Function at 0x404e30
Capabilities:
Check mutex on windows
Create process on windows
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c35c
mov eax, dword fs:[0]
push eax
mov eax, 0x5a40
call fcn.00417900
mov eax, dword [0x43d180]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, 3
test edi, edi
je 0x404e74
mov dword [edi], 0
lea ecx, [ebp - 0x4ff8]
call fcn.00408870
push 0
lea ecx, [ebp - 0x4ff8]
mov dword [ebp - 4], 0
call fcn.00409ac0
cmp eax, 0x15
ja case.0x404ea3.2
movzx eax, byte [eax + 0x40525c]
jmp dword [eax*4 + 0x405248]
mov esi, 5
jmp case.0x404ea3.2
mov esi, 1
jmp case.0x404ea3.2
mov esi, 7
jmp case.0x404ea3.2
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x5a28], 0x15
test ebx, ebx
je 0x404ee3
cmp dword [ebp + 0x10], 0
je 0x40507b
lea ecx, [ebp - 0x4ff8]
call fcn.00409b40
mov esi, eax
mov dword [ebp - 0x5a34], esi
cmp esi, 0xa
jg 0x40507b
mov dword [ebp - 0x5a40], 0
mov dword [ebp - 0x5a3c], 0
mov dword [ebp - 0x5a38], 0
mov byte [ebp - 4], 1
mov dword [ebp - 0x5a2c], 0
call fcn.00405670
mov dword [ebp - 0x5a30], eax
test eax, eax
je 0x40506c
mov dword [ebp - 0x5a40], eax
lea ecx, [ebp - 0x5a40]
lea eax, [ebp - 0x5a2c]
mov dword [ebp - 0x5a3c], 0
push eax
push 0x42db14
mov dword [ebp - 0x5a38], 0
call fcn.00406ce0
cmp dword [ebp - 0x5a2c], esi
je 0x40506c
lea ecx, [ebp - 0x5a4c]
call fcn.00403080
push esi
push 0x404c10
push 0
push 0xf1
push dword [0x440914]
mov byte [ebp - 4], 2
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp eax, 1
jne 0x404ff5
push 0
push 0x42db30
lea ecx, [ebp - 0x4ff8]
call fcn.00408a90
mov esi, eax
lea eax, [ebp - 0x218]
push 0x208
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 1
push 0
push esi
lea eax, [ebp - 0x218]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, dword [ebp - 0x5a34]
jmp 0x40502e
cmp eax, 0xf8
jne 0x40502e
lea ecx, [ebp - 0x300]
call fcn.00402f90
push 0
mov byte [ebp - 4], 3
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x300]
call fcn.00404850
lea ecx, [ebp - 0x300]
mov byte [ebp - 4], 2
call fcn.004031a0
push 4
lea eax, [ebp - 0x5a34]
mov dword [ebp - 0x5a34], esi
push eax
push 4
push 0
push 0x42db14
push dword [ebp - 0x5a30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0x5a4c], 0
je 0x40506c
push dword [ebp - 0x5a44]
push 0x440914
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea ecx, [ebp - 0x5a40]
mov byte [ebp - 4], 0
call fcn.00403230
test edi, edi
jne 0x405087
test ebx, ebx
jne case.0x4050a2.44
push 0
push 0
lea ecx, [ebp - 0x4ff8]
call fcn.00409ef0
add eax, 0xffffffd7
cmp eax, 6
ja case.0x4050a2.44
jmp dword [eax*4 + 0x405274]
test edi, edi
je 0x4050b3
mov dword [edi], 0x2a
test ebx, ebx
jne case.0x4050a2.44
push 0x1010
push 0xd4
push 0x76
jmp 0x4051a9
mov esi, dword [ebp - 0x5a28]
test edi, edi
je case.0x404ea3.2
mov dword [edi], 0x29
jmp case.0x404ea3.2
test edi, edi
je 0x4050ef
mov dword [edi], 0x2b
test ebx, ebx
jne case.0x4050a2.44
push str.NEWVERSIONFOUND_88E84E7D_FDE1_4357_99EA_B5327DBE9DB7
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je case.0x4050a2.44
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je case.0x4050a2.44
lea ecx, [ebp - 0x4ff8]
call fcn.00409b50
push 0x1041
push 0xd4
push 0x78
push ebx
mov esi, eax
call fcn.00404d50
add esp, 0x10
cmp eax, 1
jne case.0x4050a2.44
push 0x208
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 1
push ebx
push esi
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.0x4050a2.44
test edi, edi
je 0x40517d
mov dword [edi], 0x2e
test ebx, ebx
jne case.0x4050a2.44
push 0x1010
push 0xd4
push 0x77
jmp 0x4051a9
test edi, edi
je 0x405199
mov dword [edi], 0x2f
test ebx, ebx
jne case.0x4050a2.44
push 0x1010
push 0xd4
push 0x7f
push 0
call fcn.00404d50
add esp, 0x10
mov esi, dword [ebp - 0x5a28]
lea eax, [ebp - 0x5a2c]
mov dword [ebp - 0x5a24], 0x1000
push eax
push 1
push 0
push 0x42d520
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x5a30], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x5a30]
push eax
lea eax, [ebp - 0x5a24]
push eax
push 0
push 0
push 0x42d928
push dword [ebp - 0x5a2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x5a2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x4ff8]
mov dword [ebp - 4], 0xffffffff
call fcn.00408930
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416230
mov esp, ebp
pop ebp
ret