Function at 0x14001bc40
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value
Terminate thread

Disassembly:
jmp 0x14001bc40
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rdi
push r12
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rax - 0x20], rbx
xor r9d, r9d
mov qword [rax - 0x28], rsi
mov rbx, rcx
mov qword [rax - 0x30], r13
mov esi, 3
mov qword [rax - 0x40], r15
xor r13d, r13d
mov r15d, ecx
mov qword [rax - 0x78], r13
mov dword [rax - 0x80], r13d
lea rcx, str..IBMPmDrv
shr r15d, 8
mov r8d, esi
mov edx, 0xc0000000
mov dword [rsp + 0x20], esi
and r15d, 0xf
mov edi, 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x14001c7da
lea eax, [r15 - 1]
mov qword [rsp + 0x70], r14
cmp eax, edi
movzx r14d, bl
cmovbe r15d, esi
cmp dword [0x1400d44ac], r13d
je 0x14001bd93
lea ecx, [r14 - 1]
mov esi, edi
shl esi, cl
test esi, esi
je 0x14001bd93
mov eax, ebx
and eax, 0xff00
cmp eax, 0x1000
jne 0x14001bd93
lea rax, [rbp + 7]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParametersNotification
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001bd93
mov rcx, qword [rbp + 7]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x7f]
lea rax, [rbp + 0x6f]
mov dword [rbp + 0x77], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rbp + 0x7f], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rbp + 0x6f]
test eax, esi
je 0x14001bd5e
not esi
and esi, eax
jmp 0x14001bd60
or esi, eax
mov eax, dword [rbp + 0x77]
xor r8d, r8d
mov r9d, dword [rbp + 0x7f]
xor edx, edx
mov rcx, qword [rbp + 7]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x6f], esi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, r13d
cmp dword [rbp + 0x6b], r13d
jne 0x14001c7d5
mov r8d, r15d
lea rcx, str.DispatchHotKey____Got_the_event__x...SleepState___x_n
mov edx, ebx
call fcn.140003224
lea ecx, [r14 - 1]
mov esi, 1
shl esi, cl
mov r14d, ebx
mov eax, esi
and r14d, 0xff00
and eax, dword [0x1400d44b8]
test eax, 0x804
je 0x14001bdec
cmp r14d, 0x1000
jne 0x14001bdec
lea rcx, str.This_hotkey_is_overrided_by_client
call fcn.140003224
jmp 0x14001c7d5
mov edx, ebx
lea rcx, str.FnNumber__x_n
call fcn.140003224
mov qword [rsp + 0x38], r13
lea rax, [rbp - 5]
mov qword [rsp + 0x30], rax
lea r8, [rbp - 1]
lea rax, [rbp - 9]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
mov edx, 0x222434
mov dword [rbp - 1], r13d
mov rcx, r12
mov dword [rbp - 9], r13d
mov dword [rbp - 5], r13d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp dword [rbp - 9], 0x200
jne 0x14001c002
cmp r14d, 0x1100
je 0x14001bf33
cmp r14d, 0x1300
jne 0x14001c002
cmp dword [0x1400d44c4], r13d
je 0x14001bf22
test esi, esi
je 0x14001bf22
lea rax, [rbp + 7]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParameters2Type10Notification
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001bf22
mov rcx, qword [rbp + 7]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x7f]
lea rax, [rbp + 0x6f]
mov dword [rbp + 0x77], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Type13
mov dword [rbp + 0x7f], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rbp + 0x6f]
test eax, esi
je 0x14001bee8
not esi
and esi, eax
jmp 0x14001beea
or esi, eax
mov eax, dword [rbp + 0x77]
lea rdx, str.Type13
mov r9d, dword [rbp + 0x7f]
xor r8d, r8d
mov rcx, qword [rbp + 7]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x6f], esi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, r13d
lea rcx, str.Type13_hotkey_is_force_return_by_PM_service
call fcn.140003224
jmp 0x14001c7d5
cmp dword [0x1400d44bc], r13d
je 0x14001bff1
test esi, esi
je 0x14001bff1
lea rax, [rbp + 7]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParameters2Type10Notification
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001bff1
mov rcx, qword [rbp + 7]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x7f]
lea rax, [rbp + 0x6f]
mov dword [rbp + 0x77], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Type12
mov dword [rbp + 0x7f], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rbp + 0x6f]
test eax, esi
je 0x14001bfb7
not esi
and esi, eax
jmp 0x14001bfb9
or esi, eax
mov eax, dword [rbp + 0x77]
lea rdx, str.Type12
mov r9d, dword [rbp + 0x7f]
xor r8d, r8d
mov rcx, qword [rbp + 7]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x6f], esi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, r13d
lea rcx, str.Type12_hotkey_is_force_return_by_PM_service
call fcn.140003224
