Function at 0x1400d9420
Capabilities:
Persist via run registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17f0]
mov eax, 0x18f0
call fcn.1400fdb80
sub rsp, rax
mov rax, qword [0x1401aa010]
xor rax, rsp
mov qword [rbp + 0x17e0], rax
mov r14d, edx
mov r15, rcx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
call fcn.140014310
test dword [rax + 0x138], 0x800000
je 0x1400d9834
test r14d, r14d
jne 0x1400d948b
call fcn.1400d91e0
test eax, eax
jne 0x1400d9c9b
lea r8, [0x14011c160]
mov edx, 0x208
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str.RtkAudUService64_BG
mov edx, 0x104
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov edx, 0x800
lea rcx, [rbp + 0x7e0]
call fcn.140039da0
call fcn.140014310
test dword [rax + 0xc0], 0x20000000
je 0x1400d94f5
call fcn.140014310
movzx r8d, byte [rax + 0x1f3]
jmp 0x1400d94fb
mov r8d, 0x1e
lea r9, str._background
lea rcx, str.RtkAudUService64_BG
call fcn.1400696d0
mov dword [rbp - 0x60], eax
lea r9, str.RtkAudUService64_BG
lea r8, str.RunCplByTaskScheduler__s
mov edx, 0x104
lea rcx, [rbp - 0x50]
call fcn.140039da0
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x50]
call fcn.140069130
lea r13, str.SetScheduler_at_FirstTime
mov rdi, 0xffffffffffffffff
test r14d, r14d
jne 0x1400d9698
mov dword [rsp + 0x34], r12d
mov qword [rsp + 0x48], r12
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x1400d9cd0
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x30], 1
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x14011bc58]
lea rcx, [rsp + 0x48]
call fcn.14000ec90
lea r9, [rsp + 0x34]
mov r8, r13
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
mov rcx, qword [0x1401aa498]
call fcn.1400985d0
mov esi, r12d
test eax, eax
cmovne esi, dword [rsp + 0x34]
mov dword [rsp + 0x30], r12d
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d95f7
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14005eeb3.0]
cmp esi, 1
jne 0x1400d9698
mov qword [rsp + 0x50], r12
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x1400d9cdb
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x30], 2
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x14011bc58]
lea rcx, [rsp + 0x50]
call fcn.14000ec90
mov r9d, esi
lea r8, str.SetScheduler_EntryDisappear
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
mov rcx, qword [0x1401aa498]
call fcn.1400986f0
mov dword [rsp + 0x30], r12d
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, esi
jg 0x1400d9698
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14005eeb3.0]
call fcn.1400d91e0
test eax, eax
jne 0x1400d9752
mov qword [rsp + 0x58], r12
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x1400d9ce6
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x30], 4
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x14011bc58]
lea rcx, [rsp + 0x58]
call fcn.14000ec90
lea rax, str.AlreadySetScheduler_but_NoEntry_at_FirstTime
lea r8, str.AlreadySetScheduler_but_NoEntry
test r14d, r14d
cmovne r8, rax
mov r9d, 1
mov rbx, qword [rsp + 0x58]
mov rdx, rbx
mov rcx, qword [0x1401aa498]
call fcn.1400986f0
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400d980c
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14005eeb3.0]
jmp 0x1400d980c
mov qword [rsp + 0x60], r12
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x1400d9cf1
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x30], 8
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x14011bc58]
lea rcx, [rsp + 0x60]
call fcn.14000ec90
lea r8, str.SetScheduler
test r14d, r14d
cmovne r8, r13
mov r9d, 1
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, qword [0x1401aa498]
call fcn.1400986f0
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400d97ef
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14005eeb3.0]
xor r9d, r9d
lea r8, str.RtkAudUService
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
mov rcx, 0xffffffff80000002
call fcn.140098bd0
mov dword [r15 + 0x1b8], 1
call fcn.1400147e0
mov rcx, rax
mov edx, 0x400
mov r8d, 0x7918
call fcn.1400e8700
jmp 0x1400d9c9b
call fcn.14009abe0
mov r15d, eax
test eax, eax
je 0x1400d9849
test r14d, r14d
je 0x1400d9c9b
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x1400d9cfc
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rbp - 0x58], rax
mov r13d, 0x22
lea rbx, [0x1401aa490]
cmp word [0x1401aa4b8], 0
jne 0x1400d98b9
mov word [0x1401aa4b8], r13w
mov r8d, 0xfe
lea rdx, [0x1401aa4ba]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
lea rcx, [0x1401aa4b8]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
movsxd rcx, eax
mov word [rbx + rcx*2 + 0x28], r13w
lea rsi, str._background
mov r9, rsi
lea r8, [0x1401aa4b8]
lea rdx, [0x14011beb0]
lea rcx, [rbp - 0x58]
call fcn.14000ec90
mov rbx, qword [rbp - 0x58]
mov r9, rbx
mov r8d, 0x26
lea rdx, str.CRegKeyMgr::AddRtkAudUServiceRunKey
lea rcx, str._s__d_szPath_s
call fcn.140075db0
mov r9, rbx
lea r8, str.RtkAudUService
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
mov rcx, 0xffffffff80000002
call fcn.140099530
nop
lea rdx, [rbx - 0x18]
mov rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d9942
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14005eeb3.0]
call fcn.1400f0f50
test eax, eax
je 0x1400d9a10
lea rax, [rsp + 0x40]
mov qword [rbp - 0x70], rax
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x1400d9d07
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.14000c4c0
test al, al
jne 0x1400d99ae
mov rax, rdi
inc rax
cmp word [rsi + rax*2], 0
jne 0x1400d9993
mov r8d, eax
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.14000c750
nop
cmp word [0x1401aa4b8], 0
jne 0x1400d99f2
mov word [0x1401aa4b8], r13w
mov r8d, 0xfe
lea rdx, [0x1401aa4ba]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
lea rcx, [0x1401aa4b8]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
movsxd rcx, eax
lea rax, [0x1401aa490]
mov word [rax + rcx*2 + 0x28], r13w
lea rdx, [0x1401aa4b8]
lea rcx, [rbp - 0x78]
call fcn.14000c3f0
nop
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.1400efc20
test r15d, r15d
jne 0x1400d9c9b
lea r15, str.AddRtkAudUServiceRunKey_at_FirstTime
test r14d, r14d
jne 0x1400d9b70
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x68], r12
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x1400d9d12
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x30], SafeArrayUnaccessData
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x14011bc58]
lea rcx, [rsp + 0x68]
call fcn.14000ec90
lea r9, [rsp + 0x38]
mov r8, r15
mov rbx, qword [rsp + 0x68]
mov rdx, rbx
mov rcx, qword [0x1401aa498]
call fcn.1400985d0
mov esi, r12d
test eax, eax
cmovne esi, dword [rsp + 0x38]
mov dword [rsp + 0x30], r12d
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400d9acf
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14005eeb3.0]
cmp esi, 1
jne 0x1400d9b70
mov qword [rsp + 0x70], r12
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x1400d9d1d
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x30], 0x20
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x14011bc58]
lea rcx, [rsp + 0x70]
call fcn.14000ec90
mov r9d, esi
lea r8, str.AddRtkAudUServiceRunKey_RunKeyDisappear
mov rbx, qword [rsp + 0x70]
mov rdx, rbx
mov rcx, qword [0x1401aa498]
call fcn.1400986f0
mov dword [rsp + 0x30], r12d
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, esi
jg 0x1400d9b70
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14005eeb3.0]
call fcn.14009abe0
test eax, eax
jne 0x1400d9c02
mov qword [rsp + 0x78], r12
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x1400d9d28
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x30], 0x40
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x14011bc58]
lea rcx, [rsp + 0x78]
call fcn.14000ec90
lea rax, str.AddRtkAudUServiceRunKey_but_NoEntry_at_FirstTime
lea r8, str.AddRtkAudUServiceRunKey_but_NoEntry
test r14d, r14d
cmovne r8, rax
mov r9d, 1
mov rbx, qword [rsp + 0x78]
mov rdx, rbx
mov rcx, qword [0x1401aa498]
call fcn.1400986f0
nop
jmp 0x1400d9c7a
mov qword [rbp - 0x80], r12
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x1400d9cc5
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x30], 0x80
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x14011bc58]
lea rcx, [rbp - 0x80]
call fcn.14000ec90
lea r8, str.AddRtkAudUServiceRunKey
test r14d, r14d
cmovne r8, r15
mov r9d, 1
mov rbx, qword [rbp - 0x80]
mov rdx, rbx
mov rcx, qword [0x1401aa498]
call fcn.1400986f0
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400d9c9b
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14005eeb3.0]
mov rcx, qword [rbp + 0x17e0]
xor rcx, rsp
call fcn.1400f4410
mov rbx, qword [rsp + 0x1940]
add rsp, 0x18f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000ce90
nop
mov ecx, 0x80004005
call fcn.14000ce90
nop
mov ecx, 0x80004005
call fcn.14000ce90
nop
mov ecx, 0x80004005
call fcn.14000ce90
nop
mov ecx, 0x80004005
call fcn.14000ce90
nop
mov ecx, 0x80004005
call fcn.14000ce90
int3
mov ecx, 0x80004005
call fcn.14000ce90
nop
mov ecx, 0x80004005
call fcn.14000ce90
nop
mov ecx, 0x80004005
call fcn.14000ce90
nop
mov ecx, 0x80004005
call fcn.14000ce90
int3