Function at 0x104095c
Capabilities:
Accept command line arguments
Check mutex on windows
Create process on windows
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa5c
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0xa34], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [sym.imp.ole32.dll_CoInitialize]
xor edi, edi
push edi
mov ebx, eax
call esi
push edi
mov dword [ebp - 0xa2c], eax
mov dword [ebp - 0xa30], edi
call esi
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
xor eax, eax
lea edi, [ebp - 0xa40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ecx, 0x1074c44
mov dword [ebp - 0xa40], 8
mov dword [ebp - 0xa3c], 0x20ff
call fcn.0103316a
lea eax, [ebp - 0xa40]
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push ebx
push 0x10044e0
push 4
call fcn.01055c69
add esp, 0xc
cmp dword [ebp - 0xa2c], 0
jge 0x1040a03
mov eax, dword [ebp - 0xa2c]
jmp 0x1041395
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x100
lea eax, [ebp - 0x618]
push eax
push 0x64
push dword [ebp - 0xa34]
call edi
test eax, eax
jne 0x1040a32
xor esi, esi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
jmp 0x1041395
push 0x10044a0
call dword [sym.imp.SHELL32.dll_SetCurrentProcessExplicitAppUserModelID]
push 0x100447c
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, dword [sym.imp.msvcrt.dll_wcsstr]
mov dword [ebp - 0xa28], eax
test eax, eax
je 0x1040a69
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1040a91
test ebx, ebx
je 0x104130b
push 0x1004468
push ebx
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1040a91
push 0x1004454
push ebx
call esi
pop ecx
pop ecx
test eax, eax
je 0x10412e1
xor edi, edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
test eax, eax
jge 0x1040aab
push 0x1004410
push 2
call fcn.01055c2f
mov eax, dword [ebp - 0xa34]
mov dword [0x1073960], eax
cmp ebx, edi
je 0x1040ae8
push 0x1001ff8
push ebx
call esi
pop ecx
pop ecx
test eax, eax
je 0x1040ad4
call fcn.010342e4
mov esi, eax
jmp 0x1040a25
push 0x10043f0
push ebx
call esi
pop ecx
pop ecx
test eax, eax
je 0x1040ae8
mov dword [0x1072b8c], edi
call fcn.01034065
push edi
mov dword [0x1072134], 1
call fcn.01033da4
cmp ebx, edi
je 0x1040cdb
push 0x1001df0
push ebx
call esi
neg eax
sbb eax, eax
neg eax
push 0x10043dc
push ebx
mov dword [0x107399c], eax
call esi
add esp, 0x10
test eax, eax
je 0x1040b3b
xor edi, edi
mov dword [0x1073a18], 1
mov dword [0x107226c], edi
jmp 0x1040b42
call fcn.010340e2
xor edi, edi
cmp dword [0x107399c], edi
je 0x1040b50
mov dword [0x107226c], edi
push 0x105
lea eax, [ebp - 0xa24]
push eax
push 0xdb
push dword [0x1073960]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1040bf9
lea eax, [ebp - 0xa24]
push 0x10043d8
push eax
mov dword [ebp - 0xa38], 1
mov dword [ebp - 0xa2c], edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1040ba5
mov dword [ebp - 0xa38], edi
jmp 0x1040bab
mov dword [0x107226c], edi
push edi
lea eax, [ebp - 0xa2c]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push 0x1002038
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1040bf9
push 4
lea eax, [ebp - 0xa38]
push eax
push 4
push edi
push 0x10043c0
push dword [ebp - 0xa2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xa2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1002088
push ebx
call esi
pop ecx
pop ecx
test eax, eax
je 0x1040c0d
push ebx
call fcn.01034414
mov edi, 0x1001e30
push edi
push ebx
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1040c4a
push 0x100439c
push ebx
call esi
pop ecx
pop ecx
test eax, eax
je 0x1040c4a
push ebx
call fcn.010344b9
call fcn.0103694b
test eax, eax
je 0x1040c4a
push 0x1004374
push 2
call fcn.01055c2f
jmp 0x1040a23
push 0x1004368
push ebx
call esi
neg eax
sbb eax, eax
neg eax
push edi
push ebx
mov dword [0x10739a0], eax
call esi
add esp, 0x10
test eax, eax
je 0x1040cb8
xor eax, eax
mov dword [ebp - 0xa38], eax
mov dword [ebp - 0xa30], eax
mov dword [0x107399c], eax
call fcn.01042f5c
call fcn.010356f2
push 0x105
lea eax, [ebp - 0x418]
push eax
call fcn.01058ed0
test eax, eax
je 0x1040cb4
