Function at 0x401000
Capabilities:
Check mutex on windows
Create directory
Get common file path

Disassembly:
push esi
xor esi, esi
push str.DE622D185C1BC760E40CCDB249B95612
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
jne 0x40102d
je 0x40102d
jg 0x401096
jg 0x401098
jg 0x40109a
jg 0x40109c
jg 0x40109e
jg 0x4010a0
jg 0x4010a2
jg 0x4010a4
jg 0x4010a6
jg 0x4010a8
jg 0x4010aa
jg 0x4010ac
test eax, eax
je 0x401043
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov eax, 1
je 0x401045
mov eax, esi
pop esi
ret
push 0x1a
push eax
push 0
call esi
add bh, bh
salc
cmp eax, 1
clc
add dword [ebp + eax*2 + 0xf], esi
mov ecx, dword [edx]
add byte [eax], al
add byte [edi], cl
mov al, byte [eax + eax]
je 0x4010e7
jnp 0x4010b2
or al, byte [eax]
add byte [eax], al
jp 0x4010b2
add al, 0
add byte [eax], al
jns 0x401129
jns 0x40112b
push 1
lea ecx, [ebp - 0x104]
push 0x23
push ecx
push 0
call esi
cmp eax, 1
je 0x4010e7
lea edx, [ebp - 0x104]
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x104]
push edx
push 0x104
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [ebp - 0x104]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40120a
push ebx
jnp 0x401114
jp 0x401114
jns 0x401185
jns 0x401187
jns 0x401189
jns 0x40118b
jns 0x40118d
mov edi, 0x406064
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x104]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
test dword [ebx - 0x7c057427], 0xaef2ffc9
invalid
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push eax
and ecx, 3
lea eax, [ebp - 0x104]
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, str.QQAccelex.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x104]
repne scasb al, byte es:[edi]
scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jnp 0x40119b
add byte [edi], cl
jp 0x40119b
mov cl, byte [edi]
add byte [eax], al
add byte [ecx + 0x79], bh
jns 0x401207
jns 0x401208
jns 0x401209
jns 0x40120a
jns 0x40120b
jns 0x40120c
jns 0x40120d
jns 0x40120e
jns 0x40120f
jns 0x401210
jns 0x401211
jns 0x401212
jns 0x401213
jns 0x401214
jns 0x401129
lea eax, [ebp - 0x104]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jnp 0x4011d3
test esp, edi
invalid
jp 0x4011d3
jns 0x401241
jns 0x401243
jns 0x401245
jns 0x401247
jns 0x401249
jns 0x40124b
jns 0x401161
lea edx, [ebp - 0x208]
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x208]
push 0x104
push edx
rep stosd dword es:[edi], eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x104]
lea ecx, [ebp - 0x208]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
xchg ebp, eax
clc
std
invalid
inc eax
add byte [ebx + 0x5f], bl
pop ebx
pop edi
pop esi
mov esp, ebp
in eax, 0x5d
pop ebp
ret
mov eax, dword [sym.imp.MFC42.DLL_AFX_MSGMAPconstCWinApp::messageMap]
ret
adc byte [edx + 0x40], al
inc edx
inc eax
add bl, al
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 0x404318
ret
invalid
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push esi
mov esi, ecx
call fcn.00401270
test byte [esp + 8], 1
je 0x401268
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, esi
pop esi
ret 4