Function at 0x140091a90
Capabilities:
Persist via run registry key

Disassembly:
push rbp
push rdi
push r14
lea rbp, [rsp - 0x15a0]
mov eax, 0x16a0
call fcn.1400ad030
sub rsp, rax
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x16d0], rbx
mov qword [rsp + 0x16d8], rsi
mov rax, qword [0x14011f010]
xor rax, rsp
mov qword [rbp + 0x1590], rax
mov esi, edx
mov rbx, rcx
call fcn.14000ac00
test dword [rax + 0xc0], 0x800000
je 0x140091cb2
test esi, esi
jne 0x140091b18
mov dword [rsp + 0x48], 1
lea r8, [rsp + 0x48]
lea edx, [rsi + 1]
lea rcx, str.schtasks__TN_RtkAudUService64_BG
call fcn.140043510
cmp dword [rsp + 0x48], esi
je 0x140091e7f
xor ecx, ecx
lea rdx, [0x1400c4360]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx + rdx]
mov word [rbp + rcx + 0x170], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140091b30
xor ecx, ecx
lea r14, str.RtkAudUService64_BG
nop
movzx eax, word [rcx + r14]
mov word [rbp + rcx + 0x380], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140091b50
lea r8, [0x1400d8250]
mov edx, 0x800
lea rcx, [rbp + 0x590]
call fcn.140023560
mov dword [rsp + 0x4c], 0
call fcn.14000ac00
test dword [rax + 0x48], 0x20000000
je 0x140091ba3
call fcn.14000ac00
movzx r8d, byte [rax + 0x17b]
jmp 0x140091ba9
mov r8d, 0x1e
lea r9, str._background
mov rcx, r14
call fcn.1400430b0
mov dword [rsp + 0x4c], eax
mov r9, r14
lea r8, str.RunCplByTaskScheduler__s
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.140023560
lea r8, [rsp + 0x4c]
lea rdx, [rsp + 0x60]
call fcn.140042b30
lea rdi, str.SetScheduler_at_FirstTime
test esi, esi
jne 0x140091c2a
xor r9d, r9d
mov r8, rdi
lea rdx, str.DebugLog
lea rcx, [0x1401267f0]
call fcn.140004da0
cmp eax, 1
jne 0x140091c2a
mov r9d, eax
lea r8, str.SetScheduler_EntryDisappear
lea rdx, str.DebugLog
lea rcx, [0x1401267f0]
call fcn.140004e80
mov dword [rsp + 0x50], 1
lea r8, [rsp + 0x50]
mov edx, 1
lea rcx, str.schtasks__TN_RtkAudUService64_BG
call fcn.140043510
mov r9d, 1
lea rdx, str.DebugLog
lea rcx, [0x1401267f0]
cmp dword [rsp + 0x50], 0
je 0x140091c79
lea rax, str.AlreadySetScheduler_but_NoEntry_at_FirstTime
lea r8, str.AlreadySetScheduler_but_NoEntry
test esi, esi
cmovne r8, rax
jmp 0x140091c86
lea r8, str.SetScheduler
test esi, esi
cmovne r8, rdi
call fcn.140004e80
mov dword [rbx + 0x1b4], 1
call fcn.14000af30
mov rcx, rax
mov edx, 0x400
mov r8d, 0x7918
call fcn.1400989d0
jmp 0x140091e7f
call fcn.14006cd20
mov r14d, eax
test eax, eax
je 0x140091cc6
test esi, esi
je 0x140091deb
call fcn.140004540
mov rcx, rax
test rax, rax
je 0x140091eb1
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x58], rax
call fcn.140005f30
mov r8, rax
lea rdi, str._background
mov r9, rdi
lea rdx, str._s__s
lea rcx, [rsp + 0x58]
call fcn.140006190
mov rbx, qword [rsp + 0x58]
mov r9, rbx
mov r8d, 0x23
lea rdx, str.CRegKeyMgr::AddRtkAudUServiceRunKey
lea rcx, str._s__d_szPath_s
call fcn.14004c3d0
mov r9, rbx
lea r8, str.RtkAudUService
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
mov rcx, 0xffffffff80000002
call fcn.14006b650
nop
lea rdx, [rbx - 0x18]
mov rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140091d68
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.1400a1630
test eax, eax
je 0x140091deb
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], rax
call fcn.140004540
mov rcx, rax
test rax, rax
je 0x140091ea6
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140003d00
test al, al
jne 0x140091dcb
nop dword [rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140091db0
mov r8d, ebx
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140003f80
nop
call fcn.140005f30
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140003bc0
nop
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1400a0900
test r14d, r14d
jne 0x140091e7f
lea rbx, str.AddRtkAudUServiceRunKey_at_FirstTime
test esi, esi
jne 0x140091e3a
xor r9d, r9d
mov r8, rbx
lea rdx, str.DebugLog
lea rcx, [0x1401267f0]
call fcn.140004da0
cmp eax, 1
jne 0x140091e3a
mov r9d, eax
lea r8, str.AddRtkAudUServiceRunKey_RunKeyDisappear
lea rdx, str.DebugLog
lea rcx, [0x1401267f0]
call fcn.140004e80
call fcn.14006cd20
mov r9d, 1
lea rdx, str.DebugLog
lea rcx, [0x1401267f0]
test eax, eax
jne 0x140091e6d
lea rax, str.AddRtkAudUServiceRunKey_but_NoEntry_at_FirstTime
lea r8, str.AddRtkAudUServiceRunKey_but_NoEntry
test esi, esi
cmovne r8, rax
jmp 0x140091e7a
lea r8, str.AddRtkAudUServiceRunKey
test esi, esi
cmovne r8, rbx
call fcn.140004e80
mov rcx, qword [rbp + 0x1590]
xor rcx, rsp
call fcn.1400a4020
lea r11, [rsp + 0x16a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140004670
int3
mov ecx, 0x80004005
call fcn.140004670
int3