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.010569a5
push 3
jmp 0x1040ccc
push 0x1004344
push ebx
call esi
pop ecx
pop ecx
test eax, eax
je 0x1040d53
push 4
call fcn.01033da4
mov dword [0x1072134], 5
xor edi, edi
cmp dword [0x107399c], edi
je 0x1040ce8
mov dword [ebp + 0x14], edi
push 0x1073a20
push 0x1073a28
push 0x10332b1
push 0x1001aac
call fcn.01033308
lea eax, [ebp - 0x618]
push eax
push dword [ebp + 0x14]
push dword [ebp - 0xa34]
call fcn.0104088d
mov dword [ebp - 0xa30], eax
cmp eax, edi
jne 0x104116f
cmp dword [ebp - 0xa28], edi
je 0x1040d44
push dword [ebp - 0xa28]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0xa28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1073a20
call fcn.01033334
jmp 0x1040a23
push 0x1004334
push ebx
call esi
pop ecx
pop ecx
test eax, eax
je 0x1040da8
push 0x200
lea eax, [ebp - 0x204]
push eax
push ebx
call fcn.01036f65
test eax, eax
jl 0x1040a23
push 0x100430c
push ebx
xor edi, edi
call esi
pop ecx
pop ecx
test eax, eax
je 0x1040d8c
inc edi
push edi
push 1
lea eax, [ebp - 0x204]
push eax
call fcn.01037590
test eax, eax
jge 0x1040a23
jmp 0x1040acd
mov edi, 0x1003540
push edi
push ebx
call esi
pop ecx
pop ecx
test eax, eax
jne 0x10410a3
push 0x1003524
push ebx
call esi
pop ecx
pop ecx
test eax, eax
jne 0x10410a3
push 0x1004468
push ebx
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1040fe7
push 0x10042f4
push ebx
call esi
pop ecx
pop ecx
mov edi, 0x10042d8
test eax, eax
jne 0x1040e00
push edi
push ebx
call esi
pop ecx
pop ecx
test eax, eax
je 0x1040cdb
push 0x10042b8
push 4
call fcn.01055c2f
xor eax, eax
push eax
push eax
push eax
push 6
call fcn.01058952
test eax, eax
jne 0x1040a23
push edi
push ebx
call esi
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
pop ecx
pop ecx
test eax, eax
je 0x1040e51
push 0x100
lea eax, [ebp - 0x618]
push eax
push 0x81
push dword [ebp - 0xa34]
call edi
test eax, eax
je 0x1040a23
call fcn.010356f2
test eax, eax
je 0x1040ea7
push 0x105
lea eax, [ebp - 0x418]
push eax
push 0x127
push dword [ebp - 0xa34]
call edi
test eax, eax
je 0x1040ea7
movzx eax, byte [0x1074c46]
neg eax
sbb eax, eax
and eax, 0x180000
or eax, 0x30
push eax
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x418]
push eax
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1040a25
call fcn.01033fea
test eax, eax
jne 0x1040eb9
call fcn.01033fcb
test eax, eax
je 0x1040ed6
push 0x105
lea eax, [ebp - 0x418]
push eax
push 0x128
push dword [ebp - 0xa34]
call edi
test eax, eax
jne 0x1040e77
push 0x10042d8
push ebx
call esi
pop ecx
pop ecx
test eax, eax
push 0x105
lea eax, [ebp - 0x418]
push eax
je 0x1040f01
mov dword [0x10739ac], 1
push 0x117
jmp 0x1040f06
push 0x110
push dword [0x1073960]
call edi
xor esi, esi
cmp eax, esi
jle 0x1040a25
movzx eax, byte [0x1074c46]
neg eax
sbb eax, eax
and eax, 0x180000
or eax, 0x131
push eax
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x418]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x1040a25
push 2
call fcn.01033da4
lea eax, [ebp - 0x618]
push eax
push dword [ebp + 0x14]
mov dword [0x1072134], 3
push dword [ebp - 0xa34]
call fcn.0104088d
mov ebx, eax
cmp ebx, esi
jne 0x1040fa1
cmp dword [ebp - 0xa28], esi
je 0x1040a25
push dword [ebp - 0xa28]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0xa28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1040a25
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x1040fd5
lea eax, [ebp - 0xa5c]
push eax
push ebx
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x1040fd5
lea eax, [ebp - 0xa5c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0xa5c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
push esi
lea eax, [ebp - 0xa5c]
push eax
call edi
test eax, eax
jne 0x1040fa9
jmp 0x1040f78
call fcn.0105c780
test eax, eax
jne 0x104108d
xor ebx, ebx
cmp dword [0x107399c], ebx
jne 0x1041064
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
mov edi, 0x100
push edi
lea eax, [ebp - 0x818]
push eax
push 0xba
push dword [0x1073960]
call esi
test eax, eax
je 0x1041064
push edi
lea eax, [ebp - 0x204]
push eax
push 0xad
