Function at 0x401000
Capabilities:
Check mutex on windows
Create thread
Inspect load icon resource
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x207c
call fcn.00429400
mov eax, dword [0x4ae7ec]
xor eax, esp
mov dword [esp + 0x2078], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push str.Enter.....
push str.WinMain
call fcn.0040b1e0
add esp, 8
xor eax, eax
push str.MUTEX_SINGLE_INSTANCE
push eax
push eax
mov dword [esp + 0x1c], 0
mov word [esp + 0x6c], ax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4b209c], eax
call esi
cmp eax, 0xb7
jne 0x40107f
push str.Another_instance_is_running
push str.WinMain
call fcn.0040b0a0
mov eax, 1
jmp 0x401430
push 0x400
push 0x4b1090
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4010ac
call esi
push eax
push str.Unable_to_get_program_directory___d_
push 0x435344
call fcn.0040b0a0
add esp, 0xc
jmp 0x4010c7
push 0x3a
push 0x5c
push 0x401
push 0x4b1090
push 0x4b1090
call sym.SelectBehaviorsExe.exe_TM_PickDirectoryNameExW
add esp, 0x14
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0xc]
push edx
mov esi, 1
push esi
xor ecx, ecx
push ecx
push str.SoftwareSelectBehaviorsDebug
push 0x80000002
mov dword [esp + 0x28], 4
mov word [esp + 0x24], cx
call ebx
test eax, eax
jne 0x40125a
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
push str.Enable
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401123
xor esi, esi
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40125a
mov eax, 1
cmp dword [esp + 0x10], eax
jne 0x40125a
lea ecx, [esp + 0xc]
push ecx
push eax
xor edx, edx
push edx
push str.SoftwareSelectBehaviorsDebug
push 0x80000002
mov dword [0x4b20b4], eax
mov dword [esp + 0x28], 0x401
mov word [esp + 0x74], dx
call ebx
test eax, eax
jne 0x40119b
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x20]
push ecx
push esi
push str.Path
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [esp + 0x60], 0
jne 0x4011bc
push 0x401
lea ecx, [esp + 0x64]
push str.c:SelectBehaviors.log
push ecx
call sym.SelectBehaviorsExe.exe_TM_CopyStringW
add esp, 0xc
jmp 0x4011e6
lea edx, [esp + 0x60]
push edx
call sym.SelectBehaviorsExe.exe_TM_IsDirW
add esp, 4
test eax, eax
je 0x4011e6
push 0x5c
push 0x401
lea eax, [esp + 0x68]
push eax
push str.SelectBehaviors.log
call sym.SelectBehaviorsExe.exe_TM_AddFileNametoPathExW
add esp, 0x10
lea esi, [esp + 0x60]
call fcn.00401cd0
lea edx, [esp + 0xc]
push edx
mov esi, 1
push esi
xor ecx, ecx
push ecx
push str.SoftwareSelectBehaviorsDebug
push 0x80000002
mov dword [esp + 0x28], 4
mov word [esp + 0x24], cx
call ebx
test eax, eax
jne 0x40125a
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
push str.Level
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401241
xor esi, esi
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40125a
mov edx, dword [esp + 0x10]
mov dword [0x4af51c], edx
push 0x802
push 0x4b0888
push 0x6e
push edi
call dword [sym.imp.USER32.dll_LoadStringW]
call fcn.0040b380
mov ebx, dword [sym.imp.USER32.dll_LoadIconW]
xor esi, esi
push 0x7f00
push esi
mov dword [esp + 0x24], 3
mov dword [esp + 0x28], 0x401450
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], edi
call ebx
push 0x7f00
push esi
mov dword [esp + 0x38], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push esi
mov dword [esp + 0x38], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], str._tm_SelectBehaviors
call dword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
jne 0x4012f2
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2078]
xor ecx, esp
call fcn.004171f3
mov esp, ebp
pop ebp
ret 0x10
push esi
push edi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x80000000
push 0x4b0888
push str._tm_SelectBehaviors
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x65
mov esi, eax
push edi
mov dword [0x4b20a8], esi
call ebx
push eax
push 0xfffffffffffffff2
push esi
call dword [sym.imp.USER32.dll_SetClassLongW]
push str.Enter.....
push str.GetLicenseStatus
call fcn.0040b1e0
push str.Enter.....
push str.GetProductStatus
call fcn.0040b1e0
add esp, 0x10
push 0x802
lea ecx, [esp + 0x86c]
push ecx
push 0x70
push edi
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x65
push edi
call ebx
lea edx, [esp + 0x1070]
push edx
lea eax, [esp + 0x86c]
push eax
lea ecx, [esp + 0x1880]
push 0x401
push ecx
call sym.SelectBehaviorsExe.exe_TM_FormatStringW
add esp, 0x10
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0xea60
push 1
push esi
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0
push 0
push 0x4014e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4b20a0], eax
test eax, eax
jne 0x4013cf
push str.Create_Event_Thread_failed
push str.WinMain
call fcn.0040b0a0
add esp, 8
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
push 0
lea edx, [esp + 0x50]
push edx
call esi
test eax, eax
je 0x401411
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [esp + 0x44]
push eax
call edi
lea ecx, [esp + 0x44]
push ecx
call ebx
push 0
push 0
push 0
lea edx, [esp + 0x50]
push edx
call esi
test eax, eax
jne 0x4013f2
mov eax, dword [0x4b209c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Leave.....
push str.WinMain
call fcn.0040b1e0
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x208c]
add esp, 8
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004171f3
mov esp, ebp
pop ebp
ret 0x10