Function at 0x140148db0
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x38], 0xfffffffffffffffe
call fcn.140162c14
mov rcx, rax
test rax, rax
je 0x140149270
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x30], rax
call fcn.140162c14
mov rcx, rax
test rax, rax
je 0x14014927b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x40], rax
call fcn.140162c14
mov rcx, rax
test rax, rax
je 0x140149286
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x40], rax
call fcn.140164860
xor r14d, r14d
test rax, rax
je 0x140148e58
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0xe8]
test rax, rax
je 0x140148e58
mov rdi, qword [rax + 0x100]
test rdi, rdi
je 0x140148e58
inc dword [rdi + 0x1b78]
jmp 0x140148e5b
mov rdi, r14
mov rsi, 0xffffffffffffffff
test dword [rdi + 0xc], 0x100000
je 0x140148f5d
lea rdx, [0x140393240]
mov rax, rsi
test dword [rdi + 0x38], 0x200
je 0x140148ef0
inc rax
cmp word [rdx + rax*2], r14w
jne 0x140148e82
mov r8d, eax
lea rcx, [rbp + 0x30]
call fcn.140016ad0
call fcn.140155310
movzx r9d, word [rdi + 0x564]
mov r8d, 0x109a
mov rdx, qword [rax + 0x10]
lea rcx, [rbp + 0x30]
call fcn.14009b190
mov rax, qword [rbp + 0x30]
movzx ecx, word [rax]
cmp cx, word [0x140393240]
jne 0x140149009
call fcn.140155310
mov r9d, 0x409
mov r8d, 0x109a
mov rdx, qword [rax + 0x10]
lea rcx, [rbp + 0x30]
call fcn.14009b190
jmp 0x140149009
inc rax
cmp word [rdx + rax*2], r14w
jne 0x140148ef0
mov r8d, eax
lea rcx, [rbp + 0x30]
call fcn.140016ad0
call fcn.140155310
movzx r9d, word [rdi + 0x564]
mov r8d, 0xcaf
mov rdx, qword [rax + 0x10]
lea rcx, [rbp + 0x30]
call fcn.14009b190
mov rax, qword [rbp + 0x30]
movzx ecx, word [rax]
cmp cx, word [0x140393240]
jne 0x140149009
call fcn.140155310
mov r9d, 0x409
mov r8d, 0xcaf
mov rdx, qword [rax + 0x10]
lea rcx, [rbp + 0x30]
call fcn.14009b190
jmp 0x140149009
test dword [rdi + 0x10], 0x400
je 0x140148fd6
lea rdx, [0x140393240]
mov rax, rsi
inc rax
cmp word [rdx + rax*2], r14w
jne 0x140148f70
mov r8d, eax
lea rcx, [rbp + 0x30]
call fcn.140016ad0
call fcn.140155310
movzx r9d, word [rdi + 0x564]
mov r8d, 0xce7
mov rdx, qword [rax + 0x10]
lea rcx, [rbp + 0x30]
call fcn.14009b190
mov rax, qword [rbp + 0x30]
movzx ecx, word [rax]
cmp cx, word [0x140393240]
jne 0x140149009
call fcn.140155310
mov r9d, 0x409
mov r8d, 0xce7
mov rdx, qword [rax + 0x10]
lea rcx, [rbp + 0x30]
call fcn.14009b190
jmp 0x140149009
mov eax, dword [rdi + 0x38]
bt eax, 0xb
jae 0x140148fe7
mov r8d, 0x109b
jmp 0x140148ff9
bt eax, 0x17
mov r8d, 0x109a
jb 0x140148ff9
mov r8d, 0x93d
lea rdx, [rbp + 0x30]
lea rcx, [rdi + 0x558]
call fcn.1400a4220
mov r8, qword [rbp + 0x30]
lea rdx, str.MicrosoftWindowsStart_MenuPrograms_s.lnk
lea rcx, [rbp - 0x40]
call fcn.140012720
mov r8, qword [rbp + 0x30]
lea rdx, str._s.lnk
lea rcx, [rbp + 0x40]
call fcn.140012720
add dword [rdi + 0x1b78], 0xffffffff
jne 0x140149048
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rbp - 0x20], r14
mov dword [rbp - 0x18], r14d
mov qword [rbp - 0x10], r14
mov r9d, 0x2001f
lea r8, str.SOFTWARERealtekAudioGUI_INFORMATION
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x20]
call fcn.140024490
test eax, eax
jne 0x1401490d7
mov rax, qword [rbp + 0x40]
cmp dword [rax - 8], 1
jle 0x14014908f
mov edx, dword [rax - 0x10]
lea rcx, [rbp + 0x40]
call fcn.1400124b0
mov rax, qword [rbp + 0x40]
test rax, rax
je 0x140149108
mov rcx, rsi
nop word [rax + rax]
lea rcx, [rcx + 1]
cmp word [rax + rcx*2], 0
jne 0x1401490a0
lea ecx, [rcx*2 + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.ShortCutLnk
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x140149108
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, str.SOFTWARERealtekAudioGUI_INFORMATION
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x20]
call fcn.14002e590
lea rax, [rbp + 0x38]
mov qword [rbp - 0x30], rax
call fcn.140162c14
mov rcx, rax
test rax, rax
je 0x140149265
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x38], rax
lea rbx, str.Realtek.GUI.ToastMsg
mov rdx, rbx
lea rcx, [rbp + 0x38]
call fcn.1400168b0
test al, al
jne 0x14014916a
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140149150
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x38]
call fcn.140016ad0
nop
lea rax, [rbp + 0x38]
mov qword [rbp - 0x28], rax
mov rbx, qword [rbp - 0x40]
lea rcx, [rbx - 0x18]
call fcn.140012250
add rax, 0x18
mov qword [rbp + 0x48], rax
lea rax, [rbp + 0x48]
mov qword [rbp - 0x30], rax
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov rdx, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ToastDll64.dll_bool___cdecl_TryCreateShortcut_wchar_t__const___ptr64__wchar_t__const___ptr64_]
movzx edi, al
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401491d2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401491f0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140149200
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14014921e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, esi
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x140149239
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140149255
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, edi
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.140012800
nop
mov ecx, 0x80004005
call fcn.140012800
nop
mov ecx, 0x80004005
call fcn.140012800
nop
mov ecx, 0x80004005
call fcn.140012800
int3