Function at 0x107021f
Capabilities:
Create process on windows
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6b8
mov eax, dword [0x10b0090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 0x624]
push eax
push 0x20019
xor ebx, ebx
push ebx
mov edi, 0x1017800
push edi
push 0x80000002
mov dword [ebp - 0x634], ecx
call esi
test eax, eax
jne 0x10705d0
lea eax, [ebp - 0x628]
push eax
push 3
push ebx
push edi
push 0x80000001
call esi
test eax, eax
jne 0x10705c4
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x674]
push eax
push ebx
push ebx
push 0x107070c
push dword [ebp - 0x628]
mov dword [ebp - 0x620], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x107031c
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x664]
push eax
call esi
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x674]
push eax
call esi
lea eax, [ebp - 0x63c]
push eax
call fcn.0106d2be
mov esi, eax
lea eax, [ebp - 0x630]
push eax
mov edi, edx
call fcn.0106d2be
sub eax, esi
sbb edx, edi
cmp edx, 0xc9
jb 0x10705b8
ja 0x107031c
cmp eax, 0x2a69c000
jb 0x10705b8
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x62c]
push eax
push ebx
push ebx
push 0x10706ec
push dword [ebp - 0x624]
mov dword [ebp - 0x620], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1070357
mov dword [ebp - 0x62c], 0x927c0
jmp 0x1070369
mov eax, dword [ebp - 0x62c]
imul eax, eax, 0x3e8
mov dword [ebp - 0x62c], eax
push 8
pop esi
lea eax, [ebp - 0x63c]
push eax
mov dword [ebp - 0x63c], esi
call dword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x107039b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x638]
cmp eax, dword [ebp - 0x62c]
jb 0x10705b8
xor eax, eax
mov ecx, esi
lea edi, [ebp - 0x654]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x654]
push eax
push ebx
push ebx
push 0x10706bc
push dword [ebp - 0x624]
mov dword [ebp - 0x620], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x107044c
mov ax, word [ebp - 0x650]
cmp ax, bx
je 0x10703ef
cmp ax, word [ebp - 0x660]
jne 0x10705b8
cmp word [ebp - 0x64e], bx
je 0x1070419
mov ax, word [ebp - 0x65e]
cmp word [ebp - 0x64e], ax
jb 0x10705b8
cmp ax, word [ebp - 0x63e]
ja 0x10705b8
cmp word [ebp - 0x64c], bx
jne 0x107042b
cmp word [ebp - 0x63c], bx
je 0x107044c
mov ax, word [ebp - 0x65c]
cmp word [ebp - 0x64c], ax
ja 0x10705b8
cmp ax, word [ebp - 0x63c]
ja 0x10705b8
mov eax, dword [ebp - 0x634]
mov eax, dword [eax + 0xc08]
mov esi, 0x104
cmp eax, ebx
je 0x10704a0
push esi
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.01009e9b
test eax, eax
jl 0x10705b8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
cmp eax, ebx
je 0x10705b8
push 0x10706b0
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpICW]
test eax, eax
jne 0x10705b8
push 0x1070684
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x10705b8
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x10705b8
mov esi, 0x208
push esi
lea eax, [ebp - 0x61c]
push eax
push 0x1070638
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x10705b8
push 0x10705e8
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.0101237f
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.0101237f
push 0x10705e0
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.0101237f
push 0x44
pop esi
push esi
lea eax, [ebp - 0x6b8]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x644]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x6b8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x61c]
push eax
push ebx
mov dword [ebp - 0x6b8], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10705b8
push dword [ebp - 0x644]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x640]
call esi
push 0x10
lea eax, [ebp - 0x664]
push eax
push 3
push ebx
push 0x107070c
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x634]
push ebx
push 1
push dword [0x10b00e8]
call fcn.0106f0d8
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100204d
leave
ret