Function at 0x14003f860
Capabilities:
Create process on windows
Get uefi variable
Log keystrokes via application hook
Print debug messages
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x5a0
mov qword [rsp + 0x188], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400f2bd8]
xor rax, rsp
mov qword [rsp + 0x590], rax
mov rsi, rcx
xor eax, eax
or rbp, 0xffffffffffffffff
mov rcx, rbp
lea rdi, str.c:_templog.txt
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.c:_templog.txt
lea rcx, [0x1400fd3b0]
call fcn.140001bd0
lea rcx, str.CRtHDVBgProcWnd::Init__n
call fcn.1400022c0
lea rcx, str.CRtHDVBgProcWnd::Init__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor r12d, r12d
mov dword [0x1400fbe5c], r12d
mov rcx, rsi
call fcn.140044c80
mov rdi, qword [0x1400fd3a0]
cmp dword [rdi - 0x10], r12d
je 0x14003f98a
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], r12d
jl 0x14003f92d
cmp rax, qword [rdi - 0x18]
jne 0x14003f92d
lea rbx, [rdi - 0x18]
lock add dword [rdi - 8], 1
jmp 0x14003f96a
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x14003f949
call fcn.140001a80
int3
mov eax, dword [rdi - 0x10]
mov dword [rbx + 8], eax
mov eax, dword [rdi - 0x10]
add eax, 1
movsxd rdx, eax
add rdx, rdx
mov r8, rdi
lea rcx, [rbx + 0x18]
mov r9, rdx
call fcn.14008f260
lea rax, [rbx + 0x18]
mov qword [rsp + 0x120], rax
lea rcx, [rsp + 0x120]
call fcn.140018310
xor eax, eax
jmp 0x140041579
cmp qword [rsi + 0xcd0], r12
jle 0x14003f99f
lea rcx, [rsi + 0xcb8]
call fcn.140063bf4
cmp dword [0x1400fd38c], r12d
je 0x14003fcfb
lea rcx, [rsp + 0x50]
call fcn.140016e70
nop
xor eax, eax
mov rcx, rbp
lea rbx, str.RealtekAudioHDA_
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r15, [rcx - 1]
mov rsi, rbx
mov rax, qword [rsp + 0x50]
sub rsi, rax
sar rsi, 1
mov r14d, dword [rax - 0x10]
lea edi, [r14 + rcx - 1]
mov r13d, 1
mov edx, r13d
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, edx
jge 0x14003fa0d
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140001970
mov rax, qword [rsp + 0x50]
cmp rsi, r14
ja 0x14003fa16
lea rbx, [rax + rsi*2]
movsxd rdx, r15d
add rdx, rdx
lea rcx, [rax + r14*2]
mov r9, rdx
mov r8, rbx
call fcn.14008f260
test edi, edi
js 0x14003fcf0
mov rax, qword [rsp + 0x50]
cmp edi, dword [rax - 0xc]
jg 0x14003fcf0
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x50]
mov word [rax + rcx*2], 0
xor eax, eax
mov rcx, rbp
lea rsi, str.RAVCpl64.exe
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r15, [rcx - 1]
mov rbx, rsi
mov rax, qword [rsp + 0x50]
sub rbx, rax
sar rbx, 1
mov r14d, dword [rax - 0x10]
lea edi, [r14 + rcx - 1]
sub r13d, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, r13d
jge 0x14003faa1
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140001970
mov rax, qword [rsp + 0x50]
cmp rbx, r14
ja 0x14003faaa
lea rsi, [rax + rbx*2]
movsxd rdx, r15d
add rdx, rdx
lea rcx, [rax + r14*2]
mov r9, rdx
mov r8, rsi
call fcn.14008f260
test edi, edi
js 0x14003fce5
mov rax, qword [rsp + 0x50]
cmp edi, dword [rax - 0xc]
jg 0x14003fce5
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x50]
mov word [rax + rcx*2], 0
call fcn.140063708
mov rdx, rax
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
jne 0x14003fb06
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0xf8], rax
mov r8, qword [rsp + 0x50]
lea rdx, str.__s_
lea rcx, [rsp + 0xf8]
call fcn.140001e50
mov rsi, qword [rsp + 0xf8]
mov rcx, qword [rsi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rsi - 8], 0
jl 0x14003fb60
cmp rax, qword [rsi - 0x18]
jne 0x14003fb60
lea rbx, [rsi - 0x18]
lock add dword [rsi - 8], 1
jmp 0x14003fb9e
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rsi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x14003fb7c
call fcn.140001a80
int3
mov eax, dword [rsi - 0x10]
mov dword [rbx + 8], eax
mov eax, dword [rsi - 0x10]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rsi
