Function at 0x14001fa60
Capabilities:
Persist via windows service
Set registry value

Disassembly:
jmp 0x14001fa60
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
xor edi, edi
lea rcx, str.Inside_InitTannerRegistryInterface____n
mov dword [rbp + 0x67], edi
call fcn.140003224
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCConfigurations
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001faec
mov rcx, qword [rbp + 0x6f]
lea r9d, [rdi + 1]
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCConfigurationsScreenRotation
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001fb81
mov rcx, qword [rbp + 0x6f]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x6f]
lea rax, [rbp + 0x67]
mov dword [rsp + 0x28], 4
lea rdx, str.TNSPMode
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x67], edi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCStatus
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001fc16
mov rcx, qword [rbp + 0x6f]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x6f]
lea rax, [rbp + 0x67]
mov dword [rsp + 0x28], 4
lea rdx, str.LastSystemTransformation
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x67], edi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWARELenovoShortCutKeyAppLaunchEx_3C
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001fcaf
mov rcx, qword [rbp + 0x6f]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x6f]
lea rax, [rbp + 0x67]
mov dword [rsp + 0x28], 4
lea rdx, str.AppType
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x67], 3
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWARELenovoShortCutKeyAppLaunchEx_3CUIAccess
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rbx, 0xffffffffffffffff
lea rsi, str.C:WindowsSystem32ibmpmctl.exe
test eax, eax
jne 0x14001fe0f
mov rcx, qword [rbp + 0x6f]
lea r9d, [rbx + 2]
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movaps xmm0, xmmword [str.C:WindowsSystem32ibmpmctl.exe]
lea rcx, [rbp - 9]
movaps xmm1, xmmword [0x1400b1dc0]
movzx eax, word [0x1400b1df0]
movaps xmmword [rbp - 9], xmm0
movaps xmm0, xmmword [0x1400b1dd0]
movaps xmmword [rbp + 7], xmm1
movaps xmm1, xmmword [0x1400b1de0]
mov word [rbp + 0x37], ax
mov rax, rbx
movaps xmmword [rbp + 0x17], xmm0
movaps xmmword [rbp + 0x27], xmm1
nop dword [rax]
inc rax
cmp word [rcx + rax*2], di
jne 0x14001fd60
mov rcx, qword [rbp + 0x6f]
lea rdx, str.File
add eax, eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [0x1400b1e40]
lea rcx, [rbp - 9]
movups xmm0, xmmword [str.TabletToClamshellForTanner]
mov dword [rbp + 0x27], eax
movzx eax, word [0x1400b1e44]
movups xmm1, xmmword [0x1400b1e20]
mov word [rbp + 0x2b], ax
mov rax, rbx
movups xmmword [rbp - 9], xmm0
movups xmm0, xmmword [0x1400b1e30]
movups xmmword [rbp + 7], xmm1
movups xmmword [rbp + 0x17], xmm0
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], di
jne 0x14001fdd0
mov rcx, qword [rbp + 0x6f]
lea rdx, str.Parameters
add eax, eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, str.TabletToClamshellForTanner
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWARELenovoShortCutKeyAppLaunchEx_3E
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001fea8
mov rcx, qword [rbp + 0x6f]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x6f]
lea rax, [rbp + 0x67]
mov dword [rsp + 0x28], 4
lea rdx, str.AppType
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x67], 3
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWARELenovoShortCutKeyAppLaunchEx_3EUIAccess
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001ffdf
mov rcx, qword [rbp + 0x6f]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movaps xmm0, xmmword [str.C:WindowsSystem32ibmpmctl.exe]
lea rcx, [rbp - 9]
movaps xmm1, xmmword [0x1400b1dc0]
movzx eax, word [0x1400b1df0]
movaps xmmword [rbp - 9], xmm0
movaps xmm0, xmmword [0x1400b1dd0]
movaps xmmword [rbp + 7], xmm1
movaps xmm1, xmmword [0x1400b1de0]
mov word [rbp + 0x37], ax
mov rax, rbx
movaps xmmword [rbp + 0x17], xmm0
movaps xmmword [rbp + 0x27], xmm1
inc rax
cmp word [rcx + rax*2], di
jne 0x14001ff47
mov rcx, qword [rbp + 0x6f]
lea rdx, str.File
add eax, eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movups xmm0, xmmword [str.FlipButtonForTanner]
lea rcx, [rbp - 9]
mov rax, rbx
movups xmm1, xmmword [0x1400b1f70]
movups xmmword [rbp - 9], xmm0
movsd xmm0, qword [0x1400b1f80]
movsd qword [rbp + 0x17], xmm0
movups xmmword [rbp + 7], xmm1
nop
inc rax
cmp word [rcx + rax*2], di
jne 0x14001ffa0
mov rcx, qword [rbp + 0x6f]
lea rdx, str.Parameters
add eax, eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, str.FlipButtonForTanner
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWARELenovoShortCutKeyAppLaunchEx_3B
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140020078
mov rcx, qword [rbp + 0x6f]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x6f]
lea rax, [rbp + 0x67]
mov dword [rsp + 0x28], 4
lea rdx, str.AppType
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x67], 3
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWARELenovoShortCutKeyAppLaunchEx_3BUIAccess
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400201bf
mov rcx, qword [rbp + 0x6f]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movaps xmm0, xmmword [str.C:WindowsSystem32ibmpmctl.exe]
lea rcx, [rbp - 9]
movaps xmm1, xmmword [0x1400b1dc0]
movzx eax, word [0x1400b1df0]
movaps xmmword [rbp - 9], xmm0
movaps xmm0, xmmword [0x1400b1dd0]
movaps xmmword [rbp + 7], xmm1
movaps xmm1, xmmword [0x1400b1de0]
mov word [rbp + 0x37], ax
mov rax, rbx
movaps xmmword [rbp + 0x17], xmm0
movaps xmmword [rbp + 0x27], xmm1
inc rax
cmp word [rcx + rax*2], di
jne 0x140020117
mov rcx, qword [rbp + 0x6f]
lea rdx, str.File
add eax, eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [0x1400b20b0]
movups xmm0, xmmword [str.ClamshellToTabletForTanner]
mov dword [rbp + 0x27], eax
movzx eax, word [0x1400b20b4]
movups xmm1, xmmword [0x1400b2090]
mov word [rbp + 0x2b], ax
lea rax, [rbp - 9]
movups xmmword [rbp - 9], xmm0
movups xmm0, xmmword [0x1400b20a0]
movups xmmword [rbp + 7], xmm1
movups xmmword [rbp + 0x17], xmm0
nop
inc rbx
cmp word [rax + rbx*2], di
jne 0x140020180
mov rcx, qword [rbp + 0x6f]
lea rax, str.ClamshellToTabletForTanner
add ebx, ebx
lea rdx, str.Parameters
mov dword [rsp + 0x28], ebx
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret