Function at 0x14000b8f0
Capabilities:
Create thread
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
sub rsp, 0x78
mov rax, qword [0x140048010]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov qword [0x14004ac58], rax
test rax, rax
jne 0x14000b925
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebp, ebp
mov ebx, ebp
nop dword [rax]
cmp ebx, 0xa
ja 0x14000bcce
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
lea rcx, str..IBMPmDrv
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x14000b97f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
jmp 0x14000b930
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], rbp
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x40], ebp
lea rdx, str.SYSTEMCurrentControlSetServicesLPlatSvc
mov dword [rsp + 0x50], ebp
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x54], ebp
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000ba75
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x54]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
lea rdx, str.Capability
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000ba33
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x54]
lea rax, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.Capability
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000ba75
cmp dword [rsp + 0x40], 2
sete bl
jmp 0x14000ba75
call fcn.140001dc0
test al, al
mov dword [rsp + 0x28], 4
mov ecx, ebp
lea rdx, str.Capability
setne cl
movzx ebx, al
inc ecx
lea rax, [rsp + 0x58]
mov dword [rsp + 0x58], ecx
mov r9d, 4
mov rcx, qword [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000ba85
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x14000bcce
mov qword [rsp + 0x90], rsi
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x98], rdi
mov r8d, 0x222728
mov qword [rsp + 0xa0], r12
mov ecx, 0x100
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0x70], r15
mov dword [rsp + 0x40], ebp
call fcn.14000c7c0
cmp dword [rsp + 0x40], 4
mov ecx, ebp
sete cl
test eax, eax
je 0x14000bb49
test ecx, ecx
je 0x14000bb49
mov r8d, 1
mov dword [0x14004ab54], 1
lea rdx, str.KeyboardLightControlCapability
call fcn.14000cc00
xor r8d, r8d
lea rdx, str.AutomaticModeControlCapability
call fcn.14000cc00
xor r8d, r8d
mov dword [0x14004ab48], ebp
lea rdx, str.OptionKeyboardAttachStatus
call fcn.14000cc00
xor r8d, r8d
lea rdx, str.CurrentLightLevelSetting
call fcn.14000cc00
xor r8d, r8d
mov dword [0x14004ab50], ebp
lea rdx, str.CurrentAutomodeStatus
call fcn.14000cc00
mov dword [0x14004ab4c], ebp
jmp 0x14000bb5c
mov r8d, dword [0x14004ab54]
lea rdx, str.KeyboardLightControlCapability
call fcn.14000cc00
lea r12, [0x14004ac10]
mov rbx, rbp
mov r14, r12
lea r15, [0x140000000]
mov edi, ebp
mov rsi, rbp
mov ecx, edi
test edi, edi
je 0x14000bbb3
sub ecx, 1
je 0x14000bbaa
sub ecx, 1
je 0x14000bba1
sub ecx, 1
je 0x14000bb98
cmp ecx, 1
jne 0x14000bbba
lea rbx, [fcn.140009ee0]
jmp 0x14000bbba
lea rbx, [0x14000c490]
jmp 0x14000bbba
lea rbx, [0x14000ddd0]
jmp 0x14000bbba
lea rbx, [0x140009ef0]
jmp 0x14000bbba
lea rbx, [fcn.14000de90]
test rbx, rbx
je 0x14000bc32
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + r15 + 0x4abc0], rax
test rax, rax
je 0x14000bc32
movsxd rax, edi
xor r9d, r9d
mov r8, rbx
xor edx, edx
xor ecx, ecx
lea rax, [r12 + rax*4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + r15 + 0x4ac28], rax
test rax, rax
je 0x14000bc32
mov r8d, dword [r14]
lea rcx, str.Create_thread___d__Thread_ID_0x_08x_Theread_Handle_0x_08x__n
mov r9, rax
mov edx, edi
call fcn.140009ed0
inc edi
add rsi, 8
add r14, 4
cmp edi, 5
jl 0x14000bb75
mov rcx, qword [0x14004ab80]
call sym.LPlatSvc.exe_OnSvcInit
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0xa8]
mov r12, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov qword [0x14004ab78], rax
test rax, rax
je 0x14000bcce
cmp dword [0x14004ab5c], 1
jne 0x14000bcc2
mov rcx, qword [0x14004ac58]
test rcx, rcx
je 0x14000bcc2
mov dword [rsp + 0x28], ebp
lea rdx, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], rbp
mov r8d, 0x1388
mov qword [rsp + 0x48], rbp
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
test eax, eax
jne 0x14000bcc2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x14004ab8c], 4
jmp 0x14000bcd8
mov dword [0x14004ab8c], 1
mov rcx, qword [0x14004ab80]
lea rdx, [0x14004ab88]
mov qword [0x14004ab90], 0x1c5
mov qword [0x14004ab9c], rbp
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400109a0
add rsp, 0x78
pop rbp
pop rbx
ret