Function at 0x1401c5300
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x90
mov qword [rsp + 0x78], 0xfffffffffffffffe
call fcn.1401e9268
mov rdx, rax
xor ebx, ebx
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
jne 0x1401c5338
mov ecx, 0x80004005
call fcn.140003c70
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xc8], rax
call fcn.1401e9268
mov rdx, rax
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
jne 0x1401c536c
mov ecx, 0x80004005
call fcn.140003c70
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
call fcn.1401e9268
mov rdx, rax
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
jne 0x1401c539d
mov ecx, 0x80004005
call fcn.140003c70
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xd8], rax
call fcn.1401e9d6c
test rax, rax
je 0x1401c53e7
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0xe8]
test rax, rax
je 0x1401c53e7
mov rbp, qword [rax + 0xc0]
test rbp, rbp
jne 0x1401c53de
mov rbp, rbx
jmp 0x1401c53ea
add dword [rbp + 0x1ab4], 1
jmp 0x1401c53ea
mov rbp, rbx
bt dword [rbp + 0xc], 0x14
jae 0x1401c5550
bt dword [rbp + 0x38], 9
jae 0x1401c54a8
xor eax, eax
or r12, 0xffffffffffffffff
mov rcx, r12
lea rdi, [0x140260b08]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x140260b08]
lea rcx, [rsp + 0xc8]
call fcn.140007720
call fcn.1401dc36c
movzx r9d, word [rbp + 0x53c]
mov r8d, 0x109a
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d0d70
xor r11d, r11d
lea rdi, [0x140260b08]
mov rsi, qword [rsp + 0xc8]
mov ecx, 1
repe cmpsw word [rsi], word [rdi]
je 0x1401c5474
sbb r11d, r11d
sbb r11d, r12d
test r11d, r11d
sete al
test al, al
je 0x1401c5809
call fcn.1401dc36c
mov r9w, 0x409
mov r8d, 0x109a
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d0d70
jmp 0x1401c5809
xor eax, eax
or r12, 0xffffffffffffffff
mov rcx, r12
lea rdi, [0x140260b08]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x140260b08]
lea rcx, [rsp + 0xc8]
call fcn.140007720
call fcn.1401dc36c
movzx r9d, word [rbp + 0x53c]
mov r8d, 0xcaf
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d0d70
xor r11d, r11d
lea rdi, [0x140260b08]
mov rsi, qword [rsp + 0xc8]
mov ecx, 1
repe cmpsw word [rsi], word [rdi]
je 0x1401c551c
sbb r11d, r11d
sbb r11d, r12d
test r11d, r11d
sete al
test al, al
je 0x1401c5809
call fcn.1401dc36c
mov r9w, 0x409
mov r8d, 0xcaf
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d0d70
jmp 0x1401c5809
bt dword [rbp + 0x10], 0xa
jae 0x1401c5603
xor eax, eax
or r12, 0xffffffffffffffff
mov rcx, r12
lea rdi, [0x140260b08]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x140260b08]
lea rcx, [rsp + 0xc8]
call fcn.140007720
call fcn.1401dc36c
movzx r9d, word [rbp + 0x53c]
mov r8d, 0xce7
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d0d70
xor r11d, r11d
lea rdi, [0x140260b08]
mov rsi, qword [rsp + 0xc8]
mov ecx, 1
repe cmpsw word [rsi], word [rdi]
je 0x1401c55cf
sbb r11d, r11d
sbb r11d, r12d
test r11d, r11d
sete al
test al, al
je 0x1401c5809
call fcn.1401dc36c
mov r9w, 0x409
mov r8d, 0xce7
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d0d70
jmp 0x1401c5809
mov eax, dword [rbp + 0x38]
bt eax, 0xb
jae 0x1401c56b8
xor eax, eax
or r12, 0xffffffffffffffff
mov rcx, r12
lea rdi, [0x140260b08]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x140260b08]
lea rcx, [rsp + 0xc8]
call fcn.140007720
call fcn.1401dc36c
movzx r9d, word [rbp + 0x53c]
mov r8d, 0x109b
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d0d70
xor r11d, r11d
lea rdi, [0x140260b08]
mov rsi, qword [rsp + 0xc8]
mov ecx, 1
repe cmpsw word [rsi], word [rdi]
je 0x1401c5684
sbb r11d, r11d
sbb r11d, r12d
test r11d, r11d
sete al
test al, al
je 0x1401c5809
call fcn.1401dc36c
mov r9w, 0x409
mov r8d, 0x109b
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d0d70
jmp 0x1401c5809
bt eax, 0x17
jae 0x1401c576a
xor eax, eax
or r12, 0xffffffffffffffff
mov rcx, r12
lea rdi, [0x140260b08]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x140260b08]
lea rcx, [rsp + 0xc8]
call fcn.140007720
call fcn.1401dc36c
movzx r9d, word [rbp + 0x53c]
mov r8d, 0x109a
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d0d70
xor r11d, r11d
lea rdi, [0x140260b08]
mov rsi, qword [rsp + 0xc8]
mov ecx, 1
repe cmpsw word [rsi], word [rdi]
je 0x1401c5736
