Function at 0x401000
Capabilities:
Check mutex on windows
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
push esi
push edi
push str.GlobalEyeGuard.exe
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [0x433a28], eax
je 0x4010d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401052
mov eax, dword [0x433a28]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x433a28], ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [0x433a28], ebx
je 0x4010d1
mov esi, dword [ebp + 8]
push 0x64
push ebx
mov dword [esp + 0x38], 3
mov dword [esp + 0x3c], 0x401290
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], esi
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push ebx
mov dword [esp + 0x4c], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 4
mov dword [esp + 0x4c], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], 0x431fd4
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x4010dc
push 0x10
push 0x41446c
push 0x414478
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push ebx
push esi
push ebx
push ebx
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0x41441c
push 0x431fd4
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 1
mov edi, eax
push 0x431fd4
push edi
mov dword [0x433738], esi
call dword [sym.imp.USER32.dll_SetPropA]
call fcn.004088c0
test eax, eax
jne 0x401147
push 0x10
push 0x41446c
push 0x4144a4
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.00409290
call fcn.00408590
lea edx, [esp + 0x10]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40117a
mov eax, dword [esp + 0x10]
push 0x41441c
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call ebx
lea edx, [esp + 0x10]
push edx
push str.SYSTEMCurrentControlSetControlSafeBoot
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4011aa
mov dword [0x433a38], 1
mov eax, dword [esp + 0x10]
push eax
call ebx
push 0x64
push esi
mov dword [0x433548], 0x1e8
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [0x43355c], eax
mov dword [0x43354c], edi
mov dword [0x433550], 0x64
call fcn.00409300
cmp dword [0x417ce8], 0
mov dword [0x433558], 0x401
mov dword [0x433554], 7
je 0x401208
push 0x433548
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
cmp dword [0x4339f4], 0
je 0x401216
call fcn.00408c90
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
call esi
test eax, eax
je 0x40125f
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea esp, [esp]
lea edx, [esp + 0x14]
push edx
call edi
lea eax, [esp + 0x14]
push eax
call ebx
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
call esi
test eax, eax
jne 0x401240
mov eax, dword [0x433a28]
test eax, eax
je 0x401279
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x433a28], 0
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10