Function at 0x405a5c
Capabilities:
Create thread
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push edi
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0x98], 0x94
mov dword [ebp - 0x94], 0
mov ecx, 0x23
xor eax, eax
lea edi, [ebp - 0x90]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xa0], 0x80c
mov dword [ebp - 4], 0
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push str.HOTKEYDASHBOARDINIT:CLASS1
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x417374], eax
lea ecx, [ebp - 0xb0]
push ecx
push 0x20019
push 0
push 0x4136f4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405b38
mov dword [ebp - 0xb4], 4
lea edx, [ebp - 0xb4]
push edx
lea eax, [ebp - 0xac]
push eax
push 0
push 0
push str.Serviced
mov ecx, dword [ebp - 0xb0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0xb0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xb0]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesIBMPMSVCParametersCapability
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405c9f
mov dword [ebp - 0xb8], 4
lea ecx, [ebp - 0xb8]
push ecx
lea edx, [ebp - 0xa0]
push edx
push 0
push 0
push str.IsExistPMInternalFunction
mov eax, dword [ebp - 0xb0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xb8], 4
lea ecx, [ebp - 0xb8]
push ecx
lea edx, [ebp - 4]
push edx
push 0
push 0
push str.OverrideCapability
mov eax, dword [ebp - 0xb0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xb8], 4
lea ecx, [ebp - 0xb8]
push ecx
lea edx, [ebp - 0x9c]
push edx
push 0
push 0
push 0
mov eax, dword [ebp - 0xb0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405c92
mov ecx, dword [ebp - 0xa0]
not ecx
mov edx, dword [ebp - 0x9c]
and edx, ecx
mov dword [ebp - 0x9c], edx
mov eax, dword [ebp - 0xac]
not eax
mov ecx, dword [ebp - 0x9c]
and ecx, eax
mov dword [ebp - 0x9c], ecx
mov edx, dword [ebp - 0x9c]
and edx, 0xffffffbf
mov dword [ebp - 0x9c], edx
cmp dword [ebp - 0x88], 1
jne 0x405c3d
mov eax, dword [ebp - 0x9c]
and ah, 0xfe
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xa8], 0
jmp 0x405c58
mov ecx, dword [ebp - 0xa8]
add ecx, 1
mov dword [ebp - 0xa8], ecx
cmp dword [ebp - 0xa8], 0x20
jge 0x405c92
mov edx, 1
mov ecx, dword [ebp - 0xa8]
shl edx, cl
mov eax, dword [ebp - 0x9c]
and eax, edx
test eax, eax
je 0x405c90
mov edx, 1
mov ecx, dword [ebp - 0xa8]
shl edx, cl
push edx
call fcn.00401813
add esp, 4
jmp 0x405c49
mov eax, dword [ebp - 0xb0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
call fcn.00401513
add esp, 4
mov dword [ebp - 0x9c], eax
mov ecx, dword [ebp - 0x9c]
or ecx, dword [ebp - 4]
mov dword [ebp - 0x9c], ecx
mov edx, dword [ebp - 0xac]
not edx
mov eax, dword [ebp - 0x9c]
and eax, edx
mov dword [ebp - 0x9c], eax
mov ecx, dword [ebp - 0x9c]
and ecx, 0xffffffbf
mov dword [ebp - 0x9c], ecx
cmp dword [ebp - 0x88], 1
jne 0x405cfb
mov edx, dword [ebp - 0x9c]
and dh, 0xfe
mov dword [ebp - 0x9c], edx
push 0
lea eax, [ebp - 0xb0]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREIBMTPHOTKEYCLASS01
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x405e8b
push 4
lea ecx, [ebp - 0x9c]
push ecx
push 4
push 0
push str.Capability
mov edx, dword [ebp - 0xb0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0xa8], 0
jmp 0x405d63
mov eax, dword [ebp - 0xa8]
add eax, 1
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0x20
jge 0x405e7e
mov edx, 1
mov ecx, dword [ebp - 0xa8]
shl edx, cl
mov eax, dword [ebp - 0x9c]
and eax, edx
test eax, eax
jne 0x405d8b
jmp 0x405d54
mov ecx, dword [ebp - 0xa8]
add ecx, 1
push ecx
push str._02X
lea edx, [ebp - 0xc4]
push edx
call fcn.00408df6
add esp, 0xc
push 0
lea eax, [ebp - 0xbc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0xc4]
push ecx
mov edx, dword [ebp - 0xb0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x405e79
mov eax, 1
mov ecx, dword [ebp - 0xa8]
shl eax, cl
mov ecx, dword [ebp - 4]
and ecx, eax
test ecx, ecx
je 0x405e6c
lea edx, [ebp - 0xcc]
push edx
push 0
push 0
push 0
push str.File
mov eax, dword [ebp - 0xbc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405e4f
lea ecx, [ebp - 0xc8]
push ecx
push 0
push 0
push 0
push str.Parameters
mov edx, dword [ebp - 0xbc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405e4f
mov eax, 1
mov ecx, dword [ebp - 0xa8]
shl eax, cl
push eax
call fcn.00401813
add esp, 4
jmp 0x405e6c
mov edx, 1
mov ecx, dword [ebp - 0xa8]
shl edx, cl
not edx
mov eax, dword [ebp - 0x9c]
and eax, edx
mov dword [ebp - 0x9c], eax
mov ecx, dword [ebp - 0xbc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x405d54
mov edx, dword [ebp - 0xb0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x417374], 0
je 0x405ea0
mov eax, dword [0x417374]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [ebp - 0x9c], 0
jne 0x405ead
xor eax, eax
jmp 0x405f1e
push str.Press_Class1_ThinkPad_Hotkey
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x417690], eax
push str.Restart_Class1_ThinkPad_Hotkey
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x417694], eax
push str.Class1_Hotkey_Exit
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x417698], eax
lea ecx, [ebp - 0xa4]
push ecx
push 2
mov edx, dword [ebp - 0x9c]
push edx
push 0x4057ba
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
xor eax, eax
cmp dword [edx], 0
setne al
pop edi
mov esp, ebp
pop ebp
ret