Function at 0x100eeae
Capabilities:
Check mutex on windows
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x24
push esi
push edi
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edi, dword [esp + 0x30]
push edi
call fcn.01012d41
call sub.SHLWAPI.dll_Ordinal_241
xor esi, esi
push esi
push edi
push 0x103f4f8
mov ecx, 0x103e828
mov dword [0x103e818], eax
mov dword [0x103e648], edi
call fcn.01012e50
test eax, eax
jl 0x1020466
call fcn.01012efb
call dword [sym.imp.USER32.dll_GetShellWindow]
test eax, eax
jne 0x100ef2f
cmp dword [0x103e7f8], esi
jne 0x100ef2f
push esi
push esi
push esi
push esi
push esi
push esi
push 0x1018624
push 0x10185c8
call dword [sym.imp.SHLWAPI.dll_SHRegGetUSValueW]
test eax, eax
je 0x1020392
push ebx
push 0x103e0e0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.01012b78
push 0x103e820
push 0x10189d0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
call fcn.01012f3b
cmp eax, esi
je 0x10203ad
push 0x101859c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
cmp ebx, esi
mov dword [esp + 0xc], ebx
je 0x100ef82
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.01012f3b
cmp eax, esi
je 0x10203a2
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
call edi
xor ebx, ebx
inc ebx
push ebx
mov ebp, eax
call dword [sym.imp.SHELL32.dll_Ordinal_188]
push esi
push 2
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
call fcn.01012bb2
push esi
push 0x12
push 0x12
push esi
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
call fcn.01012fe9
push ebx
mov dword [esp + 0x18], eax
call dword [sym.imp.SHELL32.dll_Ordinal_660]
call fcn.0101123b
mov dword [0x103e800], eax
call fcn.01011296
mov dword [0x103f4d0], eax
call fcn.010110a6
call fcn.0101110f
cmp dword [0x103e800], esi
je 0x100f024
call fcn.01011175
push 0x40000048
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0x100f024
push esi
push 0x100e2e3
push 3
push 0x1017db0
push 0x80000002
call fcn.0100de4c
cmp dword [0x103e7f8], esi
jne 0x10203c0
call fcn.010111cb
cmp dword [0x103e7f8], esi
jne 0x100f05d
push 0x1018560
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, eax
call sub.SHDOCVW.dll_Ordinal_125
cmp ebx, esi
je 0x100f05d
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x103f4d0], esi
je 0x10203ca
push esi
call fcn.0101107c
call dword [sym.imp.SHDOCVW.dll_Ordinal_110]
xor ebx, ebx
call fcn.0101101b
test eax, eax
jne 0x100f087
call fcn.0100edc2
mov ebx, eax
cmp dword [esp + 0x10], esi
je 0x100f097
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp ebx, esi
je 0x100f105
push esi
push 1
push 0x590
push dword [0x103e070]
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.0100f178
call fcn.0100f229
call fcn.0100f116
push dword [esp + 0x44]
push dword [esp + 0x44]
call fcn.0100f338
cmp dword [0x103e818], esi
jne 0x102041e
push 0x15
push 0x1018548
call fcn.0100ebed
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push ebx
call sub.SHELL32.dll_Ordinal_201
push 1
call fcn.0101107c
push esi
call fcn.01027cd1
call dword [sym.imp.SHDOCVW.dll_Ordinal_111]
call dword [sym.imp.ole32.dll_OleUninitialize]
jmp 0x1020447
push 0x1026fb4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x100ef2f
cmp ebx, esi
je 0x10203ad
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esp + 0x40]
push dword [esp + 0x40]
push edi
call fcn.01027b67
jmp 0x102045b
call fcn.01027bc4
jmp 0x100f030
call fcn.01027ca0
inc eax
push eax
call fcn.01027cd1
call fcn.01027d23
test eax, eax
je 0x100f069
lea eax, [esp + 0x38]
push eax
push 0x1026fcc
push 3
push esi
push 0x1016804
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x100f069
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
push 5
push eax
call dword [ecx + 0xc]
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x100f069
call edi
push ebp
push 3
push 1
push 0x1026f88
push esi
mov edi, eax
call sub.SHLWAPI.dll_Ordinal_244
push edi
push 3
push 3
push 0x1026f60
push esi
call sub.SHLWAPI.dll_Ordinal_244
jmp 0x100f0d7
cmp dword [esp + 0x14], esi
pop ebp
jl 0x1020454
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.SHELL32.dll_Ordinal_188]
push 0x103e828
call fcn.010276ea
pop ebx
call fcn.0103495a
xor eax, eax
pop edi
inc eax
pop esi
add esp, 0x24
ret 0x10