Function at 0x10012f5
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Link many functions at runtime
Query environment variable
Query or enumerate registry value
Set current directory
Terminate process

Disassembly:
call dword [ebp - 0x28]
test al, al
jne 0x1001d26
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [ebp - 0x10]
test eax, eax
jne 0x1001a32
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
test byte [ebp - 0x84], 1
je 0x1001a1c
movzx eax, word [ebp - 0x80]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x48]
call dword [ebp - 0x18]
cmp eax, 0x80070005
mov dword [ebp - 0x44], eax
setne byte [ebp - 1]
jmp 0x1001a32
call fcn.01001283
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb0
push ebx
push esi
push edi
push 0x10016f8
xor ebx, ebx
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
cmp esi, ebx
jne 0x1001b58
push ebx
mov dword [ebp - 0x44], ebx
mov byte [ebp - 2], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
push 0x10016d4
push edi
mov dword [ebp - 0xc], edi
call fcn.01001723
test eax, eax
push 0x10016bc
push edi
setne byte [ebp - 3]
call fcn.01001723
add esp, 0x10
test eax, eax
push 0x43
setne byte [ebp - 1]
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x1001b6b
call fcn.010010e5
test al, al
jne 0x1001b76
xor esi, esi
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp eax, ebx
mov dword [ebp - 0x1c], eax
je 0x1001bbf
lea eax, [ebp - 0xb0]
push eax
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0xb0], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0x1001598
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x1001c07
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1001bc4
lea eax, [ebp - 0x20]
push eax
push 0x20019
push ebx
push 0x1001608
push 0x80000002
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10014ef
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x30]
push eax
push ebx
lea eax, [ebp - 0x24]
push eax
push ebx
mov edi, 0x10015fc
push edi
push dword [ebp - 0x20]
call esi
test eax, eax
jne 0x10014e3
cmp dword [ebp - 0x24], 1
je 0x1001458
cmp dword [ebp - 0x24], 2
jne 0x10014e3
push dword [ebp - 0x30]
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x10014e3
lea ecx, [ebp - 0x30]
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push edi
push dword [ebp - 0x20]
call esi
test eax, eax
jne 0x10014d6
cmp dword [ebp - 0x24], 2
jne 0x1001c1b
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ebx
push ebx
push dword [ebp - 0x10]
call esi
mov edi, eax
cmp edi, ebx
je 0x10014d6
lea eax, [edi + edi]
push eax
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
mov dword [ebp - 0x28], eax
je 0x10014d6
push edi
push eax
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x10014c9
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [ebp - 8], eax
push dword [ebp - 0x28]
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x10]
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x20], ebx
push dword [ebp - 0xc]
call fcn.010011b7
test al, al
jne 0x1001c2c
push 0x10016ac
mov byte [ebp - 1], bl
mov byte [ebp - 2], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
je 0x1001d52
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
push ebx
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0xbb8
push edi
call esi
push 0xbb9
push edi
mov dword [ebp - 0x18], eax
call esi
push 0xbbd
push edi
mov dword [ebp - 0x10], eax
call esi
push 0x100169c
push edi
mov dword [ebp - 0x28], eax
call esi
push 0x100168c
push edi
mov dword [ebp - 8], eax
call esi
cmp eax, ebx
je 0x1001575
push dword [ebp - 0xc]
call eax
cmp dword [ebp - 0x18], ebx
je 0x1001a32
cmp dword [ebp - 0x10], ebx
je 0x1001a32
cmp dword [ebp - 0x28], ebx
je 0x1001a32
jmp 0x1001d1b
push 0xa
pop eax
jmp 0x1001254
cmp byte [ebp - 3], bl
je 0x100120e
jmp 0x1001219
cmp dword [ebp - 8], ebx
jne 0x1001d2f
jmp 0x1001d36
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1001322
cmp byte [ebp - 1], bl
jne 0x1001382
jmp 0x1001bbf
cmp byte [ebp - 3], bl
mov dword [ebp - 0x14], ebx
jne 0x1001bbf
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push 0xc0000002
push ebx
push reloc.KERNEL32.dll_GetProcessHeap
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x1001bbf
