Function at 0x401820
Capabilities:
Check mutex on windows
Delete registry value
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x42c304]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x433]
push ebx
push eax
mov edi, ecx
mov byte [ebp - 0x434], bl
call fcn.0040f480
push 0x103
lea ecx, [ebp - 0x32f]
push ebx
push ecx
mov byte [ebp - 0x330], bl
call fcn.0040f480
add esp, 0x18
lea edx, [ebp - 0x448]
push edx
push 0xf003f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
mov dword [ebp - 0x44c], 0x80000002
mov dword [ebp - 0x43c], ebx
mov byte [ebp - 0x440], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4018aa
mov byte [ebp - 0x440], 1
mov eax, dword [ebp - 0x448]
push str.SunJavaUpdateSched
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [ebp - 0x448]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4018d3
mov byte [ebp - 0x440], bl
push str.Global_MSIExecute
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x438], eax
cmp eax, ebx
jne 0x401926
cmp dword [edi], 3
jg 0x401b77
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.fail_to_create_mutex_with_error:_d
push str._AUUninstall__YAXPAVlogger___Z
push 0xe8
push str.jaureg.cpp
call fcn.00402f60
add esp, 0x14
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040c2f6
mov esp, ebp
pop ebp
ret
push esi
push 0x927c0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [edi], 2
mov esi, eax
jg 0x401957
push esi
push str.finish_waiting_for_mutex__d
push str._AUUninstall__YAXPAVlogger___Z
push 0xec
push str.jaureg.cpp
call fcn.00402f60
add esp, 0x14
mov edx, dword [ebp - 0x438]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
jne 0x401a9b
xor eax, eax
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov byte [ebp - 7], al
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 0x24], bl
call fcn.004016d0
add esp, 4
test eax, eax
je 0x4019b0
push str.1.6.0_18
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jns 0x401b76
push 0x103
lea edx, [ebp - 0x127]
push ebx
push edx
mov byte [ebp - 0x128], bl
call fcn.0040f480
push 0x103
lea eax, [ebp - 0x22b]
push ebx
push eax
mov byte [ebp - 0x22c], bl
call fcn.0040f480
add esp, 0x18
push 0x104
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x401a2f
cmp dword [edi], 3
jg 0x401b76
push str.fail_to_get_SystemDir
push str._AUUninstall__YAXPAVlogger___Z
push 0x103
push str.jaureg.cpp
call fcn.00402f60
add esp, 0x10
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040c2f6
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 0x22c]
push str._smsiexec.exe
push eax
call fcn.0040cd62
lea ecx, [ebp - 0x22c]
push ecx
call fcn.00401b90
add esp, 0x10
test eax, eax
je 0x401b76
cmp dword [edi], 2
jg 0x401b76
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.fail_to_create_msiexec_proccess__d
push str._AUUninstall__YAXPAVlogger___Z
push 0x10a
push str.jaureg.cpp
call fcn.00402f60
add esp, 0x14
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040c2f6
mov esp, ebp
pop ebp
ret
cmp esi, 0x102
jne 0x401b76
lea edx, [ebp - 0x434]
push edx
push ebx
push ebx
push 0x2b
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x401b76
cmp dword [edi], 1
jg 0x401ae2
push str.Start_jaureg_uninstall_auto_update_when_user_login
push str._AUUninstall__YAXPAVlogger___Z
push 0x116
push str.jaureg.cpp
call fcn.00402f60
add esp, 0x10
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x330]
push str.__sJavaJava_Updatejaureg.exe___u_auto_update
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea esi, [ebp - 0x460]
mov dword [ebp - 0x460], 0x80000002
mov dword [ebp - 0x450], ebx
mov byte [ebp - 0x454], bl
call fcn.00409300
lea edx, [ebp - 0x330]
lea esi, [ebp - 0x474]
call fcn.00401040
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x460]
call fcn.00409340
mov ecx, dword [ebp - 0x470]
mov edx, dword [ebp - 0x46c]
sub edx, ecx
push edx
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x474]
push ecx
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call fcn.00401090
mov ecx, dword [ebp - 0x45c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0040c2f6
mov esp, ebp
pop ebp
ret