push dword [0x1073960]
call esi
test eax, eax
je 0x1041064
movzx eax, byte [0x1074c46]
neg eax
sbb eax, eax
and eax, 0x180000
or eax, 0x10
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x818]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [ebp - 0xa28], ebx
je 0x1040a23
push dword [ebp - 0xa28]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0xa28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1040a23
push 1
call fcn.01033da4
mov dword [0x1072134], 2
jmp 0x1040cdb
and dword [ebp - 0xa38], 0
push edi
push ebx
mov dword [ebp - 0xa2c], 1
call esi
pop ecx
pop ecx
test eax, eax
je 0x10410c5
and dword [ebp - 0xa2c], 0
push 0x100430c
push ebx
call esi
pop ecx
pop ecx
test eax, eax
je 0x10410dd
mov dword [ebp - 0xa38], 1
push 0x200
lea eax, [ebp - 0x818]
push eax
push ebx
call fcn.01036f65
test eax, eax
jl 0x1041133
push dword [ebp - 0xa38]
lea eax, [ebp - 0x818]
push dword [ebp - 0xa2c]
push eax
call fcn.01037590
mov dword [ebp - 0xa30], eax
lea eax, [ebp - 0x818]
push 0x100173c
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1041133
push 0x1001794
call fcn.0105c8c4
mov esi, dword [ebp - 0xa30]
jmp 0x1040a25
lea eax, [ebp - 0xa5c]
push eax
push dword [ebp - 0xa30]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x104116f
lea eax, [ebp - 0xa5c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0xa5c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push edi
push edi
push edi
lea eax, [ebp - 0xa5c]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x104113e
push edi
call fcn.01034009
cmp ebx, edi
je 0x10411b7
push 0x1001e30
push ebx
call esi
pop ecx
pop ecx
test eax, eax
je 0x10411a4
push edi
push edi
call fcn.01044ad8
jmp 0x10411b7
push 0x100401c
push ebx
call esi
pop ecx
pop ecx
test eax, eax
je 0x10411b7
call fcn.010369c6
push 0x1073a20
call fcn.01033334
mov ecx, dword [0x10739c8]
cmp ecx, edi
je 0x10411d8
push 1
call fcn.010340bc
mov dword [0x10739c8], edi
mov ecx, dword [0x10739cc]
cmp ecx, edi
je 0x10411ef
push 1
call fcn.010344fc
mov dword [0x10739cc], edi
mov ecx, dword [0x10739d0]
cmp ecx, edi
je 0x1041206
push 1
call fcn.010344fc
mov dword [0x10739d0], edi
mov ecx, dword [0x10739d4]
cmp ecx, edi
je 0x104121d
push 1
call fcn.010344fc
mov dword [0x10739d4], edi
push dword [ebp - 0xa30]
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp dword [ebp - 0xa28], edi
je 0x1041249
push dword [ebp - 0xa28]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0xa28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x10739a8], edi
je 0x10412c5
cmp dword [0x1072610], edi
je 0x10412c5
cmp dword [0x1072b8c], edi
je 0x10412c5
cmp dword [0x1073998], edi
jne 0x10412c5
mov esi, 0x104
push esi
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.01058c2d
test eax, eax
je 0x10412c5
lea eax, [ebp - 0x20c]
push eax
call fcn.01055e3d
push 0x100429c
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01035886
test eax, eax
jl 0x10412c5
lea eax, [ebp - 0x20c]
push eax
call fcn.010561ca
test eax, eax
je 0x10412c5
push 0xa
push edi
push edi
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.010555dc
mov esi, dword [sym.imp.ole32.dll_CoUninitialize]
call esi
mov edi, dword [0x10739b4]
call esi
mov eax, edi
jmp 0x1041395
push 0x1001e30
push ebx
call esi
pop ecx
pop ecx
test eax, eax
jne 0x104136c
push 0x100427c
push ebx
call esi
pop ecx
pop ecx
test eax, eax
jne 0x104136c
push 0x1001df0
push ebx
call esi
pop ecx
pop ecx
test eax, eax
jne 0x104136c
mov esi, 0x100
push esi
lea eax, [ebp - 0x818]
push eax
push 0xac
push dword [0x1073960]
call edi
test eax, eax
je 0x104136c
push esi
lea eax, [ebp - 0x204]
push eax
push 0xad
push dword [0x1073960]
call edi
test eax, eax
je 0x104136c
movzx eax, byte [0x1074c46]
neg eax
sbb eax, eax
and eax, 0x180000
or eax, 0x10
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x818]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [ebp - 0xa28], 0
je 0x104138d
push dword [ebp - 0xa28]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0xa28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047464
leave
ret 0x10