Function at 0x404890
Capabilities:
Check mutex on windows
Check os version
Delete registry value
Query or enumerate registry value
Resolve function by parsing pe exports
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4584fe
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x471920]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x2c], ebp
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x44], 8
mov dword [esp + 0x48], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, dword [ebp + 0x44]
xor ebx, ebx
push ebx
mov dword [0x47679c], ecx
lea edi, [ebp + 0xa8]
push 0x4622b0
mov ecx, edi
call fcn.004029b0
push 0x208
call fcn.0040f788
mov edx, dword [0x47679c]
add esp, 4
mov esi, eax
push 0x104
push esi
push edx
mov dword [esp + 0x44], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4049b2
cmp esi, ebx
jne 0x404932
xor eax, eax
jmp 0x404946
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x404937
sub eax, edx
sar eax, 1
push eax
push esi
mov ecx, edi
call fcn.004029b0
mov eax, dword [edi]
mov esi, dword [eax - 0xc]
push 0x5c
push eax
call fcn.0043f400
add esp, 8
cmp eax, ebx
jne 0x404968
or eax, 0xffffffff
jmp 0x40496c
sub eax, dword [edi]
sar eax, 1
sub esi, eax
sub esi, 1
push esi
lea ecx, [esp + 0x1c]
push ecx
mov ecx, edi
call fcn.00406300
push eax
mov ecx, edi
mov dword [esp + 0x7c], ebx
call fcn.00402930
mov dword [esp + 0x78], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4049b2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, ebp
call fcn.00405420
call fcn.0040b840
mov ecx, ebp
call fcn.00425060
call fcn.00425ae9
test eax, eax
jne 0x4049dd
push 0xffffffffffffffff
push ebx
push 0x64
call fcn.00425e0e
jmp 0x405255
call fcn.00425e63
mov eax, dword [eax + 0x40]
mov dword [eax + 0x28], ebx
call fcn.00425e63
mov eax, dword [eax + 0x40]
mov dword [eax + 0x38], 2
call fcn.00425e63
mov eax, dword [eax + 0x40]
mov esi, 1
mov dword [eax + 0x2c], esi
call fcn.00425e63
mov eax, dword [eax + 0x40]
push ebx
mov dword [eax + 0x3c], 0xffffffff
call fcn.004271a9
add esp, 4
call fcn.0041c08e
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x404a39
push 0x80004005
call fcn.00402660
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x78], esi
mov eax, dword [0x476788]
cmp eax, ebx
je 0x404d95
cmp eax, 9
jle 0x404ad9
push 0x46254c
push 0x462570
lea edi, [esp + 0x34]
call fcn.0040c350
mov byte [esp + 0x80], 2
mov ecx, dword [0x476788]
mov eax, dword [eax]
push 9
push ecx
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.00402e70
mov byte [esp + 0x90], 1
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
add esp, 0x18
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404abb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x18]
push 0
push 0
push esi
call fcn.00425dc5
mov dword [esp + 0x78], 0xffffffff
lea eax, [esi - 0x10]
jmp 0x40523c
call fcn.0041c08e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404af3
push 0x80004005
call fcn.00402660
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
xor ebp, ebp
mov byte [esp + 0x78], 3
xor esi, esi
lea esp, [esp]
mov ecx, dword [edi]
push esi
push ecx
lea edx, [esp + 0x28]
push str.SHHQCFSInst_s__d
push edx
call fcn.00402e70
mov eax, dword [esp + 0x30]
add esp, 0x10
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x404b56
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 1
add ebp, 1
cmp esi, 9
jl 0x404b10
mov eax, dword [0x476788]
cmp ebp, eax
jl 0x404c01
push 0x46259c
push 0x4625c4
lea edi, [esp + 0x34]
call fcn.0040c350
mov byte [esp + 0x80], 4
mov ecx, dword [0x476788]
mov eax, dword [eax]
push ecx
push ebp
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.00402e70
mov byte [esp + 0x90], 3
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
add esp, 0x18
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404bbe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x18]
push 0
push 0
push esi
call fcn.00425dc5
mov byte [esp + 0x78], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404bf1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x78], 0xffffffff
lea eax, [esi - 0x10]
jmp 0x40523c
cmp eax, 1
jne 0x404d70
call fcn.0041c08e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404c24
push 0x80004005
call fcn.00402660
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x30]
push ecx
lea esi, [esp + 0x28]
mov byte [esp + 0x7c], 5
call fcn.00401420
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404c6a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str._runner.dll
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x38]
push edx
call fcn.00402140
add esp, 0xc
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x7c], 6
call fcn.00402930
mov byte [esp + 0x78], 5
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404cb5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x24]
push ecx
add esi, 0xfffffff0
mov dword [esp + 0x38], esp
mov edi, esp
push esi
call fcn.00402ac0
add eax, 0x10
add esp, 4
mov dword [edi], eax
call fcn.004045f0
test eax, eax
jle 0x404d52
push str._nN_k
push 0x462620
lea edi, [esp + 0x38]
call fcn.0040c350
add esp, 8
push 0
mov byte [esp + 0x7c], 7
mov eax, dword [eax]
push 0
push eax
call fcn.00425dc5
mov byte [esp + 0x78], 5
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404d26
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x78], 3
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404d44
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov byte [esp + 0x78], 1
mov eax, dword [esp + 0x20]
jmp 0x405211
mov byte [esp + 0x78], 3
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404d70
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov byte [esp + 0x78], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404d95
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
call esi
test eax, eax
jns 0x404ddc
call esi
cmp al, 4
jae 0x404ddc
push str.This_sample_application_can_be_run_only_on_versions_of_Windows_that_support_the_WIN32_API_for_multi_thread_support.
