Function at 0x10001040
Capabilities:
Check mutex on windows
Delete registry value
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x100136e0]
xor eax, ebp
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x148], 4
mov dword [ebp - 8], 0
push 0x10013008
push 0x10013028
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
push 0x10013034
push 0x10013044
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
call fcn.10008220
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 4], 0x80000000
jae 0x10001106
mov dword [0x10015164], 1
jmp 0x10001110
mov dword [0x10015164], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0
je 0x10001462
cmp dword [ebp - 0x154], 1
je 0x10001134
jmp 0x1000155c
cmp dword [0x10015164], 0
je 0x10001406
push str.EIO_shared_memory_mutex
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x100144a0], eax
cmp dword [ebp - 0x14], 0
je 0x10001160
push 0
call dword [ebp - 0x14]
push 0x100
lea ecx, [ebp - 0x138]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea edx, [ebp - 0x138]
push edx
call fcn.100083d0
add esp, 8
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
add eax, 1
mov dword [ebp - 0x14c], eax
push str.IDriver.exe
mov ecx, dword [ebp - 0x14c]
push ecx
call fcn.1000f4a9
add esp, 8
test eax, eax
jne 0x100011c7
cmp dword [ebp - 0x14], 0
je 0x100011bd
push 1
call dword [ebp - 0x14]
mov eax, 1
jmp 0x10001561
cmp dword [ebp - 0x20], 0
je 0x100011de
lea edx, [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0x20]
cmp dword [section..data], 0
je 0x100011f4
cmp dword [section..data], 0xffffffff
jne 0x1000135b
xor eax, eax
jne 0x10001201
cmp dword [ebp - 0x140], 0
je 0x10001232
cmp dword [ebp - 0x13c], 0xc
jne 0x1000121e
push 0x10013074
push 0x10013088
call fcn.100065a0
add esp, 8
jmp 0x10001230
push 0x10013094
push 0x100130a8
call fcn.100065a0
add esp, 8
jmp 0x10001261
cmp dword [ebp - 0x13c], 0xc
jne 0x1000124f
push 0x100130bc
push 0x100130d0
call fcn.100065a0
add esp, 8
jmp 0x10001261
push 0x100130dc
push 0x100130f0
call fcn.100065a0
add esp, 8
cmp dword [0x100144a0], 0
je 0x1000127e
push 0xffffffffffffffff
mov ecx, dword [0x100144a0]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 8], eax
jmp 0x10001285
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0
je 0x10001294
cmp dword [ebp - 8], 0x80
jne 0x10001304
push 0x10013100
call fcn.10005d30
add esp, 4
test eax, eax
jne 0x100012cd
cmp dword [ebp - 0x14], 0
je 0x100012b0
push 1
call dword [ebp - 0x14]
cmp dword [0x100144a0], 0
je 0x100012c6
mov edx, dword [0x100144a0]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
jmp 0x10001561
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push 0x10013108
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [section..data], eax
cmp dword [0x100144a0], 0
je 0x10001304
mov eax, dword [0x100144a0]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
je 0x10001323
mov dword [section..data], 0xffffffff
cmp dword [section..data], 0
je 0x10001335
cmp dword [section..data], 0xffffffff
jne 0x1000135b
push 0x10013114
mov ecx, dword [ebp - 0x144]
push ecx
call fcn.10006a90
add esp, 8
cmp dword [ebp - 0x14], 0
je 0x10001354
push 1
call dword [ebp - 0x14]
xor eax, eax
jmp 0x10001561
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
push 0xf003f
push 0
push 0x100144b8
push 0
push 0x10013120
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100013ef
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x150]
push edx
lea eax, [ebp - 0x148]
push eax
push 0
push 0x10013154
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100013ba
mov dword [ebp - 0x150], 1
jmp 0x100013c9
mov edx, dword [ebp - 0x150]
add edx, 1
mov dword [ebp - 0x150], edx
push 4
lea eax, [ebp - 0x150]
push eax
push 4
push 0
push 0x10013164
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0
je 0x100013fa
push 1
call dword [ebp - 0x14]
mov eax, 1
jmp 0x10001561
push 0x10013174
push str.EIO.vxd
call fcn.100065a0
add esp, 8
push 0
push 0x40000080
push 3
push 0
push 3
push 0xc0000000
push str..EIO.vxd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [section..data], eax
cmp dword [section..data], 0
je 0x1000144c
cmp dword [section..data], 0xffffffff
jne 0x10001453
xor eax, eax
jmp 0x10001561
mov eax, 1
jmp 0x10001561
cmp dword [ebp - 0x14], 0
je 0x1000146d
push 0
call dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0xf003f
push 0
push 0x100144b9
push 0
push 0x10013190
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1000152e
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x148]
push ecx
push 0
push 0x100131c4
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100014d0
mov dword [ebp - 0x150], 0
jmp 0x100014df
mov eax, dword [ebp - 0x150]
sub eax, 1
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
jne 0x10001506
push 0x100131d4
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x100131e4
call fcn.100062e0
add esp, 4
jmp 0x10001522
push 4
lea edx, [ebp - 0x150]
push edx
push 4
push 0
push 0x100131ec
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000153b
push 0x100131fc
call fcn.100062e0
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x10001546
push 1
call dword [ebp - 0x14]
cmp dword [section..data], 0
je 0x1000155c
mov edx, dword [section..data]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 0x38]
xor ecx, ebp
call fcn.100083fd
mov esp, ebp
pop ebp
ret 0xc