sbb r11d, r11d
sbb r11d, r12d
test r11d, r11d
sete al
test al, al
je 0x1401c5809
call fcn.1401dc36c
mov r9w, 0x409
mov r8d, 0x109a
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d0d70
jmp 0x1401c5809
xor eax, eax
or r12, 0xffffffffffffffff
mov rcx, r12
lea rdi, [0x140260b08]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x140260b08]
lea rcx, [rsp + 0xc8]
call fcn.140007720
call fcn.1401dc36c
movzx r9d, word [rbp + 0x53c]
mov r8d, 0x93d
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d0d70
xor r11d, r11d
lea rdi, [0x140260b08]
mov rsi, qword [rsp + 0xc8]
mov ecx, 1
repe cmpsw word [rsi], word [rdi]
je 0x1401c57de
sbb r11d, r11d
sbb r11d, r12d
test r11d, r11d
sete al
test al, al
je 0x1401c5809
call fcn.1401dc36c
mov r9w, 0x409
mov r8d, 0x93d
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d0d70
mov rdi, qword [rsp + 0xc8]
mov r8, rdi
lea rdx, str.MicrosoftWindowsStart_MenuPrograms_s.lnk
lea rcx, [rsp + 0x68]
call fcn.140004020
mov r8, rdi
lea rdx, str._s.lnk
lea rcx, [rsp + 0xd8]
call fcn.140004020
add dword [rbp + 0x1ab4], 0xffffffff
jne 0x1401c5855
mov rax, qword [rbp]
mov edx, 1
mov rcx, rbp
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov qword [rsp + 0x58], rbx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SOFTWARERealtekAudioGUI_INFORMATION
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c58fd
mov rsi, qword [rsp + 0x58]
mov qword [rsp + 0x70], rsi
mov rdi, qword [rsp + 0xd8]
cmp dword [rdi - 8], 1
jle 0x1401c58b5
mov edx, dword [rdi - 0x10]
lea rcx, [rsp + 0xd8]
call fcn.140003cf0
mov rdi, qword [rsp + 0xd8]
mov eax, ebx
test rdi, rdi
setne al
test eax, eax
jne 0x1401c58cc
mov ecx, 0x80004005
call fcn.140003c70
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
lea rdx, str.ShortCutLnk
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1401c5954
mov qword [rsp + 0x60], rbx
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWARERealtekAudioGUI_INFORMATION
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, rbx
test eax, eax
cmove rcx, qword [rsp + 0x60]
mov qword [rsp + 0x70], rcx
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x80], rax
call fcn.1401e9268
mov rcx, rax
test rax, rax
setne bl
test ebx, ebx
jne 0x1401c5981
mov ecx, 0x80004005
call fcn.140003c70
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xd0], rax
lea rdx, str.Realtek.GUI.ToastMsg
test rdx, 0xffffffffffff0000
jne 0x1401c59c7
movzx edi, dx
mov ecx, edi
call fcn.1401eb134
test rax, rax
je 0x1401c59e7
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.1400074b0
jmp 0x1401c59e7
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0xd0]
call fcn.140007720
nop
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x88], rax
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x1401c5a20
cmp rax, qword [rdi - 0x18]
jne 0x1401c5a20
lea rsi, [rdi - 0x18]
lock add dword [rdi - 8], 1
jmp 0x1401c5a5e
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rsi, rax
test rax, rax
jne 0x1401c5a3c
call fcn.1400f0ca0
int3
mov eax, dword [rdi - 0x10]
mov dword [rsi + 8], eax
mov eax, dword [rdi - 0x10]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rsi + 0x18]
call fcn.140216220
lea rax, [rsi + 0x18]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x80], rax
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov rdx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x50]
call sub.ToastDll64.dll_bool___cdecl_TryCreateShortcut_wchar_t__const___ptr64__wchar_t__const___ptr64_
movzx esi, al
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1401c5abf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xd0]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1401c5ae4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1401c5af5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0xd8]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1401c5b1a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, r12d
lock xadd dword [rdi - 8], eax
add eax, 0xffffffff
test eax, eax
jg 0x1401c5b38
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xc8]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x1401c5b5c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, esi
add rsp, 0x90
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret