Function at 0x100646d
Capabilities:
Accept command line arguments
Delete registry value
Read .ini file
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor esi, esi
push 0x1001e3c
push esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call fcn.0100738a
pop ecx
pop ecx
push 0x41
pop ecx
xor eax, eax
mov ebx, 0x1010328
mov edi, ebx
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x41
pop ecx
xor eax, eax
mov edi, 0x1010118
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
mov ecx, 0x100
mov edi, 0x100f910
rep stosd dword es:[edi], eax
push 0x1001dd8
xor edi, edi
inc edi
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [0x1010110], esi
mov dword [0x100f90c], esi
mov dword [0x100f8e0], esi
mov dword [0x100f6d4], esi
mov dword [0x100f6cc], esi
call fcn.01006369
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.01005b7a
test eax, eax
pop ecx
je 0x1006530
push dword [ebp + 0x10]
push 0x1001d90
call fcn.01003d75
pop ecx
pop ecx
push 0x10
push 0x1f4
call fcn.0100566d
pop ecx
push eax
push 0x1fe
call fcn.0100566d
pop ecx
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1006695
push ebx
mov dword [0x100f6c8], edi
call fcn.01005dc2
test eax, eax
pop ecx
jne 0x10065d3
push 0x1fd
mov dword [0x100f6c8], esi
call fcn.0100566d
cmp eax, esi
pop ecx
mov dword [ebp + 8], eax
je 0x1006695
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0x107
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
cmp edi, esi
mov dword [ebp + 0x10], edi
je 0x1006656
push dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
pop ecx
pop ecx
push 0x1001d88
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
call edi
push ebx
push dword [ebp + 0x10]
call edi
push 0x1001d88
push dword [ebp + 0x10]
call edi
push 0x10
push 0x1f4
call fcn.0100566d
pop ecx
push eax
push dword [ebp + 0x10]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1006695
call fcn.01005a07
test eax, eax
jne 0x1006695
push ebx
push 0x400
push 0x100f910
push 0x10012cc
push 0x1001d64
mov edi, 0x1001638
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push ebx
push esi
push 0x1001d38
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
mov dword [0x100f90c], eax
jne 0x1006686
mov eax, dword [0x1010110]
cmp eax, esi
je 0x1006686
push eax
call sub.RASAPI32.dll_RasHangUpW
push dword [0x1010110]
call fcn.010055f7
push 0x40
call fcn.01006b56
cmp eax, esi
pop ecx
pop ecx
je 0x100664c
mov ecx, eax
call fcn.01005177
mov dword [ebp - 8], eax
jmp 0x100664f
mov dword [ebp - 8], esi
mov ecx, dword [ebp - 8]
cmp ecx, esi
jne 0x100666e
push 0x10
push 0x1f4
call fcn.0100566d
pop ecx
push eax
push 0x1f7
jmp 0x100651d
push 0x1010118
push esi
call fcn.01005327
mov word [0x1010118], si
mov dword [0x1010110], esi
push dword [ebp + 8]
push 0x100f910
call fcn.01006005
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push 0x1001b40
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x10066c7
push 0x1001b2c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x100f6c8], esi
je 0x10066df
cmp word [0x1010328], si
je 0x10066df
push ebx
call fcn.01005bda
pop ecx
push 0x1001d00
call fcn.01003d75
mov eax, dword [0x1010110]
cmp eax, esi
pop ecx
je 0x1006755
push eax
call sub.RASAPI32.dll_RasHangUpW
cmp word [0x1010118], si
je 0x100673c
cmp dword [ebp - 8], esi
jne 0x100673c
push 0x40
call fcn.01006b56
cmp eax, esi
pop ecx
je 0x100671c
mov ecx, eax
call fcn.01005177
jmp 0x100671e
xor eax, eax
cmp eax, esi
jne 0x100672f
push 0x1001c88
call fcn.01003d75
pop ecx
jmp 0x100673c
push 0x1010118
push esi
mov ecx, eax
call fcn.01005327
push dword [0x1010110]
mov word [0x1010118], si
call fcn.010055f7
pop ecx
mov dword [0x1010110], esi
mov eax, dword [0x100ea90]
cmp eax, esi
je 0x1006765
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]