Function at 0x1002be4a
Capabilities:
Check mutex on windows
Create process on windows
Delete registry key
Delete registry value
Persist via run registry key

Disassembly:
push ebp
lea ebp, [esp - 0x44c]
sub esp, 0x4cc
mov eax, dword [0x10084500]
push ebx
push edi
xor edi, edi
xor ebx, ebx
inc edi
cmp dword [ebp + 0x454], ebx
mov dword [ebp + 0x448], eax
mov byte [ebp + 0xe8], bl
je 0x1002be8d
cmp dword [ebp + 0x454], edi
jne 0x1002be99
lea eax, [ebp + 0xe8]
push eax
call fcn.1002b92c
pop ecx
lea eax, [ebp + 0xe8]
mov dword [ebp + 0x454], eax
push esi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x454]
call fcn.1002b8d6
lea eax, [ebp + 0x408]
push eax
call fcn.100274b0
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
add esp, 0xc
lea eax, [ebp + 0x408]
push eax
push ebx
push edi
push ebx
call esi
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x408]
push eax
call fcn.10023398
pop ecx
lea eax, [ebp + 0x408]
push eax
push ebx
push edi
push ebx
call esi
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x408]
push eax
call fcn.100233e0
pop ecx
lea eax, [ebp + 0x408]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push dword [ebp + 0x45c]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
call esi
push dword [ebp + 0x45c]
push dword [ebp - 0x28]
call esi
cmp byte [ebp - 0x1c], bl
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x1002c07f
push 0x1006f5b0
lea eax, [ebp + 0x304]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0x304]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x304]
push eax
mov edi, 0x80000002
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp eax, 5
jne 0x1002bf96
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp + 0x304]
push eax
push edi
call fcn.1002bc33
pop ecx
pop ecx
lea eax, [ebp + 0x304]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call fcn.1001e3c3
test al, al
jne 0x1002bff9
lea eax, [ebp + 0x200]
push 0x1006e4f4
push eax
call fcn.10057da0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0x200]
push eax
call fcn.10057db0
add esp, 0x10
lea eax, [ebp - 0x20]
push eax
push 0x2001f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push edi
mov dword [ebp - 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002bff9
lea eax, [ebp + 0x200]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x45
pop ecx
xor eax, eax
mov byte [ebp + 0x1ec], bl
lea edi, [ebp + 0x1ed]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str.regsvr32.exe__s__u
lea eax, [ebp + 0x1ec]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0x454]
lea eax, [ebp + 0x1ec]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x10
pop ecx
xor eax, eax
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x3c], ebx
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x1ec]
push eax
push ebx
mov dword [ebp - 0x80], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x38]
call esi
push dword [ebp - 0x3c]
call esi
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [ebp + 0x458], bl
je 0x1002c11d
lea eax, [ebp + 0x304]
push eax
push dword [ebp + 0x454]
call fcn.100234ed
lea eax, [ebp + 0x304]
push ebx
push eax
call fcn.1002b9ee
add esp, 0x10
push 0x2e
push ebx
lea eax, [ebp + 0x304]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrA]
mov edi, eax
cmp edi, ebx
je 0x1002c11d
inc edi
mov eax, edi
lea ecx, [ebp + 0x304]
sub eax, ecx
cmp eax, 0x109
jge 0x1002c11d
push 5
push str.bak1
push edi
call fcn.10056df0
lea eax, [ebp + 0x304]
push ebx
push eax
call fcn.1002b9ee
lea eax, [ebp + 0x304]
push ebx
push eax
mov byte [edi + 3], 0x32
call fcn.1002b9ee
push 5
push str.ini2
push edi
call fcn.10056df0
lea eax, [ebp + 0x304]
push ebx
push eax
call fcn.1002b9ee
add esp, 0x30
push dword [ebp - 0x2c]
call esi
push dword [ebp - 0x24]
call esi
push dword [ebp - 0x28]
call esi
cmp byte [ebp + 0x458], bl
pop esi
je 0x1002c143
push ebx
push dword [ebp + 0x454]
call fcn.1002b9ee
pop ecx
pop ecx
mov ecx, dword [ebp + 0x448]
pop edi
pop ebx
call fcn.100568ae
add ebp, 0x44c
leave
ret