Function at 0x10028688
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create thread
Delete registry key
Terminate process
Terminate thread

Disassembly:
mov eax, 0x10068d00
call fcn.100575f8
sub esp, 0x2cc
mov eax, dword [0x10084500]
push esi
xor esi, esi
mov dword [esp + 0x2cc], eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x2d8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
push 0x104
push 0x10085a50
push dword [0x10085db4]
mov byte [esp + 0x2e4], 1
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.10027cc5
test al, al
jne 0x1002870b
lea ecx, [esp + 8]
mov byte [0x10085fc0], 1
call fcn.1004f53d
lea ecx, [esp + 0x18]
call fcn.1004f53d
jmp 0x100289d0
push 0x10086080
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x10085f88], eax
call fcn.100044c6
mov dword [0x10083d60], eax
lea eax, [esp + 4]
push eax
push esi
push esi
push 0x10027bc6
push esi
push esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10085fb4], eax
call fcn.10028097
cmp dword [esp + 0x2e4], 1
je 0x10028786
push esi
push dword [0x10085db4]
push esi
push esi
push 0xa
push 0xa
push esi
push esi
push 0xcf0000
push 0x1006cd39
push str.button
push esi
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0x1002f810
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x90]
push eax
call fcn.100233e0
pop ecx
lea eax, [esp + 0x90]
push eax
push esi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov ebp, eax
cmp ebp, esi
jne 0x100287cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1002892b
lea eax, [esp + 0x50]
push eax
call fcn.100274b0
push 0x68
push 1
push 3
call fcn.10004566
mov eax, dword [0x10085fb4]
add esp, 0x10
cmp eax, esi
je 0x10028839
push esi
push eax
call ebx
push dword [0x10085fb4]
call edi
lea eax, [esp + 0xd0]
push 0x1006f158
push eax
mov dword [0x10085fb4], esi
call fcn.10057da0
lea eax, [esp + 0xd8]
push str.D8727F00_BD57_4900_84CB_CD58B13EB833
push eax
call fcn.10057db0
add esp, 0x10
lea eax, [esp + 0xd0]
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov eax, dword [0x10085e78]
cmp eax, esi
je 0x10028870
push esi
push eax
call ebx
push dword [0x10085e78]
call edi
mov eax, dword [0x10085c68]
cmp eax, esi
mov dword [0x10085e78], esi
je 0x10028870
push 0x8000
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x10085c68], esi
mov eax, dword [0x10085e7c]
cmp eax, esi
je 0x10028886
push eax
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x10085e7c], esi
mov eax, dword [0x10085fb0]
cmp eax, esi
je 0x1002889c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x10085fb0], esi
push 0x104
lea eax, [esp + 0x1d8]
push eax
push esi
mov dword [0x10085f8c], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x1d4]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
call edi
mov eax, dword [0x10085f88]
cmp eax, esi
je 0x100288e4
push eax
call edi
mov dword [0x10085f88], esi
lea eax, [esp + 0x50]
push eax
push esi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebp
call edi
lea eax, [esp + 0x1d4]
push str.rundll32.exe
push eax
call fcn.10057d10
test eax, eax
pop ecx
pop ecx
je 0x100289bb
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x10089a90
push esi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
cmp eax, esi
jne 0x10028974
cmp dword [esp + 0x2f0], 1
jne 0x1002896d
push str.explorer.exe
call fcn.1002dc00
cmp eax, esi
pop ecx
je 0x10028977
push 0x10085cb0
push eax
call fcn.1002dcc0
jmp 0x10028977
call sym.mnbv.DLL_s
jmp 0x10028977
push eax
call edi
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.1002855e
mov ebp, dword [sym.imp.USER32.dll_PeekMessageA]
pop ecx
pop ecx
jmp 0x1002899b
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push esi
push esi
lea eax, [esp + 0x40]
push esi
push eax
call ebp
test eax, eax
jne 0x10028990
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10028795
lea ecx, [esp + 0x14]
call fcn.1004f53d
lea ecx, [esp + 0x24]
call fcn.1004f53d
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2d0]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x2cc]
xor eax, eax
pop esi
call fcn.100568ae
leave
ret 4