push 0x462710
lea edi, [esp + 0x38]
call fcn.0040c350
add esp, 8
push 0
mov byte [esp + 0x7c], 8
mov eax, dword [eax]
push 0
push eax
call fcn.00425dc5
mov byte [esp + 0x78], 1
mov eax, dword [esp + 0x30]
jmp 0x405211
mov edi, dword [esp + 0x2c]
cmp dword [edi + 0xa4], 0
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jl 0x404eb9
lea ecx, [esp + 0x24]
push ecx
push 0x2001f
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404eb9
push 0x4622b0
lea ecx, [esp + 0x24]
call fcn.00402680
mov byte [esp + 0x78], 9
cmp dword [edi + 0xa4], 1
mov eax, 0x46276c
je 0x404e43
mov eax, 0x462774
push eax
lea ecx, [esp + 0x24]
call fcn.00402e90
mov esi, dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x24]
push edx
push esi
push 1
push 0
push str.DisableScriptDebuggerIE
push eax
call ebp
push esi
call edi
mov edx, dword [esp + 0x24]
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push 0
push str.Disable_Script_Debugger
push edx
call ebp
mov eax, dword [esp + 0x24]
push eax
call ebx
mov byte [esp + 0x78], 1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404eb5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x2c]
push str.MaxScriptStatements
lea ecx, [esp + 0x20]
call fcn.00402680
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x2c]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerStyles
push SysReAllocString
mov byte [esp + 0x9c], 0xa
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x404f80
cmp dword [0x47678c], 0x231d
jne 0x404f1c
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x404f79
lea edx, [esp + 0x30]
push edx
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x3c]
push ecx
push 0
push edx
mov esi, 4
push eax
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x3c], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0x24]
cmp ecx, dword [esp + 0x20]
je 0x404f79
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push esi
lea edx, [esp + 0x24]
push edx
push esi
push 0
push eax
push ecx
call ebp
mov edx, dword [esp + 0x28]
push edx
call ebx
push 0x80
call fcn.0040f75d
mov esi, eax
add esp, 4
mov dword [esp + 0x2c], esi
test esi, esi
mov byte [esp + 0x78], 0xb
je 0x404fbb
push 0
push 0x88
mov ecx, esi
call fcn.00427f36
mov dword [esi], vtable.CInitMsgDlg.0
mov dword [esi + 0x7c], 0
mov ecx, esi
jmp 0x404fbd
xor ecx, ecx
mov byte [esp + 0x78], 0xa
mov eax, dword [ecx]
mov edx, dword [eax + 0x134]
push 0
push 0x88
mov dword [0x47677c], ecx
call edx
mov ecx, dword [0x47677c]
push 5
call fcn.00413cd0
mov eax, dword [0x47677c]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x90
call fcn.0040f75d
add esp, 4
mov dword [esp + 0x2c], eax
test eax, eax
mov byte [esp + 0x78], 0xc
je 0x40502c
push 0x463344
push 0x462108
push 0x462c9c
push 0x81
mov ecx, eax
call fcn.0042781e
jmp 0x40502e
xor eax, eax
test eax, eax
mov byte [esp + 0x78], 0xa
mov dword [0x476778], eax
jne 0x40505a
mov byte [esp + 0x78], 1
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x405221
push eax
mov ecx, edi
call fcn.00427bb6
push 0x254
call fcn.0040f75d
add esp, 4
mov dword [esp + 0x2c], eax
test eax, eax
mov byte [esp + 0x78], 0xd
je 0x405086
push eax
call fcn.0040d6d0
mov esi, eax
jmp 0x405088
xor esi, esi
test esi, esi
mov byte [esp + 0x78], 0xa
je 0x405208
mov edx, dword [esi]
mov eax, dword [edx + 0x138]
push 0
push 0
push 0xcf8000
push 0x80
mov ecx, esi
call eax
test eax, eax
je 0x4051fd
lea ecx, [esp + 0x48]
mov dword [edi + 0x20], esi
call fcn.004256c4
lea ecx, [esp + 0x48]
push ecx
mov ecx, edi
mov byte [esp + 0x7c], 0xe
call fcn.00424b6e
cmp dword [esp + 0x58], 0
jne 0x4050e3
mov dword [esp + 0x58], 0xffffffff
lea edx, [esp + 0x48]
push edx
mov ecx, edi
call fcn.00427a38
test eax, eax
jne 0x405118
lea ecx, [esp + 0x48]
mov byte [esp + 0x78], 0xa
call fcn.00425703
lea ecx, [esp + 0x1c]
call fcn.00402570
lea ecx, [esp + 0x18]
call fcn.00402570
jmp 0x405255
xor edi, edi
lea ebx, [ebx]
mov ecx, dword [0x4767cc]
test ecx, ecx
je 0x405167
mov eax, dword [0x4767d0]
sub eax, ecx
sar eax, 2
cmp edi, eax
jae 0x405167
cmp edi, 6
jg 0x405167
cmp edi, eax
jb 0x40514c
call fcn.0043fcd0
mov ecx, dword [0x4767cc]
lea eax, [ecx + edi*4]
push eax
lea ecx, [esi + 0xd8]
call fcn.00402930
mov ecx, esi
call fcn.0040db70
add edi, 1
jmp 0x405120
mov ebx, esi
call fcn.0040e770
movzx ecx, byte [esi + 0xdc]
push ecx
push esi
call fcn.0040df00
mov edx, dword [esp + 0x38]
push edx
call fcn.0040f78d
add esp, 4
lea ecx, [esp + 0x48]
mov byte [esp + 0x78], 0xa
call fcn.00425703
mov byte [esp + 0x78], 1
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4051bc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x78], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4051e4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi]
mov eax, dword [edx + 4]
push 1
mov ecx, esi
call eax
mov byte [esp + 0x78], 1
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40522d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x78], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405255
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret