Function at 0x401989
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Delete registry value
Read file via mapping
Terminate process

Disassembly:
push 0x88
push 0x40bd78
call fcn.00409474
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
xor edi, edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x98], bl
push 0x63
push ebx
lea eax, [ebp - 0x97]
push eax
call fcn.004074c0
add esp, 0xc
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 0x28], eax
push str._mymeanmap_
mov esi, 0x5000
push esi
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401adc
push ebx
push ebx
push ebx
push 4
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp dword [edi], 0x1c19c
je 0x401a5b
push 0x5010
push 8
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
call fcn.004060e0
add esp, 0xc
mov dword [ebp - 0x20], ebx
mov eax, esi
cmp dword [ebp - 0x20], eax
jae 0x401a4c
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
add eax, ecx
movsx ecx, byte [eax]
xor ecx, 0x86
mov byte [eax], cl
inc dword [ebp - 0x20]
jmp 0x401a2d
mov edi, dword [ebp - 0x1c]
cmp dword [edi], 0x1c19c
jne 0x401b7e
lea esi, [edi + 0x228]
mov dword [ebp - 0x30], esi
push 0x64
lea eax, [edi + 4]
push eax
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x2c]
cmp eax, dword [edi + 0x54]
jae 0x401adc
mov eax, dword [esi + 8]
sub eax, ebx
je 0x401a90
dec eax
je 0x401aa5
dec eax
dec eax
jne 0x401a9b
push ebx
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.gamevancelib32.dll_void___stdcall_ScheduleFileUpdate_char___char__]
cmp dword [ebp - 0x1c], ebx
je 0x401acc
add esi, dword [esi + 4]
jmp 0x401ad4
lea eax, [ebp - 0x34]
push eax
lea eax, [esi + 0x18]
push eax
push dword [esi + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [esi + 0x11c]
cmp eax, ebx
je 0x401a9b
push eax
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x401a9b
mov eax, dword [esi + 4]
imul eax, eax, 0x14
add esi, eax
mov dword [ebp - 0x30], esi
inc dword [ebp - 0x2c]
jmp 0x401a7a
push 0x40b548
add edi, 4
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x401af6
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.DDE_Server
push str.SysOleClass
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
je 0x401b15
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x401b36
lea eax, [ebp - 0x98]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1c], ebx
je 0x401b51
push dword [ebp - 0x1c]
push ebx
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_HeapFree]
or dword [ebp - 4], 0xffffffff
xor eax, eax
inc eax
jmp 0x401b84
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.004094af
ret