Function at 0x140011d00
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x140011d00
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
mov rbx, rcx
mov r15d, ecx
shr r15d, 8
and r15d, 0xf
lea eax, [r15 - 1]
mov r12d, 3
cmp eax, 1
cmovbe r15d, r12d
xor esi, esi
mov dword [rbp + 0x58], esi
mov dword [rbp + 0x60], esi
mov dword [rbp + 0x50], esi
mov qword [rbp - 0x20], rsi
movzx r13d, cl
lea edi, [rsi + 1]
cmp dword [0x1400c240c], esi
je 0x140011e1f
lea ecx, [r13 - 1]
mov r14d, edi
shl r14d, cl
test r14d, r14d
je 0x140011e1f
mov eax, ebx
and eax, 0xff00
cmp eax, 0x1000
jne 0x140011e1f
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParametersNotification
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140011e1f
mov dword [rbp + 0x58], 4
mov dword [rbp + 0x60], 4
lea rax, [rbp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x60]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rbp + 0x50]
test eax, r14d
je 0x140011deb
not r14d
and r14d, eax
jmp 0x140011dee
or r14d, eax
mov dword [rbp + 0x50], r14d
mov eax, dword [rbp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x60]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp + 0x4c], esi
jne 0x14001268b
mov r8d, r15d
mov edx, ebx
lea rcx, str.DispatchHotKey___:_Got_the_Fn_event__x._SleepState___x_n
call fcn.1400030c1
lea rcx, [rbp - 0x18]
call fcn.14000278e
nop
mov dword [rbp - 0x28], esi
lea r9, [rbp - 0x28]
xor r8d, r8d
mov edx, 0x222434
lea rcx, [rbp - 0x18]
call fcn.1400037ce
cmp dword [rbp - 0x28], 0x200
jne 0x140012024
mov eax, ebx
and eax, 0xff00
cmp eax, 0x1100
je 0x140011f51
cmp eax, 0x1300
jne 0x140012024
cmp dword [0x1400c2424], 0
je case.0x1400123e7.24601
lea ecx, [r13 - 1]
mov ebx, edi
shl ebx, cl
test ebx, ebx
je case.0x1400123e7.24601
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParameters2Type10Notification
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne case.0x1400123e7.24601
mov dword [rbp + 0x58], 4
mov dword [rbp + 0x60], 4
lea rax, [rbp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x60]
xor r8d, r8d
lea rdx, str.Type13
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rbp + 0x50]
test eax, ebx
je 0x140011f15
not ebx
and ebx, eax
jmp 0x140011f17
or ebx, eax
mov dword [rbp + 0x50], ebx
mov eax, dword [rbp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x60]
xor r8d, r8d
lea rdx, str.Type13
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x1400123e7.24579
cmp dword [0x1400c241c], 0
je 0x14001201d
lea ecx, [r13 - 1]
mov ebx, edi
shl ebx, cl
test ebx, ebx
je 0x14001201d
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParameters2Type10Notification
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001201d
mov dword [rbp + 0x58], 4
mov dword [rbp + 0x60], 4
lea rax, [rbp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x60]
xor r8d, r8d
lea rdx, str.Type12
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rbp + 0x50]
test eax, ebx
je 0x140011fe1
not ebx
and ebx, eax
jmp 0x140011fe3
or ebx, eax
mov dword [rbp + 0x50], ebx
mov eax, dword [rbp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x60]
xor r8d, r8d
lea rdx, str.Type12
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x1400123e7.24579
mov esi, edi
jmp case.0x1400123e7.24579
and ebx, 0xfffff0ff
cmp ebx, 0x6000
ja 0x1400123aa
je 0x14001238f
cmp ebx, 0x4010
ja 0x14001219a
je 0x140012186
cmp ebx, 0x2013
ja 0x140012128
je 0x1400120c9
cmp ebx, 0x15
je 0x1400120ae
cmp ebx, 0x1003
je case.0x1400123e7.24579
cmp ebx, 0x100c
je 0x1400120a4
lea eax, [rbx - 0x2004]
