Function at 0x4152e0
Capabilities:
Inspect load icon resource
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444907
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov esi, ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], esp
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
mov ecx, esi
mov dword [ebp - 0x44], esi
call fcn.00406900
mov cl, byte [ebp + 0x17]
xor edi, edi
mov dword [esi + 0x104], edi
mov dword [esi + 0x10c], edi
mov dword [ebp - 4], edi
mov byte [esi + 0x118], cl
mov dword [esi + 0x11c], edi
mov dword [esi + 0x120], edi
mov dword [esi + 0x124], edi
lea ebx, [esi + 0x128]
mov byte [ebp - 4], 1
mov ecx, ebx
call fcn.00435b55
mov dword [ebx], vtable.CButton.0
mov edx, dword [0x457458]
mov dword [esi + 0x164], edx
push 0x6a
lea ecx, [esi + 0x174]
mov byte [ebp - 4], 3
mov dword [esi + 0x168], edi
mov dword [esi + 0x170], edi
call fcn.0041b930
push 0xc9
lea ecx, [esi + 0x210]
mov byte [ebp - 4], 4
call fcn.00413480
push 0xda
lea ecx, [esi + 0x7a4]
mov byte [ebp - 4], 5
call fcn.0041c590
push 0xca
lea ecx, [esi + 0x8c4]
mov byte [ebp - 4], 6
call fcn.004010f0
push 0x6b
lea ecx, [esi + 0xa5c]
mov byte [ebp - 4], 7
call fcn.00404f80
push 0xdb
lea ecx, [esi + 0xc6c]
mov byte [ebp - 4], 8
call fcn.004191f0
push 0xdc
lea ecx, [esi + 0xda8]
mov byte [ebp - 4], 9
call fcn.0041b180
lea ebx, [esi + 0xe90]
mov dword [ebx], edi
lea ecx, [esi + 0xe94]
mov byte [ebp - 4], 0xb
call fcn.00434c4f
mov byte [ebp - 4], 0xc
lea eax, [ebp + 0x17]
lea edx, [ebp + 0x13]
push eax
push edi
lea ecx, [esi + 0xe9c]
push edx
call fcn.00418070
lea edi, [esi + 0xeac]
mov byte [ebp - 4], 0xd
mov ecx, edi
call fcn.00435b55
mov dword [edi + 0x3c], 0
mov dword [edi], vtable.CClsWin.0
mov dword [esi], vtable.CProfSheet.0
mov eax, dword [ebx]
test eax, eax
mov byte [ebp - 4], 0xe
je 0x415464
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea edx, [ebp + 0x14]
push edx
push 0x456da8
push 7
push 0
push 0x456d98
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x4154ad
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.ole32.dll_OleRun]
mov edi, eax
test edi, edi
jl 0x4154a0
mov eax, dword [ebp + 0x14]
push ebx
push 0x4562b8
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edi, eax
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
test edi, edi
jge 0x4154d7
mov eax, dword [0x457458]
mov dword [ebp + 0x14], eax
push 0x2c
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0xf
call fcn.004399d2
mov ecx, dword [ebp + 0x14]
push 0
push 0x10
push ecx
call fcn.0043caa1
push 0
call fcn.00427a72
mov eax, dword [ebx]
xor edi, edi
cmp eax, edi
mov byte [ebp - 4], 0x10
jne 0x4154ed
push 0x80004003
call fcn.0043032c
mov ebx, dword [ebx]
lea eax, [ebp + 0x14]
push eax
push ebx
mov edx, dword [ebx]
call dword [edx + 0x20]
cmp eax, edi
jge 0x415509
push 0x4562b8
push ebx
push eax
call fcn.0043033a
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0x168], ecx
jmp 0x4155f2
mov eax, dword [esi + 0x168]
mov dword [ebp - 4], 0xe
test byte [eax + 4], 0x30
je 0x4156d2
lea ecx, [ebp + 0x14]
mov dword [ebp + 0x14], edi
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea edx, [ebp - 0x18]
push edx
push str.SeSecurityPrivilege
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x4156c8
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push edi
push edi
lea edx, [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
push edi
push edx
push edi
push eax
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x20], ecx
call ebx
test eax, eax
je 0x4156c8
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], ecx
lea ecx, [ebp + 0x10]
lea edx, [ebp - 0x40]
push ecx
push edx
push eax
mov dword [ebp - 0x30], edi
call dword [sym.imp.ADVAPI32.dll_PrivilegeCheck]
test eax, eax
je 0x4156c8
cmp dword [ebp + 0x10], edi
jne 0x4156b7
mov dword [esi + 0x10c], 1
jmp 0x4156c8
mov edx, dword [ebp + 0x14]
push edi
push edi
lea ecx, [ebp - 0x28]
push edi
push ecx
push edi
push edx
mov dword [ebp - 0x1c], edi
call ebx
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
mov ecx, esi
call fcn.004179b0
mov eax, dword [esi + 0x10c]
cmp eax, edi
mov eax, dword [0x4592d8]
je 0x415712
cmp eax, edi
jne 0x4156fc
lea ecx, [esi + 0x174]
push ecx
mov ecx, esi
call fcn.00406ba0
lea edx, [esi + 0x210]
mov ecx, esi
push edx
call fcn.00406ba0
lea eax, [esi + 0x7a4]
jmp 0x415738
cmp eax, edi
jne 0x415724
lea ecx, [esi + 0x174]
push ecx
mov ecx, esi
call fcn.00406ba0
lea edx, [esi + 0x210]
mov ecx, esi
push edx
call fcn.00406ba0
lea eax, [esi + 0x8c4]
push eax
mov ecx, esi
call fcn.00406ba0
mov eax, dword [esi + 0x40]
or al, 0x20
mov dword [esi + 0x40], eax
call fcn.0043ec58
push 0x20
push edi
push 1
push 0x10
push 0x10
lea ecx, [esi + 0xe94]
call fcn.00434d14
call fcn.0043ec58
mov eax, dword [eax + 0xc]
mov edi, dword [sym.imp.USER32.dll_LoadIconA]
push 0xa7
push eax
call edi
mov ecx, dword [esi + 0xe98]
mov ebx, dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push eax
push 0xffffffffffffffff
push ecx
call ebx
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0xa6
push eax
call edi
mov edx, dword [esi + 0xe98]
push eax
push 0xffffffffffffffff
push edx
call ebx
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0xb2
push eax
call edi
push eax
mov eax, dword [esi + 0xe98]
push 0xffffffffffffffff
push eax
call ebx
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0xad
push eax
call edi
mov ecx, dword [esi + 0xe98]
push eax
push 0xffffffffffffffff
push ecx
call ebx
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0xae
push eax
call edi
mov edx, dword [esi + 0xe98]
push eax
push 0xffffffffffffffff
push edx
call ebx
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0xb3
push eax
call edi
push eax
mov eax, dword [esi + 0xe98]
push 0xffffffffffffffff
push eax
call ebx
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0xb4
push eax
call edi
mov ecx, dword [esi + 0xe98]
push eax
push 0xffffffffffffffff
push ecx
call ebx
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0xb5
push eax
call edi
mov edx, dword [esi + 0xe98]
push eax
push 0xffffffffffffffff
push edx
call ebx
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0x9b
push eax
call edi
push eax
mov eax, dword [esi + 0xe98]
push 0xffffffffffffffff
push eax
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
lea ecx, [esi + 0xe9c]
push eax
mov dword [ebp - 0x18], 0xe
call fcn.004180a0
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0x9c
push eax
call edi
mov ecx, dword [esi + 0xe98]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xe9c]
mov dword [ebp - 0x18], 0xf
call fcn.004180a0
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0x9d
push eax
call edi
mov ecx, dword [esi + 0xe98]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xe9c]
mov dword [ebp - 0x18], 8
call fcn.004180a0
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0x9e
push eax
call edi
mov ecx, dword [esi + 0xe98]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xe9c]
call fcn.004180a0
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0x9e
push eax
call edi
mov ecx, dword [esi + 0xe98]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xe9c]
mov dword [ebp - 0x18], 0xa
call fcn.004180a0
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0x9f
push eax
call edi
mov ecx, dword [esi + 0xe98]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xe9c]
mov dword [ebp - 0x18], 0xb
call fcn.004180a0
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0xa0
push eax
call edi
mov ecx, dword [esi + 0xe98]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xe9c]
mov dword [ebp - 0x18], 4
call fcn.004180a0
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0xa1
push eax
call edi
mov ecx, dword [esi + 0xe98]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xe9c]
mov dword [ebp - 0x18], 0xc
call fcn.004180a0
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0xa2
push eax
call edi
mov ecx, dword [esi + 0xe98]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xe9c]
mov dword [ebp - 0x18], 0xd
call fcn.004180a0
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0xa3
push eax
call edi
mov ecx, dword [esi + 0xe98]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xe9c]
mov dword [ebp - 0x18], 3
call fcn.004180a0
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0xa4
push eax
call edi
mov ecx, dword [esi + 0xe98]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xe9c]
mov dword [ebp - 0x18], 5
call fcn.004180a0
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0xa5
push eax
call edi
mov ecx, dword [esi + 0xe98]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xe9c]
mov dword [ebp - 0x18], 7
call fcn.004180a0
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0xcb
push eax
call edi
mov ecx, dword [esi + 0xe98]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x18], 0x10
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xe9c]
call fcn.004180a0
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0xcc
push eax
call edi
mov ecx, dword [esi + 0xe98]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xe9c]
mov dword [ebp - 0x18], 0x30
call fcn.004180a0
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0xcd
push eax
call edi
mov ecx, dword [esi + 0xe98]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xe9c]
mov dword [ebp - 0x18], 0x20
call fcn.004180a0
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0xa1
push eax
call edi
mov ecx, dword [esi + 0xe98]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xe9c]
mov dword [ebp - 0x18], 0x40
call fcn.004180a0
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0xcd
push eax
call edi
mov ecx, dword [esi + 0xe98]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xe9c]
mov dword [ebp - 0x18], 0x50
call fcn.004180a0
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0xce
push eax
call edi
mov ecx, dword [esi + 0xe98]
push eax
push 0xffffffffffffffff
push ecx
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x20]
push edx
push eax
lea ecx, [esi + 0xe9c]
mov dword [ebp - 0x18], 0x1000
call fcn.004180a0
call fcn.0043ec58
mov eax, dword [eax + 0xc]
push 0x80
push eax
call edi
lea ecx, [ebp + 8]
mov dword [esi + 0x16c], eax
push ecx
push 0x20019
push 0
push str.SoftwareIBMConfigUtilDataProfWizNLS
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x415cca
mov ecx, dword [ebp + 8]
lea edx, [ebp + 0x14]
lea eax, [ebp - 0x148]
push edx
push eax
push 0
push 0
push 0x459240
push ecx
mov dword [ebp + 0x14], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x415cca
lea edx, [ebp - 0x148]
push 0x456d54
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x170], eax
push esi
lea ecx, [esi + 0xeac]
call fcn.0041e440
mov eax, dword [esi + 0x170]
test eax, eax
je 0x415d18
lea eax, [esi + 0xa5c]
mov ecx, esi
push eax
call fcn.00406ba0
lea ecx, [esi + 0xc6c]
push ecx
mov ecx, esi
call fcn.00406ba0
lea edx, [esi + 0xda8]
mov ecx, esi
push edx
call fcn.00406ba0
lea eax, [esi + 0x7a4]
mov ecx, esi
push eax
call fcn.00406ba0
call fcn.0043ec58
mov eax, dword [eax + 4]
push 0
push 0x456d38
push 0x456d20
push 0
push eax
call fcn.004270e1
add esp, 0x14
mov dword [ebp + 0x10], eax
add eax, 0xc0
lea ecx, [ebp + 0xc]
push eax
mov dword [ebp - 0x2c], eax
call fcn.00439243
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 0x12
mov edi, 0x459240
mov dl, byte [eax]
mov bl, byte [edi]
mov cl, dl
cmp dl, bl
jne 0x415d7f
test cl, cl
je 0x415d7b
mov dl, byte [eax + 1]
mov bl, byte [edi + 1]
mov cl, dl
cmp dl, bl
jne 0x415d7f
add eax, 2
add edi, 2
test cl, cl
jne 0x415d57
xor eax, eax
jmp 0x415d84
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x415e8d
lea ecx, [ebp + 0xc]
call fcn.00441409
push ecx
mov ebx, eax
mov dword [ebp - 0x1c], esp
mov dword [ebp + 0x14], esp
push 0xc
call fcn.0043999e
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
test edi, edi
mov byte [ebp - 4], 0x13
je 0x415ddf
push ebx
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
mov dword [edi], eax
jne 0x415de1
test ebx, ebx
je 0x415de1
push 0x8007000e
call fcn.0043032c
jmp 0x415de1
xor edi, edi
mov eax, dword [ebp + 0x14]
mov byte [ebp - 4], 0x12
test edi, edi
mov dword [eax], edi
jne 0x415df8
push 0x8007000e
call fcn.0043032c
lea ecx, [esi + 0xe90]
mov byte [ebp - 4], 0x12
call fcn.00404030
mov ecx, eax
call fcn.00414760
mov ecx, 1
xor edx, edx
cmp eax, ecx
sete dl
mov eax, edx
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x415e52
test eax, eax
je 0x415e52
mov eax, dword [ebp - 0x2c]
mov dword [esi + 0x798], ecx
mov dword [esi + 0x788], ecx
push eax
lea ecx, [esi + 0x790]
call fcn.004395c3
lea ecx, [esi + 0x8c4]
push ecx
mov ecx, esi
call fcn.0043df17
jmp 0x415e8d
mov edx, dword [0x457458]
mov dword [ebp + 0x14], edx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp + 0x14]
push eax
push str._s_does_not_appear_to_be_a_normal_ThinkPad_Configuration_Profile_file
push ecx
mov byte [ebp - 4], 0x15
call fcn.00434631
mov edx, dword [ebp + 0x14]
add esp, 0xc
push 0
push 0
push edx
call fcn.0043caa1
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0x12
call fcn.004394ce
mov eax, dword [esi + 0x40]
lea ecx, [ebp + 0xc]
and ah, 0xfd
mov byte [ebp - 4], 0xe
mov dword [esi + 0x40], eax
call fcn.004394ce
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10