Function at 0x4141f0
Capabilities:
Acquire debug privileges
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Get installed programs
Query or enumerate registry value
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x437d66
mov eax, dword fs:[0]
push eax
sub esp, 0x2c8
mov eax, dword [0x401800]
xor eax, esp
mov dword [esp + 0x2c0], eax
push ebx
push esi
push edi
mov eax, dword [0x401800]
xor eax, esp
push eax
lea eax, [esp + 0x2d8]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov ecx, 0x409f84
call fcn.0040c4f0
xor ecx, ecx
call fcn.0040c4f0
mov esi, eax
test esi, esi
je 0x4142b4
cmp dword [esi], 1
ja 0x4142b4
lea eax, [esp + 0x1c]
push eax
call fcn.0041d99f
add esp, 4
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.0041d55d
lea eax, [esp + 0x38]
push eax
push 0x40954c
lea eax, [esp + 0xb8]
push 0x14
push eax
call fcn.0041d982
movzx eax, word [esp + 0x3c]
add esp, 0x18
push 0x409f90
push eax
lea eax, [esp + 0xb0]
push eax
push 0x40953c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x409f98
push esi
call fcn.0040c600
add esp, 0x1c
push 0
push 0x40949a
lea ecx, [esp + 0x5c]
mov dword [esp + 0x70], 0xf
mov dword [esp + 0x6c], 0
mov byte [esp + 0x5c], 0
call fcn.0040c070
mov edi, dword [ebp + 8]
mov dword [esp + 0x2e0], 0
cmp edi, 1
jle 0x41435f
mov esi, 1
lea eax, [edi - 1]
mov edx, dword [ebx + esi*4]
cmp esi, eax
jge 0x414332
cmp byte [edx], 0
jne 0x414304
xor ecx, ecx
jmp 0x41431c
mov ecx, edx
lea edi, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x414310
sub ecx, edi
mov edi, dword [ebp + 8]
push ecx
push edx
lea ecx, [esp + 0x5c]
call fcn.0040f8c0
push 1
push 0x40982c
mov ecx, eax
jmp 0x414352
cmp byte [edx], 0
jne 0x41433b
xor ecx, ecx
jmp 0x41434c
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x414340
sub ecx, edi
mov edi, dword [ebp + 8]
push ecx
push edx
lea ecx, [esp + 0x5c]
call fcn.0040f8c0
inc esi
lea eax, [edi - 1]
cmp esi, edi
jl 0x4142f4
xor ecx, ecx
call fcn.0040c4f0
mov esi, eax
test esi, esi
je 0x4143e9
cmp dword [esi], 1
ja 0x4143e9
lea eax, [esp + 0x1c]
push eax
call fcn.0041d99f
add esp, 4
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.0041d55d
lea eax, [esp + 0x38]
push eax
push 0x40954c
lea eax, [esp + 0xb8]
push 0x14
push eax
call fcn.0041d982
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea eax, [esp + 0x6c]
add esp, 0x18
cmp dword [esp + 0x68], 0x10
cmovae eax, dword [esp + 0x54]
push eax
movzx eax, word [esp + 0x28]
push 0x409f90
push eax
lea eax, [esp + 0xb4]
push eax
push 0x40953c
call ebx
push eax
push 0x409fc0
push esi
call fcn.0040c600
add esp, 0x20
jmp 0x4143ef
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x409fe0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp dword [esp + 0x64], 0
mov esi, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
ja 0x414426
test esi, esi
je 0x414426
call edi
cmp eax, 0xb7
jne 0x414426
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x414ef3
call fcn.00413f80
xor ecx, ecx
test eax, eax
jne 0x4148e1
call fcn.0040c4f0
mov esi, eax
test esi, esi
je 0x4144a6
cmp dword [esi], 1
ja 0x4144a6
lea eax, [esp + 0x1c]
push eax
call fcn.0041d99f
add esp, 4
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.0041d55d
lea eax, [esp + 0x38]
push eax
push 0x40954c
lea eax, [esp + 0xb8]
push 0x14
push eax
call fcn.0041d982
movzx eax, word [esp + 0x3c]
add esp, 0x18
push 0x409f90
push eax
lea eax, [esp + 0xb0]
push eax
push 0x40953c
call ebx
push eax
push 0x409fec
push esi
call fcn.0040c600
add esp, 0x1c
cmp dword [esp + 0x68], 0x10
lea eax, [esp + 0x54]
push 0x40a01c
cmovae eax, dword [esp + 0x58]
push eax
call fcn.0041e7e0
add esp, 8
xor ecx, ecx
test eax, eax
jne 0x41486f
call fcn.0040c4f0
mov esi, eax
test esi, esi
je 0x41453d
cmp dword [esi], 1
ja 0x41453d
lea eax, [esp + 0x1c]
push eax
call fcn.0041d99f
add esp, 4
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.0041d55d
lea eax, [esp + 0x38]
push eax
push 0x40954c
lea eax, [esp + 0xb8]
push 0x14
push eax
call fcn.0041d982
movzx eax, word [esp + 0x3c]
add esp, 0x18
push 0x409f90
push eax
lea eax, [esp + 0xb0]
push eax
push 0x40953c
call ebx
push eax
push 0x40a028
push esi
call fcn.0040c600
add esp, 0x1c
push 0x104
lea eax, [esp + 0x1c8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x414952
push 0xb
push 0x40a05c
lea ecx, [esp + 0x5c]
call fcn.0040f8c0
xor ecx, ecx
call fcn.0040c4f0
mov esi, eax
test esi, esi
je 0x4145ec
cmp dword [esi], 1
ja 0x4145ec
lea eax, [esp + 0x1c]
push eax
call fcn.0041d99f
add esp, 4
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.0041d55d
lea eax, [esp + 0x38]
push eax
push 0x40954c
lea eax, [esp + 0xb8]
push 0x14
push eax
call fcn.0041d982
add esp, 0x18
lea eax, [esp + 0x54]
cmp dword [esp + 0x68], 0x10
cmovae eax, dword [esp + 0x54]
push eax
movzx eax, word [esp + 0x28]
push 0x409f90
push eax
lea eax, [esp + 0xb4]
push eax
push 0x40953c
call ebx
push eax
push 0x40a068
push esi
call fcn.0040c600
add esp, 0x20
push 0x38
lea eax, [esp + 0x74]
mov dword [esp + 0x70], 0x3c
push 0
push eax
call fcn.0041fb40
add esp, 0xc
mov dword [esp + 0x78], 0x40a090
cmp dword [esp + 0x68], 0x10
lea eax, [esp + 0x1c4]
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x54]
cmovae eax, dword [esp + 0x54]
mov dword [esp + 0x80], eax
lea eax, [esp + 0x6c]
push eax
mov dword [esp + 0x78], 0
mov dword [esp + 0x8c], 0xa
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x4147e1
call edi
mov esi, eax
cmp esi, 0x4c7
jne 0x4146ee
mov eax, dword [esp + 0xa4]
test eax, eax
je 0x414677
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call fcn.0040c4f0
mov esi, eax
test esi, esi
je 0x414854
cmp dword [esi], 3
ja 0x414854
lea eax, [esp + 0x1c]
push eax
call fcn.0041d99f
add esp, 4
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.0041d55d
lea eax, [esp + 0x38]
push eax
push 0x40954c
lea eax, [esp + 0xb8]
push 0x14
push eax
call fcn.0041d982
movzx eax, word [esp + 0x3c]
add esp, 0x18
push 0x409f90
push eax
lea eax, [esp + 0xb0]
push eax
push 0x409544
call ebx
push eax
push 0x40a098
jmp 0x41484b
xor ecx, ecx
call fcn.0040c4f0
cmp esi, 2
jne 0x41476a
mov esi, eax
test esi, esi
je 0x414854
cmp dword [esi], 3
ja 0x414854
lea eax, [esp + 0x1c]
push eax
call fcn.0041d99f
add esp, 4
