Function at 0x101a5ed
Capabilities:
Check mutex on windows
Query or enumerate registry value

Disassembly:
push 0x1047380
push 0x10133d0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
call fcn.0101a751
cmp eax, esi
je 0x1023263
push 0x10132b0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 0xc], ebx
je 0x10130cc
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.0101a751
cmp eax, esi
je 0x1023258
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
xor ebx, ebx
inc ebx
push ebx
mov dword [ebp - 0x10], eax
call dword [sym.imp.SHELL32.dll_Ordinal_188]
push esi
push 2
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
call fcn.01019efb
push esi
push 0x12
push 0x12
push esi
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
call fcn.0101a84b
push ebx
mov dword [ebp - 0x14], eax
call dword [sym.imp.SHELL32.dll_Ordinal_660]
call fcn.01019b64
mov dword [0x10466c8], eax
call fcn.01019bed
mov dword [0x104746c], eax
call fcn.01019779
call fcn.010198dc
call fcn.010199ec
cmp dword [0x10466c8], esi
je 0x1013150
call fcn.01019a59
call fcn.010199ab
cmp dword [0x10466c4], esi
jne 0x1023274
call fcn.0101985b
cmp dword [0x10466c4], esi
jne 0x1013189
push 0x1013274
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, eax
call sub.SHDOCVW.dll_Ordinal_125
cmp ebx, esi
je 0x1013189
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x104746c], esi
push 3
pop ebx
je 0x10196b2
push esi
call fcn.010182f1
call dword [sym.imp.SHDOCVW.dll_Ordinal_110]
mov dword [ebp - 8], esi
mov dword [ebp + 8], esi
mov dword [ebp - 4], esi
call fcn.01013395
test eax, eax
jne 0x10131e2
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHLWAPI.dll_SHCreateThreadRef]
test eax, eax
jl 0x10131d1
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHSetThreadRef]
call fcn.010132f3
mov dword [ebp - 4], eax
lea eax, [ebp + 8]
push eax
call fcn.010051fe
cmp dword [ebp - 0xc], esi
je 0x10131f0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp - 4], esi
je 0x1023314
push esi
push 1
push 0x590
push dword [0x1046094]
call dword [sym.imp.USER32.dll_PostMessageW]
call fcn.0101389f
call fcn.0101343b
call fcn.01013579
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0101385e
cmp dword [0x10466e0], esi
jne 0x10232b5
push 0x15
push 0x101325c
call fcn.0100fa93
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push dword [ebp - 4]
call sub.SHELL32.dll_Ordinal_201
jmp 0x1023302
call fcn.01019669
inc eax
push eax
call fcn.0101970a
call fcn.010196d5
test eax, eax
je 0x1013198
jmp 0x102327e
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edi, dword [ebp + 8]
push edi
call fcn.0101a9de
call sub.SHLWAPI.dll_Ordinal_241_1
xor esi, esi
push esi
push edi
push 0x1047578
mov ecx, 0x1046f00
mov dword [0x10466e0], eax
mov dword [0x10460dc], edi
call fcn.0101a923
test eax, eax
jl 0x102333d
call fcn.0101a705
call dword [sym.imp.USER32.dll_GetShellWindow]
test eax, eax
jne 0x101a672
cmp dword [0x10466c4], esi
jne 0x101a672
push esi
push esi
push esi
push esi
push esi
push esi
push 0x101a6e4
push 0x101a688
call dword [sym.imp.SHLWAPI.dll_SHRegGetUSValueW]
test eax, eax
je 0x102323e
push ebx
push 0x10460a4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x102324e
push 0x10233a0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x101a672
call fcn.0102b6bd
jmp 0x101308b
cmp ebx, esi
je 0x1023263
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
call fcn.0102b427
jmp 0x1023332
call fcn.0102b49b
jmp 0x101315c
lea eax, [ebp - 4]
push eax
push 0x10233b8
push ebx
push esi
push 0x10083b4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1013198
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push 5
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1013198
call edi
push dword [ebp - 0x10]
mov edi, eax
push ebx
push 1
push 0x1023374
push esi
call sub.SHLWAPI.dll_Ordinal_244_1
push edi
push ebx
push ebx
push 0x102334c
push esi
call sub.SHLWAPI.dll_Ordinal_244_1
jmp 0x1013233
push esi
push esi
push esi
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x1023302
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 8], esi
jne 0x10232dd
push 1
call fcn.010182f1
push esi
call fcn.0101970a
call dword [sym.imp.SHDOCVW.dll_Ordinal_111]
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [ebp - 0x14], esi
jl 0x102332b
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.SHELL32.dll_Ordinal_188]
push 0x1046f00
call fcn.0102b0be
pop ebx
call fcn.0103c03f
xor eax, eax
pop edi
inc eax
pop esi
leave
ret 0x10