f], 0x63
ja 0x4024ab
mov eax, dword [0x407147]
cmp eax, dword [0x40714b]
ja 0x4024e9
push 0x105
lea ecx, [ebp - 0x138]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x138]
push eax
call fcn.00401516
add esp, 4
push eax
push 0x4076b4
push 0x408280
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x4028d2
mov byte [0x408280], 0
mov ecx, dword [ebp + 8]
mov dword [0x408a80], ecx
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x40779c], eax
cmp dword [0x40779c], 0
jne 0x40251a
jmp 0x40284b
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x2c], 0x401ff9
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x1e
mov edx, dword [0x408a80]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], 0
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x4076d8
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0
push 0x401ff9
push 0
push str.DLGPROGRESS
mov ecx, dword [0x408a80]
push ecx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x407798], eax
cmp dword [0x407798], 0
jne 0x4025a3
jmp 0x4028d2
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x4077c0], eax
push str.E1019635.exe
push 0x4078cd
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x105
lea edx, [ebp - 0x138]
push edx
call fcn.004029e0
add esp, 8
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x105
push 0x4079d2
mov ecx, dword [0x408a80]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x4079d2
call fcn.00401516
add esp, 4
mov byte [eax], 0
mov dl, byte [0x4079d2]
mov byte [ebp - 0x138], dl
mov al, byte [0x4079d3]
mov byte [ebp - 0x137], al
mov cl, byte [0x4079d4]
mov byte [ebp - 0x136], cl
mov byte [ebp - 0x135], 0
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x402654
push 0x4079d2
push 0x407ad7
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40267f
push 0
push 0
push 0x407ad7
mov eax, dword [0x407798]
push eax
call fcn.004011a7
add esp, 0x10
test eax, eax
jne 0x40267f
push 0x407ad7
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x105
push 0x4078cd
push 0x105
push 0x407ad7
mov ecx, dword [0x407798]
push ecx
call fcn.004017a0
add esp, 0x14
test eax, eax
je 0x4026c1
push 0x4078cd
call fcn.00401516
add esp, 4
push eax
push str.E1019635.exe
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4026c6
jmp 0x4028d2
push str.E1019635.exe
push 0x407ad7
push str._s_s
push 0x4078cd
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x1e
push str.E1019635.exe
call section..text
add esp, 8
push eax
push 0x3f5
mov edx, dword [0x407798]
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0x1e
push 0x407ad7
call section..text
add esp, 8
push eax
push 0x3f2
mov eax, dword [0x407798]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0
push 0x8000000
push 1
push 0x407be0
push 0
push 0x40000000
push 0x4078cd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x4077a4], eax
cmp dword [0x4077a4], 0xffffffff
jne 0x40281c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x4027f2
push 0x4078cd
push 0x4076f8
lea ecx, [ebp - 0x138]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x24
push 0x407728
lea edx, [ebp - 0x138]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
je 0x4027a1
jmp 0x40267f
push 0
push 0x8000000
push 3
push 0x407be0
push 0
push 0x40000000
push 0x4078cd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x4077a4], eax
cmp dword [0x4077a4], 0xffffffff
jne 0x4027d1
jmp 0x4027f2
push 0
push 0
push 0
mov eax, dword [0x4077a4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [0x4077a4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x40281c
push 0x4078cd
push 0x407738
push 0x408280
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x408280
call fcn.00401269
add esp, 4
jmp 0x4028d2
push 0x4077bc
push 0
push 0x407798
push 0x401ae0
push 0x2800
push 0x407be0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4077b8], eax
cmp dword [0x4077b8], 0
jne 0x40286a
push 0x407760
push 0x408280
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x408280
call fcn.00401269
add esp, 4
jmp 0x4028d2
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [0x407798]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x407798]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
push 0
lea edx, [ebp - 0x154]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4028d2
lea eax, [ebp - 0x154]
push eax
mov ecx, dword [0x407798]
push ecx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x4028d0
lea edx, [ebp - 0x154]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x402887
cmp dword [0x4077b8], 0
je 0x4028f2
mov ecx, dword [0x4077b8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4077b8], 0
cmp dword [0x4077a4], 0xffffffff
je 0x402912
mov edx, dword [0x4077a4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4077a4], 0xffffffff
cmp dword [0x4077a0], 0xffffffff
je 0x402931
mov eax, dword [0x4077a0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4077a4], 0xffffffff
cmp dword [0x40779c], 0
je 0x402951
mov ecx, dword [0x40779c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x40779c], 0
cmp dword [ebp - 8], 0
je 0x402961
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov al, byte [0x408280]
test eax, eax
je 0x402982
push 0x30
push 0x407780
push 0x408280
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x402989
mov dword [ebp - 4], 1
push 0x105
lea ecx, [ebp - 0x138]
push ecx
call fcn.004029e0
add esp, 8
lea edx, [ebp - 0x138]
push edx
call fcn.0040142b
add esp, 4
test eax, eax
je 0x4029ca
push 5
push 0x407790
push 0
lea eax, [ebp - 0x138]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x408260
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x10