Function at 0x45bc50
Capabilities:
Check mutex on windows
Create process on windows
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x5cbb9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x47c
mov edx, dword [0x5e5c9c]
mov eax, dword [esp + 0x8b4]
push ebx
push esi
push edi
xor ebx, ebx
push edx
lea ecx, [esp + 0x49c]
push 1
push ebx
mov dword [0x6268ec], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0x428
mov dword [esp + 0x30], ecx
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
push esi
jne 0x45bd4f
call dword [sym.imp.kernel32.dll_CloseHandle]
mov edx, dword [0x5e5ca0]
lea eax, [esp + 0x30]
lea ecx, [esp + 0x10]
push eax
push ecx
push ebx
push 0xf003f
push 1
push ebx
push ebx
push edx
push 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyExW]
lea eax, [esp + 0x18]
lea ecx, [esp + 0xc]
push eax
mov eax, dword [0x5e5ca4]
lea edx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push ebx
push eax
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], 4
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [0x6268ec]
mov ecx, dword [esp + 0xc]
push ebx
push eax
push 0x7e9
push ecx
call dword [sym.imp.user32.dll_PostMessageW]
mov eax, dword [0x6268ec]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x1c]
push edx
push eax
push 0x4a
push ecx
call dword [sym.imp.user32.dll_SendMessageW]
jmp 0x45be4d
call dword [sym.imp.kernel32.dll_ReleaseMutex]
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x48]
mov dword [esp + 0x44], 0x44
rep stosd dword es:[edi], eax
call fcn.004d0b70
push 0x627b18
lea ecx, [esp + 0x10]
call sub.mfc42u.dll_CString::CString_1
push 0x61c28c
lea ecx, [esp + 0x10]
mov dword [esp + 0x494], ebx
call fcn.005c0e5a
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x88]
push edx
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
add esp, 8
lea ecx, [esp + 0x34]
lea edx, [esp + 0x44]
lea eax, [esp + 0x88]
push ecx
push edx
push ebx
push ebx
push 0x4000000
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
jne 0x45bdef
lea ecx, [esp + 0xc]
mov dword [esp + 0x490], 0xffffffff
call sub.mfc42u.dll_CString::CString
jmp 0x45beb6
mov edi, dword [sym.imp.user32.dll_EnumThreadWindows]
push ebp
mov ebp, dword [sym.imp.kernel32.dll_Sleep]
xor esi, esi
mov edx, dword [esp + 0x44]
lea ecx, [esp + 0x14]
push ecx
push 0x45bbf0
push edx
mov dword [esp + 0x20], ebx
call edi
cmp dword [esp + 0x14], 1
jg 0x45be27
push 0x1f4
call ebp
inc esi
cmp esi, 0x1e
jl 0x45bdfe
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x20]
push eax
push 0x45bc20
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x494], 0xffffffff
call sub.mfc42u.dll_CString::CString
pop ebp
mov ecx, dword [0x5e5ca0]
lea edx, [esp + 0x2c]
lea eax, [esp + 0x14]
push edx
push eax
push ebx
push 0xf003f
push 1
push ebx
push ebx
push ecx
push 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyExW]
test eax, eax
jne 0x45beab
lea edx, [esp + 0x288]
push 0xff
push edx
push ebx
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov edx, dword [esp + 0x14]
lea eax, [eax + eax + 2]
lea ecx, [esp + 0x288]
push eax
push ecx
push 1
push ebx
push 0x61c27c
push edx
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, dword [esp + 0x488]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x488
ret