Function at 0x1072047
Capabilities:
Create process on windows
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6b8
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 0x624]
push eax
push 0x20019
xor ebx, ebx
push ebx
mov edi, 0x1015388
push edi
push 0x80000002
mov dword [ebp - 0x634], ecx
call esi
test eax, eax
jne 0x10723f8
lea eax, [ebp - 0x628]
push eax
push 3
push ebx
push edi
push 0x80000001
call esi
test eax, eax
jne 0x10723ec
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x674]
push eax
push ebx
push ebx
push 0x1072534
push dword [ebp - 0x628]
mov dword [ebp - 0x620], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1072144
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x664]
push eax
call esi
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x674]
push eax
call esi
lea eax, [ebp - 0x63c]
push eax
call fcn.0104b44b
mov esi, eax
lea eax, [ebp - 0x630]
push eax
mov edi, edx
call fcn.0104b44b
sub eax, esi
sbb edx, edi
cmp edx, 0xc9
jb 0x10723e0
ja 0x1072144
cmp eax, 0x2a69c000
jb 0x10723e0
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x62c]
push eax
push ebx
push ebx
push 0x1072514
push dword [ebp - 0x624]
mov dword [ebp - 0x620], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x107217f
mov dword [ebp - 0x62c], 0x927c0
jmp 0x1072191
mov eax, dword [ebp - 0x62c]
imul eax, eax, 0x3e8
mov dword [ebp - 0x62c], eax
push 8
pop esi
lea eax, [ebp - 0x63c]
push eax
mov dword [ebp - 0x63c], esi
call dword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x10721c3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x638]
cmp eax, dword [ebp - 0x62c]
jb 0x10723e0
xor eax, eax
mov ecx, esi
lea edi, [ebp - 0x654]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x654]
push eax
push ebx
push ebx
push 0x10724e4
push dword [ebp - 0x624]
mov dword [ebp - 0x620], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1072274
mov ax, word [ebp - 0x650]
cmp ax, bx
je 0x1072217
cmp ax, word [ebp - 0x660]
jne 0x10723e0
cmp word [ebp - 0x64e], bx
je 0x1072241
mov ax, word [ebp - 0x65e]
cmp word [ebp - 0x64e], ax
jb 0x10723e0
cmp ax, word [ebp - 0x63e]
ja 0x10723e0
cmp word [ebp - 0x64c], bx
jne 0x1072253
cmp word [ebp - 0x63c], bx
je 0x1072274
mov ax, word [ebp - 0x65c]
cmp word [ebp - 0x64c], ax
ja 0x10723e0
cmp ax, word [ebp - 0x63c]
ja 0x10723e0
mov eax, dword [ebp - 0x634]
mov eax, dword [eax + 0xc08]
mov esi, 0x104
cmp eax, ebx
je 0x10722c8
push esi
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.0100af93
test eax, eax
jl 0x10723e0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
cmp eax, ebx
je 0x10723e0
push 0x10724d8
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpICW]
test eax, eax
jne 0x10723e0
push 0x10724ac
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x10723e0
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x10723e0
mov esi, 0x208
push esi
lea eax, [ebp - 0x61c]
push eax
push 0x1072460
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x10723e0
push 0x1072410
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.01010e3b
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.01010e3b
push 0x1072408
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.01010e3b
push 0x44
pop esi
push esi
lea eax, [ebp - 0x6b8]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x644]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x6b8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x61c]
push eax
push ebx
mov dword [ebp - 0x6b8], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10723e0
push dword [ebp - 0x644]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x640]
call esi
push 0x10
lea eax, [ebp - 0x664]
push eax
push 3
push ebx
push 0x1072534
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x634]
push ebx
push 1
push dword [0x10b10ec]
call fcn.01070efd
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001feb
leave
ret