add rdx, rdx
lea rcx, [rbx + 0x18]
call fcn.14008f260
add rbx, 0x18
mov qword [rsp + 0x148], rbx
call fcn.140063708
mov rdx, rax
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
jne 0x14003fbca
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x88], rdi
lea rdx, [0x1400c9c04]
test rdx, 0xffffffffffff0000
jne 0x14003fc1d
movzx r13d, dx
mov ecx, r13d
call fcn.140063514
test rax, rax
je 0x14003fc44
mov r8d, r13d
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.140001fe0
mov rdi, qword [rsp + 0x88]
jmp 0x14003fc44
xor eax, eax
mov rcx, rbp
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x88]
call fcn.140001bd0
mov rdi, qword [rsp + 0x88]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9, rdi
mov r8, rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, [rdi - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003fc7f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x148]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003fca3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, ebp
lock xadd dword [rsi - 8], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003fcc0
mov rcx, qword [rsi - 0x18]
mov rax, qword [rcx]
lea rdx, [rsi - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x14003fcde
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140041579
mov ecx, 0x80070057
call fcn.140001950
int3
mov ecx, 0x80070057
call fcn.140001950
nop
cmp dword [0x1400fd390], r12d
je 0x140040057
lea rcx, [rsp + 0x58]
call fcn.140016e70
nop
xor eax, eax
mov rcx, rbp
lea rbx, str.RealtekAudioHDA_
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r15, [rcx - 1]
mov rsi, rbx
mov rax, qword [rsp + 0x58]
sub rsi, rax
sar rsi, 1
mov r14d, dword [rax - 0x10]
lea edi, [r14 + rcx - 1]
mov r13d, 1
mov edx, r13d
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, edx
jge 0x14003fd69
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.140001970
mov rax, qword [rsp + 0x58]
cmp rsi, r14
ja 0x14003fd72
lea rbx, [rax + rsi*2]
movsxd rdx, r15d
add rdx, rdx
lea rcx, [rax + r14*2]
mov r9, rdx
mov r8, rbx
call fcn.14008f260
test edi, edi
js 0x14004004c
mov rax, qword [rsp + 0x58]
cmp edi, dword [rax - 0xc]
jg 0x14004004c
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x58]
mov word [rax + rcx*2], 0
xor eax, eax
mov rcx, rbp
lea rsi, str.EP64.exe
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r15, [rcx - 1]
mov rbx, rsi
mov rax, qword [rsp + 0x58]
sub rbx, rax
sar rbx, 1
mov r14d, dword [rax - 0x10]
lea edi, [r14 + rcx - 1]
sub r13d, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, r13d
jge 0x14003fdfd
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.140001970
mov rax, qword [rsp + 0x58]
cmp rbx, r14
ja 0x14003fe06
lea rsi, [rax + rbx*2]
movsxd rdx, r15d
add rdx, rdx
lea rcx, [rax + r14*2]
mov r9, rdx
mov r8, rsi
call fcn.14008f260
test edi, edi
js 0x140040041
mov rax, qword [rsp + 0x58]
cmp edi, dword [rax - 0xc]
jg 0x140040041
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rsp + 0x58]
mov word [rax + rcx*2], 0
call fcn.140063708
mov rdx, rax
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
jne 0x14003fe62
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0xc8], rax
mov r8, qword [rsp + 0x58]
lea rdx, str.__s_
lea rcx, [rsp + 0xc8]
call fcn.140001e50
mov rsi, qword [rsp + 0xc8]
mov rcx, qword [rsi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rsi - 8], 0
jl 0x14003febc
cmp rax, qword [rsi - 0x18]
jne 0x14003febc
lea rbx, [rsi - 0x18]
lock add dword [rsi - 8], 1
jmp 0x14003fefa
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rsi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x14003fed8
call fcn.140001a80
int3
mov eax, dword [rsi - 0x10]
mov dword [rbx + 8], eax
mov eax, dword [rsi - 0x10]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rsi
add rdx, rdx
lea rcx, [rbx + 0x18]
call fcn.14008f260
add rbx, 0x18
mov qword [rsp + 0xe0], rbx
