Function at 0x1400acea0
Capabilities:
Persist via run registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17f0]
mov eax, 0x18f0
call fcn.1400ca8f0
sub rsp, rax
mov rax, qword [0x14013c010]
xor rax, rsp
mov qword [rbp + 0x17e0], rax
mov r15d, edx
mov r13, rcx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
call fcn.14000b2a0
test dword [rax + 0x138], 0x800000
je 0x1400ad28f
test r15d, r15d
jne 0x1400acf0b
call fcn.1400acc60
test eax, eax
jne 0x1400ad6f9
mov rcx, r12
lea rsi, [0x140000000]
nop word [rax + rax]
movzx eax, word [rcx + rsi + 0xe36c8]
mov word [rbp + rcx + 0x3d0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400acf20
mov rcx, r12
lea rbx, str.RtkAudUService64_BG
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx + rbx]
mov word [rbp + rcx + 0x1c0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400acf50
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov edx, 0x800
lea rcx, [rbp + 0x7e0]
call fcn.14002aeb0
call fcn.14000b2a0
test dword [rax + 0xc0], 0x20000000
je 0x1400acf9d
call fcn.14000b2a0
movzx r8d, byte [rax + 0x1f3]
jmp 0x1400acfa3
mov r8d, 0x1e
lea r9, str._background
mov rcx, rbx
call fcn.140051b30
mov dword [rbp - 0x60], eax
mov r9, rbx
lea r8, str.RunCplByTaskScheduler__s
mov edx, 0x104
lea rcx, [rbp - 0x50]
call fcn.14002aeb0
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x50]
call fcn.140051590
lea r14, str.SetScheduler_at_FirstTime
mov rdi, 0xffffffffffffffff
test r15d, r15d
jne 0x1400ad138
mov dword [rsp + 0x34], r12d
mov qword [rsp + 0x48], r12
call fcn.1400046f0
mov rcx, rax
test rax, rax
je 0x1400ad72e
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140048c62.0]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x30], 1
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x1400e3308]
lea rcx, [rsp + 0x48]
call fcn.1400064f0
lea r9, [rsp + 0x34]
mov r8, r14
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
mov rcx, qword [0x14013c488]
call fcn.14007edf0
mov esi, r12d
test eax, eax
cmovne esi, dword [rsp + 0x34]
mov dword [rsp + 0x30], r12d
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400ad097
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140048c62.0]
cmp esi, 1
jne 0x1400ad138
mov qword [rsp + 0x50], r12
call fcn.1400046f0
mov rcx, rax
test rax, rax
je 0x1400ad739
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140048c62.0]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x30], 2
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x1400e3308]
lea rcx, [rsp + 0x50]
call fcn.1400064f0
mov r9d, esi
lea r8, str.SetScheduler_EntryDisappear
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
mov rcx, qword [0x14013c488]
call fcn.14007ef10
mov dword [rsp + 0x30], r12d
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, esi
jg 0x1400ad138
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140048c62.0]
call fcn.1400acc60
test eax, eax
jne 0x1400ad1ca
mov qword [rsp + 0x58], r12
call fcn.1400046f0
mov rcx, rax
test rax, rax
je 0x1400ad744
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140048c62.0]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x30], 4
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x1400e3308]
lea rcx, [rsp + 0x58]
call fcn.1400064f0
lea rax, str.AlreadySetScheduler_but_NoEntry_at_FirstTime
lea r8, str.AlreadySetScheduler_but_NoEntry
test r15d, r15d
cmovne r8, rax
mov r9d, 1
mov rbx, qword [rsp + 0x58]
mov rdx, rbx
mov rcx, qword [0x14013c488]
call fcn.14007ef10
nop
jmp 0x1400ad246
mov qword [rsp + 0x60], r12
call fcn.1400046f0
mov rcx, rax
test rax, rax
je 0x1400ad74f
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140048c62.0]
add rax, 0x18
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x30], 8
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x1400e3308]
lea rcx, [rsp + 0x60]
call fcn.1400064f0
lea r8, str.SetScheduler
test r15d, r15d
cmovne r8, r14
mov r9d, 1
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, qword [0x14013c488]
call fcn.14007ef10
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400ad267
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140048c62.0]
mov dword [r13 + 0x1b0], 1
call fcn.14000b740
mov rcx, rax
mov edx, 0x400
mov r8d, 0x7918
call fcn.1400b5a90
jmp 0x1400ad6f9
call fcn.140081410
mov r12d, eax
test eax, eax
je 0x1400ad2a4
test r15d, r15d
je 0x1400ad6f9
call fcn.1400046f0
mov rcx, rax
test rax, rax
je 0x1400ad75a
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140048c62.0]
add rax, 0x18
mov qword [rbp - 0x58], rax
lea rsi, [0x140000000]
mov r13d, 0x22
cmp word [0x14013c4a8], 0
jne 0x1400ad317
mov word [0x14013c4a8], r13w
mov r8d, 0xfe
lea rdx, [0x14013c4aa]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
lea rcx, [0x14013c4a8]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
movsxd rcx, eax
mov word [rsi + rcx*2 + 0x13c4a8], r13w
lea r14, str._background
mov r9, r14
lea r8, [0x14013c4a8]
lea rdx, str._s__s
lea rcx, [rbp - 0x58]
call fcn.1400064f0
mov rbx, qword [rbp - 0x58]
mov r9, rbx
mov r8d, 0x26
lea rdx, str.CRegKeyMgr::AddRtkAudUServiceRunKey
lea rcx, str._s__d_szPath_s
call fcn.14005b9a0
mov r9, rbx
lea r8, str.RtkAudUService
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
mov rcx, 0xffffffff80000002
call fcn.14007fd90
nop
lea rdx, [rbx - 0x18]
mov rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400ad3a0
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140048c62.0]
call fcn.1400be2d0
test eax, eax
je 0x1400ad46b
lea rax, [rsp + 0x40]
mov qword [rbp - 0x70], rax
call fcn.1400046f0
mov rcx, rax
test rax, rax
je 0x1400ad765
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140048c62.0]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.140003e50
test al, al
jne 0x1400ad40d
mov rax, rdi
inc rax
cmp word [r14 + rax*2], 0
jne 0x1400ad3f1
mov r8d, eax
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.1400040e0
nop
cmp word [0x14013c4a8], 0
jne 0x1400ad44d
mov word [0x14013c4a8], r13w
mov r8d, 0xfe
lea rdx, [0x14013c4aa]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
lea rcx, [0x14013c4a8]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
movsxd rcx, eax
mov word [rsi + rcx*2 + 0x13c4a8], r13w
lea rdx, [0x14013c4a8]
lea rcx, [rbp - 0x78]
call fcn.140003d80
nop
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.1400bd590
test r12d, r12d
jne 0x1400ad6f9
lea r12, str.AddRtkAudUServiceRunKey_at_FirstTime
xor r14d, r14d
test r15d, r15d
jne 0x1400ad5ce
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x68], r14
call fcn.1400046f0
mov rcx, rax
test rax, rax
je 0x1400ad770
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140048c62.0]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x30], SafeArrayUnaccessData
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x1400e3308]
lea rcx, [rsp + 0x68]
call fcn.1400064f0
lea r9, [rsp + 0x38]
mov r8, r12
mov rbx, qword [rsp + 0x68]
mov rdx, rbx
mov rcx, qword [0x14013c488]
call fcn.14007edf0
mov esi, r14d
test eax, eax
cmovne esi, dword [rsp + 0x38]
mov dword [rsp + 0x30], r14d
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400ad52d
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140048c62.0]
cmp esi, 1
jne 0x1400ad5ce
mov qword [rsp + 0x70], r14
call fcn.1400046f0
mov rcx, rax
test rax, rax
je 0x1400ad77b
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140048c62.0]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x30], 0x20
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x1400e3308]
lea rcx, [rsp + 0x70]
call fcn.1400064f0
mov r9d, esi
lea r8, str.AddRtkAudUServiceRunKey_RunKeyDisappear
mov rbx, qword [rsp + 0x70]
mov rdx, rbx
mov rcx, qword [0x14013c488]
call fcn.14007ef10
mov dword [rsp + 0x30], r14d
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, esi
jg 0x1400ad5ce
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140048c62.0]
call fcn.140081410
test eax, eax
jne 0x1400ad660
mov qword [rsp + 0x78], r14
call fcn.1400046f0
mov rcx, rax
test rax, rax
je 0x1400ad786
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140048c62.0]
add rax, 0x18
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x30], 0x40
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x1400e3308]
lea rcx, [rsp + 0x78]
call fcn.1400064f0
lea rax, str.AddRtkAudUServiceRunKey_but_NoEntry_at_FirstTime
lea r8, str.AddRtkAudUServiceRunKey_but_NoEntry
test r15d, r15d
cmovne r8, rax
mov r9d, 1
mov rbx, qword [rsp + 0x78]
mov rdx, rbx
mov rcx, qword [0x14013c488]
call fcn.14007ef10
nop
jmp 0x1400ad6d8
mov qword [rbp - 0x80], r14
call fcn.1400046f0
mov rcx, rax
test rax, rax
je 0x1400ad723
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140048c62.0]
add rax, 0x18
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x30], 0x80
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x1400e3308]
lea rcx, [rbp - 0x80]
call fcn.1400064f0
lea r8, str.AddRtkAudUServiceRunKey
test r15d, r15d
cmovne r8, r12
mov r9d, 1
mov rbx, qword [rbp - 0x80]
mov rdx, rbx
mov rcx, qword [0x14013c488]
call fcn.14007ef10
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400ad6f9
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140048c62.0]
mov rcx, qword [rbp + 0x17e0]
xor rcx, rsp
call fcn.1400c17f0
mov rbx, qword [rsp + 0x1940]
add rsp, 0x18f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140004820
nop
mov ecx, 0x80004005
call fcn.140004820
nop
mov ecx, 0x80004005
call fcn.140004820
nop
mov ecx, 0x80004005
call fcn.140004820
nop
mov ecx, 0x80004005
call fcn.140004820
nop
mov ecx, 0x80004005
call fcn.140004820
int3
mov ecx, 0x80004005
call fcn.140004820
nop
mov ecx, 0x80004005
call fcn.140004820
nop
mov ecx, 0x80004005
call fcn.140004820
nop
mov ecx, 0x80004005
call fcn.140004820
int3