Function at 0x1004f5a
Capabilities:
Check mutex on windows
Create thread
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3dc
mov eax, dword [0x10154a4]
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
xor ebx, ebx
inc edi
push 0x1001bbc
mov dword [ebp - 0x3a0], edi
mov dword [ebp - 0x3b0], ebx
mov dword [ebp - 0x3a4], ebx
mov dword [0x1015d70], esi
call dword [sym.imp.user32.dll_RegisterClipboardFormatW]
push 0x10014f0
push edi
push ebx
mov dword [0x1015d58], eax
call dword [sym.imp.kernel32.dll_CreateMutexW]
cmp eax, ebx
mov dword [0x1015d5c], eax
je 0x1004fd2
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1004fd2
push 0x2710
push dword [0x1015d5c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push 0x1015de4
push 0x1015de0
push 0x1015ddc
call fcn.0100312d
cmp dword [0x1015ddc], ebx
je 0x1005000
push 0x1015de8
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.kernel32.dll_ProcessIdToSessionId]
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x2713
push esi
mov esi, dword [sym.imp.user32.dll_LoadStringW]
call esi
test eax, eax
je 0x1005090
lea eax, [ebp - 0x20c]
push eax
push 0x8002
call dword [sym.imp.user32.dll_FindWindowW]
cmp eax, ebx
mov dword [ebp - 0x3b4], eax
je 0x1005090
lea ecx, [ebp - 0x3ac]
push ecx
push eax
mov dword [ebp - 0x3ac], ebx
call dword [sym.imp.user32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x3ac]
call dword [sym.imp.user32.dll_AllowSetForegroundWindow]
lea eax, [ebp - 0x3b8]
push eax
push 0x2710
push 2
push ebx
push ebx
push 0x40b
push dword [ebp - 0x3b4]
call dword [sym.imp.user32.dll_SendMessageTimeoutW]
test eax, eax
je 0x1005090
cmp dword [ebp - 0x3b8], 0x40b
je 0x1005143
lea eax, [ebp - 0x3a8]
push eax
push 0x20019
push ebx
push 0x1001b48
push 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10051e6
lea eax, [ebp - 0x3bc]
push eax
lea eax, [ebp - 0x3b0]
push eax
lea eax, [ebp - 0x3c0]
push eax
push ebx
push 0x1001b24
push dword [ebp - 0x3a8]
mov dword [ebp - 0x3bc], 4
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
push dword [ebp - 0x3a8]
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp dword [ebp - 0x3b0], ebx
je 0x10051e6
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x2729
push dword [ebp + 8]
call esi
push 0xc8
lea eax, [ebp - 0x39c]
push eax
push 0x272a
push dword [ebp + 8]
call esi
push 0x10
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x39c]
push eax
push ebx
call dword [sym.imp.user32.dll_MessageBoxW]
mov dword [ebp - 0x3a0], ebx
xor esi, esi
inc esi
mov eax, dword [0x1015d5c]
cmp eax, ebx
je 0x1005168
push eax
call dword [sym.imp.kernel32.dll_ReleaseMutex]
push dword [0x1015d5c]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [0x1015d5c], ebx
mov ecx, dword [0x1015dc4]
cmp ecx, ebx
je 0x1005178
mov eax, dword [ecx]
push esi
call dword [eax + 0x1c]
mov ecx, dword [0x1015dc8]
cmp ecx, ebx
je 0x1005188
mov eax, dword [ecx]
push esi
call dword [eax + 0x1c]
mov ecx, dword [0x1015dcc]
cmp ecx, ebx
je 0x1005198
mov eax, dword [ecx]
push esi
call dword [eax + 0x1c]
mov ecx, dword [0x1015dd0]
cmp ecx, ebx
je 0x10051a8
push esi
call fcn.01003313
mov ecx, dword [0x1015dd4]
cmp ecx, ebx
je 0x10051b8
mov eax, dword [ecx]
push esi
call dword [eax + 0x1c]
call fcn.01006078
cmp dword [ebp - 0x3a4], ebx
pop edi
pop esi
pop ebx
je 0x10051d4
