Function at 0x140012920
Capabilities:
Set registry value
Shutdown system

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0x98
mov qword [rbp + 7], 0xfffffffffffffffe
mov rax, qword [0x1403b88b0]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r14d, r9d
mov esi, r8d
mov ebx, edx
mov rdi, rcx
and edx, 0xffffff00
call fcn.140025a80
test rax, rax
je 0x14001297d
mov r10, qword [rax]
mov r9d, r14d
mov r8d, esi
mov edx, ebx
mov rcx, rax
call qword [r10 + 0x28]
jmp 0x140012dad
cmp ebx, 0x23000211
ja 0x140012b5d
je 0x140012b11
sub ebx, 0x23000109
je 0x140012afe
sub ebx, 6
je 0x140012a28
cmp ebx, 1
jne 0x140012dab
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 1]
lea edx, [rbx + 0x27]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140012dab
lea r8, [rbp + 0x13]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [rbp + 0xf], ebx
mov ebx, 2
mov dword [rbp + 0x1b], ebx
xor edi, edi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rbp + 0xf]
xor edx, edx
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140012dab
mov edx, 0x80020003
mov ecx, ebx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x140012dab
mov rax, qword [rdi + 0x90]
test rax, rax
jne 0x140012a3e
mov edx, 0x2e3
jmp 0x140012ad5
test dword [rax + 0x1d0], 0x40000
je 0x140012ae8
mov rax, qword [rax + 0x1bd8]
test rax, rax
je 0x140012ad0
mov rbx, rax
mov rax, qword [rax]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x140012a55
cmp dword [rbx + 0x16c], 0
je 0x140012a55
cmp dword [rbx + 0x170], 0
jne 0x140012a55
cmp dword [rbx + 0x1d8], 1
jne 0x140012a55
mov rcx, rbx
call fcn.140018dc0
xor edi, edi
test eax, eax
je 0x140012aa6
mov r9d, edi
test esi, esi
sete dil
lea edx, [r9 + rdi]
call fcn.1400345e0
jmp 0x140012ae8
mov rcx, rbx
call fcn.140018b20
mov ebx, 2
mov r9d, 4
test eax, eax
cmovne r9d, ebx
test esi, esi
sete dil
lea edx, [r9 + rdi]
call fcn.1400345e0
jmp 0x140012ae8
mov edx, 0x2e8
lea r8, str.c:userschunyung_source_repos_rtkngui_rtkngui_audiocoresetting.cpp
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
call fcn.140052e90
xor edx, edx
mov ecx, 0x2300010f
call fcn.140025be0
mov eax, 1
jmp 0x140012dad
lea rcx, [rdi - 8]
call fcn.140011d30
mov eax, 1
jmp 0x140012dad
and dword [rdi + 0x60c], 0xfffffffe
and esi, 1
or dword [rdi + 0x60c], esi
mov rcx, qword [0x1403db8b0]
test rcx, rcx
jne 0x140012b4a
lea r8, str.c:userschunyung_source_repos_rtkngui_rtkngui_audioobjectui.cpp
mov edx, 0x9b
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140052e90
jmp 0x140012dab
mov rax, qword [rcx]
xor r8d, r8d
mov edx, 0x23000211
call qword [rax + 0x60]
jmp 0x140012dab
cmp ebx, 0x23000217
ja 0x140012bd9
je 0x140012bcf
sub ebx, 0x23000212
je 0x140012bac
sub ebx, 1
je 0x140012b94
cmp ebx, 1
jne 0x140012dab
and dword [rdi + 0x60c], 0xfffffff7
and esi, ebx
shl esi, 3
or dword [rdi + 0x60c], esi
jmp 0x140012dab
and dword [rdi + 0x60c], 0xfffffffb
and esi, 1
shl esi, 2
or dword [rdi + 0x60c], esi
jmp 0x140012dab
and dword [rdi + 0x60c], 0xfffffffd
and esi, 1
add esi, esi
or dword [rdi + 0x60c], esi
xor edx, edx
mov ecx, 0x23000212
call fcn.140025be0
jmp 0x140012dab
mov edx, 0x23000211
jmp 0x140012d88
sub ebx, 0x23000218
je 0x140012d83
sub ebx, 8
je 0x140012d78
cmp ebx, 0x3e3
jne 0x140012dab
xor edi, edi
mov qword [rbp - 0x29], rdi
mov dword [rbp - 0x21], edi
mov qword [rbp - 0x19], rdi
call fcn.1400f5f94
mov rcx, rax
test rax, rax
je 0x140012dc9
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 9], rax
lea rbx, str.SoftwareRealtekSBCoexist
mov rdx, rbx
lea rcx, [rbp - 9]
call fcn.140014ab0
lea r14, [rdi - 1]
test al, al
jne 0x140012c5e
mov rax, r14
inc rax
cmp word [rbx + rax*2], 0
jne 0x140012c44
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 9]
call fcn.140010390
nop
mov r9d, 0x20019
mov rbx, qword [rbp - 9]
mov r8, rbx
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x29]
call fcn.1400146e0
test eax, eax
jne 0x140012d4b
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x140012c96
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x29], rdi
mov dword [rbp - 0x21], edi
mov r9d, 0x20006
mov r8, rbx
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x29]
call fcn.1400146e0
test eax, eax
je 0x140012cfe
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8, rbx
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x29]
call fcn.1400144b0
test eax, eax
je 0x140012cfe
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x140012cf9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x29], rdi
mov dword [rbp - 0x21], edi
jmp 0x140012d4b
mov dword [rbp - 0x11], esi
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.DisablePopUp
mov rsi, qword [rbp - 0x29]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r15d, eax
test rsi, rsi
je 0x140012d41
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x29], rdi
mov dword [rbp - 0x21], edi
test r15d, r15d
sete dil
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x140012d65
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x140012d74
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x140012dad
lea rcx, [rdi - 8]
call fcn.140011a30
jmp 0x140012dad
mov edx, 0x23000212
mov rax, qword [rdi]
xor r9d, r9d
mov r8d, esi
mov rcx, rdi
call qword [rax + 0x28]
mov rax, qword [rdi]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x23000220
mov rcx, rdi
call qword [rax + 0x28]
xor eax, eax
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.140281bf0
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000dc70
int3