Function at 0x401000
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x740
xor eax, eax
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov byte [esp + 0x650], bl
mov ecx, 0x3f
lea edi, [esp + 0x651]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov byte [esp + 0x550], bl
mov ecx, 0x3f
lea edi, [esp + 0x551]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov byte [esp + 0x138], bl
mov ecx, 0x3f
lea edi, [esp + 0x139]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov byte [esp + 0x448], bl
mov ecx, 0x40
lea edi, [esp + 0x449]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x238], bl
mov ecx, 0x40
lea edi, [esp + 0x239]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x30], bl
mov ecx, 0x40
lea edi, [esp + 0x31]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [esp + 0x340], bl
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x341]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor esi, esi
push str.FTIMV.dll
stosb byte es:[edi], al
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x1c], edi
je 0x401412
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FtGeCuAcNa
push edi
call esi
lea ecx, [esp + 0x550]
push ecx
lea edx, [esp + 0x654]
push edx
call eax
add esp, 8
push str.FtGeLoUs
push edi
call esi
push str.FtSeAcTo
push edi
mov dword [esp + 0x34], eax
call esi
push str.FtReSeAcTo
push edi
mov dword [esp + 0x2c], eax
call esi
push str.FtReDeKe
push edi
mov dword [esp + 0x28], eax
call esi
push str.FtReDeKe2
push edi
mov ebp, eax
call esi
push str.FtGeProDir
push edi
call esi
mov dword [esp + 0x28], eax
jmp 0x401150
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x13c]
push 0xff
push ecx
call dword [esp + 0x38]
lea edx, [esp + 0x454]
push edx
mov dword [esp + 0x24], eax
call dword [esp + 0x38]
lea edi, [esp + 0x458]
add esp, 0x10
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x401181
mov ax, word [0x40b2ac]
mov word [edi], ax
xor eax, eax
jmp 0x4011a0
mov cl, byte [esp + eax + 0x448]
mov byte [esp + eax + 0x238], cl
inc eax
cmp cl, bl
jne 0x4011a0
lea eax, [esp + 0x138]
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4011c0
lea edi, [esp + 0x238]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x4011d1
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x238]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x4011f1
mov ecx, dword [str.NTUSER.DAT]
mov edx, dword [0x40b2a4]
mov eax, dword [0x40b2a8]
mov dword [edi], ecx
mov dword [edi + 4], edx
push str.SeRestorePrivilege
mov dword [edi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [esp + 0x2c]
add esp, 8
lea ecx, [esp + 0x238]
push ecx
lea edx, [esp + 0x13c]
push edx
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyA]
test eax, eax
jne 0x40135d
jmp 0x401250
mov cl, byte [esp + eax + 0x138]
mov byte [esp + eax + 0x30], cl
inc eax
cmp cl, bl
jne 0x401250
lea edi, [esp + 0x30]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x401265
mov ax, word [0x40b2ac]
mov word [edi], ax
xor eax, eax
jmp 0x401280
mov cl, byte [esp + eax + 0x30]
mov byte [esp + eax + 0x340], cl
inc eax
cmp cl, bl
jne 0x401280
lea edi, [esp + 0x340]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x401298
mov ecx, 8
mov esi, str.Control_PanelTabletPCPenTiltData
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x30]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x4012b4
mov ecx, 0xb
mov esi, str.Control_PanelTabletPCPenTiltDataLandscape
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x30]
push ecx
push 0x80000003
movsb byte es:[edi], byte [esi]
call ebp
add esp, 8
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x138]
mov byte [esp + eax + 0x30], cl
inc eax
cmp cl, bl
jne 0x4012e0
lea edi, [esp + 0x30]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x4012f5
mov dx, word [0x40b2ac]
mov word [edi], dx
lea edi, [esp + 0x30]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x401310
lea eax, [esp + 0x30]
push eax
mov ecx, 0xb
mov esi, str.Control_PanelTabletPCPenTiltDataPortrait
push 0x80000003
rep movsd dword es:[edi], dword [esi]
call ebp
lea ecx, [esp + 0x348]
push ecx
push 0x80000003
call ebp
add esp, 0x10
lea edx, [esp + 0x138]
push edx
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyA]
mov dword [esp + 0x18], 1
push str.SeRestorePrivilege
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
add esp, 8
cmp eax, ebx
ja 0x401150
mov ecx, 0xb
mov esi, str.Control_PanelTabletPCPenTiltDataLandscape
lea edi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x30]
push eax
push 0x80000001
movsb byte es:[edi], byte [esi]
call ebp
lea ecx, [esp + 0x38]
push ecx
push 0x80000002
call ebp
lea edx, [esp + 0x40]
push edx
mov ecx, 0xb
mov esi, str.Control_PanelTabletPCPenTiltDataPortrait
lea edi, [esp + 0x44]
push 0x80000001
rep movsd dword es:[edi], dword [esi]
call ebp
lea eax, [esp + 0x48]
push eax
push 0x80000002
call ebp
mov ecx, 8
mov esi, str.Control_PanelTabletPCPenTiltData
lea edi, [esp + 0x50]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ecx, [esp + 0x50]
push ecx
push 0x80000001
movsb byte es:[edi], byte [esi]
call ebp
lea edx, [esp + 0x58]
push edx
push 0x80000002
call ebp
mov eax, dword [esp + 0x4c]
add esp, 0x30
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret