Function at 0x40d810
Capabilities:
Check mutex on windows
Check os version
Enumerate gui resources
Get common file path
Get installed programs
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xcf8
mov eax, dword [0x437888]
xor eax, esp
mov dword [esp + 0xcf4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push esi
push edi
push 0x4336c0
push ecx
mov dword [esp + 0x14], 4
mov dword [0x43b02c], eax
call fcn.0041d830
add esp, 8
test eax, eax
je 0x40d869
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xcf4]
xor ecx, esp
call fcn.0041d486
mov esp, ebp
pop ebp
ret 0x10
push 0x100
push 0x43a5c8
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x60]
mov byte [0x43a6c7], 0
push eax
mov dword [esp + 0x64], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [esp + 0x70], 2
mov dword [0x43acb4], 1
mov dword [0x43a5b0], 0
mov dword [0x43acdc], 0
mov dword [0x43a7dc], 0
mov dword [0x43a7ec], 0
jne 0x40f5a5
mov eax, dword [esp + 0x64]
mov edi, dword [sym.imp.kernel32.dll_FreeLibrary]
cmp eax, 5
jbe 0x40d9bb
mov dword [0x43acb4], 0
cmp eax, 6
jb 0x40d963
mov ecx, dword [esp + 0x68]
mov dword [0x43a5b0], 1
ja 0x40d907
cmp ecx, 1
jb 0x40d911
mov dword [0x43acdc], 1
cmp eax, 6
ja 0x40d91b
cmp ecx, 2
jb 0x40d963
push 0x43a5c8
push 0x4336c8
lea eax, [esp + 0x300]
mov dword [0x43a7dc], 1
push 0x1ff
push eax
call fcn.0041d632
add esp, 0x10
lea eax, [esp + 0x2f8]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
test eax, eax
je 0x40d963
push eax
mov dword [0x43a7ec], 1
call edi
cmp dword [0x43acb4], 0
jne 0x40f5a5
call dword [sym.imp.kernel32.dll_GetVersion]
test eax, eax
js 0x40f5a5
push 0xa
call dword [sym.imp.kernel32.dll_IsProcessorFeaturePresent]
test eax, eax
jne 0x40d9d8
push 0x40010
push 0x4336d8
push 0x433728
push eax
call dword [sym.imp.user32.dll_MessageBoxA]
mov eax, 6
pop edi
pop esi
mov ecx, dword [esp + 0xcf4]
xor ecx, esp
call fcn.0041d486
mov esp, ebp
pop ebp
ret 0x10
jne 0x40d8ed
cmp dword [esp + 0x68], 1
jb 0x40f5a5
mov dword [0x43acb4], 0
jmp 0x40d970
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push 0x43a17c
push 0x43a180
push eax
mov dword [0x43a178], eax
mov dword [0x43a17c], 0
call dword [sym.imp.kernel32.dll_GetProcessAffinityMask]
mov eax, 1
cmp dword [0x43a17c], eax
jbe 0x40da33
mov edx, dword [0x43a180]
xor ecx, ecx
shl eax, cl
test eax, edx
jne 0x40da26
inc ecx
mov eax, 1
cmp ecx, 0x20
jl 0x40da13
jmp 0x40da33
push eax
push dword [0x43a178]
call dword [sym.imp.kernel32.dll_SetProcessAffinityMask]
mov dword [0x43a170], 0
call fcn.0041cba0
lea eax, [esp + 0x20]
mov dword [esp + 0x18], 0
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x24], 0
push eax
push 0
push 0x20019
push 0
push 0
push 0
push 0x433784
push 0x80000002
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40f576
cmp dword [esp + 0x20], 2
mov esi, dword [sym.imp.advapi32.dll_RegQueryValueExA]
jne 0x40dac2
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x20
push eax
push 0x43ab48
lea eax, [esp + 0x1c]
push eax
push 0
push 0x4337c0
push dword [esp + 0x24]
call esi
xor ecx, ecx
test eax, eax
mov eax, 1
cmove ecx, eax
mov dword [esp + 0x18], ecx
push dword [esp + 0x10]
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp dword [esp + 0x18], 0
je 0x40f576
push 0x43382c
push 0
push 0
mov dword [0x43b024], 0
call dword [sym.imp.kernel32.dll_CreateMutexA]
mov dword [0x43a7f0], eax
test eax, eax
je 0x40db3a
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40db3a
push dword [0x43a7f0]
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0
push 0x40b340
call dword [sym.imp.user32.dll_EnumWindows]
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0xcf4]
xor ecx, esp
call fcn.0041d486
mov esp, ebp
pop ebp
ret 0x10
push 0x8000
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_SetPriorityClass]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x43383c
push 0x20000
push 0
push 4
push 0
push 0xffffffffffffffff
mov dword [0x43b668], 0
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
mov dword [esp + 0x2c], eax
test eax, eax
jne 0x40dbaf
push 0x40000
push 0x433220
push 0x433844
push eax
call dword [sym.imp.user32.dll_MessageBoxA]
mov eax, 0x458
pop edi
pop esi
mov ecx, dword [esp + 0xcf4]
xor ecx, esp
call fcn.0041d486
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0
push 0
push 0xf001f
push eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov dword [0x43b668], eax
cmp dword [0x43b668], 0
jne 0x40dc0b
push dword [esp + 0x2c]
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0x40000
push 0x433220
push 0x433864
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
mov eax, 0x458
pop edi
pop esi
mov ecx, dword [esp + 0xcf4]
xor ecx, esp
call fcn.0041d486
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [0x43b668]
push 0x182d8
push 0
push eax
call fcn.00423570
mov eax, dword [0x43b668]
add esp, 0xc
mov dword [eax + 0x98], 0xffffffff
mov eax, dword [0x43b668]
push 0x43b968
mov dword [eax + 0x9c], 0xffffffff
mov eax, dword [0x43b668]
mov dword [eax + 0xa0], 0xffffffff
mov eax, dword [0x43b668]
mov ecx, dword [0x438a48]
or ecx, 0x80000000
mov dword [eax + 0xa4], 0xffffffff
mov eax, dword [0x43b668]
mov dword [eax + 0x74], ecx
mov eax, dword [0x43b668]
mov dword [eax + 0x78], 1
mov eax, dword [0x43b668]
mov dword [eax + 0xd4], 1
call dword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
mov ecx, dword [0x43b668]
mov eax, dword [0x43b968]
push 0x100
push 0x43a290
mov dword [ecx + 0x160], eax
mov eax, dword [0x43b96c]
push 0
mov dword [ecx + 0x164], eax
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
xor eax, eax
jmp 0x40dcd0
mov cl, byte [eax + 0x43a290]
cmp cl, 0x61
jl 0x40dce3
cmp cl, 0x7a
jg 0x40dce3
sub cl, 0x20
mov byte [eax + 0x43a800], cl
test cl, cl
je 0x40dcf5
inc eax
cmp eax, 0x100
jl 0x40dcd0
xor eax, eax
xor ecx, ecx
cmp byte [0x43a290], al
je 0x40dd21
cmp byte [eax + 0x43a290], 0x5c
cmove ecx, eax
inc eax
cmp byte [eax + 0x43a290], 0
jne 0x40dd01
cmp ecx, 0x100
jae 0x40f5d7
push 0x43a290
push 0xff
push 0x43ae10
mov byte [ecx + 0x43a290], 0
call fcn.0041d64e
add esp, 0xc
push 0x43387c
push 0xff
push 0x43ae10
call fcn.0041d6a3
mov eax, dword [0x43b668]
add esp, 0xc
mov dword [eax + 0xa8], 0
mov eax, dword [0x43b668]
mov dword [eax + 0xac], 0
mov eax, dword [0x43b668]
mov dword [eax + 0x158], 0
mov eax, dword [0x43b668]
mov dword [eax + 0x8c], 0
mov eax, dword [0x43b668]
mov dword [eax + 0xd0], 0
mov eax, dword [0x43b668]
mov dword [eax + 0xc8], 0
mov eax, dword [0x43b668]
mov dword [eax + 0xcc], 0x3c
mov eax, dword [0x43b668]
mov dword [eax + 0x88], 0x10
mov eax, dword [0x43b668]
mov dword [0x43ab68], 1
mov dword [0x43a184], 0
mov dword [0x438a4c], 0xa
mov dword [eax + 0xc4], 0
mov eax, dword [0x43b668]
mov dword [eax + 0xc0], 0
mov eax, dword [0x43b668]
mov dword [0x438a38], 1
mov dword [0x43a7e0], 0
mov dword [eax + 0xb0], 1
mov eax, dword [0x43b668]
mov dword [0x43b300], 0x1e
mov dword [eax + 0x14], 0
mov eax, dword [0x43b668]
mov dword [0x43a7e4], 0
mov dword [0x43a900], 1
mov dword [0x43b01c], 0
mov dword [0x43a910], 0
mov dword [0x43b690], 0
mov dword [0x43b304], 0
mov dword [0x43b688], 0
mov dword [0x43b2f8], 0
mov dword [eax + 0x34], 1
mov eax, dword [0x43b668]
mov dword [0x43a6cc], 0
mov dword [0x43acc8], 0xffffc568
mov dword [0x43acf8], 0xffffc568
mov dword [0x43acb8], 0
mov dword [0x43acec], 0
mov dword [0x43b64c], 0
mov dword [eax + 0xb4], 0x1e
mov eax, dword [0x43b668]
mov dword [0x43aca0], 0x7512
mov dword [eax + 0xb8], 0
mov eax, dword [0x43b668]
mov dword [0x43a7d8], 2
mov dword [0x43a5c4], 0xac44
mov dword [0x43a5c0], 0x10
mov dword [eax + 0xbc], 0
mov dword [0x43a3ac], 2
mov dword [0x43a5b4], 0xac44
mov dword [0x43a7d4], 0x10
mov dword [0x43a6c8], 4
mov dword [0x43aa38], 0
mov dword [0x43ab5c], 1
mov dword [0x43aca8], 0x78
mov dword [0x43ac94], 0x79
mov dword [0x43acd8], 0x7a
mov dword [0x43ad0c], 0x7b
mov dword [0x43ad04], 0x20
call fcn.00bcd9e5
mov ecx, ecx
mov edi, edi
push ss
lock adc byte [0xfffff03a], 0x79
psubusw mm5, mm1
pop ebx
fdiv qword [ecx + 0x11]
mov eax, 0x2179719f
movlps xmm7, qword [edx]
mov ecx, 0xb98ffb77
lahf
hlt
push 0x30
push 0x4337cc
push 0x4337d8
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
mov eax, 0x7b
pop edi
pop esi
mov ecx, dword [esp + 0xcf4]
xor ecx, esp
call fcn.0041d486
mov esp, ebp
pop ebp
ret 0x10
push 0x40010
push 0x4336d8
push 0x4336e4
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
mov ecx, dword [esp + 0xcfc]
mov eax, 5
pop edi
pop esi
xor ecx, esp
call fcn.0041d486
mov esp, ebp
pop ebp
ret 0x10
call fcn.0041dbcb
int3