Function at 0x4d2550
Capabilities:
Check mutex on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x64
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, 0xffffff02
test ecx, ecx
je 0x4d25c3
mov esi, dword [ebp + 8]
cmp byte [ecx + 0xb], 0
js 0x4d25d9
xor eax, eax
mov byte [ecx], al
mov byte [ecx + 0xb], al
movsx eax, byte [esi + 0xb]
test eax, eax
jns 0x4d258c
mov eax, dword [esi + 4]
test eax, eax
je 0x4d25c3
lea edi, [ebx + 4]
mov eax, dword [ebx + 4]
lea ecx, [eax + 1]
cmp ecx, 1
ja 0x4d25b3
xor eax, eax
push str.oauc_registry_mutex
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x4d25fc
mov dword [ebp - 0x60], edi
mov edi, 0xffffff04
lea ecx, [eax + 1]
cmp ecx, 2
jae 0x4d25e7
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, edi
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov eax, dword [ecx]
mov byte [eax], 0
mov dword [ecx + 4], 0
jmp 0x4d2581
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4d262f
xor edi, edi
inc edi
jmp 0x4d25c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x4d260b
mov eax, dword [edi]
jmp 0x4d25b3
push str.oauc_registry_mutex
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [edi], eax
jmp 0x4d25b3
mov eax, ecx
shr eax, 0x15
mov byte [eax + 0x7bc788], 1
jmp 0x4d2657
mov ecx, dword [ebp - 0x60]
mov edx, ecx
shr edx, 0xe
mov eax, ecx
shr eax, 0x13
mov dword [ebp - 0x6c], eax
mov eax, dword [eax*4 + 0x7b4788]
mov dword [ebp - 0x70], edx
bt eax, edx
jae 0x4d2621
push ecx
call fcn.00545e50
add esp, 4
cmp byte [ebx + 0x14], 1
jne 0x4d2711
xor eax, eax
dec eax
lea edi, [ebp - 0x5c]
mov dword [edi + 0x44], eax
mov dword [edi + 0x40], eax
pcmpeqd xmm0, xmm0
movdqu xmmword [edi + 0x30], xmm0
movdqu xmmword [edi + 0x20], xmm0
movdqu xmmword [edi + 0x10], xmm0
movdqu xmmword [edi], xmm0
add ebx, 8
mov ecx, edi
mov edx, ebx
call fcn.004d2280
lea eax, [ebp - 0x14]
xor ecx, ecx
dec ecx
mov dword [eax], ecx
mov ecx, dword [edi + 0x44]
push eax
push 2
push 0x74098d
call fcn.005ea9e0
test al, al
je 0x4d26b9
mov ecx, dword [ebp - 0x14]
cmp byte [ecx + 0xc], 6
je 0x4d2867
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x4d26d8
dec dword [esi + 4]
jne 0x4d26d8
mov eax, dword [esi]
mov edi, dword [eax + 0x18]
mov ecx, edi
call dword [0x7a29f4]
mov ecx, esi
push 1
call edi
lea ecx, [ebp - 0x5c]
call fcn.005346a0
xor edi, edi
mov esi, dword [ebp - 0x60]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax*4 + 0x7b4788]
mov ecx, dword [ebp - 0x70]
bt eax, ecx
jae 0x4d25c3
push esi
call fcn.00545f70
add esp, 4
jmp 0x4d25c3
mov dword [ebp - 0x14], 0xffffffff
lea edi, [ebp - 0x5c]
push edi
call fcn.004bfed0
add esp, 4
cmp byte [edi + 0xb], 0
jns 0x4d272d
mov edi, dword [ebp - 0x5c]
lea eax, [ebp - 0x14]
push eax
push 1
push 0
push edi
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp byte [ebp - 0x51], 0
jns 0x4d2756
push dword [ebp - 0x5c]
mov edi, eax
call fcn.006507ee
mov eax, edi
add esp, 4
xor ebx, ebx
mov edi, 0
test eax, eax
je 0x4d2798
test ebx, ebx
mov eax, 0x736aef
cmovne eax, ebx
mov ecx, dword [ebp + 0xc]
push eax
call fcn.005cd2f0
test ebx, ebx
je 0x4d26e2
push ebx
call fcn.0065082c
add esp, 4
jmp 0x4d26e2
mov eax, edx
shr eax, 0x15
mov byte [eax + 0x7bc788], 1
jmp 0x4d27c5
lea edx, [ebp - 0x14]
mov ecx, edx
shr ecx, 0xe
xor eax, eax
inc eax
shl eax, cl
mov dword [ebp - 0x68], eax
mov eax, edx
shr eax, 0x13
mov dword [ebp - 0x64], eax
mov eax, dword [eax*4 + 0x7b4788]
bt eax, ecx
jae 0x4d278a
push edx
call fcn.00545e50
add esp, 4
mov dword [ebp - 0x5c], 0xffffffff
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x4d27d6
mov eax, dword [esi]
lea edi, [ebp - 0x5c]
xor ebx, ebx
push edi
push ebx
push ebx
push ebx
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete cl
mov eax, dword [edi]
test eax, eax
setne dl
and dl, cl
mov edi, 0
cmp dl, 1
jne 0x4d2831
inc eax
push eax
call fcn.00650823
add esp, 4
mov ebx, eax
cmp byte [esi + 0xb], 0
jns 0x4d2815
mov esi, dword [esi]
xor edi, edi
lea eax, [ebp - 0x5c]
push eax
push ebx
push edi
push edi
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4d285e
mov edi, 0xffffff04
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x64]
test dword [ecx*4 + 0x7b4788], eax
je 0x4d2761
lea eax, [ebp - 0x14]
push eax
call fcn.00545f70
add esp, 4
jmp 0x4d2761
mov eax, dword [ebp - 0x5c]
mov byte [ebx + eax], 0
jmp 0x4d2831
call fcn.005d4240
movsx edx, byte [esi + 0xb]
test edx, edx
jns 0x4d2879
mov edx, dword [esi + 4]
mov esi, dword [esi]
test edx, edx
js 0x4d2911
sete cl
test esi, esi
setne ch
or ch, cl
je 0x4d2911
mov ecx, eax
push edx
push esi
call fcn.00531660
test eax, eax
je 0x4d26b9
mov edi, eax
movsx eax, byte [eax + 0xb]
mov ecx, edi
test eax, eax
jns 0x4d28c3
mov eax, dword [edi + 4]
test eax, eax
js 0x4d2911
mov ecx, dword [edi]
sete dl
test ecx, ecx
setne dh
or dh, dl
je 0x4d2911
push eax
push ecx
call fcn.005da4e0
add esp, 8
cmp edi, dword [ebp + 0xc]
je 0x4d26b9
test al, al
je 0x4d26b9
mov ecx, dword [ebp + 0xc]
cmp byte [ecx + 0xb], 0
movzx eax, byte [edi + 0xb]
js 0x4d2913
test al, al
js 0x4d2902
mov eax, dword [edi + 8]
mov dword [ecx + 8], eax
movq xmm0, qword [edi]
movq qword [ecx], xmm0
jmp 0x4d26b9
push dword [edi + 4]
push dword [edi]
call fcn.005cd8a0
jmp 0x4d26b9
ud2
test al, al
jns 0x4d291c
mov eax, dword [edi + 4]
mov edi, dword [edi]
push eax
push edi
call fcn.005cd770
jmp 0x4d26b9