Function at 0x1012215
Capabilities:
Check mutex on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edi, dword [ebp + 8]
push edi
call fcn.0101617b
call sub.SHLWAPI.dll_Ordinal_241
xor esi, esi
push esi
push edi
push 0x1040510
mov ecx, 0x1040338
mov dword [0x103f7f0], eax
mov dword [0x103f654], edi
call fcn.01016021
test eax, eax
jl 0x1020915
call fcn.01015e8e
call dword [sym.imp.USER32.dll_GetShellWindow]
test eax, eax
jne 0x1012298
cmp dword [0x103f7d4], esi
jne 0x1012298
push esi
push esi
push esi
push esi
push esi
push esi
push 0x101cfdc
push 0x101cf80
call dword [sym.imp.SHLWAPI.dll_SHRegGetUSValueW]
test eax, eax
je 0x1020846
push ebx
push 0x103f0e0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.01015b6d
push 0x1040498
push 0x101d408
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
call fcn.01015ece
cmp eax, esi
je 0x1020861
push 0x101cf54
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 4], ebx
je 0x10122ea
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.01015ece
cmp eax, esi
je 0x1020856
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
xor ebx, ebx
inc ebx
push ebx
mov dword [ebp - 8], eax
call dword [sym.imp.SHELL32.dll_Ordinal_188]
push esi
push 2
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
call fcn.01015b0d
push esi
push 0x12
push 0x12
push esi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
call fcn.01015f7c
push ebx
mov dword [ebp - 0xc], eax
call dword [sym.imp.SHELL32.dll_Ordinal_660]
call fcn.0101412b
mov dword [0x103f7d8], eax
call fcn.01014186
mov dword [0x10404ec], eax
call fcn.010140c2
call fcn.0101427e
cmp dword [0x103f7d8], esi
je 0x1012369
call fcn.01014315
call fcn.01014225
cmp dword [0x103f7d4], esi
jne 0x1020872
call fcn.010141bb
cmp dword [0x103f7d4], esi
jne 0x10123a7
push 0x101cf18
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, eax
call sub.SHDOCVW.dll_Ordinal_125
call fcn.010142e4
cmp ebx, esi
je 0x10123a7
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x10404ec], esi
je 0x102087c
push esi
call fcn.01014254
call dword [sym.imp.SHDOCVW.dll_Ordinal_110]
xor ebx, ebx
call fcn.010140a3
test eax, eax
jne 0x10123d1
call fcn.0101245c
mov ebx, eax
cmp dword [ebp - 4], esi
je 0x10123df
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp ebx, esi
je 0x101244b
push esi
push 1
push 0x590
push dword [0x103f070]
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.01012600
call fcn.010126b1
call fcn.0101256e
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.010125d0
cmp dword [0x103f7f0], esi
jne 0x10208cd
push 0x15
push 0x101cf00
call fcn.01011ab0
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
call sub.SHELL32.dll_Ordinal_201
push 1
call fcn.01014254
push esi
call fcn.01028152
call dword [sym.imp.SHDOCVW.dll_Ordinal_111]
call dword [sym.imp.ole32.dll_OleUninitialize]
jmp 0x10208f8
push 0x1027500
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x1012298
cmp ebx, esi
je 0x1020861
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
call fcn.01027fe8
jmp 0x102090a
call fcn.01028045
jmp 0x1012375
call fcn.01028121
inc eax
push eax
call fcn.01028152
call fcn.010281a4
test eax, eax
je 0x10123b3
lea eax, [ebp + 8]
push eax
push 0x1027518
push 3
push esi
push 0x101b0a4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x10123b3
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push 5
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x10123b3
call edi
push dword [ebp - 8]
mov edi, eax
push 3
push 1
push 0x10274d4
push esi
call sub.SHLWAPI.dll_Ordinal_244
push edi
push 3
push 3
push 0x10274ac
push esi
call sub.SHLWAPI.dll_Ordinal_244
jmp 0x101241d
cmp dword [ebp - 0xc], esi
jl 0x1020903
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.SHELL32.dll_Ordinal_188]
push 0x1040338
call fcn.01027caf
pop ebx
call fcn.01034e1e
xor eax, eax
pop edi
inc eax
pop esi
leave
ret 0x10