Function at 0x100bc26
Capabilities:
Check mutex on windows
Persist via winlogon helper dll registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x10431dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp + 0x10]
mov esi, 0x10497f0
push edi
mov ecx, esi
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x22c], ebx
mov byte [ebp - 0x225], bl
mov byte [ebp - 0x238], bl
mov dword [ebp - 0x230], ebx
call fcn.0101dcb4
push ebx
call fcn.0101d77e
push 0x104979c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 1
push 0x1001afc
mov ecx, esi
call fcn.0101f1c5
push 2
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
push ebx
mov edi, eax
push edi
push 0x6f
mov esi, 0x10016c4
cmp edi, ebx
push esi
sete byte [ebp - 0x221]
call fcn.0101c3d2
cmp edi, ebx
jl 0x100bf7c
lea eax, [ebp - 0x244]
push eax
mov dword [ebp - 0x244], 8
mov dword [ebp - 0x240], 0x8000
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
test eax, eax
jne 0x100bcfb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01009d20
push ebx
mov edi, eax
push edi
push 0x79
push esi
call fcn.0101c3d2
cmp edi, ebx
jl 0x100bf7c
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x225]
push eax
push 0x10497c4
push dword [ebp - 0x234]
call fcn.01009606
push ebx
mov edi, eax
push edi
push 0x80
push esi
call fcn.0101c3d2
cmp edi, ebx
jl 0x100bf7c
cmp byte [ebp - 0x225], bl
je 0x100bd72
push 0x10019c0
push 0x1001920
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x220]
call fcn.0101d18e
lea ecx, [ebp - 0x220]
call fcn.0101c911
lea ecx, [ebp - 0x220]
mov edi, eax
call fcn.0101cf88
cmp edi, ebx
jl 0x100bf7c
push ebx
push 0x1043024
push dword [ebp - 0x225]
push 0x1043020
call fcn.0100ad07
push ebx
mov edi, eax
push edi
push 0x91
push esi
call fcn.0101c3d2
cmp edi, ebx
jl 0x100bf7c
push dword [ebp - 0x225]
call fcn.0100b16c
push ebx
mov edi, eax
push edi
push 0x97
push esi
call fcn.0101c3d2
cmp edi, ebx
jl 0x100bf7c
push dword [ebp - 0x238]
call fcn.0100b201
call fcn.0100a0ac
push 0x1001adc
push ebx
push ebx
mov dword [ebp - 0x234], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp byte [ebp - 0x225], bl
mov dword [ebp - 0x230], eax
jne 0x100be1b
cmp byte [ebp - 0x238], bl
jne 0x100be1b
cmp dword [ebp - 0x234], ebx
je 0x100be1b
cmp eax, ebx
je 0x100be2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100be2f
push ebx
mov eax, 0x80004004
push eax
push 0xac
push esi
mov edi, eax
call fcn.0101c3d2
cmp edi, ebx
jl 0x100bf7c
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, ebx
mov dword [0x10497c8], eax
jne 0x100be66
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01009d20
push ebx
mov edi, eax
push edi
push 0xb7
push esi
call fcn.0101c3d2
cmp edi, ebx
jl 0x100bf7c
push 0x1001aac
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, ebx
mov dword [0x10497d0], eax
jne 0x100bea2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01009d20
push ebx
mov edi, eax
push edi
push 0xc2
push esi
call fcn.0101c3d2
jmp 0x100beb3
push 0x1001a58
push 6
push 0x1001aac
call fcn.0101bffe
cmp edi, ebx
jl 0x100bf7c
push dword [ebp - 0x23c]
call fcn.0100bbab
push dword [ebp + 0x14]
push dword [ebp - 0x23c]
call fcn.0100958c
test eax, eax
jne 0x100beec
push ebx
mov eax, 0x80004005
push eax
push 0xda
push esi
mov edi, eax
call fcn.0101c3d2
cmp edi, ebx
jl 0x100bf7c
cmp byte [0x10497c4], bl
je 0x100bf07
call fcn.0100bb5c
cmp byte [0x10497c4], bl
sete al
push eax
call fcn.01009c22
call fcn.0100aa98
call fcn.0100b7a7
push ebx
mov edi, eax
push edi
push 0xee
push esi
call fcn.0101c3d2
cmp edi, ebx
jl 0x100bf7c
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x100bf60
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x260]
push eax
call esi
test eax, eax
jne 0x100bf35
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x22c], eax
mov eax, dword [0x10497cc]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x100bfa2
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x10497cc]
call esi
mov dword [0x10497cc], ebx
mov eax, dword [0x10497c8]
cmp eax, ebx
je 0x100bfb4
push eax
call esi
mov dword [0x10497c8], ebx
mov eax, dword [0x10497d0]
cmp eax, ebx
je 0x100bfc6
push eax
call esi
mov dword [0x10497d0], ebx
cmp dword [ebp - 0x22c], 1
jne 0x100bfd9
mov dword [ebp - 0x22c], 2
cmp byte [ebp - 0x221], bl
je 0x100bfe7
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [ebp - 0x230], ebx
je 0x100bff7
push dword [ebp - 0x230]
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x22c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100d61a
leave
ret 0x10