Function at 0x10022d0
Capabilities:
Check mutex on windows
Delete file
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
push 0x58
push 0x1001548
call fcn.01002db4
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x4c], esi
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jg 0x1002316
cmp eax, 3
jge 0x100267c
cmp dword [ebp + 8], esi
je 0x100267c
lea eax, [eax + eax*2]
shl eax, 3
mov dword [ebp - 0x50], eax
push dword [eax + 0x100800c]
push dword [ebp + 8]
cmp dword [eax + 0x1008010], esi
je 0x1002344
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
jmp 0x100234d
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
jne 0x100235b
cmp dword [ebp - 0x1c], esi
je 0x100267c
lea eax, [ebp - 0x4c]
push eax
push 0x20019
push esi
push 0x10014f0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100267c
push 4
pop ebx
mov dword [ebp - 0x44], ebx
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 0x10014e0
push dword [ebp - 0x4c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call edi
cmp eax, esi
je 0x10023af
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100267c
mov dword [ebp - 0x44], ebx
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push 0x10014cc
push dword [ebp - 0x4c]
call edi
mov edi, eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4c], esi
cmp edi, esi
jne 0x100267c
xor edi, edi
inc edi
cmp dword [ebp - 0x54], edi
je 0x10023f2
cmp dword [ebp - 0x54], esi
je 0x10023f2
cmp dword [ebp - 0x54], 3
je 0x10023f2
mov dword [ebp - 0x54], edi
cmp dword [ebp - 0x58], edi
je 0x10023ff
cmp dword [ebp - 0x58], esi
je 0x10023ff
mov dword [ebp - 0x58], edi
mov ebx, dword [ebp - 0x50]
push dword [ebx + 0x1008008]
push esi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x5c], eax
cmp eax, esi
je 0x100267c
cmp dword [ebp + 0xc], 2
jne 0x1002428
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], esi
mov dword [ebp - 4], edi
push 0x493e0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x60], eax
cmp eax, esi
je 0x100244c
cmp eax, 0x80
jne 0x10024ce
lea eax, [ebp - 0x4c]
push eax
push 0xf003f
push esi
push dword [ebx + section..data]
push 0x80000002
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call ebx
mov dword [ebp - 0x60], eax
cmp eax, esi
jne 0x10024ce
push esi
push esi
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x40]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x60], eax
cmp eax, esi
jne 0x10024ce
cmp dword [ebp - 0x40], esi
je 0x10024ce
cmp dword [ebp - 0x38], esi
je 0x10024ce
inc dword [ebp - 0x38]
push edi
push esi
mov eax, dword [ebp - 0x38]
add eax, eax
push eax
call fcn.0100228a
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x10024ce
cmp dword [ebp - 0x54], esi
jne 0x10024df
cmp dword [ebp - 0x58], esi
jne 0x10024df
push dword [ebp + 0xc]
push dword [ebp - 0x38]
push eax
push dword [ebp - 0x4c]
call fcn.010021d6
mov dword [ebp - 4], esi
call fcn.0100262d
or dword [ebp - 4], 0xffffffff
jmp 0x100263b
mov eax, dword [ebp - 0x50]
cmp dword [eax + 0x1008010], esi
je 0x1002504
push edi
push esi
push dword [ebp - 0x3c]
call fcn.0100228a
mov dword [ebp - 0x2c], eax
cmp eax, esi
je 0x10024ce
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x48]
push dword [ebp - 0x30]
lea eax, [ebp - 0x64]
push eax
push esi
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x28]
push esi
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x60], eax
cmp eax, esi
je 0x100253a
cmp eax, 0x103
jne 0x10024ce
cmp eax, 0x103
jne 0x1002585
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4c], esi
lea eax, [ebp - 0x4c]
push eax
push 0xf003f
push esi
push 0x1001470
push 0x80000002
call ebx
mov dword [ebp - 0x60], eax
cmp eax, esi
jne 0x10024ce
mov eax, dword [ebp - 0x50]
push dword [eax + 0x1008004]
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x10024ce
mov edi, dword [ebp - 0x50]
cmp dword [edi + 0x1008010], esi
je 0x10025b1
cmp dword [ebp - 0x64], 3
jne 0x10025a4
push dword [ebp - 0x44]
push dword [ebp - 0x2c]
push dword [ebp - 0x28]
call dword [ebp - 0x20]
jmp 0x10025bb
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x68], esi
jmp 0x10025be
push esi
push dword [ebp - 0x28]
push dword [ebp - 0x24]
call dword [ebp - 0x1c]
mov dword [ebp - 0x68], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x10025e4
cmp dword [0x1008048], esi
je 0x10025d6
cmp dword [ebp - 0x68], esi
je 0x10025e4
cmp dword [ebp - 0x68], esi
je 0x1002504
jmp 0x10024ce
push dword [ebp - 0x28]
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x60], eax
cmp eax, esi
je 0x1002605
cmp eax, 2
je 0x1002605
cmp eax, 3
jne 0x10024ce
cmp dword [edi + 0x1008014], esi
je 0x1002504
cmp dword [0x1008048], esi
je 0x1002504
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1002504
cmp dword [ebp - 0x5c], esi
je 0x1002652
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x4c], esi
je 0x1002660
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x2c], esi
je 0x100266e
push esi
push dword [ebp - 0x2c]
call fcn.010022b2
cmp dword [ebp - 0x28], esi
je 0x100267c
push esi
push dword [ebp - 0x28]
call fcn.010022b2
call fcn.01002ded
ret 8