cmp eax, 1
ja case.0x1400123e7.24601
lfence
lea rcx, str.Got_Wakeup_Event_n
call fcn.1400030c1
mov r8d, r15d
xor edx, edx
mov ecx, edi
call fcn.140003eb3
jmp case.0x1400123e7.24579
call fcn.140003689
jmp case.0x1400123e7.24579
lea rcx, str.IBMPM_FAST_FLASH_STANDBY_CHANGED_n
call fcn.1400030c1
mov ecx, 0x15
call fcn.140002ce8
jmp case.0x1400123e7.24579
lea rcx, str.Got_IBMPM_WAKEUP_BATT_Event_n
call fcn.1400030c1
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140002cc5
test al, al
je 0x14001211e
mov ebx, esi
nop dword [rax + rax]
mov r8b, 1
movzx edx, r8b
movzx ecx, dl
call fcn.1400032c4
test al, al
jne case.0x1400123e7.24579
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 3
jl 0x1400120f0
jmp case.0x1400123e7.24579
call fcn.140002f7c
jmp case.0x1400123e7.24579
sub ebx, 0x2020
je 0x140012175
sub ebx, 0xfe3
je 0x140012149
sub ebx, 3
je 0x140012166
cmp ebx, 0xffd
jne case.0x1400123e7.24601
lea rcx, str.Got_Bus_Disconnect_Event_n
call fcn.1400030c1
xor r8d, r8d
mov edx, edi
xor ecx, ecx
call fcn.140003eb3
jmp case.0x1400123e7.24579
mov ecx, 8
call fcn.140002ce8
jmp case.0x1400123e7.24579
lea rcx, str.HK_CHANGE_CONNECTED_STANDBY_STATUS_CHNAGED_n
call fcn.1400030c1
jmp case.0x1400123e7.24579
mov ecx, 0xb
call fcn.140002ce8
call fcn.140003f17
jmp case.0x1400123e7.24579
cmp ebx, 0x5001
ja 0x140012296
je 0x14001220e
sub ebx, 0x4011
je 0x1400121fa
sub ebx, 1
je 0x1400121dc
cmp ebx, 1
jne case.0x1400123e7.24601
lea rcx, str.IBMPM_TABLET_OPTION_DETACHED_n
call fcn.1400030c1
call fcn.140001a2d
call fcn.14000389b
lea ecx, [rbx + 3]
jmp 0x14001267b
lea rcx, str.IBMPM_TABLET_OPTION_ATTACHED_n
call fcn.1400030c1
call fcn.14000452f
call fcn.14000389b
mov ecx, r12d
jmp 0x14001267b
mov ecx, 0xc
call fcn.140002ce8
call fcn.140003f17
jmp case.0x1400123e7.24579
mov ecx, 5
call fcn.140002ce8
call fcn.14000214e
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCTransformCurrentStatus
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne case.0x1400123e7.24579
mov dword [rbp + 0x48], edi
lea rax, [rbp + 0x48]
mov dword [rsp + 0x28], 4
mov dword [rbp + 0x60], 4
mov dword [rbp + 0x58], 4
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x14009b730]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x1400123e7.24579
add ebx, 0xffffaffe
cmp ebx, 0x2e
ja case.0x1400123e7.24601
lea rdx, [0x140000000]
movzx eax, byte [rdx + rbx + 0x126cc]
mov ecx, dword [rdx + rax*4 + 0x126a0]
add rcx, rdx
jmp rcx
mov ecx, 6
call fcn.140002ce8
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCTransformCurrentStatus
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne case.0x1400123e7.24579
mov dword [rbp - 0x24], 2
lea rax, [rbp - 0x24]
jmp 0x140012252
xor ecx, ecx
call fcn.140002dc9
jmp case.0x1400123e7.24579
mov ecx, edi
call fcn.140002dc9
jmp case.0x1400123e7.24579
mov ecx, 2
call fcn.140002ce8
jmp case.0x1400123e7.24579
mov ecx, r12d
call fcn.140002ce8
jmp case.0x1400123e7.24579
mov ecx, 0xa
call fcn.140002ce8
jmp case.0x1400123e7.24579
lea rcx, str.IBMPM_PEN_LOSE_n
call fcn.1400030c1
mov ecx, 0xf
call fcn.140002ce8
jmp case.0x1400123e7.24579
lea rcx, str.IBMPM_EVENT_LAYFLAT_STATE_CHANGE_n
call fcn.1400030c1
mov ecx, 2
jmp 0x14001267b
lea rcx, str.IBMPM_EVENT_DOG_EAR_CHANGED_n
call fcn.1400030c1
mov ecx, edi
jmp 0x14001267b
lea rcx, str.IBMPM_NUMLOCK_STATE_CHANGED_n
call fcn.1400030c1
mov ecx, 0xd
call fcn.140002ce8
jmp case.0x1400123e7.24579
cmp ebx, 0x7000
ja 0x140012634
je 0x14001262b
add ebx, 0xffff9fff
cmp ebx, 0xef
ja case.0x1400123e7.24601
lea rdx, [0x140000000]
movzx eax, byte [rdx + rbx + 0x12760]
mov ecx, dword [rdx + rax*4 + 0x126fc]
add rcx, rdx
jmp rcx
call fcn.1400015fa
jmp case.0x1400123e7.24579
mov ecx, 9
call fcn.140002ce8
jmp case.0x1400123e7.24579
lea rcx, str.IBMPM_FNSTICKY_STATE_CHANGED_n
call fcn.1400030c1
mov ecx, 0xe
call fcn.140002ce8
jmp case.0x1400123e7.24579
lea rcx, str.IBMPM_ACADPTER_RAW_STATE_CHANGED_n
call fcn.1400030c1
mov ecx, 0x10
call fcn.140002ce8
jmp case.0x1400123e7.24579
lea rcx, str.IBMPM_BRIGHTNESS_CHANGED_n
call fcn.1400030c1
mov ecx, 0x11
call fcn.140002ce8
jmp case.0x1400123e7.24579
lea rcx, str.IBMPM_MEDIAKEY_CHANGED_n
call fcn.1400030c1
mov ecx, 0x12
call fcn.140002ce8
jmp case.0x1400123e7.24579
lea rcx, str.IBMPM_DYNAMIC_THERMAL_CONTROL_SET_COMMAND_COMPLIETION_n
call fcn.1400030c1
mov ecx, 8
jmp 0x14001267b
lea rcx, str.IBMPM_INTELLIGENT_SLEEP_STATE_WAKES_FROM_S3_TO_S4_n
call fcn.1400030c1
mov ecx, 0x13
call fcn.140002ce8
jmp case.0x1400123e7.24579
lea rcx, str.IBMPM_INTELLIGENT_SLEEP_STATE_WAKES_FROM_S4_TO_S3_n
call fcn.1400030c1
mov ecx, 0x14
call fcn.140002ce8
jmp case.0x1400123e7.24579
lea rcx, str.IBMPM_ACTIVE_PROTECTION_SYSTEM_BUTTON_CANGED_n
call fcn.1400030c1
mov ecx, 0x16
call fcn.140002ce8
jmp case.0x1400123e7.24579
lea rcx, str.IBMPM_KEYBOARD_LIGHT_DEVICE_STATE_CHANGED_n
call fcn.1400030c1
mov ecx, 0x17
call fcn.140002ce8
jmp case.0x1400123e7.24579
lea rcx, str.IBMPM_TOUCHPAD_DEVICE_STATE_CANGED_n
call fcn.1400030c1
mov ecx, 0x19
call fcn.140002ce8
jmp case.0x1400123e7.24579
lea rcx, str.IBMPM_PSENSOR_DETECTED_n
call fcn.1400030c1
mov ecx, 0x1a
call fcn.140002ce8
jmp case.0x1400123e7.24579
lea rcx, str.IBMPM_PSENSOR_UNDETECTED_n
call fcn.1400030c1
mov ecx, 0x1b
call fcn.140002ce8
jmp case.0x1400123e7.24579
lea rcx, str.IBMPM_DEVICE_TRANSFORMATION_CHANGED_n
call fcn.1400030c1
mov ecx, 0x1e
call fcn.140002ce8
call fcn.140003ac6
call fcn.140003de6
jmp case.0x1400123e7.24579
lea rcx, str.IBMPM_ROTATIONLOCK_BUTTON_PRESSED_n
call fcn.1400030c1
mov ecx, 0x1f
call fcn.140002ce8
jmp case.0x1400123e7.24579
lea rcx, str.IBMPM_EVENT__INSTANT_ON_SETTINGS_n
call fcn.1400030c1
mov ecx, 0x18
call fcn.140002ce8
jmp case.0x1400123e7.24579
lea rcx, str.HK_KEYBORAD_LIGHT_CONTROL_MODE_CHANGED_n
call fcn.1400030c1
mov ecx, 5
jmp 0x14001267b
lea rcx, str.IBMPM_EVENT_THERMAL_TRANSFORMATION_CHANGED_n
call fcn.1400030c1
mov ecx, 6
call fcn.140002c2f
call fcn.14000434a
jmp case.0x1400123e7.24579
lea rcx, str.IBMPM_EVENT_THERMAL_DISCRETE_GPU_TEMPATURE_CHANGED_n
call fcn.1400030c1
mov ecx, 7
call fcn.140002c2f
call fcn.140004020
jmp case.0x1400123e7.24579
lea rcx, str.IBMPM_EVENT_SMART_OVERNIGHT_CHAGE_CLIP_CHANGED_n
call fcn.1400030c1
mov ecx, 0x1b
jmp 0x14001267b
lea rcx, str.EVENT_INTELLIGENT_COOLING_POWER_CHECKER_START_n
call fcn.1400030c1
mov ecx, 0x16
jmp 0x14001267b
lea rcx, str.EVENT_INTELLIGENT_COOLING_POWER_CHECKER_STOP_n
call fcn.1400030c1
mov ecx, 0x17
jmp 0x14001267b
mov ecx, edi
call fcn.140002ce8
jmp case.0x1400123e7.24579
sub ebx, 0x8034
je 0x14001266a
sub ebx, 1
je 0x140012657
cmp ebx, 1
jne case.0x1400123e7.24601
lea rcx, str.EVENT_TRACK_POINT_TAPPED_n
call fcn.1400030c1
lea ecx, [rbx + 0x19]
jmp 0x14001267b
lea rcx, str.INTELLIGNET_COOLING_AMT_AUTO_PERFORMANCE_DISBALE_n
call fcn.1400030c1
mov ecx, 0x19
jmp 0x14001267b
lea rcx, str.INTELLIGENT_COOLING_AMT_AUTO_PERFORMANCE_ENABLE_n
call fcn.1400030c1
mov ecx, 0x18
call fcn.140002c2f
mov edi, esi
lea rcx, [rbp - 0x18]
call fcn.140001834
mov eax, edi
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret