Function at 0x10725e1
Capabilities:
Create process on windows
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6b8
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 0x624]
push eax
push 0x20019
xor ebx, ebx
push ebx
mov edi, 0x1015358
push edi
push reloc.SHELL32.dll_SHChangeNotifyRegister
mov dword [ebp - 0x634], ecx
call esi
test eax, eax
jne 0x1072992
lea eax, [ebp - 0x628]
push eax
push 3
push ebx
push edi
push SHChangeNotifyRegister
call esi
test eax, eax
jne 0x1072986
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x674]
push eax
push ebx
push ebx
push 0x1072acc
push dword [ebp - 0x628]
mov dword [ebp - 0x620], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10726de
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x664]
push eax
call esi
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x674]
push eax
call esi
lea eax, [ebp - 0x63c]
push eax
call fcn.01044b13
mov esi, eax
lea eax, [ebp - 0x630]
push eax
mov edi, edx
call fcn.01044b13
sub eax, esi
sbb edx, edi
cmp edx, 0xc9
jb 0x107297a
ja 0x10726de
cmp eax, 0x2a69c000
jb 0x107297a
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x62c]
push eax
push ebx
push ebx
push 0x1072aac
push dword [ebp - 0x624]
mov dword [ebp - 0x620], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1072719
mov dword [ebp - 0x62c], 0x927c0
jmp 0x107272b
mov eax, dword [ebp - 0x62c]
imul eax, eax, 0x3e8
mov dword [ebp - 0x62c], eax
push 8
pop esi
lea eax, [ebp - 0x63c]
push eax
mov dword [ebp - 0x63c], esi
call dword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x107275d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x638]
cmp eax, dword [ebp - 0x62c]
jb 0x107297a
xor eax, eax
mov ecx, esi
lea edi, [ebp - 0x654]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x654]
push eax
push ebx
push ebx
push 0x1072a7c
push dword [ebp - 0x624]
mov dword [ebp - 0x620], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x107280e
mov ax, word [ebp - 0x650]
cmp ax, bx
je 0x10727b1
cmp ax, word [ebp - 0x660]
jne 0x107297a
cmp word [ebp - 0x64e], bx
je 0x10727db
mov ax, word [ebp - 0x65e]
cmp word [ebp - 0x64e], ax
jb 0x107297a
cmp ax, word [ebp - 0x63e]
ja 0x107297a
cmp word [ebp - 0x64c], bx
jne 0x10727ed
cmp word [ebp - 0x63c], bx
je 0x107280e
mov ax, word [ebp - 0x65c]
cmp word [ebp - 0x64c], ax
ja 0x107297a
cmp ax, word [ebp - 0x63c]
ja 0x107297a
mov eax, dword [ebp - 0x634]
mov eax, dword [eax + 0xc08]
mov esi, 0x104
cmp eax, ebx
je 0x1072862
push esi
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.0100af93
test eax, eax
jl 0x107297a
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
cmp eax, ebx
je 0x107297a
push 0x1072a70
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpICW]
test eax, eax
jne 0x107297a
push 0x1072a44
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x107297a
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x107297a
mov esi, 0x208
push esi
lea eax, [ebp - 0x61c]
push eax
push 0x10729f8
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x107297a
push 0x10729a8
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.01010e33
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.01010e33
push 0x10729a4
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.01010e33
push 0x44
pop esi
push esi
lea eax, [ebp - 0x6b8]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x644]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x6b8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x61c]
push eax
push ebx
mov dword [ebp - 0x6b8], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x107297a
push dword [ebp - 0x644]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x640]
call esi
push 0x10
lea eax, [ebp - 0x664]
push eax
push 3
push ebx
push 0x1072acc
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x634]
push ebx
push 1
push dword [0x10b10ec]
call fcn.0107147a
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001fef
leave
ret