Function at 0x140006e80
Capabilities:
Check for time delay via gettickcount
Check mutex on windows
Check os version
Create thread
Query environment variable
Terminate thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r13
push r14
push r15
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x14002b178]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov r15, rcx
lea rcx, [rbp + 0xd8]
xor edx, edx
mov r8d, 0x10c
xor ebx, ebx
mov qword [rbp + 0xd0], 0x114
call fcn.140007f40
lea rcx, [rbp + 0x1f2]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x1f0], bx
call fcn.140007f40
lea r8d, [rbx + 0x4c]
lea rcx, [rbp - 0x6c]
xor edx, edx
mov qword [rbp - 0x80], rbx
mov dword [rbp - 0x70], ebx
call fcn.140007f40
lea rcx, [rbp + 0x28]
xor edx, edx
mov r8d, 0xa8
mov qword [rbp + 0x20], rbx
call fcn.140007f40
lea r11, str.LocalLenovo_NumLock_Indicator
lea rax, str.LocalLenovo_CapsLock_Indicator
lea rcx, [rbp + 0xd0]
mov qword [rbp - 0x20], r11
mov qword [rbp - 0x18], rax
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x70], rbx
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1400075dc
lea rdx, [rbp + 0x1f0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400075dc
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0x104
mov r9d, ebx
sub ecx, eax
movsxd r10, ecx
je 0x140006f9c
cmp r10, 0x7fffffff
jbe 0x140006fa2
mov r9d, 0x80070057
test r9d, r9d
js 0x140006fd4
mov rcx, r10
lea rax, [rbp + 0x1f0]
mov r9d, ebx
test r10, r10
je 0x140006fce
nop dword [rax]
cmp word [rax], bx
je 0x140007027
add rax, 2
dec rcx
jne 0x140006fc0
mov r9d, 0x80070057
mov r8, rbx
test r9d, r9d
js 0x140007046
mov rdx, r10
lea rcx, [rbp + r8*2 + 0x1f0]
mov r9d, ebx
sub rdx, r8
je 0x140007039
mov rax, rdx
sub rax, r10
lea r10, str..dll
sub r10, rcx
lea r8, [rax + r8 + 0x7ffffffe]
test r8, r8
je 0x140007034
movzx eax, word [r10 + rcx]
test ax, ax
je 0x140007034
mov word [rcx], ax
add rcx, 2
dec r8
dec rdx
jne 0x140007007
jmp 0x140007039
test rcx, rcx
je 0x140006fce
mov r8, r10
sub r8, rcx
jmp 0x140006fd7
test rdx, rdx
jne 0x140007043
sub rcx, 2
mov r9d, 0x8007007a
mov word [rcx], bx
test r9d, r9d
mov eax, ebx
setns al
test eax, eax
je 0x1400075dc
lea rdx, str.Lenovo_Japan_Ltd.
lea rcx, [rbp + 0x1f0]
call fcn.140020c30
test eax, eax
jne 0x140007088
lea rdx, str.LENOVO
lea rcx, [rbp + 0x1f0]
call fcn.140020c30
test eax, eax
je 0x1400075dc
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
test rax, rax
je 0x1400075dc
lea rdx, str.SetHook
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test rax, rax
je 0x1400075d3
lea rdx, str.UnsetHook
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x78], rax
test rax, rax
je 0x1400075d3
or ecx, 0xffffffff
call sub.IMM32.dll_ImmDisableIME
lea rcx, [rsp + 0x68]
call fcn.1400049b0
test eax, eax
je 0x1400075d3
mov eax, dword [rsp + 0x68]
bt eax, 0x10
jb 0x1400075d3
and eax, 0x40000
lea r8, str.Localmutex_NumLock_OSD
mov edx, 1
xor ecx, ecx
mov qword [rsp + 0x550], r12
mov dword [0x14002cfa0], eax
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140007163
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140007163
lea r9, [0x140022f70]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x70], rax
test rax, rax
mov eax, 1
jne 0x140007165
mov eax, ebx
cmp dword [rbp + 0xd4], 5
mov qword [rsp + 0x548], rdi
mov r12d, 2
jbe 0x140007199
test eax, eax
je 0x140007356
lea rcx, str.Localevent_NumLock_CapsLock
call fcn.140004850
test eax, eax
jne 0x1400071a1
jmp 0x140007356
test eax, eax
je 0x140007356
mov rdi, rbx
mov r9, qword [rbp + rdi - 0x20]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + rdi + 0xa0], rax
test rax, rax
je 0x1400071ce
inc esi
add rdi, 8
cmp esi, r12d
jl 0x1400071a4
cmp esi, r12d
mov eax, ebx
sete al
test eax, eax
je 0x140007354
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call qword [sym.imp.USER32.dll_GetShellWindow]
test rax, rax
jne 0x140007216
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x1d4c0
ja 0x140007216
call qword [sym.imp.USER32.dll_GetShellWindow]
test rax, rax
je 0x1400071f1
