Function at 0x408420
Capabilities:
Check mutex on windows
Create thread
Query or enumerate registry value

Disassembly:
sub esp, 0x98
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x24], 0x104
call fcn.004086d0
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str.ZVMONEXEC
push 0
push 0
call esi
push str.ZVOnline
push 1
push 0
mov dword [0x43fbd0], eax
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40848c
call ebp
cmp eax, 0xb7
jne 0x40848c
push str.Already_Running__Mutex_:_ZVObrnline___n
push 0x420138
call fcn.0040a70a
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x98
ret 0x10
call fcn.00408710
cmp eax, 1
jne 0x40849b
call fcn.004088c0
call fcn.00408bd0
test eax, eax
je 0x4084a9
call fcn.00408ce0
call fcn.004090c0
call fcn.00408980
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push str.ZVFILESYS
push 0
push 1
push 0
call edi
mov ebx, eax
call fcn.00408400
call fcn.00408b90
push 0
push 0x4000000
push 1
push 0
test eax, eax
push 0
push 0
jne 0x4084ec
push str..Zvonline.vxd
jmp 0x4084f1
push str..NPonline.vxd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x42178c], eax
jne 0x408525
call ebp
push eax
push str.Cannot_load_VxD__error_08lx_n
push 0x420138
call fcn.0040a70a
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x98
ret 0x10
lea eax, [esp + 0x1c]
push eax
push 0x20019
push 0
push str.SOFTWAREMessage_LabsNet_ProtectorConfig
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408585
lea ecx, [esp + 0x24]
lea edx, [esp + 0x44]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x2c]
push str.Prompt
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x408585
lea ecx, [esp + 0x44]
push str.True
push ecx
call fcn.00411510
add esp, 8
test eax, eax
jne 0x408585
mov dword [0x43fbc8], 1
lea edx, [esp + 0x28]
push 0
push edx
mov edx, dword [0x42178c]
lea eax, [esp + 0x34]
push 4
push eax
lea ecx, [esp + 0x30]
push 4
push ecx
push 0x220007
push edx
mov dword [esp + 0x40], 0x408050
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x4085c2
push str.Failed_to_register_APC_n
jmp 0x408470
xor eax, eax
push str.MtxNPAV
mov dword [esp + 0x14], eax
mov dword [esp + 0x14], 0xc
mov dword [esp + 0x18], eax
push eax
mov dword [esp + 0x20], eax
push eax
mov dword [esp + 0x24], eax
call esi
test eax, eax
mov dword [0x4218cc], eax
jne 0x408600
push eax
push 0x43fc1c
push str.CreateMutex_Failed
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x30]
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
lea edx, [esp + 0x38]
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.SCANIN
push 0
lea ecx, [esp + 0x18]
lea eax, [esp + 0x38]
push 1
push ecx
mov dword [esp + 0x24], eax
call edi
push str.Spwaning_thread
mov dword [0x4218c8], eax
call fcn.00409700
push 0
push 0
push 0x409280
call fcn.0040bb85
push str.thread_Created
call fcn.00409700
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [sym.imp.KERNEL32.dll_SleepEx]
add esp, 0x14
push 0
push ebx
call esi
test eax, eax
je 0x40847d
push 1
push 0xffffffffffffffff
call edi
jmp 0x40866c