Function at 0x101a5ed
Capabilities:
Check mutex on windows
Query or enumerate registry value

Disassembly:
push 0x1047380
push 0x10133d0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
call fcn.0101a751
cmp eax, esi
je 0x102329b
push 0x10132b0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 0xc], ebx
je 0x10130cc
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.0101a751
cmp eax, esi
je 0x1023290
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
xor ebx, ebx
inc ebx
push ebx
mov dword [ebp - 0x10], eax
call dword [sym.imp.SHELL32.dll_Ordinal_188]
push esi
push 2
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
call fcn.01019efb
push esi
push 0x12
push 0x12
push esi
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
call fcn.0101a84b
push ebx
mov dword [ebp - 0x14], eax
call dword [sym.imp.SHELL32.dll_Ordinal_660]
call fcn.01019b64
mov dword [0x10466c8], eax
call fcn.01019bed
mov dword [0x104746c], eax
call fcn.01019779
call fcn.010198dc
call fcn.010199ec
cmp dword [0x10466c8], esi
je 0x1013150
call fcn.01019a59
call fcn.010199ab
cmp dword [0x10466c4], esi
jne 0x10232ac
call fcn.0101985b
cmp dword [0x10466c4], esi
jne 0x1013189
push 0x1013274
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, eax
call sub.SHDOCVW.dll_Ordinal_125
cmp ebx, esi
je 0x1013189
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x104746c], esi
push 3
pop ebx
je 0x10196b2
push esi
call fcn.01018341
call dword [sym.imp.SHDOCVW.dll_Ordinal_110]
mov dword [ebp - 8], esi
mov dword [ebp + 8], esi
mov dword [ebp - 4], esi
call fcn.01013395
test eax, eax
jne 0x10131e2
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHLWAPI.dll_SHCreateThreadRef]
test eax, eax
jl 0x10131d1
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHSetThreadRef]
call fcn.010132f3
mov dword [ebp - 4], eax
lea eax, [ebp + 8]
push eax
call fcn.010051fe
cmp dword [ebp - 0xc], esi
je 0x10131f0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp - 4], esi
je 0x102334c
push esi
push 1
push 0x590
push dword [0x1046094]
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.0101389f
call fcn.0101343b
call fcn.01013579
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0101385e
cmp dword [0x10466e0], esi
jne 0x10232ed
push 0x15
push 0x101325c
call fcn.0100fa93
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push dword [ebp - 4]
call sub.SHELL32.dll_Ordinal_201
jmp 0x102333a
call fcn.01019667
inc eax
push eax
call fcn.0101970a
call fcn.010196d5
test eax, eax
je 0x1013198
jmp 0x10232b6
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edi, dword [ebp + 8]
push edi
call fcn.0101a9de
call sub.SHLWAPI.dll_Ordinal_241_1
xor esi, esi
push esi
push edi
push 0x1047578
mov ecx, 0x1046f00
mov dword [0x10466e0], eax
mov dword [0x10460dc], edi
call fcn.0101a923
test eax, eax
jl 0x1023375
call fcn.0101a705
call dword [sym.imp.USER32.dll_GetShellWindow]
test eax, eax
jne 0x101a672
cmp dword [0x10466c4], esi
jne 0x101a672
push esi
push esi
push esi
push esi
push esi
push esi
push 0x101a6e4
push 0x101a688
call dword [sym.imp.SHLWAPI.dll_SHRegGetUSValueW]
test eax, eax
je 0x1023276
push ebx
push 0x10460a4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x1023286
push 0x10233d8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x101a672
call fcn.0102b73d
jmp 0x101308b
cmp ebx, esi
je 0x102329b
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
call fcn.0102b4ab
jmp 0x102336a
call fcn.0102b51f
jmp 0x101315c
lea eax, [ebp - 4]
push eax
push 0x10233f0
push ebx
push esi
push 0x10083b4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1013198
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push 5
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1013198
call edi
push dword [ebp - 0x10]
mov edi, eax
push ebx
push 1
push 0x10233ac
push esi
call sub.SHLWAPI.dll_Ordinal_244_1
push edi
push ebx
push ebx
push 0x1023384
push esi
call sub.SHLWAPI.dll_Ordinal_244_1
jmp 0x1013233
push esi
push esi
push esi
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x102333a
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 8], esi
jne 0x1023315
push 1
call fcn.01018341
push esi
call fcn.0101970a
call dword [sym.imp.SHDOCVW.dll_Ordinal_111]
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [ebp - 0x14], esi
jl 0x1023363
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.SHELL32.dll_Ordinal_188]
push 0x1046f00
call fcn.0102b142
pop ebx
call fcn.0103c0bf
xor eax, eax
pop edi
inc eax
pop esi
leave
ret 0x10