Function at 0x101a56d
Capabilities:
Check mutex on windows
Query or enumerate registry value

Disassembly:
push 0x1047380
push 0x10133a0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
call fcn.0101a6d1
cmp eax, esi
je 0x10231e7
push 0x1013280
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 0xc], ebx
je 0x101309c
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.0101a6d1
cmp eax, esi
je 0x10231dc
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
xor ebx, ebx
inc ebx
push ebx
mov dword [ebp - 0x10], eax
call dword [sym.imp.SHELL32.dll_Ordinal_188]
push esi
push 2
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
call fcn.01019e7b
push esi
push 0x12
push 0x12
push esi
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
call fcn.0101a7cb
push ebx
mov dword [ebp - 0x14], eax
call dword [sym.imp.SHELL32.dll_Ordinal_660]
call fcn.01019ae4
mov dword [0x10466c8], eax
call fcn.01019b6d
mov dword [0x104746c], eax
call fcn.010196f9
call fcn.0101985c
call fcn.0101996c
cmp dword [0x10466c8], esi
je 0x1013120
call fcn.010199d9
call fcn.0101992b
cmp dword [0x10466c4], esi
jne 0x10231f8
call fcn.010197db
cmp dword [0x10466c4], esi
jne 0x1013159
push 0x1013244
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, eax
call sub.SHDOCVW.dll_Ordinal_125
cmp ebx, esi
je 0x1013159
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x104746c], esi
push 3
pop ebx
je 0x1019632
push esi
call fcn.0101826d
call dword [sym.imp.SHDOCVW.dll_Ordinal_110]
mov dword [ebp - 8], esi
mov dword [ebp + 8], esi
mov dword [ebp - 4], esi
call fcn.01013365
test eax, eax
jne 0x10131b2
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHLWAPI.dll_SHCreateThreadRef]
test eax, eax
jl 0x10131a1
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHSetThreadRef]
call fcn.010132c3
mov dword [ebp - 4], eax
lea eax, [ebp + 8]
push eax
call fcn.010051c6
cmp dword [ebp - 0xc], esi
je 0x10131c0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp - 4], esi
je 0x1023298
push esi
push 1
push 0x590
push dword [0x1046094]
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.0101353e
call fcn.0101369a
call fcn.0101340b
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.010134fd
cmp dword [0x10466e0], esi
jne 0x1023239
push 0x15
push 0x101322c
call fcn.0100fa1f
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push dword [ebp - 4]
call sub.SHELL32.dll_Ordinal_201
jmp 0x1023286
call fcn.010195e9
inc eax
push eax
call fcn.0101968a
call fcn.01019655
test eax, eax
je 0x1013168
jmp 0x1023202
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edi, dword [ebp + 8]
push edi
call fcn.0101a95e
call sub.SHLWAPI.dll_Ordinal_241_1
xor esi, esi
push esi
push edi
push 0x1047578
mov ecx, 0x1046f00
mov dword [0x10466e0], eax
mov dword [0x10460dc], edi
call fcn.0101a8a3
test eax, eax
jl 0x10232c1
call fcn.0101a685
call dword [sym.imp.USER32.dll_GetShellWindow]
test eax, eax
jne 0x101a5f2
cmp dword [0x10466c4], esi
jne 0x101a5f2
push esi
push esi
push esi
push esi
push esi
push esi
push 0x101a664
push 0x101a608
call dword [sym.imp.SHLWAPI.dll_SHRegGetUSValueW]
test eax, eax
je 0x10231c2
push ebx
push 0x10460a4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x10231d2
push 0x1023324
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x101a5f2
call fcn.0102b455
jmp 0x101305b
cmp ebx, esi
je 0x10231e7
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
call fcn.0102b1c3
jmp 0x10232b6
call fcn.0102b237
jmp 0x101312c
lea eax, [ebp - 4]
push eax
push 0x102333c
push ebx
push esi
push 0x100837c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1013168
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push 5
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1013168
call edi
push dword [ebp - 0x10]
mov edi, eax
push ebx
push 1
push 0x10232f8
push esi
call sub.SHLWAPI.dll_Ordinal_244_1
push edi
push ebx
push ebx
push 0x10232d0
push esi
call sub.SHLWAPI.dll_Ordinal_244_1
jmp 0x1013203
push esi
push esi
push esi
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x1023286
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 8], esi
jne 0x1023261
push 1
call fcn.0101826d
push esi
call fcn.0101968a
call dword [sym.imp.SHDOCVW.dll_Ordinal_111]
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [ebp - 0x14], esi
jl 0x10232af
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.SHELL32.dll_Ordinal_188]
push 0x1046f00
call fcn.0102ae3e
pop ebx
call fcn.0103bd0f
xor eax, eax
pop edi
inc eax
pop esi
leave
ret 0x10