Function at 0x1024f06
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Delete registry key
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push 1
xor ebx, ebx
push ebx
push 0x1025500
push 0x80000002
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1055500
xor eax, eax
cmp dword [ebp - 0x40], ebx
sete al
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
cmp dword [ebp - 0x44], ebx
jne 0x1024f6a
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov esi, 0x10b2378
push esi
call fcn.01030a5d
push 0x10254e0
mov dword [0x10b10b0], 0x1025330
mov dword [0x10b1088], esi
call fcn.010310a4
push 0x10b2478
push 0x10b24a8
push 0x100e878
push 0x10252f0
call fcn.01030b61
lea eax, [ebp - 0x34]
push eax
mov edi, 0x10254a4
push edi
push 0x1015388
mov esi, 0x80000001
push esi
mov dword [ebp - 0x34], ebx
call fcn.0101917b
cmp dword [ebp - 0x34], ebx
je 0x1055532
mov edi, 0x80000000
cmp dword [0x10b24cc], ebx
je 0x1025033
mov al, byte [0x10b24d0]
cmp al, 4
jb 0x10252cf
mov eax, dword [0x10b24b8]
mov ecx, dword [0x10b24bc]
mov edx, 0x4010000
and eax, edx
and ecx, edi
or eax, ecx
je 0x1025033
mov eax, dword [0x10b24c0]
mov ecx, eax
and ecx, edx
mov edx, dword [0x10b24c4]
and edx, edi
cmp ecx, eax
jne 0x1025033
cmp edx, dword [0x10b24c4]
jne 0x1025033
push 0x1025300
push dword [0x10b247c]
push dword [0x10b2478]
call fcn.0100e7c9
push ebx
push ebx
push 0x1025378
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push dword [ebp - 0x28]
call fcn.01032f59
mov eax, dword [ebp - 0x28]
push ebx
push eax
push ebx
mov ecx, 0x10b23c8
mov dword [0x10b10b4], eax
call fcn.010323a6
test eax, eax
jl 0x1055755
push ebx
push ebx
call fcn.01020dd2
push 0x10b244c
push 0x1015388
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0x24], ebx
call fcn.010324d5
mov esi, eax
cmp esi, 1
jne 0x10250d5
push 0x1025340
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x10250c4
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.01025571
mov esi, eax
neg esi
sbb esi, esi
and esi, 2
add esi, 3
push esi
call dword [sym.imp.SHELL32.dll_Ordinal_899]
cmp esi, 3
jne 0x105554b
cmp dword [0x10b24cc], ebx
je 0x102514a
mov al, byte [0x10b24d0]
cmp al, 4
jb 0x10252dc
mov eax, dword [0x10b24b8]
mov ecx, dword [0x10b24bc]
mov edx, 0x2010000
mov esi, 0x80010000
and eax, edx
and ecx, esi
or eax, ecx
je 0x102514a
mov eax, dword [0x10b24c0]
mov ecx, eax
and ecx, edx
mov edx, dword [0x10b24c4]
and edx, esi
cmp ecx, eax
jne 0x102514a
cmp edx, dword [0x10b24c4]
jne 0x102514a
push 0x1025320
push dword [0x10b247c]
push dword [0x10b2478]
call fcn.0100e7c9
xor esi, esi
inc esi
push esi
call dword [sym.imp.SHELL32.dll_Ordinal_188]
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
call fcn.01030a85
push ebx
push 0x12
push 0x12
push ebx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
call fcn.01032291
push ebx
mov dword [ebp - 0x38], eax
call dword [sym.imp.ole32.dll_OleInitialize]
mov dword [ebp - 0x30], eax
call fcn.01030c77
push esi
call dword [sym.imp.SHELL32.dll_Ordinal_660]
call fcn.0102fdd5
call fcn.0102f680
call fcn.01030085
call fcn.010300f1
call fcn.010302ed
call fcn.0102f625
call fcn.0102fe6f
call fcn.0102fd51
push ebx
call fcn.0102f926
call sub.EXPLORERFRAME.dll_Ordinal_110
lea ecx, [ebp - 0x50]
call fcn.0102fcf9
call fcn.01025571
test eax, eax
jne 0x1055697
call fcn.01025631
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x24], ebx
je 0x10251f7
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x28], ebx
je 0x105571d
push ebx
push esi
push 0x590
push dword [0x10b10f0]
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.010272ea
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0x80000008
push 0x1002cd0
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
lea eax, [ebp - 0x24]
push eax
push 0x1026660
push esi
push ebx
push 0x10266a0
mov dword [ebp - 0x24], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1025262
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
push 0x102555c
push eax
call dword [ecx + 0xc]
cmp dword [0x10b24cc], ebx
je 0x10252e9
mov al, byte [0x10b24d0]
cmp al, 4
jb 0x105569f
mov eax, dword [0x10b24b8]
mov ecx, dword [0x10b24bc]
mov esi, 0x4010000
and eax, esi
and ecx, edi
or eax, ecx
je 0x10252c2
mov eax, dword [0x10b24c0]
mov edx, dword [0x10b24c4]
mov ecx, eax
and ecx, esi
and edx, edi
cmp ecx, eax
jne 0x10252c2
cmp edx, dword [0x10b24c4]
jne 0x10252c2
push 0x1025310
push dword [0x10b247c]
push dword [0x10b2478]
call fcn.0100e7c9
push dword [ebp - 0x28]
call sub.SHELL32.dll_Ordinal_201
jmp 0x10556ac
cmp al, bl
je 0x1024fe8
jmp 0x1025033
cmp al, bl
je 0x10250fa
jmp 0x102514a
mov esi, 0x4010000
jmp 0x10252c2
lea eax, [ebp - 0x40]
push eax
push 0x105580c
push ebx
push dword [ebp - 0x2c]
call fcn.0101917b
lea eax, [ebp - 0x44]
push eax
push 0x10557d0
push ebx
push dword [ebp - 0x2c]
call fcn.0101917b
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1024f4b
push ebx
call fcn.01080a1f
push 1
push edi
push 0x1015388
push esi
call fcn.0107b73b
jmp 0x1024fce
cmp dword [ebp - 0x24], ebx
je 0x1055562
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
cmp esi, 5
jne 0x1055580
call fcn.0106d6b5
jmp 0x105574b
call fcn.010191d1
cmp eax, ebx
mov dword [ebp - 0x30], eax
jl 0x105574b
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetArgsW]
lea ecx, [ebp - 0x20]
push ecx
push eax
call fcn.0106d127
test eax, eax
je 0x105568a
call fcn.01030c77
cmp esi, 4
jne 0x1055601
lea eax, [ebp - 0x24]
push eax
push 0x1026660
push 1
push ebx
push 0x10266a0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1055681
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x10555fc
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x24]
jmp 0x105567b
lea eax, [ebp - 0x28]
push eax
push 0x10557c0
push 1
push ebx
push 0x1055850
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1055681
push 0x40
lea eax, [ebp - 0x90]
push ebx
push eax
mov dword [ebp - 0x94], 0x44
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
test byte [ebp - 0x68], 1
lea edi, [ebp - 0x38]
mov dword [ebp - 0x3c], ebx
stosd dword es:[edi], eax
je 0x105565a
movzx ecx, word [ebp - 0x64]
jmp 0x105565d
push 0xa
pop ecx
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
push ecx
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp - 0x18]
push dword [ebp - 0x20]
push 0x1055840
push eax
call dword [edx + 0xc]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x20]
call dword [sym.imp.SHELL32.dll_ILFree]
push dword [ebp - 0x30]
call fcn.01019203
jmp 0x105574b
mov dword [ebp - 0x28], ebx
jmp 0x10251e0
cmp al, bl
je 0x1025277
jmp 0x10252e9
cmp dword [0x10b24cc], ebx
je 0x1055705
mov al, byte [0x10b24d0]
cmp al, 4
jae 0x10556c1
cmp al, bl
jne 0x1055705
mov eax, dword [0x10b24b8]
mov ecx, dword [0x10b24bc]
and eax, esi
and ecx, edi
or eax, ecx
je 0x1055705
mov eax, dword [0x10b24c0]
mov ecx, eax
and ecx, esi
mov esi, dword [0x10b24c4]
mov edx, esi
and edx, edi
cmp ecx, eax
jne 0x1055705
cmp edx, esi
jne 0x1055705
push 0x10557b0
push dword [0x10b247c]
push dword [0x10b2478]
call fcn.0100e7c9
lea ecx, [ebp - 0x50]
call fcn.0106d8e9
lea eax, [ebp - 0x24]
push eax
call fcn.01002bee
push 1
call fcn.0102f926
call sub.EXPLORERFRAME.dll_Ordinal_111
cmp dword [ebp - 0x30], ebx
jl 0x105572d
call dword [sym.imp.ole32.dll_OleUninitialize]
push dword [ebp - 0x38]
call fcn.01019203
push ebx
call dword [sym.imp.SHELL32.dll_Ordinal_188]
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x50], 0x102fd48
call fcn.0106d8e9
push 0x10b23c8
call fcn.0106d809
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetArgsW]
push eax
call fcn.0106cfdb
call fcn.0107be7b
mov ecx, 0x10b1460
call fcn.01019fb7
push ebx
call fcn.01024c6d
push 0x10b2478
call fcn.0106d78c
call fcn.0106d5e4
cmp dword [0x10b39e8], ebx
pop edi
pop esi
pop ebx
je 0x105579f
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.01001feb
leave
ret 0x10