Function at 0x140003689
Capabilities:
Persist via windows service
Set registry value

Disassembly:
jmp 0x14001b1c0
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
xor edi, edi
lea rax, [rbp + 0x28]
mov qword [rsp + 0x40], rdi
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCConfigurations
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
mov dword [rbp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14001b23e
mov rcx, qword [rbp + 0x28]
lea r9d, [rdi + 1]
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x28]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCConfigurationsScreenRotation
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14001b2d3
mov rcx, qword [rbp + 0x28]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
lea rdx, str.TNSPMode
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x28]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCStatus
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14001b368
mov rcx, qword [rbp + 0x28]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
lea rdx, str.LastSystemTransformation
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x28]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWARELenovoShortCutKeyAppLaunchEx_3C
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14001b401
mov rcx, qword [rbp + 0x28]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
lea rdx, str.AppType
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x20], 3
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x28]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWARELenovoShortCutKeyAppLaunchEx_3CUIAccess
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
or rbx, 0xffffffffffffffff
lea rsi, str.C:WindowsSystem32ibmpmctl.exe
test eax, eax
jne 0x14001b531
mov rcx, qword [rbp + 0x28]
lea r9d, [rbx + 2]
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
movzx eax, byte [0x14009c1f8]
lea rcx, [rbp - 0x30]
movups xmm0, xmmword [str.C:WindowsSystem32ibmpmctl.exe]
mov byte [rbp - 0x10], al
mov rax, rbx
movups xmm1, xmmword [0x14009c1e8]
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm1
inc rax
cmp byte [rcx + rax], dil
jne 0x14001b494
mov rcx, qword [rbp + 0x28]
lea rdx, str.File
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
movzx eax, word [0x14009c220]
lea rcx, [rbp - 0x30]
movups xmm0, xmmword [str.TabletToClamshellForTanner]
mov word [rbp - 0x18], ax
movzx eax, byte [0x14009c222]
movsd xmm1, qword [0x14009c218]
mov byte [rbp - 0x16], al
mov rax, rbx
movups xmmword [rbp - 0x30], xmm0
movsd qword [rbp - 0x20], xmm1
inc rax
cmp byte [rcx + rax], dil
jne 0x14001b4f4
mov rcx, qword [rbp + 0x28]
lea rdx, str.Parameters
mov dword [rsp + 0x28], eax
mov r9d, 1
lea rax, str.TabletToClamshellForTanner
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x28]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWARELenovoShortCutKeyAppLaunchEx_3E
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14001b5ca
mov rcx, qword [rbp + 0x28]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
lea rdx, str.AppType
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x20], 3
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x28]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWARELenovoShortCutKeyAppLaunchEx_3EUIAccess
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14001b6dd
mov rcx, qword [rbp + 0x28]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
movzx eax, byte [0x14009c1f8]
lea rcx, [rbp - 0x30]
movups xmm0, xmmword [str.C:WindowsSystem32ibmpmctl.exe]
mov byte [rbp - 0x10], al
mov rax, rbx
movups xmm1, xmmword [0x14009c1e8]
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm1
inc rax
cmp byte [rcx + rax], dil
jne 0x14001b652
mov rcx, qword [rbp + 0x28]
lea rdx, str.File
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [0x14009c2c0]
lea rcx, [rbp - 0x30]
movups xmm0, xmmword [str.FlipButtonForTanner]
mov dword [rbp - 0x20], eax
mov rax, rbx
movups xmmword [rbp - 0x30], xmm0
nop dword [rax]
inc rax
cmp byte [rcx + rax], dil
jne 0x14001b6a0
mov rcx, qword [rbp + 0x28]
lea rdx, str.Parameters
mov dword [rsp + 0x28], eax
mov r9d, 1
lea rax, str.FlipButtonForTanner
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x28]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWARELenovoShortCutKeyAppLaunchEx_3B
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14001b776
mov rcx, qword [rbp + 0x28]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
lea rdx, str.AppType
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x20], 3
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x28]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWARELenovoShortCutKeyAppLaunchEx_3BUIAccess
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14001b89d
mov rcx, qword [rbp + 0x28]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
movzx eax, byte [0x14009c1f8]
lea rcx, [rbp - 0x30]
movups xmm0, xmmword [str.C:WindowsSystem32ibmpmctl.exe]
mov byte [rbp - 0x10], al
mov rax, rbx
movups xmm1, xmmword [0x14009c1e8]
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm1
nop
inc rax
cmp byte [rcx + rax], dil
jne 0x14001b800
mov rcx, qword [rbp + 0x28]
lea rdx, str.File
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
movzx eax, word [0x14009c358]
movups xmm0, xmmword [str.ClamshellToTabletForTanner]
mov word [rbp - 0x18], ax
movzx eax, byte [0x14009c35a]
movsd xmm1, qword [0x14009c350]
mov byte [rbp - 0x16], al
lea rax, [rbp - 0x30]
movups xmmword [rbp - 0x30], xmm0
movsd qword [rbp - 0x20], xmm1
nop dword [rax]
inc rbx
cmp byte [rax + rbx], dil
jne 0x14001b860
mov rcx, qword [rbp + 0x28]
lea rax, str.ClamshellToTabletForTanner
mov dword [rsp + 0x28], ebx
lea rdx, str.Parameters
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret