Function at 0x100189f
Capabilities:
Check if file exists
Check mutex on windows
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
push 0x74
push 0x1001510
call fcn.01002714
xor esi, esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x1c], esi
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xffffffff
jg 0x10018e1
cmp ebx, 3
jge 0x10018ea
cmp dword [ebp + 8], esi
je 0x10018ea
xor eax, eax
jmp 0x10018ef
mov eax, 0x80070057
cmp eax, esi
jl 0x1001d31
lea ebx, [ebx + ebx*2]
shl ebx, 3
push dword [ebx + 0x100302c]
push dword [ebp + 8]
cmp dword [ebx + 0x1003030], esi
je 0x1001919
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x48], eax
jmp 0x1001922
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x48], esi
jne 0x1001930
cmp dword [ebp - 0x4c], esi
je 0x1001d31
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push esi
push 0x10014a8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x1001d31
mov dword [ebp - 0x28], 4
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
push eax
push esi
push esi
push 0x1001498
push dword [ebp - 0x1c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call edi
cmp eax, esi
je 0x1001985
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1001d31
mov dword [ebp - 0x28], 4
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x3c]
push eax
push esi
push esi
push 0x1001484
push dword [ebp - 0x1c]
call edi
mov edi, eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], esi
cmp edi, esi
jne 0x1001d31
xor edi, edi
inc edi
cmp dword [ebp - 0x34], edi
je 0x10019cc
cmp dword [ebp - 0x34], esi
je 0x10019cc
cmp dword [ebp - 0x34], 3
je 0x10019cc
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x3c], edi
je 0x10019d9
cmp dword [ebp - 0x3c], esi
je 0x10019d9
mov dword [ebp - 0x3c], edi
push dword [ebx + 0x1003028]
push esi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x50], eax
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 0x7ff8ffa9
add ecx, 0x80070057
mov dword [ebp - 0x74], ecx
js 0x1001d31
cmp dword [ebp + 0xc], 2
jne 0x1001a12
mov dword [ebp - 0x6c], edi
mov dword [ebp - 4], esi
mov dword [ebp - 4], edi
push 0x493e0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x2c], eax
cmp eax, esi
je 0x1001a36
cmp eax, 0x80
jne 0x1001cc2
lea eax, [ebp - 0x1c]
push eax
push 0xf003f
push esi
push dword [ebx + 0x1003020]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x2c], eax
cmp eax, esi
jne 0x1001cc2
push esi
push esi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x2c], eax
cmp eax, esi
jne 0x1001cc2
cmp dword [ebp - 0x54], esi
je 0x1001cc2
cmp dword [ebp - 0x24], esi
je 0x1001cc2
inc dword [ebp - 0x24]
mov dword [ebp - 0x78], esi
mov edi, dword [ebp - 0x24]
add edi, edi
mov dword [ebp - 0x7c], edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 8
push eax
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
call edi
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x1001cc2
cmp dword [ebp - 0x34], esi
jne 0x1001adf
cmp dword [ebp - 0x3c], esi
jne 0x1001adf
push dword [ebp + 0xc]
push dword [ebp - 0x24]
push eax
push dword [ebp - 0x1c]
call fcn.010017dc
jmp 0x1001cc2
cmp dword [ebx + 0x1003030], esi
je 0x1001b13
mov dword [ebp - 0x80], esi
mov ebx, dword [ebp - 0x44]
mov dword [ebp - 0x84], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push 8
push eax
call edi
mov dword [ebp - 0x40], eax
cmp eax, esi
je 0x1001cc2
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x38], esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
or dword [ebp - 0x68], 0xffffffff
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
lea eax, [ebp - 0x70]
push eax
push esi
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x38]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x2c], eax
cmp eax, esi
je 0x1001b5c
cmp eax, 0x103
jne 0x1001cc2
cmp eax, 0x103
jne 0x1001bab
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x1c]
push eax
push 0xf003f
push esi
push 0x1001410
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x2c], eax
cmp eax, esi
jne 0x1001cc2
mov eax, dword [ebp + 0xc]
lea eax, [eax + eax*2]
push dword [eax*8 + 0x1003024]
push dword [ebp - 0x1c]
call ebx
jmp 0x1001cc2
push esi
push esi
push 3
push esi
push 3
push 0x80000000
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x68], eax
cmp eax, 0xffffffff
jne 0x1001c10
mov dword [ebp - 0x64], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 2
je 0x1001be3
call edi
cmp eax, 3
jne 0x1001bff
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
call ebx
mov dword [ebp - 0x2c], eax
cmp eax, esi
je 0x1001bfc
cmp eax, 2
je 0x1001bfc
cmp eax, 3
jne 0x1001bff
mov dword [ebp - 0x64], esi
cmp dword [ebp - 0x64], esi
je 0x1001b1c
inc dword [ebp - 0x38]
jmp 0x1001b1c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x68], 0xffffffff
mov edi, dword [ebp + 0xc]
lea edi, [edi + edi*2]
shl edi, 3
cmp dword [edi + 0x1003030], esi
je 0x1001c4d
cmp dword [ebp - 0x70], 3
jne 0x1001c40
push dword [ebp - 0x28]
push dword [ebp - 0x40]
push dword [ebp - 0x20]
call dword [ebp - 0x48]
jmp 0x1001c57
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x30], esi
jmp 0x1001c5a
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x6c]
call dword [ebp - 0x4c]
mov dword [ebp - 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x1001c83
cmp dword [0x1003068], esi
je 0x1001c78
cmp dword [ebp - 0x30], esi
je 0x1001c83
cmp dword [ebp - 0x30], 5
je 0x1001c83
cmp dword [ebp - 0x30], esi
je 0x1001b1c
jmp 0x1001cc2
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
call ebx
mov dword [ebp - 0x2c], eax
cmp eax, esi
je 0x1001ca0
cmp eax, 2
je 0x1001ca0
cmp eax, 3
jne 0x1001c08
cmp dword [edi + 0x1003034], esi
je 0x1001cb8
cmp dword [0x1003068], esi
je 0x1001cb8
push dword [ebp - 0x20]
call fcn.01001712
cmp dword [ebp - 0x30], 5
jne 0x1001b1c
mov dword [ebp - 4], esi
call fcn.01001cd2
or dword [ebp - 4], 0xffffffff
jmp 0x1001ce0
cmp dword [ebp - 0x50], esi
je 0x1001cf7
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1c], esi
je 0x1001d05
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x40], esi
je 0x1001d1b
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push dword [ebp - 0x40]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x20], esi
je 0x1001d31
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push dword [ebp - 0x20]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.0100274f
ret 8