Function at 0x101a5fd
Capabilities:
Check mutex on windows
Query or enumerate registry value

Disassembly:
push 0x1047380
push 0x10133f0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
call fcn.0101a761
cmp eax, esi
je 0x10232b7
push 0x10132d0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 0xc], ebx
je 0x10130ec
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.0101a761
cmp eax, esi
je 0x10232ac
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
xor ebx, ebx
inc ebx
push ebx
mov dword [ebp - 0x10], eax
call dword [sym.imp.SHELL32.dll_Ordinal_188]
push esi
push 2
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
call fcn.01019f0b
push esi
push 0x12
push 0x12
push esi
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
call fcn.0101a85b
push ebx
mov dword [ebp - 0x14], eax
call dword [sym.imp.SHELL32.dll_Ordinal_660]
call fcn.01019b74
mov dword [0x10466c8], eax
call fcn.01019bfd
mov dword [0x104746c], eax
call fcn.01019789
call fcn.010198ec
call fcn.010199fc
cmp dword [0x10466c8], esi
je 0x1013170
call fcn.01019a69
call fcn.010199bb
cmp dword [0x10466c4], esi
jne 0x10232c8
call fcn.0101986b
cmp dword [0x10466c4], esi
jne 0x10131a9
push 0x1013294
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, eax
call sub.SHDOCVW.dll_Ordinal_125
cmp ebx, esi
je 0x10131a9
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x104746c], esi
push 3
pop ebx
je 0x10196c2
push esi
call fcn.01018351
call dword [sym.imp.SHDOCVW.dll_Ordinal_110]
mov dword [ebp - 8], esi
mov dword [ebp + 8], esi
mov dword [ebp - 4], esi
call fcn.010133b5
test eax, eax
jne 0x1013202
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHLWAPI.dll_SHCreateThreadRef]
test eax, eax
jl 0x10131f1
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHSetThreadRef]
call fcn.01013313
mov dword [ebp - 4], eax
lea eax, [ebp + 8]
push eax
call fcn.010051fe
cmp dword [ebp - 0xc], esi
je 0x1013210
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp - 4], esi
je 0x1023368
push esi
push 1
push 0x590
push dword [0x1046094]
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.010138bf
call fcn.0101345b
call fcn.01013599
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0101387e
cmp dword [0x10466e0], esi
jne 0x1023309
push 0x15
push 0x101327c
call fcn.0100fa9f
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push dword [ebp - 4]
call sub.SHELL32.dll_Ordinal_201
jmp 0x1023356
call fcn.01019677
inc eax
push eax
call fcn.0101971a
call fcn.010196e5
test eax, eax
je 0x10131b8
jmp 0x10232d2
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edi, dword [ebp + 8]
push edi
call fcn.0101a9ee
call sub.SHLWAPI.dll_Ordinal_241_1
xor esi, esi
push esi
push edi
push 0x1047578
mov ecx, 0x1046f00
mov dword [0x10466e0], eax
mov dword [0x10460dc], edi
call fcn.0101a933
test eax, eax
jl 0x1023391
call fcn.0101a715
call dword [sym.imp.USER32.dll_GetShellWindow]
test eax, eax
jne 0x101a682
cmp dword [0x10466c4], esi
jne 0x101a682
push esi
push esi
push esi
push esi
push esi
push esi
push 0x101a6f4
push 0x101a698
call dword [sym.imp.SHLWAPI.dll_SHRegGetUSValueW]
test eax, eax
je 0x1023292
push ebx
push 0x10460a4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x10232a2
push 0x10233f4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x101a682
call fcn.0102b76d
jmp 0x10130ab
cmp ebx, esi
je 0x10232b7
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
call fcn.0102b4db
jmp 0x1023386
call fcn.0102b54f
jmp 0x101317c
lea eax, [ebp - 4]
push eax
push 0x102340c
push ebx
push esi
push 0x10083b4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x10131b8
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push 5
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x10131b8
call edi
push dword [ebp - 0x10]
mov edi, eax
push ebx
push 1
push 0x10233c8
push esi
call sub.SHLWAPI.dll_Ordinal_244_1
push edi
push ebx
push ebx
push 0x10233a0
push esi
call sub.SHLWAPI.dll_Ordinal_244_1
jmp 0x1013253
push esi
push esi
push esi
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x1023356
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 8], esi
jne 0x1023331
push 1
call fcn.01018351
push esi
call fcn.0101971a
call dword [sym.imp.SHDOCVW.dll_Ordinal_111]
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [ebp - 0x14], esi
jl 0x102337f
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.SHELL32.dll_Ordinal_188]
push 0x1046f00
call fcn.0102b172
pop ebx
call fcn.0103c0ef
xor eax, eax
pop edi
inc eax
pop esi
leave
ret 0x10