Function at 0x4be338e8
Capabilities:
Check mutex on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
push edi
xor esi, esi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 8], eax
push esi
mov esi, 0x4be57911
lea edi, [ebp - 0x30]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
mov esi, 0x4be57931
lea edi, [ebp - 0x138]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
mov dword [ebp - 0x10], 0x1f
push 0x4be57bdb
push 0
push 0x4be62cf4
call sub.KERNEL32.dll_CreateMutexA
mov dword [0x4be577c8], eax
test eax, eax
jne 0x4be3394d
mov si, 0x2a04
jmp 0x4be33b3e
push 0xffffffffffffffff
push dword [0x4be577c8]
call sub.KERNEL32.dll_WaitForSingleObject
push 0x4be57be6
lea eax, [ebp - 0x138]
push eax
call fcn.4be41cfc
add esp, 8
push 0x4be57c07
lea edx, [ebp - 0x138]
push edx
call fcn.4be41c6c
add esp, 8
push 0x4be57c12
lea ecx, [ebp - 0x138]
push ecx
call fcn.4be41c6c
add esp, 8
push 0x4be57c19
lea eax, [ebp - 0x138]
push eax
call fcn.4be41c6c
add esp, 8
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp - 0x138]
push ecx
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyA
test eax, eax
jne 0x4be339f7
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x30]
push edx
push 0
push 0
push 0x4be57c1f
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
jne 0x4be339ef
lea ecx, [ebp - 0x30]
push ecx
call fcn.4be47b30
pop ecx
mov ebx, eax
shl ebx, 0xa
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_RegCloseKey
cmp ebx, 0x200000
jae 0x4be33a0b
mov ebx, 0x200000
mov edi, 0x20
jmp 0x4be33a10
mov edi, ebx
shr edi, 0x10
push 0x4be57c2d
push ebx
push 0
push 4
push 0x4be62cf4
push 0xffffffffffffffff
call sub.KERNEL32.dll_CreateFileMappingA
mov dword [0x4be577c4], eax
test eax, eax
jne 0x4be33a3e
call sub.KERNEL32.dll_GetLastError
int3
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
setne al
and eax, 1
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
push ebx
push 0
push 0
push 2
push dword [0x4be577c4]
call sub.KERNEL32.dll_MapViewOfFileEx
mov dword [0x4be577d0], eax
cmp dword [0x4be577d0], 0
jne 0x4be33a9e
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x1e7
je 0x4be33a85
cmp eax, 8
jne 0x4be33a9e
push 0
push ebx
push 0
push 0
push 2
push dword [0x4be577c4]
call sub.KERNEL32.dll_MapViewOfFileEx
mov dword [0x4be577d0], eax
cmp dword [0x4be577d0], 0
jne 0x4be33ab0
mov si, 0x251e
jmp 0x4be33b3e
cmp dword [ebp - 4], 0
je 0x4be33ae5
push dword [0x4be577d0]
push edi
call fcn.4be33bbb
mov eax, dword [0x4be577d0]
mov dword [eax + 0x4c], 1
push dword [0x4be577d0]
push 9
call sym.idapi32.dll_OsSetSharedPtr
push ebx
push 0xa
call sym.idapi32.dll_OsSetSharedPtr
jmp 0x4be33b2a
mov edx, dword [0x4be577d0]
mov ecx, dword [edx]
cmp ecx, dword [0x4be577d0]
je 0x4be33b22
mov eax, dword [0x4be577d0]
mov edx, dword [eax]
mov dword [ebp + 0xc], edx
push dword [0x4be577d0]
call sub.KERNEL32.dll_UnmapViewOfFile
cmp dword [ebp - 8], 0
je 0x4be33b16
mov si, 0x210d
jmp 0x4be33b3e
mov dword [ebp - 8], 1
jmp 0x4be33a51
mov eax, dword [0x4be577d0]
inc dword [eax + 4]
cmp dword [ebp + 8], 0
je 0x4be33b3e
mov edx, dword [0x4be577d0]
mov ecx, dword [edx + 4]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
cmp dword [0x4be577c8], 0
je 0x4be33b52
push dword [0x4be577c8]
call sub.KERNEL32.dll_ReleaseMutex
test si, si
je 0x4be33b96
cmp dword [0x4be577c4], 0
je 0x4be33b6b
push dword [0x4be577c4]
call sub.KERNEL32.dll_CloseHandle
xor edx, edx
mov dword [0x4be577c4], edx
cmp dword [0x4be577c8], 0
je 0x4be33b87
push dword [0x4be577c8]
call sub.KERNEL32.dll_CloseHandle
xor ecx, ecx
mov dword [0x4be577c8], ecx
xor eax, eax
mov dword [0x4be577d0], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8