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.0041d55d
lea eax, [esp + 0x38]
push eax
push 0x40954c
lea eax, [esp + 0xb8]
push 0x14
push eax
call fcn.0041d982
movzx eax, word [esp + 0x3c]
add esp, 0x18
push 0x409f90
push eax
lea eax, [esp + 0xb0]
push eax
push 0x409544
call ebx
push eax
push 0x40a0c8
jmp 0x41484b
mov edi, eax
test edi, edi
je 0x414854
cmp dword [edi], 3
ja 0x414854
lea eax, [esp + 0x1c]
push eax
call fcn.0041d99f
add esp, 4
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.0041d55d
lea eax, [esp + 0x38]
push eax
push 0x40954c
lea eax, [esp + 0xb8]
push 0x14
push eax
call fcn.0041d982
movzx eax, word [esp + 0x3c]
add esp, 0x18
push esi
push 0x409f90
push eax
lea eax, [esp + 0xb4]
push eax
push 0x409544
call ebx
push eax
push 0x40a108
push edi
call fcn.0040c600
add esp, 0x20
jmp 0x414854
xor ecx, ecx
call fcn.0040c4f0
mov esi, eax
test esi, esi
je 0x414854
cmp dword [esi], 1
ja 0x414854
lea eax, [esp + 0x1c]
push eax
call fcn.0041d99f
add esp, 4
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.0041d55d
lea eax, [esp + 0x38]
push eax
push 0x40954c
lea eax, [esp + 0xb8]
push 0x14
push eax
call fcn.0041d982
movzx eax, word [esp + 0x3c]
add esp, 0x18
push 0x409f90
push eax
lea eax, [esp + 0xb0]
push eax
push 0x40953c
call ebx
push eax
push 0x40a148
push esi
call fcn.0040c600
add esp, 0x1c
mov eax, dword [esp + 0xa4]
test eax, eax
je 0x414ef3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x414ef3
call fcn.0040c4f0
mov esi, eax
test esi, esi
je 0x414952
cmp dword [esi], 1
ja 0x414952
lea eax, [esp + 0x1c]
push eax
call fcn.0041d99f
add esp, 4
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.0041d55d
lea eax, [esp + 0x38]
push eax
push 0x40954c
lea eax, [esp + 0xb8]
push 0x14
push eax
call fcn.0041d982
movzx eax, word [esp + 0x3c]
add esp, 0x18
push 0x409f90
push eax
lea eax, [esp + 0xb0]
push eax
push 0x40953c
call ebx
push eax
push 0x40a180
jmp 0x414949
call fcn.0040c4f0
mov esi, eax
test esi, esi
je 0x414952
cmp dword [esi], 1
ja 0x414952
lea eax, [esp + 0x1c]
push eax
call fcn.0041d99f
add esp, 4
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.0041d55d
lea eax, [esp + 0x38]
push eax
push 0x40954c
lea eax, [esp + 0xb8]
push 0x14
push eax
call fcn.0041d982
movzx eax, word [esp + 0x3c]
add esp, 0x18
push 0x409f90
push eax
lea eax, [esp + 0xb0]
push eax
push 0x40953c
call ebx
push eax
push 0x40a1b0
push esi
call fcn.0040c600
add esp, 0x1c
push 0xb
push 0
push 0x40a1dc
lea ecx, [esp + 0x60]
call fcn.0040faa0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp eax, 0xffffffff
je 0x4149f7
xor ecx, ecx
call fcn.0040c4f0
mov esi, eax
test esi, esi
je 0x4149e6
cmp dword [esi], 1
ja 0x4149e6
lea eax, [esp + 0x1c]
push eax
call fcn.0041d99f
add esp, 4
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.0041d55d
lea eax, [esp + 0x38]
push eax
push 0x40954c
lea eax, [esp + 0xb8]
push 0x14
push eax
call fcn.0041d982
movzx eax, word [esp + 0x3c]
add esp, 0x18
push 0x409f90
push eax
lea eax, [esp + 0xb0]
push eax
push 0x40953c
call ebx
push eax
push 0x40a1e8
push esi
call fcn.0040c600
add esp, 0x1c
