Function at 0x402ef1
Capabilities:
Check mutex on windows
Create process on windows
Delete directory
Delete file
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x76c
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x267]
mov byte [ebp - 0x268], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x163]
mov byte [ebp - 0x164], bl
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push str.MCC_Install.exe
push dword [ebp + 8]
mov dword [ebp - 8], 1
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x268]
push str._s_s
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x164]
push 0x104
push eax
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push str.My_Comet_Cursor
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
cmp edi, ebx
je 0x403043
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x403043
push 1
pop eax
push str.Comet_MCC_EXE
push eax
push 0x1f0001
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x403120
push ebx
push 1
push 0x16
push edi
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x3a98
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x403027
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x76b]
mov byte [ebp - 0x76c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x76c]
push 0x3ff
push eax
push 0xa
push dword [0x408c64]
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x40035
lea eax, [ebp - 0x76c]
push 0x406a1c
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
je 0x4030cd
jmp 0x403035
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
jne 0x402fbd
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x5c]
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x1c], ebx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x18]
push 0x40
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x36b]
mov byte [ebp - 0x36c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x36c]
push str._s_genesis
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x60], 0x44
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
lea eax, [ebp - 0x36c]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [ebp - 0x1c]
push 0x7530
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4030db
mov dword [ebp - 8], 3
jmp 0x403110
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
pop eax
jmp 0x403123
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0x1f4
push edi
call esi
lea eax, [ebp - 0x164]
mov dword [ebp - 8], ebx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x408328
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push edi
call esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret