Function at 0x424ee0
Capabilities:
Check mutex on windows
Check os version
Create thread
Delete registry value
Persist via run registry key
Query or enumerate registry value
Resume thread

Disassembly:
sub esp, 0x314
mov ecx, 0x43bc08
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
push ebp
call fcn.0040b450
test eax, eax
jne 0x424f16
push ebp
push ebp
push str.Load_Setup.dll_Fail
call fcn.00424c50
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x314
ret
push 0xa
mov ecx, 0x43bc08
call fcn.0040b580
cmp eax, ebp
je 0x424fb7
lea ecx, [eax - 4]
cmp ecx, ebp
mov dword [0x43d844], ecx
je 0x424f46
mov esi, dword [ecx]
call dword [esi + 0x14]
mov ecx, dword [0x43d844]
push eax
call dword [esi + 0x10]
push 0xffffffffffffffff
lea eax, [esp + 0x14]
push 1
push eax
call fcn.004249d0
mov edi, eax
mov eax, dword [0x43baf8]
add esp, 0xc
mov esi, dword [edi]
cmp eax, esi
je 0x424fdb
cmp dword [eax - 0xc], ebp
jge 0x424f76
mov ecx, dword [0x43734c]
add eax, 0xfffffff4
cmp eax, ecx
jne 0x424f7b
cmp dword [esi - 0xc], ebp
jge 0x424fbf
mov ebx, dword [esi - 8]
mov ecx, 0x43baf8
push ebx
call fcn.00402440
test eax, eax
je 0x424fdb
mov edi, dword [0x43baf8]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x43baf8]
mov dword [eax - 8], ebx
mov ecx, dword [0x43baf8]
mov byte [ecx + ebx], 0
jmp 0x424fdb
mov dword [0x43d844], ebp
jmp 0x424f46
mov ecx, 0x43baf8
call fcn.00402400
mov edi, dword [edi]
mov dword [0x43baf8], edi
add edi, 0xfffffff4
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 0x10]
mov ecx, dword [0x43734c]
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x42500c
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x42500c
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.004292c0
add esp, 4
mov ecx, 0x43be60
call fcn.00408550
test eax, eax
jne 0x425034
push ebp
push ebp
push str.No_Valid_Config
call fcn.00424c50
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x314
ret
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x121]
mov byte [esp + 0x120], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor ecx, ecx
mov dword [esp + 0x10], ebp
cmp ecx, 0x43c09c
lea edx, [esp + 0x20]
stosb byte es:[edi], al
jne 0x425081
push edx
call fcn.00425440
add esp, 4
jmp 0x4250a3
mov edi, 0x43c09c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push 1
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4250fd
lea edx, [esp + 0x1c]
lea eax, [esp + 0x120]
push edx
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x2c]
push ebp
push edx
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x34], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x42516e
push 0xffffffffffffffff
lea eax, [esp + 0x14]
push 0x13a
push eax
call fcn.004249d0
mov ecx, dword [esp + 0x1c]
push ebp
push 0x40
push ecx
call fcn.00424c50
mov eax, dword [esp + 0x28]
mov ecx, dword [0x43734c]
add esp, 0x18
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x425431
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x425431
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.004292c0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x314
ret
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x221]
mov byte [esp + 0x220], 0
rep stosd dword es:[edi], eax
mov ecx, dword [0x43d848]
lea edx, [esp + 0x220]
stosw word es:[edi], ax
push ecx
push 0x43c09c
push str.Rising_Setup__s__d
push edx
stosb byte es:[edi], al
call fcn.00429590
push 0x108
call fcn.00429728
mov esi, eax
add esp, 0x14
cmp esi, ebp
je 0x4251f3
lea eax, [esp + 0x220]
mov dword [esi], ebp
test eax, eax
mov dword [esi + 4], ebp
je 0x4251e5
lea ecx, [esp + 0x220]
push pe_nt_image_headers32
lea edx, [esi + 8]
push ecx
push edx
call fcn.0042a8c0
add esp, 0xc
jmp 0x4251f1
mov ecx, 0x40
xor eax, eax
lea edi, [esi + 8]
rep stosd dword es:[edi], eax
mov ebp, esi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ebx, [ebp + 8]
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
repne scasb al, byte es:[edi]
mov esi, dword [0x43d844]
not ecx
dec ecx
je 0x42536a
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
push ebx
jne 0x425245
lea eax, [esp + 0x24]
push str.Global_s
push eax
call fcn.00429590
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
push 0
call edi
mov dword [ebp], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
lea edx, [esp + 0x24]
push str.Tip__s
push edx
mov dword [esp + 0x20], eax
call fcn.00429590
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
je 0x42535c
cmp eax, 0xb7
je 0x425289
cmp eax, 5
jne 0x425306
test esi, esi
je 0x425306
lea eax, [esp + 0x20]
push eax
push 0
push 0
call edi
mov dword [ebp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x121]
mov byte [esp + 0x120], 0
mov edx, dword [esi]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x13d620
mov ecx, esi
stosb byte es:[edi], al
call dword [edx + 0xc]
mov eax, dword [esi]
push 0x4386ac
push 1
mov ecx, esi
call dword [eax + 0x24]
lea ecx, [esp + 0x120]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test ebx, ebx
je 0x425322
lea edx, [esp + 0x120]
push edx
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x425306
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test ebp, ebp
je 0x425431
push 1
mov ecx, ebp
call fcn.00425510
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x314
ret
mov eax, dword [esi]
push 0
mov ecx, esi
call dword [eax + 0xc]
mov edx, dword [esi]
push str.The_program_only_for_one_user_in_same_time_
push 7
mov ecx, esi
call dword [edx + 0x24]
mov edi, eax
mov eax, dword [esi]
push 0x13d620
mov ecx, esi
call dword [eax + 0xc]
lea ecx, [esp + 0x120]
push 0
push ecx
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x425306
lea edx, [esp + 0x20]
push edx
push 0
push 0
call edi
mov dword [ebp + 4], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 2
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4253aa
mov ecx, dword [esp + 0x18]
push 0x43c09c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00424230
test eax, eax
je 0x425424
mov edi, 0x43c82a
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x425424
push 1
call fcn.00412700
mov al, byte [0x43d84c]
add esp, 4
test al, 4
je 0x42541f
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 4
push 0
push 0x425a50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x425424
push 0xfffffffffffffff1
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x425424
call fcn.00424cf0
test ebp, ebp
je 0x425431
push 1
mov ecx, ebp
call fcn.00425510
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x314
ret