push dword [ebp - 0x3a4]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x3a0]
call fcn.01011fd4
leave
ret 0x10
call dword [sym.imp.comctl32.dll_InitCommonControls]
call fcn.010026cb
push ebx
push ebx
xor esi, esi
inc esi
push esi
push ebx
call dword [sym.imp.kernel32.dll_CreateEventW]
push 0x1015d88
push ebx
mov edi, eax
push edi
push 0x100f5c5
push ebx
push ebx
mov dword [ebp - 0x3a4], edi
call dword [sym.imp.kernel32.dll_CreateThread]
cmp edi, ebx
mov dword [0x1015d8c], eax
je 0x100522f
push 0x3e8
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push 0x48
mov dword [0x1015dc0], 5
call fcn.010024e0
cmp eax, ebx
pop ecx
je 0x100524e
mov ecx, eax
call fcn.0100348d
jmp 0x1005250
xor eax, eax
cmp eax, ebx
mov dword [0x1015dc4], eax
jne 0x1005264
mov dword [ebp - 0x3a0], ebx
jmp 0x1005146
push 0x50
call fcn.010024e0
cmp eax, ebx
pop ecx
je 0x1005279
mov ecx, eax
call fcn.01003442
jmp 0x100527b
xor eax, eax
cmp eax, ebx
mov dword [0x1015dc8], eax
je 0x1005259
call fcn.0100321d
test al, al
jne 0x100531e
push 0x58
call fcn.010024e0
mov edx, eax
cmp edx, ebx
pop ecx
je 0x10052b1
push 9
pop ecx
xor eax, eax
lea edi, [edx + 0x24]
mov dword [edx], 0x10018f4
rep stosd dword es:[edi], eax
jmp 0x10052b3
xor edx, edx
cmp edx, ebx
mov dword [0x1015dcc], edx
je 0x1005259
push pe_nt_image_headers32
call fcn.010024e0
cmp eax, ebx
pop ecx
je 0x10052d2
mov ecx, eax
call fcn.01008194
jmp 0x10052d4
xor eax, eax
cmp eax, ebx
mov dword [0x1015dd0], eax
je 0x1005259
cmp dword [0x1015ddc], ebx
je 0x1005316
cmp dword [0x1015de0], ebx
jne 0x1005316
push 0x48
call fcn.010024e0
cmp eax, ebx
pop ecx
je 0x1005306
mov ecx, eax
call fcn.010034e4
jmp 0x1005308
xor eax, eax
cmp eax, ebx
mov dword [0x1015dd4], eax
jne 0x1005328
jmp 0x1005259
dec dword [0x1015dc0]
jmp 0x1005328
mov dword [0x1015dc0], 2
call fcn.010030b5
call fcn.01005f10
test al, al
je 0x1005259
call fcn.010074bf
test al, al
je 0x1005259
push ebx
push 0x1004a63
push ebx
push 0x69
push dword [ebp + 8]
call dword [sym.imp.user32.dll_CreateDialogParamW]
cmp eax, ebx
mov dword [0x1015d64], eax
je 0x1005259
mov ecx, dword [0x1015e04]
mov edx, dword [0x1015e0c]
mov edi, dword [0x1015e08]
push 4
sub edx, ecx
push edx
mov edx, dword [0x1015e00]
sub edi, edx
push edi
push ecx
push edx
push ebx
push eax
mov dword [0x1015dbc], esi
call dword [sym.imp.user32.dll_SetWindowPos]
push dword [ebp + 0x14]
push dword [0x1015d64]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x1015d64]
call fcn.01003284
mov eax, dword [0x1015d5c]
cmp eax, ebx
je 0x10053d2
push eax
call dword [sym.imp.kernel32.dll_ReleaseMutex]
push dword [0x1015d5c]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [0x1015d5c], ebx
push esi
push esi
call dword [sym.imp.kernel32.dll_SetProcessShutdownParameters]
mov edi, dword [sym.imp.user32.dll_GetMessageW]
jmp 0x1005430
lea eax, [ebp - 0x3dc]
push eax
push dword [0x1015d74]
push dword [0x1015d64]
call dword [sym.imp.user32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x1005430
lea eax, [ebp - 0x3dc]
push eax
push dword [0x1015d64]
call dword [sym.imp.user32.dll_IsDialogMessageW]
test eax, eax
jne 0x1005430
lea eax, [ebp - 0x3dc]
push eax
call dword [sym.imp.user32.dll_TranslateMessage]
lea eax, [ebp - 0x3dc]
push eax
call dword [sym.imp.user32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x3dc]
push eax
call edi
test eax, eax
jne 0x10053e2
jmp 0x1005146