Function at 0x4265bb
Capabilities:
Check mutex on windows
Create thread
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov byte [0x4afb92], bl
cmp word [eax], 0x2a
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
push esi
push eax
mov dword [ebp - 0x10], ecx
sete byte [ebp - 1]
call fcn.00410c5a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov si, word [eax]
cmp si, 0x2d
pop ecx
mov dword [ebp - 0xc], ebx
mov cl, 0x2a
jne 0x4265fd
add cl, 3
movsx ecx, cl
movzx edx, si
cmp ecx, edx
jne 0x426636
movzx edx, word [eax + 2]
cmp ecx, edx
jne 0x426636
add eax, 4
xor esi, esi
mov dword [ebp - 0x14], eax
inc esi
push esi
lea eax, [ebp - 0x14]
push eax
push 0x49b3d4
call fcn.00438eee
add esp, 0xc
test al, al
je 0x426639
mov eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
jmp 0x426650
xor esi, esi
inc esi
push 5
lea eax, [ebp + 8]
push eax
push str._user
call fcn.00438eee
add esp, 0xc
test al, al
je 0x42665c
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x20], str.UCallBackhWnd
jmp 0x426664
mov eax, dword [0x4ae2a8]
mov dword [ebp - 0x20], eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0xc], ebx
mov eax, str.GlobalPECMD:main_u
jne 0x42667a
mov eax, str.GlobalPECMD:main
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x42669d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0xb7
cmp eax, ecx
jne 0x42669d
mov eax, ecx
jmp 0x426b6d
cmp dword [ebp - 0xc], ebx
je 0x4266ab
mov byte [0x4b3003], 0x20
jmp 0x4266bb
mov eax, dword [ebp + 8]
cmp word [eax], bx
setne al
add al, 0x10
mov byte [0x4b3003], al
cmp dword [0x4afe20], ebx
push edi
mov edi, 0x4aff28
jne 0x4266e9
push 0x49c0a0
call fcn.00482cde
test eax, eax
pop ecx
je 0x4266e9
push 0x497994
push str._D:DebugPeMain2.log
mov ecx, edi
call fcn.00419ca5
movsx eax, byte [0x4b3003]
push eax
push dword [ebp - 0x1c]
push str.MAIN___s__0x_X_r_n
push edi
call fcn.0040d2ad
add esp, 0x10
call fcn.00416392
cmp byte [ebp - 1], bl
je 0x426713
mov byte [0x4b3001], 1
cmp dword [ebp - 0xc], ebx
mov esi, 0x80000002
jne 0x4267f4
mov eax, dword [ebp + 8]
cmp word [eax], bx
je 0x426810
push str.SOFTWAREPELOGONRAMDATA
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.SOFTWAREPELOGONRAMDATA.HOTKEY
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push 1
push ebx
push ebx
push ebx
push str.SOFTWAREPELOGON
push esi
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 8], ebx
je 0x42676d
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push 1
push 1
push ebx
push ebx
push str.SOFTWAREPELOGONRAMDATA
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 8], ebx
je 0x426793
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push 1
push 1
push ebx
push ebx
push str.SOFTWAREPELOGONRAMDATA.HOTKEY
push esi
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 8], ebx
je 0x4267bc
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x25e7
push str.MAIN_DBG:_d_r_n
push edi
call fcn.0040d391
push 0x25e9
push str.MAIN_DBG:_d_r_n
push edi
call fcn.0040d391
call fcn.0040c40f
push 0x25eb
push str.MAIN_DBG:_d_r_n
push edi
call fcn.0040d391
add esp, 0x24
mov eax, dword [ebp + 8]
cmp word [eax], bx
je 0x426810
mov ecx, dword [ebp - 0x10]
push ebx
push 0x24
push ebx
push 0x497994
call fcn.0041e106
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax]
cmp cx, 0x2a
mov dword [ebp - 0x24], ecx
jne 0x426832
add eax, 2
cmp word [eax], 0x23
je 0x426832
lea ecx, [ebp + 8]
mov dword [ebp + 8], eax
call fcn.0040c032
mov eax, 0x497994
push eax
push eax
call sym.PECMD.exe_LoadEnvi
mov eax, dword [ebp + 8]
cmp word [eax], bx
pop ecx
pop ecx
jne 0x42684f
mov byte [0x4b0269], 1
call fcn.004322fc
call fcn.00426570
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 4
push str.MainPECMDPID
push str.SOFTWAREPELOGON
push esi
call fcn.00432b38
push 0x25f5
push str.MAIN_DBG:_d_r_n
push edi
call fcn.0040d391
push ebx
push 0x4aff28
call fcn.0047a9b3
mov ecx, dword [ebp - 0x10]
add esp, 0x2c
cmp dword [ecx + 0x44], ebx
jne 0x426912
test byte [0x4b0000], 1
jne 0x4268c4
or dword [0x4b0000], 1
push 0x496949
mov dword [0x4afffc], ebx
call fcn.004836d8
pop ecx
mov ecx, dword [ebp - 0x10]
push 0x10000
mov dword [ecx + 0x44], 0x4afffc
call fcn.00436055
lea ecx, [ebp - 8]
call fcn.0043717e
push dword [ebp - 8]
mov ecx, 0x4afffc
call fcn.0046419c
mov eax, dword [0x4afffc]
mov ecx, dword [ebp - 0x10]
push 1
push dword [ebp - 0x1c]
mov dword [ebp - 8], ebx
mov eax, dword [eax]
mov dword [ecx + 0x48], eax
call fcn.00444e2a
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
mov dword [eax + 0x50], ebx
call fcn.00431c4c
push 0x2601
push str.MAIN_DBG:_d_r_n
push edi
call fcn.0040d391
add esp, 0xc
cmp dword [ebp - 0xc], ebx
jne 0x42694d
mov al, byte [0x4b3003]
push 1
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push eax
push 3
push str.bInMain
push str.SOFTWAREPELOGON
push esi
call fcn.00432b38
add esp, 0x18
push 0x2605
push str.MAIN_DBG:_d_r_n
push edi
call fcn.0040d391
mov eax, dword [ebp + 8]
add esp, 0xc
cmp word [eax], bx
je 0x42696d
call fcn.0040f561
push 4
push 0x4afe14
push 4
push dword [ebp - 0x20]
push str.SOFTWAREPELOGON
push esi
call fcn.00432b38
add esp, 0x18
cmp word [ebp - 0x24], bx
jne 0x426992
cmp dword [ebp - 0xc], ebx
je 0x426997
call fcn.00420811
mov ecx, dword [ebp - 0x10]
call fcn.00415ddb
push 0x8000
call fcn.0043bb54
mov eax, dword [ebp + 8]
cmp word [eax], bx
pop ecx
jne 0x4269b7
cmp dword [ebp - 0xc], ebx
je 0x426a0c
push 0x2611
push str.MAIN_DBG:_d_r_n
push edi
mov dword [ebp - 0x24], ebx
call fcn.0040d391
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
push 0x10000
push ebx
push 0x426595
push 0x80000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x426a09
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x426a09
lea ecx, [eax + 2]
cmp word [ecx], 0x23
je 0x426a12
mov dword [ebp + 8], ecx
lea ecx, [ebp + 8]
call fcn.0040c032
mov eax, dword [ebp + 8]
cmp word [eax], 0x2a
je 0x4269f5
cmp word [eax], bx
je 0x426b2b
push 0x261a
push str.MAIN_DBG:_d_r_n
push edi
call fcn.0040d391
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0x5c8
push eax
lea ecx, [ebp - 8]
call fcn.0043719c
mov eax, dword [ebp - 8]
mov word [eax], bx
mov edi, dword [ebp - 8]
push 0x104
add edi, 0x280
mov dword [ebp - 0x24], eax
push edi
lea eax, [edi + 0x488]
push ebx
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
jne 0x426a80
mov dword [ebp - 0x20], edi
jmp 0x426a85
inc eax
inc eax
mov dword [ebp - 0x20], eax
push dword [ebp + 8]
call fcn.0040eae0
test eax, eax
pop ecx
je 0x426ab5
push dword [ebp + 8]
lea ecx, [ebp - 0x20]
call fcn.004419bc
mov ecx, dword [ebp - 0x10]
push ebx
push ebx
push ebx
push dword [ebp - 0x20]
call fcn.00427548
lea ecx, [ebp - 0x20]
call fcn.00431c4c
jmp 0x426b23
push dword [ebp - 0x20]
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push str.___exe:__s_____s_
push dword [ebp - 0xc]
call edi
add esp, 0x10
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
lea eax, [ecx + eax*2]
push str.LOAD_sysinit__s
push eax
call edi
mov eax, dword [ebp - 0x24]
add esp, 0xc
cmp word [eax], bx
je 0x426b13
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push str.SysStartuped
push str.SOFTWAREPELOGONRAMDATA
push esi
mov dword [ebp - 0x18], 1
call fcn.00432b38
add esp, 0x18
mov ecx, dword [ebp - 0x10]
push ebx
push ebx
push ebx
push ebx
push ecx
push dword [ebp - 0xc]
call fcn.004074ae
lea ecx, [ebp - 8]
call fcn.00431c4c
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x40]
push eax
call esi
pop edi
jmp 0x426b5a
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x40]
push eax
call esi
test eax, eax
jne 0x426b3d
push dword [0x4afe00]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [ebp - 0x38]
pop esi
pop ebx
leave
ret 4