Function at 0x405920
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55617a
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x5b6e64]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.0041d0a5
push dword [edi + 0xb0]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0x80
push dword [edi + 0x20]
call esi
push dword [edi + 0xb0]
push 0
push 0x80
push dword [edi + 0x20]
call esi
push 0
push 0x80
push 0x40000
mov ecx, edi
call fcn.00416f84
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
mov ecx, edi
call fcn.004170ac
push 0
mov ecx, edi
call fcn.00417328
mov edx, dword [0x5c1b60]
test edx, edx
jne 0x4059ba
xor ecx, ecx
jmp 0x4059d2
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x414], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4059c5
sub ecx, dword [ebp - 0x414]
push ecx
push edx
lea ecx, [edi + 0xc0]
call fcn.00402e70
push str.SkywidgetTu2
mov ecx, edi
call fcn.004172e4
push str.SkywidgetTu2
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x405a1d
push 0
push 2
push 0x111
push dword [edi + 0x20]
call esi
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00407350
push str.Runcmd
push dword [edi + 0xc0]
call fcn.0053d922
add esp, 8
test eax, eax
setne al
test al, al
je 0x405a5a
push str.Updatecmd
push dword [edi + 0xc0]
call fcn.0053d922
add esp, 8
test eax, eax
setne al
test al, al
jne 0x405a07
cmp dword [0x5b7704], 8
jne 0x405ab0
lea eax, [ebp - 0x414]
push eax
call fcn.00401043
test eax, eax
js 0x405a8a
cmp dword [ebp - 0x414], 0
je 0x405a8a
push 0x5b7700
call fcn.00401000
test eax, eax
je 0x405a94
mov dword [0x5b7700], 0x80000001
lea esi, [edi + 0xfc]
push esi
lea ebx, [edi + 0x100]
lea eax, [edi + 0x104]
push ebx
push eax
call fcn.00407190
jmp 0x405afb
lea esi, [edi + 0xfc]
push esi
lea ebx, [edi + 0x100]
lea eax, [edi + 0x104]
push ebx
push eax
call fcn.00407190
lea eax, [ebp - 0x414]
push eax
call fcn.00401043
test eax, eax
js 0x405af1
cmp dword [ebp - 0x414], 0
je 0x405af1
push 0x5b7700
call fcn.00401000
test eax, eax
je 0x405afb
mov dword [0x5b7700], 0x80000001
push str.Runcmd
push dword [edi + 0xc0]
call fcn.0053d922
add esp, 8
test eax, eax
sete al
test al, al
je 0x405b4a
push ecx
mov ecx, esp
mov dword [ebp - 0x420], esp
push str.update_tu2_skywidgets.php
call fcn.00404ae0
push ecx
mov ecx, esp
mov dword [ebp - 4], 0
push str.down.skywidget.co.kr
call fcn.00404ae0
mov dword [ebp - 4], 0xffffffff
call fcn.004074b0
call fcn.00407350
push esi
push ebx
lea eax, [edi + 0x104]
push eax
call fcn.00407190
push ecx
mov ecx, esp
mov dword [ebp - 0x420], esp
push str.update_tu2_instcheck.php
call fcn.00404ae0
push ecx
mov ecx, esp
mov dword [ebp - 4], 1
push str.down.skywidget.co.kr
call fcn.00404ae0
lea eax, [ebp - 0x42c]
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.00407f20
push ecx
mov ecx, esp
mov dword [ebp - 4], 2
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x420], ecx
push eax
call fcn.00403070
lea eax, [ebp - 0x414]
push eax
call fcn.00408240
push eax
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 3
call fcn.00402ba0
mov byte [ebp - 4], 2
or esi, 0xffffffff
mov edx, dword [ebp - 0x414]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x405bf3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.004083b0
mov dword [ebp - 0x414], eax
test eax, eax
je 0x405c53
push ecx
mov ecx, esp
mov dword [ebp - 0x420], esp
push str.cnt_index.php_pidskywidget_toast2type4
call fcn.00404ae0
push ecx
mov ecx, esp
mov byte [ebp - 4], 4
push str.part.skywidget.co.kr
call fcn.00404ae0
lea eax, [ebp - 0x418]
mov byte [ebp - 4], 2
push eax
call fcn.00407f20
mov edx, dword [ebp - 0x418]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x405c53
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov ecx, esp
lea eax, [ebp - 0x42c]
push eax
mov dword [ebp - 0x420], ecx
call fcn.00403070
mov ecx, edi
call fcn.00408690
test eax, eax
je 0x405edc
cmp dword [edi + 0xd0], 0
je 0x405edc
push 0x2d0
call fcn.0040de30
add esp, 4
mov dword [ebp - 0x420], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x405ca9
push ecx
mov ecx, eax
call fcn.0040c6a0
jmp 0x405cab
xor eax, eax
mov byte [ebp - 4], 2
push 0x400
mov dword [edi + 0xac], eax
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.0053aab0
add esp, 0xc
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + 0x5944a8]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x411], al
test al, al
jne 0x405cd0
push 0x104
lea eax, [ebp - 0x410]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x41c]
call fcn.00404ae0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x41c]
push 0x5c
push eax
mov ebx, dword [eax - 0xc]
call fcn.00541abe
add esp, 8
test eax, eax
jne 0x405d2b
or eax, 0xffffffff
jmp 0x405d31
sub eax, dword [ebp - 0x41c]
push ebx
inc eax
lea ecx, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.00404350
push eax
lea ecx, [ebp - 0x41c]
mov byte [ebp - 4], 7
call fcn.00402ba0
mov byte [ebp - 4], 6
mov eax, esi
mov edx, dword [ebp - 0x418]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x405d77
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00409940
push 0
push 0
push 0x2001f
push 0
push 0
imul eax, eax, 0x3e8
lea ecx, [ebp - 0x428]
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
push dword [0x5b7700]
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x420], 0
call fcn.0040c310
mov ebx, dword [ebp - 0x428]
test eax, eax
jne 0x405df9
mov eax, dword [ebp - 0x418]
push 4
mov dword [ebp - 0x43c], eax
lea eax, [ebp - 0x43c]
push eax
push 4
push 0
push dword [ebp - 0x41c]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test ebx, ebx
je 0x405e06
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
push 0
call fcn.00540ad7
mov ecx, eax
add esp, 4
mov eax, dword [edi + 0xc4]
xorps xmm0, xmm0
mov dword [ebp - 0x420], ecx
movlpd qword [ebp - 0x438], xmm0
test eax, eax
je 0x405e5a
mov edx, 0x3c
imul edx
push 0
add eax, ecx
mov ecx, eax
mov dword [ebp - 0x434], eax
sub ecx, dword [ebp - 0x420]
imul eax, ecx, 0x3e8
push eax
push 0x14
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x405e66
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x434], eax
mov eax, dword [edi + 0xc8]
test eax, eax
je 0x405eb0
mov ecx, 0x3c
imul ecx
push 0
mov esi, eax
mov ecx, edx
shld ecx, esi, 4
shl esi, 4
sub esi, eax
sbb ecx, edx
shld ecx, esi, 2
shl esi, 2
add esi, dword [ebp - 0x434]
sub esi, dword [ebp - 0x434]
imul eax, esi, 0x3e8
push eax
push 0x15
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
or esi, 0xffffffff
test ebx, ebx
je 0x405ebb
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 2
mov eax, esi
mov edx, dword [ebp - 0x41c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x405edc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 5
push 0xea60
call ebx
sub esi, 1
jne 0x405ee7
mov ecx, edi
call fcn.0040ace0
test eax, eax
jne 0x405f1f
nop
push 0xea60
call ebx
inc esi
cmp esi, 0xf0
je 0x405f92
mov ecx, edi
call fcn.0040ace0
test eax, eax
je 0x405f00
mov esi, 1
push 0
push 0x5944a8
lea ecx, [edi + 0xf0]
mov dword [edi + 0xec], 0
call fcn.00402e70
test esi, esi
je 0x405fdd
cmp dword [edi + 0xec], 0
je 0x405f96
push 0x5944a8
push dword [edi + 0xf0]
call fcn.0053d922
add esp, 8
test eax, eax
setne al
test al, al
je 0x405f96
cmp dword [ebp - 0x414], 0
je 0x405f81
push dword [edi + 0xec]
call fcn.0040aa30
mov ecx, edi
call fcn.00409b50
push ecx
mov ecx, edi
call fcn.0040a270
jmp 0x405fdd
xor esi, esi
jmp 0x405f24
cmp dword [edi + 0xf4], 0
je 0x405fdd
push 0x5944a8
push dword [edi + 0xf8]
call fcn.0053d922
add esp, 8
test eax, eax
setne al
test al, al
je 0x405fdd
cmp dword [ebp - 0x414], 0
je 0x405fcf
push dword [edi + 0xf4]
call fcn.0040aa30
mov ecx, edi
call fcn.0040ab60
mov ecx, edi
call fcn.00409b50
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x42c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x406002
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00537a6f
mov esp, ebp
pop ebp
ret