Function at 0x1a4b30
Capabilities:
Check mutex on windows
Check os version
Create thread
Resolve function by parsing pe exports
Terminate thread

Disassembly:
sub esp, 0xf8
mov eax, dword [0x1d6750]
xor eax, esp
mov dword [esp + 0xf4], eax
push ebx
mov ebx, dword [esp + 0x100]
push ebp
push esi
mov esi, dword [esp + 0x110]
push edi
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ebp, ebp
push 0x8c
mov dword [esp + 0x18], eax
lea eax, [esp + 0x7c]
push ebp
push eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x7c], 0x94
mov dword [esp + 0x80], ebp
call fcn.001a76a0
add esp, 0xc
push 0xffffffffffffffff
call sub.IMM32.dll_ImmDisableIME
push str.Localmutex_ThinkPad_FSM
push 1
push ebp
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1a4bca
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1a4eff
lea ecx, [esp + 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x74]
cmp eax, 6
ja 0x1a4bef
jne 0x1a4be7
cmp dword [esp + 0x78], 1
jae 0x1a4bef
mov dword [0x1d7ba0], ebp
jmp 0x1a4bf9
mov dword [0x1d7ba0], 1
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrA]
push 0x1d6330
push esi
call edi
test eax, eax
je 0x1a4cd6
push 0x1d6338
push esi
call edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push str._UEFI
mov esi, eax
call edi
add esi, eax
cmp byte [esi], 0x5c
je 0x1a4c58
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x1a4c3c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1a4eff
push esi
call edi
mov edi, 1
add eax, edi
cmp eax, 0x104
jb 0x1a4c91
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x1a4c78
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x1a4eff
mov dword [0x1d7a84], edi
call fcn.001a4ae0
push esi
push 0x1d7a88
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebp
push ebp
push ebp
push ebp
mov dword [0x1d7b8c], edi
call esi
push ebp
push ebp
push ebp
push ebp
mov dword [0x1d7b90], eax
call esi
mov dword [0x1d7b94], eax
cmp dword [0x1d7b90], ebp
je 0x1a4c69
cmp eax, ebp
je 0x1a4c69
mov edi, dword [esp + 0x14]
cmp edi, ebp
je 0x1a4cfe
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WTSRegisterSessionNotification
push edi
call esi
push str.WTSUnRegisterSessionNotification
push edi
mov dword [0x1d7a7c], eax
call esi
mov dword [0x1d7a80], eax
push ebp
push 0x10
push 0x10
push 1
push 0x65
push ebx
mov dword [esp + 0x3c], 0x30
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], 0x1a3c70
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x60], ebp
mov dword [esp + 0x64], 0x1d638c
mov dword [esp + 0x68], ebp
call dword [sym.imp.USER32.dll_LoadImageA]
lea edx, [esp + 0x24]
push edx
mov dword [0x1d89b4], eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
jne 0x1a4d83
cmp edi, ebp
je 0x1a4d6a
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1a4eff
push ebp
push ebx
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push 0x80880000
push str.TpUZoom
push 0x1d63a8
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [esp + 0x20], eax
cmp eax, ebp
je 0x1a4d5f
cmp dword [0x1d7ba0], ebp
je 0x1a4e0a
lea eax, [esp + 0x18]
push eax
push str..DISPLAY2
mov dword [esp + 0x20], ebp
call fcn.001a5080
add esp, 8
test eax, eax
jne 0x1a4dfd
mov ecx, dword [0x1d63bc]
mov edx, dword [0x1d63c0]
mov eax, dword [0x1d63c4]
mov dword [str..DISPLAY2], ecx
mov cl, byte [0x1d63c8]
mov dword [0x1d7bac], edx
mov dword [0x1d7bb0], eax
mov byte [0x1d7bb4], cl
push str..DISPLAY2
call fcn.001a53d0
add esp, 4
cmp dword [0x1d7a84], ebp
je 0x1a4e2e
push ebp
push ebp
lea edx, [esp + 0x28]
push edx
push 0x1a4990
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov dword [esp + 0x1c], esi
jmp 0x1a4e30
mov esi, ebp
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push ebp
push ebp
push ebp
lea eax, [esp + 0x60]
push eax
call edi
test eax, eax
je 0x1a4e96
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
mov ecx, dword [0x1d7b98]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1a4e76
mov eax, dword [0x1d7b98]
lea edx, [esp + 0x54]
push edx
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x1a4e84
lea ecx, [esp + 0x54]
push ecx
call esi
lea edx, [esp + 0x54]
push edx
call ebx
push ebp
push ebp
push ebp
lea eax, [esp + 0x60]
push eax
call edi
test eax, eax
jne 0x1a4e50
mov esi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1d7a84], ebp
je 0x1a4ede
cmp esi, ebp
je 0x1a4ecd
lea ecx, [esp + 0x18]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1a4eca
cmp dword [esp + 0x18], 0x103
jne 0x1a4eca
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call ebx
mov edx, dword [0x1d7b90]
push edx
call ebx
mov eax, dword [0x1d7b94]
push eax
call ebx
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x1a4eed
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call ebx
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x104]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.001a771a
add esp, 0xf8
ret 0x10