call r13
lea rcx, [rbp + 0x20]
mov esi, eax
call fcn.140005890
lea rcx, [rbp + 0x20]
call fcn.140004fa0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14002c568], rax
test rax, rax
je 0x140007356
lea rdx, [0x14002c570]
lea rcx, str._ProgramData_NoiseSuppressionTipsLenovoToast.exe
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x140007356
lea rcx, str.hlp8.dll
call fcn.140005080
mov qword [0x14002c560], rax
test rax, rax
je 0x140007356
lea rax, [0x140005df0]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp - 0x70], 0x50
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x50], rbx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rbp - 0x48], rax
lea rax, [0x140023070]
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x30], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov ecx, ebx
cmp bx, ax
setne cl
test ecx, ecx
je 0x140007356
lea rax, [rbp + 0x20]
lea r8, [0x140022754]
lea rdx, str.wndclass_NumLock_OSD
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov r9d, 0x80000000
mov ecx, 0x80800a8
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rbp + 0x20], rax
test rax, rax
je 0x140007356
mov r9d, r12d
mov r8b, 0xff
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
test eax, eax
je 0x140007356
mov eax, 1
jmp 0x140007358
mov esi, ebx
mov eax, ebx
cmp dword [0x14002cfa0], ebx
je 0x14000749f
test eax, eax
je 0x14000739a
lea rax, [rbp + 0x68]
lea r9, [rbp + 0x20]
lea r8, [0x140006740]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
mov qword [rbp - 0x80], rax
test rax, rax
jne 0x1400074d9
mov r13, rbx
mov rdi, qword [rsp + 0x548]
test esi, esi
je 0x1400073ac
call qword [rbp - 0x78]
lea rbx, [rbp + 0x38]
mov rcx, qword [rbx + 0x68]
test rcx, rcx
je 0x1400073bf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400073cd
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x1400073dc
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbx + 0x88]
test rcx, rcx
je 0x1400073ee
call qword [sym.imp.GDI32.dll_DeleteObject]
add rbx, 8
dec r12
jne 0x1400073b0
mov rcx, qword [rbp + 0x90]
mov r12, qword [rsp + 0x550]
test rcx, rcx
je 0x140007411
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140007423
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140007433
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp - 0x80]
test rax, rax
je 0x140007445
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13, r13
je 0x140007453
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x14000746f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14002c568]
test rcx, rcx
je 0x140007481
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [0x14002c560]
test rcx, rcx
je 0x1400075dc
jmp 0x1400075d6
test eax, eax
je 0x14000739a
lea rax, [rbp + 0x68]
lea r9, [rbp + 0x20]
lea r8, [0x1400061f0]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14000739a
lea rax, [rbp + 0x6c]
lea r9, [rbp + 0x20]
lea r8, [0x140006b00]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r13, rax
test rax, rax
je 0x14000739d
cmp dword [rbp + 0x78], 1
mov rcx, qword [rbp + 0x20]
mov eax, 8
cmove ebx, eax
mov edx, ebx
call qword [sym.imp.USER32.dll_ShowWindow]
nop
xor r8d, r8d
lea rdx, [rsp + 0x70]
or r9d, 0xffffffff
lea ecx, [r8 + 1]
mov dword [rsp + 0x20], 0x4ff
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
je 0x14000759e
dec eax
jne 0x140007520
lea rcx, [rbp - 0x10]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140007520
cmp dword [rbp - 8], 0x12
je 0x1400075b8
lea rcx, [rbp - 0x10]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x10]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rbp - 0x10]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140007564
jmp 0x140007520
mov rcx, qword [rbp + 0x20]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8000
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x140007520
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x14000739d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.140007f10
mov rbx, qword [rsp + 0x558]
add rsp, 0x510
pop r15
pop r14
pop r13
pop rsi
pop rbp
ret