Function at 0x100b2c6
Capabilities:
Check mutex on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edi, dword [ebp + 8]
push edi
call fcn.010299fc
call sub.SHLWAPI.dll_Ordinal_241
xor esi, esi
push esi
push edi
push 0x103d7e0
mov ecx, 0x103d6e0
mov dword [0x103d6d8], eax
mov dword [0x103d768], edi
call fcn.0100b1e5
test eax, eax
jl 0x100b5a7
call fcn.0100a5a3
call dword [sym.imp.USER32.dll_GetShellWindow]
test eax, eax
jne 0x100b350
cmp dword [0x103d7d0], esi
jne 0x100b350
push esi
push esi
push esi
push esi
push esi
push esi
push 0x1002b9c
push 0x1002b40
call dword [sym.imp.SHLWAPI.dll_SHRegGetUSValueW]
test eax, eax
jne 0x100b350
push 0x1002b28
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push ebx
push 0x103d76c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.0100ac5e
push 0x103d784
push 0x1002ac0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
call fcn.0100a688
cmp eax, esi
je 0x100b3b2
push 0x1002a90
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 4], ebx
je 0x100b39e
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.0100a688
cmp eax, esi
jne 0x100b3c3
cmp ebx, esi
je 0x100b3b2
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
call fcn.0100a42c
jmp 0x100b59c
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
xor ebx, ebx
inc ebx
push ebx
mov dword [ebp - 8], eax
call dword [sym.imp.SHELL32.dll_Ordinal_188]
push esi
push 2
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
call fcn.0100a380
push esi
push 0x12
push 0x12
push esi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
call fcn.0100aadb
push ebx
mov dword [ebp - 0xc], eax
call dword [sym.imp.SHELL32.dll_Ordinal_660]
call fcn.0100a881
mov dword [0x103d788], eax
call fcn.0100aa04
mov dword [0x103d038], eax
call fcn.0100ab3b
call fcn.0100abaa
cmp dword [0x103d788], esi
je 0x100b435
call fcn.0100a18c
call fcn.0100a291
cmp dword [0x103d7d0], esi
je 0x100b442
call fcn.0100a6a1
call fcn.01009d97
cmp dword [0x103d7d0], esi
jne 0x100b474
push 0x1002a54
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, eax
call sub.SHDOCVW.dll_Ordinal_125
call fcn.0100b0e3
cmp ebx, esi
je 0x100b474
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x103d038], esi
jne 0x100b4c0
call fcn.0100a8dc
inc eax
push eax
call fcn.0100a90d
call fcn.0100a95f
test eax, eax
je 0x100b4c0
lea eax, [ebp + 8]
push eax
push 0x10054cc
push 3
push esi
push 0x10054dc
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x100b4c0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push 5
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
call fcn.0100a9d0
call dword [sym.imp.SHDOCVW.dll_Ordinal_110]
xor ebx, ebx
call fcn.0100a5c4
test eax, eax
jne 0x100b4de
call fcn.0100a840
mov ebx, eax
cmp dword [ebp - 4], esi
je 0x100b4ec
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp ebx, esi
je 0x100b57e
push esi
push 1
push 0x590
push dword [0x103e454]
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.0100aebc
call fcn.0100af5b
call fcn.0100affa
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0100a790
cmp dword [0x103d6d8], esi
je 0x100b550
call edi
push dword [ebp - 8]
mov edi, eax
push 3
push 1
push 0x1002a28
push esi
call sub.SHLWAPI.dll_Ordinal_244
push edi
push 3
push 3
push 0x1002a00
push esi
call sub.SHLWAPI.dll_Ordinal_244
push 0x15
push 0x10029e8
call fcn.01009cbb
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
call sub.SHELL32.dll_Ordinal_201
push 1
call fcn.0100a9d0
push esi
call fcn.0100a90d
call dword [sym.imp.SHDOCVW.dll_Ordinal_111]
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [ebp - 0xc], esi
jl 0x100b595
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.SHELL32.dll_Ordinal_188]
push 0x103d6e0
call fcn.010095f8
pop ebx
call fcn.01029a2c
xor eax, eax
pop edi
inc eax
pop esi
leave
ret 0x10