push 0x1001f74
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x10
push 0x1001eac
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 0x1002100
mov dword [ebp - 0x14], ebx
call dword [sym.imp.USER32.dll_FindWindowW]
test byte [ebp - 0x84], 1
je 0x1001beb
cmp word [ebp - 0x80], bx
je 0x1001bed
xor esi, esi
cmp eax, ebx
je 0x1001bfb
cmp esi, ebx
jne 0x1001bfb
push eax
call fcn.010022d9
push esi
push edi
call fcn.01002241
jmp 0x1001e80
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x10013f7
jmp 0x1001e80
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [ebp - 8], eax
jmp 0x10014d6
cmp dword [ebp - 8], ebx
je 0x10014ff
cmp dword [ebp - 0xc], ebx
mov byte [ebp - 1], bl
mov esi, 0x1001f50
mov edi, 0x1001f30
je 0x1001cf4
lea eax, [ebp - 0x10]
push eax
push 1
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call fcn.01002213
test eax, eax
jl 0x1001cf4
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp - 0x10]
call fcn.01002213
test eax, eax
jl 0x1001cf4
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push 2
pop ecx
mul ecx
push edx
push eax
call fcn.010021e1
test eax, eax
jl 0x1001cf4
push dword [ebp - 0x18]
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x1001cf4
push esi
push dword [ebp - 0x10]
push eax
call fcn.010023f7
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 8]
call fcn.01002431
push 0xa
push ebx
push dword [ebp - 8]
push edi
push 0x1001f68
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jbe 0x1001ce2
mov byte [ebp - 1], 1
mov byte [ebp - 2], bl
push dword [ebp - 8]
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp byte [ebp - 1], bl
jne 0x1001d0d
push 0xa
push ebx
push esi
push edi
push 0x1001f68
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jbe 0x1001d0d
mov byte [ebp - 2], bl
cmp byte [ebp - 2], bl
jne 0x10014ff
jmp 0x1001e80
cmp dword [ebp - 8], ebx
jne 0x1001a24
jmp 0x1001d36
mov byte [ebp - 2], 1
jmp 0x1001a32
call dword [ebp - 8]
test eax, eax
jne 0x1001d3d
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.ole32.dll_CoFreeUnusedLibraries]
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp byte [ebp - 1], bl
jne 0x1001e80
cmp byte [ebp - 3], bl
jne 0x1001e80
cmp byte [ebp - 2], bl
je 0x1001da7
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push 0xc0000004
push ebx
push reloc.KERNEL32.dll_GetProcessHeap
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x1001e80
push 0x1001f74
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x10
push 0x1001eac
push dword [ebp - 8]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 8]
jmp 0x1001e7a
mov eax, dword [ebp - 0x2c]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov dword [ebp - 0xc], ebx
mov edi, reloc.KERNEL32.dll_GetProcessHeap
je 0x1001e19
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x38]
shr eax, 0x10
mov dword [ebp - 0x68], eax
movzx eax, word [ebp - 0x38]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x34]
shr eax, 0x10
mov dword [ebp - 0x60], eax
movzx eax, word [ebp - 0x34]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x40]
shr eax, 0x10
mov dword [ebp - 0x58], eax
movzx eax, word [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x3c]
shr eax, 0x10
mov dword [ebp - 0x50], eax
movzx eax, word [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x6c]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push 0xc0000003
push ebx
push edi
call esi
mov eax, dword [ebp - 0xc]
cmp eax, ebx
jne 0x1001e22
mov dword [ebp - 0x18], 0x1001f64
jmp 0x1001e25
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push 0xc0000001
push ebx
push edi
call esi
test eax, eax
je 0x1001e72
push 0x1001f74
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x14
push 0x1001eac
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x1001e72
push 0xa
push ebx
push ebx
push 0x1001ed8
push 0x1001f68
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp - 0xc], ebx
je 0x1001e80
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x2c], ebx
je 0x1001e92
push dword [ebp - 0x2c]
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x14], ebx
je 0x1001ea0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_ExitProcess]