Function at 0x10702e7
Capabilities:
Create process on windows
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6b8
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 0x624]
push eax
push 0x20019
xor ebx, ebx
push ebx
mov edi, 0x1017800
push edi
push 0x80000002
mov dword [ebp - 0x634], ecx
call esi
test eax, eax
jne 0x1070698
lea eax, [ebp - 0x628]
push eax
push 3
push ebx
push edi
push 0x80000001
call esi
test eax, eax
jne 0x107068c
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x674]
push eax
push ebx
push ebx
push 0x10707d4
push dword [ebp - 0x628]
mov dword [ebp - 0x620], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10703e4
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x664]
push eax
call esi
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x674]
push eax
call esi
lea eax, [ebp - 0x63c]
push eax
call fcn.0106d386
mov esi, eax
lea eax, [ebp - 0x630]
push eax
mov edi, edx
call fcn.0106d386
sub eax, esi
sbb edx, edi
cmp edx, 0xc9
jb 0x1070680
ja 0x10703e4
cmp eax, 0x2a69c000
jb 0x1070680
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x62c]
push eax
push ebx
push ebx
push 0x10707b4
push dword [ebp - 0x624]
mov dword [ebp - 0x620], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x107041f
mov dword [ebp - 0x62c], 0x927c0
jmp 0x1070431
mov eax, dword [ebp - 0x62c]
imul eax, eax, 0x3e8
mov dword [ebp - 0x62c], eax
push 8
pop esi
lea eax, [ebp - 0x63c]
push eax
mov dword [ebp - 0x63c], esi
call dword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x1070463
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x638]
cmp eax, dword [ebp - 0x62c]
jb 0x1070680
xor eax, eax
mov ecx, esi
lea edi, [ebp - 0x654]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x654]
push eax
push ebx
push ebx
push 0x1070784
push dword [ebp - 0x624]
mov dword [ebp - 0x620], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1070514
mov ax, word [ebp - 0x650]
cmp ax, bx
je 0x10704b7
cmp ax, word [ebp - 0x660]
jne 0x1070680
cmp word [ebp - 0x64e], bx
je 0x10704e1
mov ax, word [ebp - 0x65e]
cmp word [ebp - 0x64e], ax
jb 0x1070680
cmp ax, word [ebp - 0x63e]
ja 0x1070680
cmp word [ebp - 0x64c], bx
jne 0x10704f3
cmp word [ebp - 0x63c], bx
je 0x1070514
mov ax, word [ebp - 0x65c]
cmp word [ebp - 0x64c], ax
ja 0x1070680
cmp ax, word [ebp - 0x63c]
ja 0x1070680
mov eax, dword [ebp - 0x634]
mov eax, dword [eax + 0xc08]
mov esi, 0x104
cmp eax, ebx
je 0x1070568
push esi
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.01009e9b
test eax, eax
jl 0x1070680
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
cmp eax, ebx
je 0x1070680
push 0x1070778
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpICW]
test eax, eax
jne 0x1070680
push 0x107074c
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x1070680
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1070680
mov esi, 0x208
push esi
lea eax, [ebp - 0x61c]
push eax
push 0x1070700
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1070680
push 0x10706b0
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.0101237f
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.0101237f
push 0x10706a8
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.0101237f
push 0x44
pop esi
push esi
lea eax, [ebp - 0x6b8]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x644]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x6b8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x61c]
push eax
push ebx
mov dword [ebp - 0x6b8], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1070680
push dword [ebp - 0x644]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x640]
call esi
push 0x10
lea eax, [ebp - 0x664]
push eax
push 3
push ebx
push 0x10707d4
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x634]
push ebx
push 1
push dword [0x10b10e8]
call fcn.0106f1a0
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100204d
leave
ret