Function at 0x140012ff0
Capabilities:
Create process on windows
Set registry value
Terminate process

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
lea rax, str.firstkey
mov rbx, rcx
cmp rdx, rax
jne 0x140013116
add rcx, 0x30
xor edi, edi
mov eax, edi
cmp dword [rbx + 0x8c], eax
sete al
mov dword [rcx + 0x5c], eax
call fcn.14000dd80
mov eax, edi
cmp dword [rbx + 0x8c], eax
lea rdx, str.SoftwareLenovoTpShocks
mov rcx, 0xffffffff80000001
setne al
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x80], eax
lea rax, [rsp + 0x78]
mov dword [rsp + 0x78], edi
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001310e
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x80]
lea r9d, [rdi + 4]
lea rdx, str.ShowSnoozePopup
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rcx, str.CLASS_TPSHOCKS
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
je 0x140013100
mov edx, dword [rbx + 0x8c]
lea rcx, str.APS:_SendMessage_TPSHOCKS_TRAY_WPARAM_SHOWSNOOZE_:_show_snooze_paopao_
call fcn.140017c00
cmp dword [rbx + 0x8c], edi
mov edx, dword [rbx + 0x9f0]
setne dil
mov r8d, 2
mov rcx, rsi
mov r9, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
lea rax, str.sencondkey
cmp rdx, rax
jne 0x140013285
add rcx, 0x370
xor edi, edi
mov eax, edi
cmp dword [rbx + 0x3cc], eax
sete al
mov dword [rcx + 0x5c], eax
call fcn.14000dd80
lea rcx, [rbx + 0x30]
cmp dword [rbx + 0x3cc], edi
je 0x140013157
mov dword [rcx + 0x48], 1
jmp 0x14001315a
mov dword [rcx + 0x48], edi
call fcn.14000dd80
mov eax, edi
lea rdx, str.SoftwareLenovoTpShocks
cmp dword [rbx + 0x3cc], eax
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x78], edi
setne al
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x80], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001310e
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x80]
lea rdx, str.ShowNotifyIcon
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.CLASS_TPSHOCKS
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
je 0x140013253
mov edx, dword [rbx + 0x3cc]
lea rcx, str.APS:_SendMessage_TPSHOCKS_TRAY_WPARAM_SHOWTRAYICON_:_show_notification_
call fcn.140017c00
cmp dword [rbx + 0x3cc], edi
mov edx, dword [rbx + 0x9f0]
setne dil
mov r8d, 1
mov rcx, rsi
mov r9, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
cmp dword [rbx + 0x3cc], edi
je 0x14001310e
lea rcx, str.NotificationSetting_OnMyBtnClick_start_TpShocks.exe
call fcn.140017c00
lea rcx, str.TpShocks.exe
mov edx, 1
call qword [sym.imp.KERNEL32.dll_WinExec]
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
lea rax, str.ADMINCHANGESTATUS
cmp rdx, rax
jne 0x14001310e
call fcn.140016820
test eax, eax
je 0x140013398
xor edi, edi
lea rcx, [rbx + 0x6b0]
mov eax, edi
cmp dword [rbx + 0x70c], eax
sete al
mov dword [rcx + 0x5c], eax
call fcn.14000dd80
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x1400132f7
lea r8, str.TpShEvUI.exe
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
call qword [sym.imp.MSVCR110.dll_exit]
int3
mov rcx, qword [rbx + 8]
mov edx, edi
mov dword [rsp + 0x78], edi
cmp dword [rbx + 0x70c], edx
sete dl
mov dword [rsp + 0x80], edx
mov rax, qword [rcx]
call qword [rax]
lea rax, [rsp + 0x78]
lea rdx, str.SoftwareLenovoTpShocks
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001310e
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x80]
lea rdx, str.AllowAllUser
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x140013100
cmp dword [rbx + 0x70c], 0
jne 0x14001310e
lea r8, str.TpShEvUI.exe
lea rdx, str.open
xor edi, edi
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
call qword [sym.imp.MSVCR110.dll_exit]
int3