Function at 0x1400c0400
Capabilities:
Persist via run registry key

Disassembly:
push rdi
mov eax, 0x18a0
call fcn.1400f9a10
sub rsp, rax
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x18c0], rbx
mov qword [rsp + 0x18c8], rsi
mov rax, qword [0x1401a4010]
xor rax, rsp
mov qword [rsp + 0x1890], rax
mov edi, edx
mov rbx, rcx
call fcn.14000b810
test dword [rax + 0x138], 0x800000
je 0x1400c05f7
test edi, edi
jne 0x1400c0465
call fcn.1400c0210
test eax, eax
jne 0x1400c077d
lea r8, [0x140119b08]
mov edx, 0x208
lea rcx, [rsp + 0x480]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str.RtkAudUService64_BG
mov edx, 0x104
lea rcx, [rsp + 0x270]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [0x140139310]
mov edx, 0x800
lea rcx, [rsp + 0x890]
call fcn.14002c4e0
mov dword [rsp + 0x48], 0
call fcn.14000b810
test dword [rax + 0xc0], 0x20000000
je 0x1400c04da
call fcn.14000b810
movzx r8d, byte [rax + 0x1f3]
jmp 0x1400c04e0
mov r8d, 0x1e
lea r9, str._background
lea rcx, str.RtkAudUService64_BG
call fcn.1400530d0
mov dword [rsp + 0x48], eax
lea r9, str.RtkAudUService64_BG
lea r8, str.RunCplByTaskScheduler__s
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14002c4e0
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x60]
call fcn.140052b40
lea rsi, str.SetScheduler_at_FirstTime
test edi, edi
jne 0x1400c0569
xor r9d, r9d
mov r8, rsi
lea rdx, str.DebugLog
lea rcx, [0x1401aef30]
call fcn.140005c30
cmp eax, 1
jne 0x1400c0569
mov r9d, eax
lea r8, str.SetScheduler_EntryDisappear
lea rdx, str.DebugLog
lea rcx, [0x1401aef30]
call fcn.140005d10
call fcn.1400c0210
mov r9d, 1
lea rdx, str.DebugLog
lea rcx, [0x1401aef30]
test eax, eax
jne 0x1400c05a1
lea rax, str.AlreadySetScheduler_but_NoEntry_at_FirstTime
lea r8, str.AlreadySetScheduler_but_NoEntry
test edi, edi
cmovne r8, rax
call fcn.140005d10
jmp 0x1400c05d0
lea r8, str.SetScheduler
test edi, edi
cmovne r8, rsi
call fcn.140005d10
xor r9d, r9d
lea r8, str.RtkAudUService
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
mov rcx, 0xffffffff80000002
call fcn.140086130
mov dword [rbx + 0x1b0], 1
call fcn.14000bb60
mov rcx, rax
mov edx, 0x400
mov r8d, 0x7918
call fcn.1400c8b50
jmp 0x1400c077d
call fcn.140088100
mov esi, eax
test eax, eax
je 0x1400c060a
test edi, edi
je 0x1400c06ea
call fcn.140005430
mov rcx, rax
test rax, rax
je 0x1400c07a2
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x50], rax
call fcn.140006b10
mov r8, rax
lea r9, str._background
lea rdx, [0x14011a020]
lea rcx, [rsp + 0x50]
call fcn.1400071a0
mov rbx, qword [rsp + 0x50]
mov r9, rbx
mov r8d, 0x26
lea rdx, str.CRegKeyMgr::AddRtkAudUServiceRunKey
lea rcx, str._s__d_szPath_s
call fcn.140065460
mov r9, rbx
lea r8, str.RtkAudUService
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
mov rcx, 0xffffffff80000002
call fcn.140086a70
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400c06a5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.1400d0690
test eax, eax
je 0x1400c06ea
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
lea rdx, str._background
lea rcx, [rsp + 0x30]
call fcn.140004ab0
mov rbx, rax
call fcn.140006b10
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140004ab0
nop
mov rdx, rbx
mov rcx, rax
call fcn.1400cf960
test esi, esi
jne 0x1400c077d
lea rbx, str.AddRtkAudUServiceRunKey_at_FirstTime
test edi, edi
jne 0x1400c0738
xor r9d, r9d
mov r8, rbx
lea rdx, str.DebugLog
lea rcx, [0x1401aef30]
call fcn.140005c30
cmp eax, 1
jne 0x1400c0738
mov r9d, eax
lea r8, str.AddRtkAudUServiceRunKey_RunKeyDisappear
lea rdx, str.DebugLog
lea rcx, [0x1401aef30]
call fcn.140005d10
call fcn.140088100
mov r9d, 1
lea rdx, str.DebugLog
lea rcx, [0x1401aef30]
test eax, eax
jne 0x1400c076b
lea rax, str.AddRtkAudUServiceRunKey_but_NoEntry_at_FirstTime
lea r8, str.AddRtkAudUServiceRunKey_but_NoEntry
test edi, edi
cmovne r8, rax
jmp 0x1400c0778
lea r8, str.AddRtkAudUServiceRunKey
test edi, edi
cmovne r8, rbx
call fcn.140005d10
mov rcx, qword [rsp + 0x1890]
xor rcx, rsp
call fcn.1400d37a0
lea r11, [rsp + 0x18a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, 0x80004005
call fcn.140005560
int3