mov ecx, 0x40996c
call fcn.0040cb90
push 0x1f4
call edi
push 7
push 0
push 0x40a21c
lea ecx, [esp + 0x60]
call fcn.0040faa0
cmp eax, 0xffffffff
je 0x414a96
xor ecx, ecx
call fcn.0040c4f0
mov esi, eax
test esi, esi
je 0x414a85
cmp dword [esi], 1
ja 0x414a85
lea eax, [esp + 0x1c]
push eax
call fcn.0041d99f
add esp, 4
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.0041d55d
lea eax, [esp + 0x38]
push eax
push 0x40954c
lea eax, [esp + 0xb8]
push 0x14
push eax
call fcn.0041d982
movzx eax, word [esp + 0x3c]
add esp, 0x18
push 0x409f90
push eax
lea eax, [esp + 0xb0]
push eax
push 0x40953c
call ebx
push eax
push 0x40a224
push esi
call fcn.0040c600
add esp, 0x1c
mov ecx, 0x4099b8
call fcn.0040cb90
push 0x1f4
call edi
call fcn.00413c50
lea edx, [esp + 0x18]
mov dword [esp + 0x18], 0x40a254
call fcn.00413ee0
push 0x103
lea eax, [esp + 0xc1]
mov dword [esp + 0x14], 0
push 0
push eax
mov dword [esp + 0x20], 0
mov byte [esp + 0xc8], 0
call fcn.0041fb40
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0xf013f
push 0
push 0x40a268
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test edi, edi
jne 0x414dfc
lea eax, [esp + 0x14]
push eax
push edi
push edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x40a2a8
push dword [esp + 0x24]
call edi
xor ecx, ecx
mov ebx, eax
call fcn.0040c4f0
mov esi, eax
test esi, esi
je 0x414b98
cmp dword [esi], 1
ja 0x414b98
lea eax, [esp + 0x1c]
push eax
call fcn.0041d99f
add esp, 4
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.0041d55d
lea eax, [esp + 0x38]
push eax
push 0x40954c
lea eax, [esp + 0xb8]
push 0x14
push eax
call fcn.0041d982
movzx eax, word [esp + 0x3c]
add esp, 0x18
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x409f90
push eax
lea eax, [esp + 0xb4]
push eax
push 0x40953c
call ebx
push eax
push 0x40a2b4
push esi
call fcn.0040c600
add esp, 0x20
jmp 0x414b9e
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xc0]
push eax
push 0
push 0
push 0x40a2a8
push dword [esp + 0x24]
call edi
mov edi, eax
test edi, edi
jne 0x414d87
lea esi, [esp + 0xbc]
mov ecx, 0x41
lea edi, [esp + 0x1c4]
mov dword [esp + 0x44], 0xf
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x40], eax
mov byte [esp + 0x30], al
cmp byte [esp + 0xbc], al
jne 0x414bf6
xor ecx, ecx
jmp 0x414c09
lea ecx, [esp + 0x1c4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x414c00
sub ecx, edx
push ecx
lea eax, [esp + 0x1c8]
push eax
lea ecx, [esp + 0x38]
call fcn.0040c070
mov byte [esp + 0x2e0], 1
lea ecx, [esp + 0x30]
cmp dword [esp + 0x44], 0x10
mov edx, 4
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x40]
cmovae ecx, ebx
cmp edi, edx
cmovb edx, edi
test edx, edx
je 0x414ca4
mov esi, 0x4098b0
sub edx, 4
jb 0x414c61
nop
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x414c66
add ecx, 4
add esi, 4
sub edx, 4
jae 0x414c50
cmp edx, 0xfffffffc
je 0x414c9a
mov al, byte [ecx]
cmp al, byte [esi]
jne 0x414c93
cmp edx, 0xfffffffd
je 0x414c9a
mov al, byte [ecx + 1]
cmp al, byte [esi + 1]
jne 0x414c93
cmp edx, 0xfffffffe
je 0x414c9a
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x414c93
cmp edx, 0xffffffff
je 0x414c9a
mov al, byte [ecx + 3]
cmp al, byte [esi + 3]
je 0x414c9a
sbb eax, eax
or eax, 1
jmp 0x414c9c
xor eax, eax
test eax, eax
jne 0x414d60
cmp edi, 4
jb 0x414d60
xor eax, eax
cmp edi, 4
setne al
test eax, eax
jne 0x414d60
xor ecx, ecx
call fcn.0040c4f0
mov esi, eax
test esi, esi
je 0x414d4a
cmp dword [esi], 1
ja 0x414d4a
lea eax, [esp + 0x1c]
push eax
call fcn.0041d99f
add esp, 4
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x70]
push eax
call fcn.0041d55d
lea eax, [esp + 0x74]
push eax
push 0x40954c
lea eax, [esp + 0xb8]
push 0x14
push eax
call fcn.0041d982
movzx eax, word [esp + 0x3c]
add esp, 0x18
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x409f90
push eax
lea eax, [esp + 0xb0]
push eax
push 0x40953c
call edi
push eax
push 0x40a2ec
push esi
call fcn.0040c600
mov ebx, dword [esp + 0x4c]
add esp, 0x1c
mov dword [0x43b584], 1
jmp 0x414d66
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, dword [esp + 0x30]
mov dword [0x43b584], 1
jmp 0x414d66
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov byte [esp + 0x2e0], 0
cmp dword [esp + 0x44], 0x10
jb 0x414e76
push ebx
call fcn.0041cba6
add esp, 4
jmp 0x414e76
xor ecx, ecx
call fcn.0040c4f0
mov esi, eax
test esi, esi
je 0x414e70
cmp dword [esi], 1
ja 0x414e70
lea eax, [esp + 0x1c]
push eax
call fcn.0041d99f
add esp, 4
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x70]
push eax
call fcn.0041d55d
lea eax, [esp + 0x74]
push eax
push 0x40954c
lea eax, [esp + 0xb8]
push 0x14
push eax
call fcn.0041d982
movzx eax, word [esp + 0x3c]
add esp, 0x18
push edi
push 0x409f90
push eax
lea eax, [esp + 0xb4]
push eax
push 0x40953c
call ebx
push eax
push 0x40a328
jmp 0x414e67
xor ecx, ecx
call fcn.0040c4f0
mov esi, eax
test esi, esi
je 0x414e70
cmp dword [esi], 1
ja 0x414e70
lea eax, [esp + 0x1c]
push eax
call fcn.0041d99f
add esp, 4
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x70]
push eax
call fcn.0041d55d
lea eax, [esp + 0x74]
push eax
push 0x40954c
lea eax, [esp + 0xb8]
push 0x14
push eax
call fcn.0041d982
movzx eax, word [esp + 0x3c]
add esp, 0x18
push edi
push 0x409f90
push eax
lea eax, [esp + 0xb4]
push eax
push 0x40953c
call ebx
push eax
push 0x40a358
push esi
call fcn.0040c600
add esp, 0x20
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call fcn.00411f70
call fcn.004137c0
xor ecx, ecx
call fcn.0040c4f0
mov esi, eax
test esi, esi
je 0x414ef3
cmp dword [esi], 1
ja 0x414ef3
lea eax, [esp + 0x1c]
push eax
call fcn.0041d99f
add esp, 4
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x70]
push eax
call fcn.0041d55d
lea eax, [esp + 0x74]
push eax
push 0x40954c
lea eax, [esp + 0xb8]
push 0x14
push eax
call fcn.0041d982
movzx eax, word [esp + 0x3c]
add esp, 0x18
push 0x409f90
push eax
lea eax, [esp + 0xb0]
push eax
push 0x40953c
call edi
push eax
push 0x40a388
push esi
call fcn.0040c600
add esp, 0x1c
cmp dword [esp + 0x68], 0x10
jb 0x414f06
push dword [esp + 0x54]
call fcn.0041cba6
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x2d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2c0]
xor ecx, esp
call fcn.0041c3ed
mov esp, ebp
pop ebp
ret