jmp 0x14001c7d5
and ebx, 0xfffff0ff
cmp ebx, 0x5001
ja 0x14001c295
je 0x14001c240
cmp ebx, 0x3003
ja 0x14001c15e
je 0x14001c196
cmp ebx, 0x2005
ja 0x14001c0bc
cmp ebx, 0x2004
jae 0x14001c09b
sub ebx, 0x15
je 0x14001c07d
sub ebx, 0xfee
je 0x14001c063
cmp ebx, 9
jne case.0x14001c4cf.24599
call fcn.14000387d
mov edi, r13d
jmp 0x14001c7d5
cmp dword [0x1400d4160], r13d
jne case.0x14001c4cf.24579
call fcn.140001654
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_FAST_FLASH_STANDBY_CHANGED_n
call fcn.140003224
mov ecx, 0x15
call fcn.140002e46
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.Got_Wakeup_Event_n
call fcn.140003224
xor edx, edx
mov r8d, r15d
lea ecx, [rdx + 1]
call fcn.14000415b
mov edi, r13d
jmp 0x14001c7d5
sub ebx, 0x2013
je 0x14001c0de
cmp ebx, 0xd
jne case.0x14001c4cf.24599
lea rcx, str.HK_CHANGE_CONNECTED_STANDBY_STATUS_CHNAGED_n
call fcn.140003224
jmp 0x14001c7d5
lea rcx, str.Got_IBMPM_WAKEUP_BATT_Event_n
call fcn.140003224
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140002e28
test al, al
je 0x14001c151
cmp dword [0x1400d415c], r13d
jne 0x14001c114
call fcn.14000263a
mov edi, r13d
jmp 0x14001c7d5
mov ebx, r13d
nop word [rax + rax]
mov r8b, 1
movzx edx, r8b
movzx ecx, dl
call fcn.14000345e
test al, al
jne case.0x14001c4cf.24579
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 3
jl 0x14001c120
mov edi, r13d
jmp 0x14001c7d5
call fcn.1400030c1
mov edi, r13d
jmp 0x14001c7d5
cmp ebx, 0x4011
ja 0x14001c1e1
je 0x14001c1ca
sub ebx, 0x3006
je 0x14001c1b8
sub ebx, 0xffd
je 0x14001c196
cmp ebx, 0xd
jne case.0x14001c4cf.24599
lea ecx, [rbx - 2]
call fcn.140002e46
call fcn.1400041dd
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.Got_Bus_Disconnect_Event_n
call fcn.140003224
xor r8d, r8d
xor ecx, ecx
lea edx, [r8 + 1]
call fcn.14000415b
mov edi, r13d
jmp 0x14001c7d5
mov ecx, 8
call fcn.140002e46
mov edi, r13d
jmp 0x14001c7d5
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
call fcn.140002e46
call fcn.1400041dd
mov edi, r13d
jmp 0x14001c7d5
sub ebx, 0x4012
je 0x14001c218
cmp ebx, 1
jne case.0x14001c4cf.24599
lea rcx, str.IBMPM_TABLET_OPTION_DETACHED_n
call fcn.140003224
call fcn.140001a9b
call fcn.140003ada
lea ecx, [rbx + 3]
call fcn.140002d83
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_TABLET_OPTION_ATTACHED_n
call fcn.140003224
call fcn.140004859
call fcn.140003ada
mov ecx, 3
call fcn.140002d83
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.Got_Lid_Close_Event_n
call fcn.140003224
mov ecx, 5
call fcn.140002e46
call fcn.1400021f8
lea rax, [rbp + 7]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCTransformCurrentStatus
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne case.0x14001c4cf.24579
mov dword [rbp + 0x67], 1
jmp 0x14001c323
cmp ebx, 0x6000
ja 0x14001c492
je 0x14001c474
add ebx, 0xffffaffe
cmp ebx, 0x2e
ja case.0x14001c4cf.24599
lea rdx, [0x140000000]
movzx eax, byte [rdx + rbx + 0x1c844]
mov ecx, dword [rdx + rax*4 + 0x1c810]
add rcx, rdx
jmp rcx
lea rcx, str.Got_Lid_Open_Event_n
call fcn.140003224
mov ecx, 6
call fcn.140002e46
xor ecx, ecx
call fcn.140002eaa
lea rax, [rbp + 7]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCTransformCurrentStatus
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne case.0x14001c4cf.24579
mov dword [rbp + 0x67], 2
mov rcx, qword [rbp + 7]
lea rax, [rbp + 0x67]
mov dword [rsp + 0x28], 4
lea rdx, [0x1400a9c60]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x77], 4
mov dword [rbp + 0x7f], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, r13d
jmp 0x14001c7d5
xor ecx, ecx
call fcn.140002f1d
mov edi, r13d
jmp 0x14001c7d5
mov ecx, 1
call fcn.140002f1d
mov edi, r13d
jmp 0x14001c7d5
xor ecx, ecx
call fcn.140002635
mov edi, r13d
jmp 0x14001c7d5
mov ecx, 2
call fcn.140002e46
mov edi, r13d
jmp 0x14001c7d5
mov ecx, 3
call fcn.140002e46
mov edi, r13d
jmp 0x14001c7d5
mov ecx, 0xa
call fcn.140002e46
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_PEN_LOSE_n
call fcn.140003224
mov ecx, 0xf
call fcn.140002e46
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_TABLET_MODE_n
call fcn.140003224
mov ecx, 0x1c
call fcn.140002e46
call fcn.1400048d6
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_NOTEBOOK_MODE_n
call fcn.140003224
mov ecx, 0x1d
call fcn.140002e46
call fcn.14000209f
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_EVENT_LAYFLAT_STATE_CHANGE_n
call fcn.140003224
mov ecx, 2
call fcn.140002d83
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_EVENT_DOG_EAR_CHANGED_n
call fcn.140003224
mov ecx, 1
call fcn.140002d83
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_NUMLOCK_STATE_CHANGED_n
call fcn.140003224
mov ecx, 0xd
call fcn.140002e46
mov edi, r13d
jmp 0x14001c7d5
cmp ebx, 0x7000
ja case.0x14001c4cf.24599
je 0x14001c7c1
add ebx, 0xffff9fff
cmp ebx, 0xef
ja case.0x14001c4cf.24599
lea rdx, [0x140000000]
movzx eax, byte [rdx + rbx + 0x1c8d0]
mov ecx, dword [rdx + rax*4 + 0x1c874]
add rcx, rdx
jmp rcx
cmp qword [0x1400d44b0], r13
je case.0x14001c4cf.24582
cmp dword [0x1400d4160], r13d
jne case.0x14001c4cf.24582
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
xor edx, edx
xor ecx, ecx
mov r8d, 0x1ff
mov rdi, rax
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rbx, rax
test rax, rax
je 0x14001c51d
mov rcx, rax
call qword [sym.imp.USER32.dll_SetThreadDesktop]
lea rdx, str.Warning
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14001c544
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x1400d44b0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x1400d44b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
mov qword [0x1400d44b0], r13
call qword [sym.imp.USER32.dll_SetThreadDesktop]
test rbx, rbx
je case.0x14001c4cf.24582
mov rcx, rbx
call qword [sym.imp.USER32.dll_CloseDesktop]
call fcn.140001636
mov edi, r13d
jmp 0x14001c7d5
mov ecx, 9
call fcn.140002e46
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_FNSTICKY_STATE_CHANGED_n
call fcn.140003224
mov ecx, 0xe
call fcn.140002e46
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_ACADPTER_RAW_STATE_CHANGED_n
call fcn.140003224
mov ecx, 0x10
call fcn.140002e46
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_BRIGHTNESS_CHANGED_n
call fcn.140003224
mov ecx, 0x11
call fcn.140002e46
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_MEDIAKEY_CHANGED_n
call fcn.140003224
mov ecx, 0x12
call fcn.140002e46
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_DYNAMIC_THERMAL_CONTROL_SET_COMMAND_COMPLIETION_n
call fcn.140003224
mov ecx, 8
call fcn.140002d83
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_INTELLIGENT_SLEEP_STATE_WAKES_FROM_S3_TO_S4_n
call fcn.140003224
mov ecx, 0x13
call fcn.140002e46
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_INTELLIGENT_SLEEP_STATE_WAKES_FROM_S4_TO_S3_n
call fcn.140003224
mov ecx, 0x14
call fcn.140002e46
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_ACTIVE_PROTECTION_SYSTEM_BUTTON_CANGED_n
call fcn.140003224
mov ecx, 0x16
call fcn.140002e46
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_KEYBOARD_LIGHT_DEVICE_STATE_CHANGED_n
call fcn.140003224
mov ecx, 0x17
call fcn.140002e46
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_TOUCHPAD_DEVICE_STATE_CANGED_n
call fcn.140003224
mov ecx, 0x19
call fcn.140002e46
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_PSENSOR_DETECTED_n
call fcn.140003224
mov ecx, 0x1a
call fcn.140002e46
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_PSENSOR_UNDETECTED_n
call fcn.140003224
mov ecx, 0x1b
call fcn.140002e46
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_DEVICE_TRANSFORMATION_CHANGED_n
call fcn.140003224
mov ecx, 0x1e
call fcn.140002e46
call fcn.140003d23
call fcn.140004089
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_ROTATIONLOCK_BUTTON_PRESSED_n
call fcn.140003224
mov ecx, 0x1f
call fcn.140002e46
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_EVENT__INSTANT_ON_SETTINGS_n
call fcn.140003224
mov ecx, 0x18
call fcn.140002e46
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.HK_KEYBORAD_LIGHT_CONTROL_MODE_CHANGED_n
call fcn.140003224
mov ecx, 5
call fcn.140002d83
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_EVENT_THERMAL_TRANSFORMATION_CHANGED_n
call fcn.140003224
mov ecx, 6
call fcn.140002d83
call fcn.140004656
mov edi, r13d
jmp 0x14001c7d5
lea rcx, str.IBMPM_EVENT_THERMAL_DISCRETE_GPU_TEMPATURE_CHANGED_n
call fcn.140003224
mov ecx, 7
call fcn.140002d83
call fcn.1400042f5
mov edi, r13d
jmp 0x14001c7d5
mov ecx, 1
call fcn.140002e46
mov edi, r13d
jmp 0x14001c7d5
mov edi, 1
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x68]
mov r13, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
test r12, r12
je 0x14001c802
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
add rsp, 0x90
pop r12
pop rdi
pop rbp
ret