Function at 0x413860
Capabilities:
Inspect load icon resource
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4425b7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov esi, ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], esp
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
mov ecx, esi
mov dword [ebp - 0x44], esi
call fcn.004050c0
mov cl, byte [ebp + 0x17]
xor edi, edi
mov dword [esi + 0x204], edi
mov dword [ebp - 4], edi
mov byte [esi + 0x210], cl
mov dword [esi + 0x214], edi
mov dword [esi + 0x218], edi
mov dword [esi + 0x21c], edi
lea ebx, [esi + 0x220]
mov byte [ebp - 4], 1
mov ecx, ebx
call fcn.004341af
mov dword [ebx], vtable.CButton.0
mov edx, dword [0x4542b8]
mov dword [esi + 0x25c], edx
push 0x6a
lea ecx, [esi + 0x26c]
mov byte [ebp - 4], 3
mov dword [esi + 0x260], edi
mov dword [esi + 0x268], edi
call fcn.00419a40
push 0xc9
lea ecx, [esi + 0x308]
mov byte [ebp - 4], 4
call fcn.00411d90
push 0xda
lea ecx, [esi + 0x7e0]
mov byte [ebp - 4], 5
call fcn.0041a610
push 0xca
lea ecx, [esi + 0x900]
mov byte [ebp - 4], 6
call fcn.00401080
push 0x6b
lea ecx, [esi + 0xa78]
mov byte [ebp - 4], 7
call fcn.004039c0
push 0xdb
lea ecx, [esi + 0xc88]
mov byte [ebp - 4], 8
call fcn.004173e0
push 0xdc
lea ecx, [esi + 0xdc4]
mov byte [ebp - 4], 9
call fcn.004192c0
lea ebx, [esi + 0xeac]
mov dword [ebx], edi
lea ecx, [esi + 0xeb0]
mov byte [ebp - 4], 0xb
call fcn.004329fc
mov byte [ebp - 4], 0xc
lea ecx, [esi + 0xeb8]
lea eax, [ebp + 0x17]
lea edx, [ebp + 0x13]
push eax
push edi
push edx
call fcn.00416260
lea edi, [esi + 0xec8]
mov byte [ebp - 4], 0xd
mov ecx, edi
call fcn.004341af
mov dword [edi + 0x3c], 0
mov dword [edi], vtable.CClsWin.0
mov dword [esi], vtable.CProfSheet.0
mov eax, dword [ebx]
test eax, eax
mov byte [ebp - 4], 0xe
je 0x4139de
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea edx, [ebp + 0x14]
push edx
push 0x453d68
push 7
push 0
push 0x453d58
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x413a27
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.ole32.dll_OleRun]
mov edi, eax
test edi, edi
jl 0x413a1a
mov eax, dword [ebp + 0x14]
push ebx
push 0x4532e0
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edi, eax
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
test edi, edi
jge 0x413a51
mov eax, dword [0x4542b8]
mov dword [ebp + 0x14], eax
push 0x2c
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0xf
call fcn.0043776a
mov ecx, dword [ebp + 0x14]
push 0
push 0x10
push ecx
call fcn.0043a83c
push 0
call fcn.00425a82
mov eax, dword [ebx]
xor edi, edi
cmp eax, edi
mov byte [ebp - 4], 0x10
jne 0x413a67
push 0x80004003
call fcn.0042e23c
mov ebx, dword [ebx]
lea eax, [ebp + 0x14]
push eax
push ebx
mov edx, dword [ebx]
call dword [edx + 0x20]
cmp eax, edi
jge 0x413a83
push 0x4532e0
push ebx
push eax
call fcn.0042e24a
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0x260], ecx
jmp 0x413b6c
mov eax, dword [esi + 0x260]
mov dword [ebp - 4], 0xe
test byte [eax + 4], 0x30
je 0x413c4c
lea ecx, [ebp + 0x14]
mov dword [ebp + 0x14], edi
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea edx, [ebp - 0x18]
push edx
push str.SeSecurityPrivilege
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x413c42
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push edi
push edi
lea edx, [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
push edi
push edx
push edi
push eax
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x20], ecx
call ebx
test eax, eax
je 0x413c42
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], ecx
lea ecx, [ebp + 0x10]
lea edx, [ebp - 0x40]
push ecx
push edx
push eax
mov dword [ebp - 0x30], edi
call dword [sym.imp.ADVAPI32.dll_PrivilegeCheck]
test eax, eax
je 0x413c42
cmp dword [ebp + 0x10], edi
jne 0x413c31
mov dword [esi + 0x204], 1
jmp 0x413c42
mov edx, dword [ebp + 0x14]
push edi
push edi
lea ecx, [ebp - 0x28]
push edi
push ecx
push edi
push edx
mov dword [ebp - 0x1c], edi
call ebx
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
mov ecx, esi
call fcn.00415da0
mov eax, dword [esi + 0x204]
cmp eax, edi
mov eax, dword [0x456190]
je 0x413c8c
cmp eax, edi
jne 0x413c76
lea ecx, [esi + 0x26c]
push ecx
mov ecx, esi
call fcn.00405410
lea edx, [esi + 0x308]
mov ecx, esi
push edx
call fcn.00405410
lea eax, [esi + 0x7e0]
jmp 0x413cb2
cmp eax, edi
jne 0x413c9e
lea ecx, [esi + 0x26c]
push ecx
mov ecx, esi
call fcn.00405410
lea edx, [esi + 0x308]
mov ecx, esi
push edx
call fcn.00405410
lea eax, [esi + 0x900]
push eax
mov ecx, esi
call fcn.00405410
mov eax, dword [esi + 0x40]
or al, 0x20
mov dword [esi + 0x40], eax
call fcn.0043ca1f
push 0x20
push edi
push 1
push 0x10
push 0x10
lea ecx, [esi + 0xeb0]
call fcn.00432ac1
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
mov edi, dword [sym.imp.USER32.dll_LoadIconA]
push 0xa7
push eax
call edi
mov ecx, dword [esi + 0xeb4]
mov ebx, dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push eax
push 0xffffffffffffffff
push ecx
call ebx
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
push 0xa6
push eax
call edi
mov edx, dword [esi + 0xeb4]
push eax
push 0xffffffffffffffff
push edx
call ebx
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
push 0xb2
push eax
call edi
push eax
mov eax, dword [esi + 0xeb4]
push 0xffffffffffffffff
push eax
call ebx
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
push 0xad
push eax
call edi
mov ecx, dword [esi + 0xeb4]
push eax
push 0xffffffffffffffff
push ecx
call ebx
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
push 0xae
push eax
call edi
mov edx, dword [esi + 0xeb4]
push eax
push 0xffffffffffffffff
push edx
call ebx
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
push 0xb3
push eax
call edi
push eax
mov eax, dword [esi + 0xeb4]
push 0xffffffffffffffff
push eax
call ebx
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
push 0xb4
push eax
call edi
mov ecx, dword [esi + 0xeb4]
push eax
push 0xffffffffffffffff
push ecx
call ebx
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
push 0xb5
push eax
call edi
mov edx, dword [esi + 0xeb4]
push eax
push 0xffffffffffffffff
push edx
call ebx
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
push 0x9b
push eax
call edi
push eax
mov eax, dword [esi + 0xeb4]
push 0xffffffffffffffff
push eax
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
lea ecx, [esi + 0xeb8]
push eax
mov dword [ebp - 0x18], 0xe
call fcn.00416290
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
push 0x9c
push eax
call edi
mov ecx, dword [esi + 0xeb4]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xeb8]
mov dword [ebp - 0x18], 0xf
call fcn.00416290
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
push 0x9d
push eax
call edi
mov ecx, dword [esi + 0xeb4]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xeb8]
mov dword [ebp - 0x18], 8
call fcn.00416290
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
push 0x9e
push eax
call edi
mov ecx, dword [esi + 0xeb4]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xeb8]
call fcn.00416290
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
push 0x9e
push eax
call edi
mov ecx, dword [esi + 0xeb4]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xeb8]
mov dword [ebp - 0x18], 0xa
call fcn.00416290
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
push 0x9f
push eax
call edi
mov ecx, dword [esi + 0xeb4]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xeb8]
mov dword [ebp - 0x18], 0xb
call fcn.00416290
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
push 0xa0
push eax
call edi
mov ecx, dword [esi + 0xeb4]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xeb8]
mov dword [ebp - 0x18], 4
call fcn.00416290
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
push 0xa1
push eax
call edi
mov ecx, dword [esi + 0xeb4]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xeb8]
mov dword [ebp - 0x18], 0xc
call fcn.00416290
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
push 0xa2
push eax
call edi
mov ecx, dword [esi + 0xeb4]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xeb8]
mov dword [ebp - 0x18], 0xd
call fcn.00416290
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
push 0xa3
push eax
call edi
mov ecx, dword [esi + 0xeb4]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xeb8]
mov dword [ebp - 0x18], 3
call fcn.00416290
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
push 0xa4
push eax
call edi
mov ecx, dword [esi + 0xeb4]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xeb8]
mov dword [ebp - 0x18], 5
call fcn.00416290
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
push 0xa5
push eax
call edi
mov ecx, dword [esi + 0xeb4]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xeb8]
mov dword [ebp - 0x18], 7
call fcn.00416290
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
push 0xcb
push eax
call edi
mov ecx, dword [esi + 0xeb4]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x18], 0x10
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xeb8]
call fcn.00416290
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
push 0xcc
push eax
call edi
mov ecx, dword [esi + 0xeb4]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xeb8]
mov dword [ebp - 0x18], 0x30
call fcn.00416290
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
push 0xcd
push eax
call edi
mov ecx, dword [esi + 0xeb4]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xeb8]
mov dword [ebp - 0x18], 0x20
call fcn.00416290
call fcn.0043ca1f
mov eax, dword [eax + 0xc]
push 0x80
push eax
call edi
lea ecx, [ebp + 8]
mov dword [esi + 0x264], eax
push ecx
push 0x20019
push 0
push str.SoftwareIBMTP98UTILNLS
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x414199
mov ecx, dword [ebp + 8]
lea edx, [ebp + 0x14]
lea eax, [ebp - 0x148]
push edx
push eax
push 0
push 0
push 0x4560f8
push ecx
mov dword [ebp + 0x14], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x414199
lea edx, [ebp - 0x148]
push 0x453d24
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x268], eax
push esi
lea ecx, [esi + 0xec8]
call fcn.0041c450
mov eax, dword [esi + 0x268]
test eax, eax
je 0x4141e7
lea eax, [esi + 0xa78]
mov ecx, esi
push eax
call fcn.00405410
lea ecx, [esi + 0xc88]
push ecx
mov ecx, esi
call fcn.00405410
lea edx, [esi + 0xdc4]
mov ecx, esi
push edx
call fcn.00405410
lea eax, [esi + 0x7e0]
mov ecx, esi
push eax
call fcn.00405410
call fcn.0043ca1f
mov eax, dword [eax + 4]
push 0
push 0x453d08
push 0x453cf0
push 0
push eax
call fcn.004250f1
add esp, 0x14
mov dword [ebp + 0x10], eax
add eax, 0xc0
lea ecx, [ebp + 0xc]
push eax
mov dword [ebp - 0x2c], eax
call fcn.00436fed
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 0x12
mov edi, 0x4560f8
mov dl, byte [eax]
mov bl, byte [edi]
mov cl, dl
cmp dl, bl
jne 0x41424e
test cl, cl
je 0x41424a
mov dl, byte [eax + 1]
mov bl, byte [edi + 1]
mov cl, dl
cmp dl, bl
jne 0x41424e
add eax, 2
add edi, 2
test cl, cl
jne 0x414226
xor eax, eax
jmp 0x414253
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41435c
lea ecx, [ebp + 0xc]
call fcn.0043f1c6
push ecx
mov ebx, eax
mov dword [ebp - 0x1c], esp
mov dword [ebp + 0x14], esp
push 0xc
call fcn.00437736
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
test edi, edi
mov byte [ebp - 4], 0x13
je 0x4142ae
push ebx
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
mov dword [edi], eax
jne 0x4142b0
test ebx, ebx
je 0x4142b0
push 0x8007000e
call fcn.0042e23c
jmp 0x4142b0
xor edi, edi
mov eax, dword [ebp + 0x14]
mov byte [ebp - 4], 0x12
test edi, edi
mov dword [eax], edi
jne 0x4142c7
push 0x8007000e
call fcn.0042e23c
lea ecx, [esi + 0xeac]
mov byte [ebp - 4], 0x12
call fcn.00403860
mov ecx, eax
call fcn.00412ec0
mov ecx, 1
xor edx, edx
cmp eax, ecx
sete dl
mov eax, edx
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x414321
test eax, eax
je 0x414321
mov eax, dword [ebp - 0x2c]
mov dword [esi + 0x7d4], ecx
mov dword [esi + 0x7c4], ecx
push eax
lea ecx, [esi + 0x7cc]
call fcn.0043736d
lea ecx, [esi + 0x900]
push ecx
mov ecx, esi
call fcn.0043bcb2
jmp 0x41435c
mov edx, dword [0x4542b8]
mov dword [ebp + 0x14], edx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp + 0x14]
push eax
push str._s_does_not_appear_to_be_a_normal_ThinkPad_Configuration_Profile_file
push ecx
mov byte [ebp - 4], 0x15
call fcn.004323de
mov edx, dword [ebp + 0x14]
add esp, 0xc
push 0
push 0
push edx
call fcn.0043a83c
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0x12
call fcn.00437278
mov eax, dword [esi + 0x40]
lea ecx, [ebp + 0xc]
and ah, 0xfd
mov byte [ebp - 4], 0xe
mov dword [esi + 0x40], eax
call fcn.00437278
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10