Function at 0x1071faf
Capabilities:
Create process on windows
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6b8
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 0x624]
push eax
push 0x20019
xor ebx, ebx
push ebx
mov edi, 0x1015388
push edi
push 0x80000002
mov dword [ebp - 0x634], ecx
call esi
test eax, eax
jne 0x1072360
lea eax, [ebp - 0x628]
push eax
push 3
push ebx
push edi
push 0x80000001
call esi
test eax, eax
jne 0x1072354
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x674]
push eax
push ebx
push ebx
push 0x107249c
push dword [ebp - 0x628]
mov dword [ebp - 0x620], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10720ac
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x664]
push eax
call esi
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x674]
push eax
call esi
lea eax, [ebp - 0x63c]
push eax
call fcn.0104b44b
mov esi, eax
lea eax, [ebp - 0x630]
push eax
mov edi, edx
call fcn.0104b44b
sub eax, esi
sbb edx, edi
cmp edx, 0xc9
jb 0x1072348
ja 0x10720ac
cmp eax, 0x2a69c000
jb 0x1072348
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x62c]
push eax
push ebx
push ebx
push 0x107247c
push dword [ebp - 0x624]
mov dword [ebp - 0x620], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10720e7
mov dword [ebp - 0x62c], 0x927c0
jmp 0x10720f9
mov eax, dword [ebp - 0x62c]
imul eax, eax, 0x3e8
mov dword [ebp - 0x62c], eax
push 8
pop esi
lea eax, [ebp - 0x63c]
push eax
mov dword [ebp - 0x63c], esi
call dword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x107212b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x638]
cmp eax, dword [ebp - 0x62c]
jb 0x1072348
xor eax, eax
mov ecx, esi
lea edi, [ebp - 0x654]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x654]
push eax
push ebx
push ebx
push 0x107244c
push dword [ebp - 0x624]
mov dword [ebp - 0x620], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10721dc
mov ax, word [ebp - 0x650]
cmp ax, bx
je 0x107217f
cmp ax, word [ebp - 0x660]
jne 0x1072348
cmp word [ebp - 0x64e], bx
je 0x10721a9
mov ax, word [ebp - 0x65e]
cmp word [ebp - 0x64e], ax
jb 0x1072348
cmp ax, word [ebp - 0x63e]
ja 0x1072348
cmp word [ebp - 0x64c], bx
jne 0x10721bb
cmp word [ebp - 0x63c], bx
je 0x10721dc
mov ax, word [ebp - 0x65c]
cmp word [ebp - 0x64c], ax
ja 0x1072348
cmp ax, word [ebp - 0x63c]
ja 0x1072348
mov eax, dword [ebp - 0x634]
mov eax, dword [eax + 0xc08]
mov esi, 0x104
cmp eax, ebx
je 0x1072230
push esi
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.0100af93
test eax, eax
jl 0x1072348
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
cmp eax, ebx
je 0x1072348
push 0x1072440
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpICW]
test eax, eax
jne 0x1072348
push 0x1072414
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x1072348
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1072348
mov esi, 0x208
push esi
lea eax, [ebp - 0x61c]
push eax
push 0x10723c8
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1072348
push 0x1072378
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.01010e3b
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.01010e3b
push 0x1072370
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.01010e3b
push 0x44
pop esi
push esi
lea eax, [ebp - 0x6b8]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x644]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x6b8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x61c]
push eax
push ebx
mov dword [ebp - 0x6b8], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1072348
push dword [ebp - 0x644]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x640]
call esi
push 0x10
lea eax, [ebp - 0x664]
push eax
push 3
push ebx
push 0x107249c
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x634]
push ebx
push 1
push dword [0x10b10ec]
call fcn.01070e65
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001feb
leave
ret