Function at 0x412fad
Capabilities:
Acquire debug privileges
Delete registry key
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x684
push ebx
push esi
push edi
call fcn.00406ede
test eax, eax
jne 0x412fcb
inc eax
jmp 0x41321a
call fcn.00417ae3
xor edi, edi
push str.SeLoadDriverPrivilege
lea eax, [esp + 0x10]
mov dword [esp + 0x10], edi
call fcn.00415c96
push str.SeDebugPrivilege
lea eax, [esp + 0x10]
call fcn.00415c96
push 0x8001
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
push edi
push 0x41773c
push edi
mov dword [0x424998], 0x11223344
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_EnumResourceTypesA]
lea eax, [esp + 0x10]
call fcn.0040ae26
lea ebx, [esp + 0x60]
mov dword [esp + 0x38], 0x20
mov dword [esp + 0x30], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x40], edi
call fcn.00412acd
push dword [ebp + 0x10]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x690], eax
call fcn.0040b2fd
mov esi, dword [esp + 0x688]
push str._savelangfile
call fcn.0040b46f
test eax, eax
jl 0x4130ab
mov dword [0x42741c], 0x424408
call fcn.0040d6bb
lea edi, [esp + 0x60]
call fcn.00412c0d
lea esi, [esp + 0x10]
call fcn.0040ae48
lea esi, [esp + 0x30]
call fcn.00416ef1
lea esi, [esp + 0x10]
call fcn.0040ae48
cmp dword [esp + 0xc], 0
jmp 0x41320c
call fcn.0040d57f
mov esi, dword [esp + 0x688]
push str._deleteregkey
call fcn.0040b46f
test eax, eax
jl 0x4130d7
push str.SoftwareNirSoftVideoCacheView
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x41307d
mov eax, dword [esp + 0x688]
cmp dword [eax + 0x30], 1
jl 0x4130f2
lea eax, [esp + 0x60]
push eax
call fcn.00412d21
test eax, eax
jne 0x41307d
mov esi, dword [esp + 0x688]
push str._copymms
call fcn.0040b46f
mov esi, eax
cmp esi, edi
jl 0x41312c
mov ecx, dword [esp + 0x688]
lea eax, [esi + 2]
call fcn.0040b45f
push eax
lea eax, [esi + 1]
call fcn.0040b45f
push eax
call fcn.00413223
jmp 0x41307d
push edi
call dword [sym.imp.ole32.dll_OleInitialize]
lea edi, [esp + 0x60]
call fcn.00412a09
mov eax, edi
call fcn.00412a85
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push 0x67
push eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
mov dword [esp + 0x188], eax
push ebx
lea eax, [esp + 0x50]
push eax
call esi
test eax, eax
je 0x4131de
mov edi, dword [sym.imp.USER32.dll_IsDialogMessageA]
lea eax, [esp + 0x44]
push eax
push dword [esp + 0x184]
push dword [esp + 0x170]
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x4131d0
mov eax, dword [0x42722c]
cmp eax, ebx
je 0x4131a8
lea ecx, [esp + 0x44]
push ecx
push eax
call edi
test eax, eax
jne 0x4131d0
lea eax, [esp + 0x44]
push eax
push dword [esp + 0x16c]
call edi
test eax, eax
jne 0x4131d0
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
lea eax, [esp + 0x50]
push eax
call esi
test eax, eax
jne 0x413176
call dword [sym.imp.ole32.dll_OleUninitialize]
lea edi, [esp + 0x60]
call fcn.00412c0d
lea esi, [esp + 0x10]
call fcn.0040ae48
lea esi, [esp + 0x30]
call fcn.00416ef1
lea esi, [esp + 0x10]
call fcn.0040ae48
cmp dword [esp + 0xc], ebx
je 0x413218
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10