Function at 0x401000
Capabilities:
Check mutex on windows
Delete registry value
Persist via run registry key

Disassembly:
sub esp, 0xae4
mov ecx, 6
xor eax, eax
push ebx
push ebp
push esi
push edi
mov esi, str.SoftwareRealtekInitAp_
lea edi, [esp + 0x6f4]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0xf9
lea edi, [esp + 0x70d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xb
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
lea edi, [esp + 0x2f4]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0xf4
lea edi, [esp + 0x323]
rep stosd dword es:[edi], eax
push str.Realtek_Simulate
stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push 0x4090c8
mov eax, dword [esp + 0xb04]
push eax
call fcn.00403c60
add esp, 8
test eax, eax
je 0x401107
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebp, dword [sym.imp.USER32.dll_GetWindow]
push eax
call ebp
mov edi, dword [sym.imp.USER32.dll_GetClassNameA]
lea ecx, [esp + 0x74]
mov esi, eax
push 0x80
push ecx
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea edx, [esp + 0x74]
push str.AlcxmntrClass
push edx
call ebx
test eax, eax
je 0x4010e4
push 2
push esi
call ebp
mov esi, eax
test esi, esi
je 0x4010f5
lea eax, [esp + 0x74]
push 0x80
push eax
push esi
call edi
lea ecx, [esp + 0x74]
push str.AlcxmntrClass
push ecx
call ebx
test eax, eax
jne 0x4010bc
test esi, esi
je 0x4010f5
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xae4
ret 0x10
call 0x402910
test eax, eax
jne 0x40115f
lea edx, [esp + 0x10]
push edx
push 0xf003f
push eax
lea eax, [esp + 0x300]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40114d
mov ecx, dword [esp + 0x10]
push str.Alcmtr
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xae4
ret 0x10
lea eax, [esp + 0x10]
xor edi, edi
push eax
push 0x2001f
lea ecx, [esp + 0x6fc]
push edi
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401190
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40119b
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.AlcxmntrMutex
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x409a70], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4011c9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xae4
ret 0x10
push 0x409b28
call fcn.004034c0
add esp, 4
test eax, eax
jne 0x4011f9
mov eax, dword [0x409a70]
cmp eax, edi
je 0x401211
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xae4
ret 0x10
cmp dword [0x409b28], edi
jne 0x401220
mov eax, dword [0x409a70]
cmp eax, edi
je 0x401211
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xae4
ret 0x10
mov eax, dword [esp + 0xafc]
mov esi, dword [esp + 0xaf8]