Function at 0x10010c5
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Check os version
Create process on windows
Query or enumerate registry value
Set current directory
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xac
push ebx
xor ebx, ebx
push ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x40], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call fcn.01001529
test al, al
jne 0x10017eb
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x100182f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
jl 0x1001832
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x24], eax
push 0x10012e8
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x10018dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10018ae
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push 0x1001318
push 0x80000002
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100120d
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x2c]
push eax
push ebx
lea eax, [ebp - 0x28]
push eax
push ebx
push 0x100135c
push dword [ebp - 0x1c]
call esi
test eax, eax
jne 0x1001201
cmp dword [ebp - 0x28], 1
jne 0x1001201
push dword [ebp - 0x2c]
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x1001201
lea ecx, [ebp - 0x2c]
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
push 0x100135c
push dword [ebp - 0x1c]
call esi
test eax, eax
jne 0x10011f4
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push dword [ebp - 0xc]
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], ebx
push dword [ebp - 4]
call fcn.01001630
test al, al
jne 0x10018f1
push 0x1001374
mov byte [ebp - 5], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1001991
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0xbb8
push edi
call esi
push 0xfa0
push edi
mov dword [ebp - 4], eax
call esi
push 0x1001364
push edi
mov dword [ebp - 0xc], eax
call esi
cmp dword [ebp - 4], ebx
mov esi, eax
je 0x10014ff
cmp dword [ebp - 0xc], ebx
je 0x10014ff
cmp esi, ebx
je 0x1001975
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [ebp - 0xc]
test eax, eax
jne 0x10014ff
lea eax, [ebp - 0xac]
push eax
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0xac], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
test byte [ebp - 0x80], 1
jne 0x10014f6
push 0xa
pop eax
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x44]
call dword [ebp - 4]
cmp eax, 0x80070005
mov dword [ebp - 0x40], eax
setne byte [ebp - 5]
jmp 0x10014ff
movzx eax, word [ebp - 0x7c]
jmp 0x10012cd
cmp esi, ebx
jne 0x100196f
jmp 0x1001975
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push 0xc0000002
push ebx
push 0x2900
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
je 0x100182f
push 0x1001b1c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x10
push 0x1001aa8
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
leave
ret
push 0x1001b14
push dword [ebp - 4]
call fcn.010015ca
test eax, eax
pop ecx
pop ecx
je 0x1001141
push dword [ebp - 4]
call edi
mov esi, eax
lea eax, [esi + esi + 2]
push eax
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x100114a
inc esi
push esi
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x10018a6
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1001892
call esi
jmp 0x100189e
call esi
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jl 0x100114a
mov eax, dword [ebp - 0x18]
jmp 0x1001147
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 0x1001c88
mov dword [ebp - 0x10], ebx
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
je 0x10018d0
push eax
call fcn.01001d30
push dword [ebp - 0x24]
call fcn.01001c99
jmp 0x1001a6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1001174
jmp 0x1001a6a
cmp dword [ebp - 4], ebx
mov esi, 0x1001b00
je 0x1001955
push dword [ebp - 4]
call edi
push esi
mov dword [ebp - 0xc], eax
call edi
mov ecx, dword [ebp - 0xc]
lea eax, [ecx + eax + 1]
push eax
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, ebx
je 0x1001955
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0xa
push ebx
push edi
push 0x1001af0
push 0x1001b0c
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push edi
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1001a6a
push 0xa
push ebx
push esi
push 0x1001af0
push 0x1001b0c
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x1001a6a
call esi
test eax, eax
jne 0x100197c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.ole32.dll_CoFreeUnusedLibraries]
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp byte [ebp - 5], bl
jne 0x1001a6a
mov eax, dword [ebp - 0x20]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [ebp - 4], ebx
mov edi, 0x2900
je 0x1001a03
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x30]
shr eax, 0x10
mov dword [ebp - 0x64], eax
movzx eax, word [ebp - 0x30]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x3c]
shr eax, 0x10
mov dword [ebp - 0x5c], eax
movzx eax, word [ebp - 0x3c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x38]
shr eax, 0x10
mov dword [ebp - 0x54], eax
movzx eax, word [ebp - 0x38]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x34]
shr eax, 0x10
mov dword [ebp - 0x4c], eax
movzx eax, word [ebp - 0x34]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x68]
push eax
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0xc0000003
push ebx
push edi
call esi
mov eax, dword [ebp - 4]
cmp eax, ebx
jne 0x1001a0c
mov dword [ebp - 0xc], 0x1001b0a
jmp 0x1001a0f
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0xc0000001
push ebx
push edi
call esi
test eax, eax
je 0x1001a5c
push 0x1001b1c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x14
push 0x1001aa8
push dword [ebp - 4]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x1001a5c
push 0xa
push ebx
push ebx
push 0x1001ac0
push 0x1001b0c
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [ebp - 4], ebx
je 0x1001a6a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x20], ebx
pop edi
pop esi
je 0x1001a7e
push dword [ebp - 0x20]
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x18], ebx
je 0x1001a90
push dword [ebp - 0x18]
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x10], ebx
je 0x1001a9e
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_ExitProcess]