Function at 0x1005fcd
Capabilities:
Accept command line arguments
Delete registry value
Read .ini file
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor esi, esi
push 0x1001dfc
push esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call fcn.01006e8c
pop ecx
pop ecx
push 0x41
pop ecx
xor eax, eax
mov ebx, 0x1010368
mov edi, ebx
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x41
pop ecx
xor eax, eax
mov edi, 0x1010158
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
mov ecx, 0x100
mov edi, 0x100f950
rep stosd dword es:[edi], eax
push 0x1001d98
xor edi, edi
inc edi
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [0x1010150], esi
mov dword [0x100f94c], esi
mov dword [0x100f920], esi
mov dword [0x100f714], esi
mov dword [0x100f70c], esi
call fcn.01005ec9
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.010056da
test eax, eax
pop ecx
je 0x1006090
push dword [ebp + 0x10]
push 0x1001d50
call fcn.010038d5
pop ecx
pop ecx
push 0x10
push 0x1f4
call fcn.010051cd
pop ecx
push eax
push 0x1fe
call fcn.010051cd
pop ecx
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x10061f5
push ebx
mov dword [0x100f708], edi
call fcn.01005922
test eax, eax
pop ecx
jne 0x1006133
push 0x1fd
mov dword [0x100f708], esi
call fcn.010051cd
cmp eax, esi
pop ecx
mov dword [ebp + 8], eax
je 0x10061f5
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0x107
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
cmp edi, esi
mov dword [ebp + 0x10], edi
je 0x10061b6
push dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
pop ecx
pop ecx
push 0x1001d48
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
call edi
push ebx
push dword [ebp + 0x10]
call edi
push 0x1001d48
push dword [ebp + 0x10]
call edi
push 0x10
push 0x1f4
call fcn.010051cd
pop ecx
push eax
push dword [ebp + 0x10]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x10061f5
call fcn.01005567
test eax, eax
jne 0x10061f5
push ebx
push 0x400
push 0x100f950
push 0x100128c
push 0x1001d24
mov edi, 0x10015f8
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push ebx
push esi
push 0x1001cf8
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
mov dword [0x100f94c], eax
jne 0x10061e6
mov eax, dword [0x1010150]
cmp eax, esi
je 0x10061e6
push eax
call sub.RASAPI32.dll_RasHangUpW
push dword [0x1010150]
call fcn.01005157
push 0x40
call fcn.0100667d
cmp eax, esi
pop ecx
pop ecx
je 0x10061ac
mov ecx, eax
call fcn.01004cd7
mov dword [ebp - 8], eax
jmp 0x10061af
mov dword [ebp - 8], esi
mov ecx, dword [ebp - 8]
cmp ecx, esi
jne 0x10061ce
push 0x10
push 0x1f4
call fcn.010051cd
pop ecx
push eax
push 0x1f7
jmp 0x100607d
push 0x1010158
push esi
call fcn.01004e87
mov word [0x1010158], si
mov dword [0x1010150], esi
push dword [ebp + 8]
push 0x100f950
call fcn.01005b65
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push 0x1001b00
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1006227
push 0x1001aec
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x100f708], esi
je 0x100623f
cmp word [0x1010368], si
je 0x100623f
push ebx
call fcn.0100573a
pop ecx
push 0x1001cc0
call fcn.010038d5
mov eax, dword [0x1010150]
cmp eax, esi
pop ecx
je 0x10062b5
push eax
call sub.RASAPI32.dll_RasHangUpW
cmp word [0x1010158], si
je 0x100629c
cmp dword [ebp - 8], esi
jne 0x100629c
push 0x40
call fcn.0100667d
cmp eax, esi
pop ecx
je 0x100627c
mov ecx, eax
call fcn.01004cd7
jmp 0x100627e
xor eax, eax
cmp eax, esi
jne 0x100628f
push 0x1001c48
call fcn.010038d5
pop ecx
jmp 0x100629c
push 0x1010158
push esi
mov ecx, eax
call fcn.01004e87
push dword [0x1010150]
mov word [0x1010158], si
call fcn.01005157
pop ecx
mov dword [0x1010150], esi
mov eax, dword [0x100ead0]
cmp eax, esi
je 0x10062c5
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]