call fcn.140063708
mov rdx, rax
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
jne 0x14003ff26
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x90], rdi
lea rdx, [0x1400c9c04]
test rdx, 0xffffffffffff0000
jne 0x14003ff79
movzx r13d, dx
mov ecx, r13d
call fcn.140063514
test rax, rax
je 0x14003ffa0
mov r8d, r13d
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140001fe0
mov rdi, qword [rsp + 0x90]
jmp 0x14003ffa0
xor eax, eax
mov rcx, rbp
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x90]
call fcn.140001bd0
mov rdi, qword [rsp + 0x90]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9, rdi
mov r8, rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, [rdi - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003ffdb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xe0]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003ffff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, ebp
lock xadd dword [rsi - 8], eax
add eax, 0xffffffff
test eax, eax
jg 0x14004001c
mov rcx, qword [rsi - 0x18]
mov rax, qword [rcx]
lea rdx, [rsi - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x14004003a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140041579
mov ecx, 0x80070057
call fcn.140001950
int3
mov ecx, 0x80070057
call fcn.140001950
nop
mov r13d, 1
cmp dword [0x1400fd37c], r12d
jne 0x140040081
cmp dword [0x1400fd380], r12d
jne 0x140040081
cmp dword [0x1400fd398], r12d
jne 0x140040081
cmp dword [0x1400fd394], r12d
je 0x140040088
mov dword [0x1400fd39c], r13d
cmp dword [0x1400fd2e4], r12d
je 0x1400400bb
lea rcx, [rsi + 0x868]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
call fcn.140034c70
mov rcx, rsi
call fcn.140056430
xor eax, eax
jmp 0x140041579
mov rcx, rsi
call fcn.140044d80
cmp dword [0x1400fd37c], r12d
jne 0x1400400e7
cmp dword [0x1400fd380], r12d
jne 0x1400400e7
cmp dword [0x1400fd398], r12d
jne 0x1400400e7
cmp dword [0x1400fd394], r12d
je 0x14004014e
lea rdi, [rsi + 0x868]
lea rax, [rsi + 0xa40]
test rdi, rdi
je 0x14004010d
test rax, rax
je 0x14004010d
mov qword [rsi + 0x4e0], rdi
mov qword [rsi + 0x4e8], rax
call fcn.1400727ec
test rax, rax
je 0x14004012e
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0xe8]
test rax, rax
je 0x14004012e
mov rax, qword [rax + 0x40]
jmp 0x140040131
mov rax, r12
mov qword [rdi + 0x88], rax
mov qword [rdi + 0xa0], rax
mov dword [0x1400fbe58], r12d
mov rcx, rsi
call fcn.1400567b0
bt dword [rsi + 0xa58], 0x1d
jae 0x1400401eb
cmp dword [0x1400fd358], r12d
jne 0x14004016e
cmp dword [0x1400fd36c], r12d
je 0x1400401eb
mov ecx, 0x30
call fcn.140063100
mov qword [rsp + 0xe0], rax
test rax, rax
je 0x140040190
mov rcx, rax
call fcn.140025d20
mov r12, rax
test r12, r12
je 0x1400401e4
mov rcx, r12
call fcn.140025e30
test eax, eax
je 0x1400401d2
mov rcx, r12
call fcn.140025f50
test eax, eax
je 0x1400401d2
cmp dword [r12 + 0x14], 0
je 0x1400401d2
lea rdx, [r12 + 0x28]
lea rcx, [rsp + 0x128]
call fcn.140010c50
mov rdx, rax
mov rcx, rsi
call fcn.140057830
mov edx, r13d
mov rcx, r12
call fcn.140041850
xor eax, eax
jmp 0x140041579
xor eax, eax
jmp 0x140041579
cmp dword [0x1400fd364], r12d
je 0x140040343
mov rcx, qword [rsi + 0x490]
test rcx, rcx
je 0x14004020c
mov rax, qword [rcx]
mov edx, r13d
call qword [rax]
mov qword [rsi + 0x490], r12
mov ecx, 0x138
call fcn.140063100
mov qword [rsp + 0x128], rax
test rax, rax
je 0x14004023a
mov r8b, 1
mov rdx, rsi
mov rcx, rax
call fcn.14002fcc0
jmp 0x14004023d
mov rax, r12
mov qword [rsi + 0x490], rax
xor ecx, ecx
mov qword [rsp + 0x1e0], rcx
mov qword [rsp + 0x1e8], rcx
mov qword [rsp + 0x1f0], rcx
mov qword [rsp + 0x1f8], rcx
mov qword [rsp + 0x200], rcx
mov qword [rsp + 0x208], rcx
mov qword [rsp + 0x210], rcx
mov qword [rsp + 0x218], rcx
lea rdx, [rsp + 0x1e0]
mov rcx, rax
call fcn.140032680
call fcn.140063708
mov rdx, rax
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
jne 0x1400402b6
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0xb8], rax
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0xb8]
call fcn.140059880
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x138]
call fcn.140010c50
mov rdx, rax
mov rcx, rsi
call fcn.140057830
mov rcx, qword [rsi + 0x490]
test rcx, rcx
je 0x14004031b
mov rax, qword [rcx]
mov edx, r13d
call qword [rax]
mov qword [rsi + 0x490], r12
mov rdx, qword [rsp + 0xb8]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x14004033c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140041579
cmp dword [0x1400fd374], r12d
je 0x140040603
mov rcx, qword [rsi + 0x490]
test rcx, rcx
je 0x140040364
mov rax, qword [rcx]
mov edx, r13d
call qword [rax]
mov qword [rsi + 0x490], r12
mov ecx, 0x138
call fcn.140063100
mov qword [rsp + 0x138], rax
test rax, rax
je 0x140040392
mov r8b, 1
mov rdx, rsi
mov rcx, rax
call fcn.14002fcc0
jmp 0x140040395
mov rax, r12
mov qword [rsi + 0x490], rax
xor ecx, ecx
mov qword [rsp + 0x220], rcx
mov qword [rsp + 0x228], rcx
mov qword [rsp + 0x230], rcx
mov qword [rsp + 0x238], rcx
mov qword [rsp + 0x240], rcx
mov qword [rsp + 0x248], rcx
mov qword [rsp + 0x250], rcx
mov qword [rsp + 0x258], rcx
lea rdx, [rsp + 0x220]
mov rcx, rax
call fcn.140032680
call fcn.140063708
mov rdx, rax
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
jne 0x14004040e
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x60]
call fcn.140059880
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x180]
call fcn.140010c50
mov rdx, rax
mov rcx, rsi
call fcn.140057830
cmp eax, 1
jne 0x1400404a0
lea rcx, str.CRtHDVBgProcWnd::Init_WriteR0Registry_true_n
call fcn.1400022c0
mov rcx, qword [rsi + 0x490]
test rcx, rcx
je 0x14004047b
mov rax, qword [rcx]
mov edx, r13d
call qword [rax]
mov qword [rsi + 0x490], r12
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x140040499
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140041579
xor eax, eax
mov dword [rsp + 0x100], eax
mov dword [rsp + 0x104], eax
mov dword [rsp + 0x108], eax
mov dword [rsp + 0x10c], eax
mov dword [rsp + 0x110], eax
mov dword [rsp + 0x114], eax
mov dword [rsp + 0x118], eax
lea rcx, [rsi + 0xa40]
lea rdx, [rsp + 0x1a8]
call fcn.14005f3e0
lea rdx, [rsp + 0x100]
mov rcx, rax
call fcn.14001ba60
mov edi, eax
mov edx, eax
lea rcx, str.first_time_getR0_d_n
call fcn.1400022c0
test edi, edi
je 0x1400405ca
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x100]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
mov eax, dword [rcx + 0x18]
mov dword [rdx + 0x18], eax
lea r8, [rsp + 0x1c0]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.140058cb0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x168]
call fcn.140010c50
mov rdx, rax
mov rcx, rsi
call fcn.140059390
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x190]
call fcn.140010c50
mov rdx, rax
mov rcx, rsi
call fcn.140057830
mov rcx, qword [rsi + 0x490]
test rcx, rcx
je 0x1400405a5
mov rax, qword [rcx]
mov edx, r13d
call qword [rax]
mov qword [rsi + 0x490], r12
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x1400405c3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140041579
xor r9d, r9d
mov edx, 0x3ef
mov r8d, 0x4e20
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_SetTimer]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140040603
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [0x1400fd394], 0
je 0x14004065c
mov dword [rsi + 0x508], r12d
mov rcx, rsi
call fcn.140056940
test eax, eax
je 0x140040633
mov dword [rsi + 0x508], r13d
mov edx, r13d
mov rcx, rsi
call fcn.140056d30
jmp 0x140040644
mov dword [rsi + 0x508], r12d
xor edx, edx
mov rcx, rsi
call fcn.140056d30
xor r9d, r9d
mov edx, 0x3f1
mov r8d, 0x1388
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_SetTimer]
cmp dword [0x1400fd388], 0
je 0x14004067d
xor r9d, r9d
mov edx, 0x3f0
mov r8d, 0x7530
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_SetTimer]
