Function at 0x401000
Capabilities:
Check mutex on windows
Create thread
Delete registry value
Hide graphical window
Persist via run registry key

Disassembly:
sub esp, 0xae4
mov ecx, 6
xor eax, eax
push ebx
push ebp
push esi
push edi
mov esi, str.SoftwareRealtekInitAp_
lea edi, [esp + 0x6f4]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0xf9
lea edi, [esp + 0x70d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xb
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
lea edi, [esp + 0x2f4]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0xf4
lea edi, [esp + 0x323]
rep stosd dword es:[edi], eax
push str.Realtek_Simulate
stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push 0x4090c8
mov eax, dword [esp + 0xb04]
push eax
call fcn.00403c60
add esp, 8
test eax, eax
je 0x401107
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebp, dword [sym.imp.USER32.dll_GetWindow]
push eax
call ebp
mov edi, dword [sym.imp.USER32.dll_GetClassNameA]
lea ecx, [esp + 0x74]
mov esi, eax
push 0x80
push ecx
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea edx, [esp + 0x74]
push str.AlcxmntrClass
push edx
call ebx
test eax, eax
je 0x4010e4
push 2
push esi
call ebp
mov esi, eax
test esi, esi
je 0x4010f5
lea eax, [esp + 0x74]
push 0x80
push eax
push esi
call edi
lea ecx, [esp + 0x74]
push str.AlcxmntrClass
push ecx
call ebx
test eax, eax
jne 0x4010bc
test esi, esi
je 0x4010f5
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xae4
ret 0x10
call fcn.00402910
test eax, eax
jne 0x40115f
lea edx, [esp + 0x10]
push edx
push 0xf003f
push eax
lea eax, [esp + 0x300]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40114d
mov ecx, dword [esp + 0x10]
push str.Alcmtr
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xae4
ret 0x10
lea eax, [esp + 0x10]
xor edi, edi
push eax
push 0x2001f
lea ecx, [esp + 0x6fc]
push edi
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401190
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40119b
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.AlcxmntrMutex
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x409a70], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4011c9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xae4
ret 0x10
push 0x409b28
call fcn.004034c0
add esp, 4
test eax, eax
jne 0x4011f9
mov eax, dword [0x409a70]
cmp eax, edi
je 0x401211
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xae4
ret 0x10
cmp dword [0x409b28], edi
jne 0x401220
mov eax, dword [0x409a70]
cmp eax, edi
je 0x401211
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xae4
ret 0x10
mov eax, dword [esp + 0xafc]
mov esi, dword [esp + 0xaf8]
cmp eax, edi
jne 0x40128a
push 0x66
push esi
mov dword [esp + 0x58], str.AlcxmntrClass
mov dword [esp + 0x38], 0x401530
mov dword [esp + 0x34], 8
mov dword [esp + 0x44], esi
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push edi
mov dword [esp + 0x48], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x48], 6
mov dword [esp + 0x4c], edi
mov dword [esp + 0x44], eax
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
call dword [sym.imp.USER32.dll_RegisterClassA]
push edi
push esi
push edi
push edi
push 0x8c
push 0xc8
push edi
push edi
push DirectSoundCreate
push str.ALCXMNTR
push str.AlcxmntrClass
push 0x88
mov dword [0x409a74], esi
call dword [sym.imp.USER32.dll_CreateWindowExA]
cmp eax, edi
mov dword [0x409a78], eax
jne 0x4012d2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xae4
ret 0x10
push 0xf
push 0x14
push 0x78
push 0xc8
mov eax, 0x77
push edi
push edi
mov dword [esp + 0x2c], 0xa0
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 0xbe
mov dword [esp + 0x38], 0x87
mov dword [esp + 0x3c], 0xb4
mov dword [esp + 0x40], eax
call dword [sym.imp.GDI32.dll_CreateRoundRectRgn]
push 2
lea ecx, [esp + 0x18]
push 3
push ecx
mov dword [0x409e2c], eax
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
push 2
mov dword [0x409e30], eax
push eax
mov eax, dword [0x409e2c]
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
mov edx, dword [0x409e2c]
mov eax, dword [0x409a78]
push 1
push edx
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
call fcn.004028d0
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push edi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
push edi
mov dword [0x409a98], eax
call esi
push edi
push edi
push edi
push edi
mov dword [0x409aa8], eax
call esi
push edi
push edi
push edi
push edi
mov dword [0x409ab8], eax
call esi
mov dword [0x409ac8], eax
mov eax, dword [0x409ad8]
cmp eax, edi
jne 0x4013a6
push edi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
push edi
mov dword [0x409ad8], eax
call esi
mov dword [0x409ae8], eax
push edi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
push edi
mov dword [0x409af8], eax
call esi
mov dword [0x409b08], eax
call fcn.004025e0
lea ecx, [esp + 0x54]
push ecx
push edi
push edi
push 0x402460
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [0x409a78]
mov esi, dword [sym.imp.USER32.dll_LoadImageA]
push 0x40
push 0x10
mov dword [0x409a90], eax
mov eax, dword [0x409a74]
push 0x10
push 1
mov ebp, 0x40a
push 0x67
push eax
mov dword [0x409ea0], 0x58
mov dword [0x409ea4], edx
mov dword [0x409ea8], 1
mov dword [0x409eac], 7
mov dword [0x409eb0], ebp
call esi
mov edx, dword [0x409a74]
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0xf4]
push 0x200
push ecx
push 1
push edx
mov dword [0x409eb4], eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0xf4]
push eax
push 0x409eb8
call ebx
mov edx, dword [0x409a74]
mov ecx, dword [0x409a78]
push 0x40
push 0x10
push 0x10
push 1
push 0x6c
push edx
mov dword [0x409e40], 0x58
mov dword [0x409e44], ecx
mov dword [0x409e48], 1
mov dword [0x409e4c], 7
mov dword [0x409e50], ebp
call esi
mov ecx, dword [0x409a74]
mov dword [0x409e54], eax
lea eax, [esp + 0xf4]
push 0x200
push eax
push 1
push ecx
call edi
lea edx, [esp + 0xf4]
push edx
push 0x409e58
call ebx
mov eax, dword [0x409a78]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
lea ecx, [esp + 0x60]
push 0
push ecx
call esi
test eax, eax
je 0x40151e
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea edx, [esp + 0x58]
push edx
call edi
lea eax, [esp + 0x58]
push eax
call ebx
push 0
push 0
lea ecx, [esp + 0x60]
push 0
push ecx
call esi
test eax, eax
jne 0x4014ff
mov eax, dword [esp + 0x60]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xae4
ret 0x10