cmp dword [0x1400fd368], 0
je 0x14004074d
mov rcx, rsi
call fcn.140057790
mov r9d, 0x104
lea r8, [rsp + 0x480]
lea rdx, str.DDE3B212_51F2_40C2_B51F_43268123D113
lea rcx, str.Real_AMP
call qword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableA]
test eax, eax
jne 0x1400406be
call qword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.140063708
mov rcx, rax
test rax, rax
setne r12b
test r12d, r12d
jne 0x1400406dd
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x98], rax
lea rdx, [rsp + 0x480]
lea rcx, [rsp + 0x98]
call fcn.140059880
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x178]
call fcn.140010c50
mov rdx, rax
mov rcx, rsi
call fcn.140057830
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x140040746
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140041579
cmp dword [0x1400fd370], 0
je 0x1400408b0
mov ecx, 0x30
call fcn.140063100
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14004077b
mov rcx, rax
call fcn.140025d20
mov rbx, rax
jmp 0x14004077e
mov rbx, r12
test rbx, rbx
je 0x1400408a9
mov rcx, rbx
call fcn.140001000
test eax, eax
je 0x1400407c1
mov edx, 0x40
mov rcx, rbx
call fcn.140001120
lea rdx, [rbx + 0x28]
lea rcx, [rsp + 0x1a0]
call fcn.140010c50
mov rdx, rax
mov rcx, rsi
call fcn.140057830
jmp 0x140040897
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x260]
call fcn.1400935f0
call fcn.140063708
mov rcx, rax
test rax, rax
setne r12b
test r12d, r12d
jne 0x1400407f5
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x68], rdi
mov rcx, rsi
call fcn.140057790
mov r9d, 0x104
lea r8, [rsp + 0x260]
lea rdx, str.B870EF1B_1810_4A27_B2C3_EC2DCA72B027
lea rcx, str.RLKCODEC
call qword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableA]
test eax, eax
jne 0x14004083a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14004087e
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x68]
call fcn.140059880
xor edx, edx
lea r8d, [rdx + 2]
lea rcx, [rsp + 0x68]
call fcn.14003e5a0
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x150]
call fcn.140010c50
mov rdx, rax
mov rcx, rsi
call fcn.140057830
mov rdi, qword [rsp + 0x68]
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x140040897
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edx, r13d
mov rcx, rbx
call fcn.140041850
xor eax, eax
jmp 0x140041579
xor eax, eax
jmp 0x140041579
cmp dword [0x1400fd378], 0
je 0x140040ade
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x370]
call fcn.1400935f0
call fcn.140063708
mov rdx, rax
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
jne 0x1400408f2
mov ecx, 0x80004005
call fcn.140001950
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x80], rbx
mov rcx, rsi
call fcn.140057790
mov r9d, 0x104
lea r8, [rsp + 0x370]
lea rdx, str.B870EF1B_1810_4A27_B2C3_EC2DCA72B027
lea rcx, str.RLKCODEC
call qword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableA]
test eax, eax
jne 0x140040940
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140040a96
lea rdx, [rsp + 0x370]
lea rcx, [rsp + 0x80]
call fcn.140059880
nop
mov qword [rsp + 0xd8], r12
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SOFTWARERealtekRealtekEffectsDriver
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004099e
mov rdi, qword [rsp + 0xd8]
mov qword [rsp + 0xd0], rdi
jmp 0x140040a04
mov qword [rsp + 0xf0], r12
lea rax, [rsp + 0x140]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWARERealtekRealtekEffectsDriver
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140040ab6
mov rdi, qword [rsp + 0xf0]
mov qword [rsp + 0xd0], rdi
mov rbx, qword [rsp + 0x80]
cmp dword [rbx - 8], 1
jle 0x140040a2a
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x80]
call fcn.1400019d0
mov rbx, qword [rsp + 0x80]
mov eax, r12d
test rbx, rbx
setne al
test eax, eax
jne 0x140040a42
mov ecx, 0x80004005
call fcn.140001950
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, r13d
xor r8d, r8d
lea rdx, str.MAXIM_CAL
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rdi, rdi
je 0x140040a87
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r12
mov qword [rsp + 0xd0], r12
test rdi, rdi
je 0x140040a96
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x140040aaf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140041579
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x140040ad7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140041579
test byte [rsi + 0xb9c], 1
je 0x140040bf7
mov edi, r12d
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsi + 0xa40]
call fcn.14005f3e0
nop
lea rdx, [0x1400c9da4]
lea rcx, [rsp + 0xb0]
call fcn.1400597c0
nop
lea rcx, [rsp + 0x70]
call fcn.140010640
mov rdx, qword [rsp + 0xb0]
test rdx, rdx
je 0x140040b50
mov rcx, qword [rsp + 0x70]
cmp dword [rcx - 0x10], 0
jl 0x140040b50
call fcn.14008fb90
test rax, rax
je 0x140040b50
sub rax, qword [rsp + 0x70]
sar rax, 1
cmp eax, 0xffffffff
jne 0x140040bb5
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rsi
call fcn.140044d80
nop
mov rdx, qword [rsp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140040b88
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140040ba8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add edi, 1
cmp edi, 0xa
jge 0x140040bf7
jmp 0x140040af0
mov rdx, qword [rsp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140040bd9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x140040bf7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [rsi + 0xb70]
shr eax, 9
and eax, 1
mov dword [rsi + 0x1208], eax
cmp dword [0x1400fd2d8], 0
je 0x140040c4b
mov rcx, rsi
call fcn.140056180
cmp dword [0x1400fd2b8], 0
jne 0x140040c3c
cmp dword [0x1400fd2cc], 0
jne 0x140040c3c
lea rcx, [0x1400fd120]
call fcn.14003e510
test eax, eax
je 0x140040c44
mov rcx, rsi
call fcn.1400445c0
xor eax, eax
jmp 0x140041579
lea rcx, [0x1400fd120]
call fcn.14003e510
test eax, eax
jne 0x14004156f
cmp dword [0x1400fd2b8], eax
jne 0x14004156f
cmp dword [0x1400fd2cc], eax
jne 0x14004156f
cmp dword [0x1400fd2d4], eax
je 0x140040ca5
lea rcx, [rsi + 0xa40]
lea rdx, [rsp + 0x1b0]
call fcn.14005f3e0
mov edx, r13d
mov rcx, rax
call fcn.14002d4b0
xor eax, eax
jmp 0x140041579
mov dword [rsi + 0x670], 0x67
mov dword [rsi + 0x674], 0x66
cmp dword [0x1400fd31c], 0
je 0x140040d5f
add rsi, 0x868
je 0x140040d58
call fcn.14005e3c0
lea rcx, [rsi + 0x190]
call fcn.140034610
mov ebx, dword [rsi + 0x138]
test ebx, ebx
je 0x140040d47
nop
cmp r12d, dword [rsi + 0x138]
jae 0x140040d36
mov edx, r12d
lea rcx, [rsi + 0x120]
call fcn.140063ef8
test rax, rax
je 0x140040d41
mov rdi, qword [rax + 0x10]
test rdi, rdi
je 0x140040d36
lea rdx, [rsp + 0x198]
mov rcx, rdi
call fcn.14003a580
mov rcx, rax
call fcn.14005de40
mov rcx, rdi
call fcn.14005d9d0
add r12d, 1
cmp r12d, ebx
jae 0x140040d47
jmp 0x140040cf0
call fcn.140063294
int3
mov rax, qword [rsi + 0x190]
lea rcx, [rsi + 0x190]
call qword [rax + 0x28]
xor eax, eax
jmp 0x140041579
cmp dword [0x1400fd340], 0
je 0x140040d75
call fcn.140019580
test eax, eax
je 0x140041579
cmp dword [0x1400fd350], 0
je 0x140040d94
cmp dword [0x1400fbf8c], 0
je 0x140040d94
call fcn.140019580
test eax, eax
je 0x140041579
cmp dword [0x1400fd268], 0
je 0x140040dd5
lea rdi, [0x1400f5200]
mov ebx, 0x26
nop
nop
mov rdx, qword [rdi]
test rdx, rdx
je 0x140040dc4
lea rcx, [rsi + 0xcb8]
call fcn.140063e18
add rdi, 8
sub rbx, 1
jne 0x140040db0
mov dword [rsi + 0x11d4], r13d
cmp dword [0x1400fd264], 0
je 0x140040de6
mov rcx, rsi
call fcn.14004cf70
cmp dword [0x1400fd300], 0
je 0x140040e1a
mov rcx, rsi
call fcn.14004d010
bt dword [rsi + 0xaf4], 0x1d
jae 0x140040e09
mov rcx, rsi
call fcn.14004d3f0
test byte [rsi + 0xb5c], 0x80
je 0x140040e1a
mov rcx, rsi
call fcn.140053580
cmp dword [0x1400fd308], 0
je 0x140040e49
mov dword [rsi + 0x11d4], r13d
mov rdx, qword [0x1400f4700]
test rdx, rdx
je 0x140040e42
lea rcx, [rsi + 0xcb8]
call fcn.140063e18
mov dword [rsi + 0x11d4], r13d
cmp dword [0x1400fd304], 0
je 0x140040e59
mov dword [rsi + 0x11d4], r13d
cmp dword [0x1400fd26c], 0
je 0x140040e74
xor edx, edx
mov rcx, rsi
call fcn.14004d480
mov rcx, rsi
call fcn.140050300
cmp dword [0x1400fd270], 0
je 0x140040e90
mov edx, r13d
mov rcx, rsi
call fcn.14004d480
mov rcx, rsi
call fcn.1400503b0
cmp dword [0x1400fd274], 0
je 0x140040eab
xor edx, edx
mov rcx, rsi
call fcn.14004d480
mov rcx, rsi
call fcn.140050270
lea rcx, [0x1400fd120]
call fcn.14003e4b0
test eax, eax
jne 0x140040ecb
cmp dword [0x1400fd280], eax
jne 0x140040ecb
cmp dword [0x1400fd354], eax
je 0x140040ed3
mov rcx, rsi
call fcn.1400447a0
cmp dword [0x1400fd278], 0
je 0x140040f47
mov dword [rsi + 0xcb0], r13d
lea rdi, [0x1400f4610]
mov ebx, SafeArrayGetDim
nop
mov rdx, qword [rdi]
test rdx, rdx
je 0x140040f04
lea rcx, [rsi + 0xcb8]
call fcn.140063e18
add rdi, 8
sub rbx, 1
jne 0x140040ef0
mov dword [rsi + 0x11d4], r13d
lea rcx, [rsi + 0xa40]
lea rdx, [rsp + 0x158]
call fcn.14005f3e0
mov rdx, rax
lea rcx, [rsi + 0xd10]
call fcn.140023dd0
mov dword [rsi + 0xdf8], r13d
mov rcx, rsi
call fcn.140052ac0
cmp dword [0x1400fd2f8], 0
je 0x140040f89
lea rcx, [rsi + 0x10e0]
call fcn.14005b960
mov rax, qword [rsi + 0x1110]
test rax, rax
je 0x140040f77
xor r8d, r8d
mov rdx, rsi
lea rcx, [0x140053d60]
call rax
mov rcx, rsi
call fcn.140053d80
xor edx, edx
mov rcx, rsi
call fcn.1400528b0
cmp dword [0x1400fd2fc], 0
je 0x1400411a8
mov edx, r13d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
movzx edx, word [rsi + 0xa42]
cmp edx, 0x1025
je 0x140040fd8
cmp edx, 0x17aa
jne 0x140040fdf
mov dword [0x1400fc6c8], 0xff
mov dword [0x1400fc6cc], 0x71
mov dword [rsi + 0x11b0], r13d
jmp 0x140040fdf
mov dword [rsi + 0x11b4], r13d
lea rcx, [rsi + 0xc20]
cmp dword [rcx], 0
jne 0x14004111e
cmp dword [rsi + 0xc24], 0
jne 0x14004111e
cmp dword [rsi + 0xc28], 0
jne 0x14004111e
cmp dword [rsi + 0xc2c], 0
jne 0x14004111e
mov ecx, dword [rsi + 0xbe8]
test ecx, ecx
je 0x140041043
movzx eax, byte [rsi + 0xbe9]
mov dword [0x1400fced0], eax
movzx eax, cl
mov dword [0x1400fced4], eax
mov rcx, rsi
call fcn.1400530a0
jmp 0x140041180
bt dword [rsi + 0xb6c], 0xc
jae 0x140041066
mov dword [0x1400fc6c8], 0xff
mov dword [0x1400fc6cc], 2
jmp 0x140041180
movzx eax, word [rsi + 0xa40]
shl edx, 0x10
or eax, edx
sub eax, 0x17aa215e
je 0x1400410e9
sub eax, 0x5a
je 0x1400410b9
sub eax, 0x17bd
jne 0x140041180
movzx eax, word [rsi + 0xa44]
cmp ax, 0x4010
je 0x1400410a0
cmp ax, 0x4012
jne 0x140041180
mov dword [0x1400fc6c8], 0xff
mov dword [0x1400fc6cc], 0x71
jmp 0x140041180
movzx eax, word [rsi + 0xa44]
cmp ax, 0x21bd
je 0x1400410d0
cmp ax, 0x21bf
jne 0x140041180
mov dword [0x1400fc6c8], 0xff
mov dword [0x1400fc6cc], 0x71
jmp 0x140041180
movzx eax, word [rsi + 0xa44]
cmp ax, 0x21a3
je 0x140041108
cmp ax, 0x21a5
je 0x140041108
cmp ax, 0x21ba
je 0x140041108
cmp ax, 0x21bc
jne 0x140041180
mov dword [0x1400fc6c8], 0xff
mov dword [0x1400fc6cc], 0x71
jmp 0x140041180
mov dword [0x1400fcef8], r12d
mov rdx, r12
mov edi, 4
lea r8, [0x140000000]
nop
nop
nop
movzx eax, byte [rcx + 1]
mov dword [rdx + r8 + 0xfced8], eax
movzx eax, byte [rcx]
mov dword [rdx + r8 + 0xfcee8], eax
add rdx, 4
add rcx, 4
sub rdi, 1
jne 0x140041140
cmp dword [0x1400fcee0], edi
jne 0x140041180
mov eax, r12d
cmp dword [0x1400fcee4], eax
cmovne eax, r13d
mov dword [0x1400fcef8], eax
cmp qword [0x1400fbf90], 0
jne 0x1400411a8
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140052bc0]
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x1400fbf90], rax
bt dword [rsi + 0xaf4], 0xf
jae 0x1400412a7
mov rdi, r12
mov dword [rsp + 0x78], r12d
mov qword [rsp + 0xe8], r12
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, [0x1400c9da8]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004128d
mov rdi, qword [rsp + 0xe8]
mov qword [rsp + 0x160], rdi
mov dword [rsp + 0xa0], 4
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x130]
xor r8d, r8d
lea rdx, str.Logoff
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x78], 2
jne 0x14004128d
mov edx, r13d
mov rcx, rsi
call fcn.1400537b0
mov dword [rsp + 0xa8], r13d
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Logoff
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edx, edx
mov rcx, qword [rsi + 0x40]
call sub.WTSAPI32.dll_WTSRegisterSessionNotification
nop
test rdi, rdi
je 0x1400412a7
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call fcn.14004ac10
cmp dword [0x1400fd268], 0
je 0x1400412c0
mov rcx, rsi
call fcn.140044000
lea rcx, [0x1400fd120]
call fcn.14003e4b0
test eax, eax
jne 0x1400412d8
cmp dword [0x1400fd280], eax
je 0x1400412e0
mov rcx, rsi
call fcn.140044500
cmp dword [0x1400fd310], 0
je 0x1400412f8
mov dword [rsi + 0x11d4], r13d
mov rcx, rsi
call fcn.140053ea0
cmp dword [0x1400fd314], 0
jne 0x140041313
cmp dword [0x1400fd318], 0
jne 0x140041313
cmp dword [0x1400fd2ec], 0
je 0x14004131a
mov dword [rsi + 0x11d4], r13d
cmp dword [0x1400fd344], 0
jne 0x14004132c
cmp dword [0x1400fd328], 0
je 0x140041346
mov qword [rsi + 0xd00], rsi
lea rdx, [rsi + 0xcf8]
lea rcx, [rsi + 0x868]
call fcn.140034ed0
cmp dword [0x1400fd320], 0
je 0x140041375
lea rcx, [rsi + 0xcb8]
lea rdx, [0x1400c25c8]
call fcn.140063e18
mov dword [rsi + 0x11d4], r13d
lea rcx, [rsi + 0x868]
call fcn.14005c020
mov rcx, rsi
call fcn.140043ba0
cmp dword [0x1400fd334], 0
je 0x140041392
lea rcx, [rsi + 0x868]
call fcn.1400237b0
cmp dword [rsi + 0xe20], 0
je 0x1400413a3
mov rcx, rsi
call fcn.140043680
cmp dword [0x1400fd328], 0
je 0x1400413d6
test byte [rsi + 0xae8], 8
je 0x1400413d6
mov rcx, rsi
call fcn.140043900
mov rcx, qword [rsi + 0x1210]
test rcx, rcx
je 0x1400413d6
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rsi + 0x1210], r12
cmp dword [0x1400fd348], 0
je 0x140041435
lea rcx, [rsi + 0x868]
call fcn.1400366c0
test rax, rax
je 0x1400413fb
mov rdx, rax
mov rcx, rsi
call fcn.140054b00
mov dword [rsi + 0xcb0], r13d
lea rdi, [0x1400f46a0]
mov ebx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
nop
mov rdx, qword [rdi]
test rdx, rdx
je 0x140041424
lea rcx, [rsi + 0xcb8]
call fcn.140063e18
add rdi, 8
sub rbx, 1
jne 0x140041410
mov dword [rsi + 0x11d4], r13d
cmp dword [0x1400fd2c8], 0
je 0x140041471
lea rcx, [rsi + 0xcb8]
lea rdx, [0x1400c2178]
call fcn.140063e18
mov dword [rsi + 0x11d4], r13d
lea rcx, [rsi + 0x868]
call fcn.140036300
test rax, rax
je 0x140041471
mov rcx, rax
call fcn.14005bdd0
cmp dword [0x1400fd338], 0
je 0x140041494
lea rcx, [rsi + 0xcb8]
lea rdx, [0x1400c2178]
call fcn.140063e18
mov dword [rsi + 0x11d4], r13d
cmp dword [rsi + 0x11d4], 0
je 0x1400414b7
mov qword [rsi + 0xcf0], rsi
lea rcx, [rsi + 0x868]
lea rdx, [rsi + 0xca8]
call fcn.140034ed0
mov rcx, rsi
call fcn.1400434e0
cmp dword [0x1400fd2e0], 0
je 0x1400414ed
cmp qword [0x1400fbf98], 0
jne 0x1400414ed
xor r8d, r8d
lea rdx, [0x1400c1210]
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_RegisterPowerSettingNotification]
mov qword [0x1400fbf98], rax
mov eax, dword [0x1400fd2e8]
test eax, eax
je 0x140041505
mov dword [0x1400fbe5c], eax
mov rcx, rsi
call fcn.140056ea0
cmp dword [0x1400fd398], 0
je 0x14004156a
lea rcx, [rsi + 0x868]
xor r8d, r8d
xor edx, edx
call fcn.140035e70
test byte [rax + 0x180], 8
jne 0x140041532
bt dword [rax + 0x184], 0x17
jae 0x14004156a
lea rdx, str.DolbyEnable
lea rcx, [rsp + 0x170]
call fcn.140001f00
lea r8, [rsp + 0xc0]
mov rdx, rax
lea rcx, str.SOFTWAREDolbyDAX
call fcn.140016110
mov edx, dword [rsp + 0xc0]
mov dword [rsi + 0x122c], edx
mov eax, r13d
jmp 0x140041579
mov rcx, rsi
call fcn.1400445c0
xor eax, eax
mov rcx, qword [rsp + 0x590]
xor rcx, rsp
call fcn.14008f240
lea r11, [rsp + 0x5a0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret