Function at 0x140013820
Capabilities:
Set registry value
Shutdown system

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xa8
mov qword [rbp - 0x11], 0xfffffffffffffffe
mov rax, qword [0x1403d88e8]
xor rax, rsp
mov qword [rbp + 7], rax
mov r13d, r9d
mov r14d, r8d
mov edi, edx
mov rbx, rcx
xor esi, esi
mov r15d, esi
mov r12d, edx
and r12d, 0xffffff00
mov dword [rbp - 0x21], r12d
mov edx, 0x1f31d
mov ecx, r12d
call fcn.1402a7070
mov qword [rbp - 0x49], rax
shr rax, 0x20
imul ecx, eax, 0x41a7
imul eax, dword [rbp - 0x49], 0xb14
sub ecx, eax
jns 0x140013899
add ecx, 0x7fffffff
xor edx, edx
mov eax, ecx
div dword [rbx + 0x68]
mov r8d, edx
mov rdx, qword [rbx + 0x60]
test rdx, rdx
je 0x1400138d0
mov rax, qword [rdx + r8*8]
test rax, rax
je 0x1400138d0
cmp dword [rax + 0x18], ecx
jne 0x1400138bf
cmp dword [rax], r12d
je 0x1400138c5
mov rax, qword [rax + 0x10]
jmp 0x1400138b0
test rax, rax
je 0x1400138d6
mov r15, qword [rax + 8]
jmp 0x1400138d3
mov rax, rsi
test rax, rax
cmove r15, rsi
test r15, r15
je 0x1400138f5
mov rax, qword [r15]
mov r9d, r13d
mov r8d, r14d
mov edx, edi
mov rcx, r15
call qword [rax + 0x28]
jmp 0x140013d19
cmp edi, 0x23000211
ja 0x140013ac3
je 0x140013a75
sub edi, 0x23000109
je 0x140013a62
sub edi, 6
je 0x14001399e
cmp edi, 1
jne 0x140013d17
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x19]
lea edx, [rdi + 0x27]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140013d17
lea r8, [rbp - 5]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [rbp - 9], edi
mov ebx, 2
mov dword [rbp + 3], ebx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rbp - 9]
xor edx, edx
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140013d17
mov edx, 0x80020003
mov ecx, ebx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x140013d17
mov rax, qword [rbx + 0x90]
test rax, rax
jne 0x1400139b4
mov edx, 0x2e3
jmp 0x140013a39
test dword [rax + 0x1d0], 0x40000
je 0x140013a4c
mov rax, qword [rax + 0x1bd8]
test rax, rax
je 0x140013a34
mov rbx, rax
mov rax, qword [rax]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x1400139cb
cmp dword [rbx + 0x16c], esi
je 0x1400139cb
cmp dword [rbx + 0x170], esi
jne 0x1400139cb
cmp dword [rbx + 0x1d8], 1
jne 0x1400139cb
mov rcx, rbx
call fcn.140019dc0
test eax, eax
je 0x140013a09
mov r9d, esi
jmp 0x140013a22
mov rcx, rbx
call fcn.140019b20
mov ebx, 2
mov r9d, 4
test eax, eax
cmovne r9d, ebx
test r14d, r14d
sete sil
lea edx, [r9 + rsi]
call fcn.140036570
jmp 0x140013a4c
mov edx, 0x2e8
lea r8, str.AudioCoreSetting.cpp
lea rcx, str._VCpl__RETURN_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
xor edx, edx
mov ecx, 0x2300010f
call fcn.1400271a0
mov eax, 1
jmp 0x140013d19
lea rcx, [rbx - 8]
call fcn.140012b60
mov eax, 1
jmp 0x140013d19
and dword [rbx + 0x60c], 0xfffffffe
and r14d, 1
or dword [rbx + 0x60c], r14d
mov rcx, qword [0x1403ff420]
test rcx, rcx
jne 0x140013ab0
lea r8, str.AudioObjectUI.cpp
mov edx, 0x9b
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
jmp 0x140013d17
mov rax, qword [rcx]
xor r8d, r8d
mov edx, 0x23000211
call qword [rax + 0x60]
jmp 0x140013d17
cmp edi, 0x23000217
ja 0x140013b48
je 0x140013b3e
sub edi, 0x23000212
je 0x140013b18
sub edi, 1
je 0x140013afd
cmp edi, 1
jne 0x140013d17
and dword [rbx + 0x60c], 0xfffffff7
and r14d, edi
shl r14d, 3
or dword [rbx + 0x60c], r14d
jmp 0x140013d17
and dword [rbx + 0x60c], 0xfffffffb
and r14d, 1
shl r14d, 2
or dword [rbx + 0x60c], r14d
jmp 0x140013d17
and dword [rbx + 0x60c], 0xfffffffd
and r14d, 1
add r14d, r14d
or dword [rbx + 0x60c], r14d
xor edx, edx
mov ecx, 0x23000212
call fcn.1400271a0
jmp 0x140013d17
mov edx, 0x23000211
jmp 0x140013cf4
sub edi, 0x23000218
je 0x140013cef
sub edi, 8
je 0x140013ce4
cmp edi, 0x3e3
jne 0x140013d17
mov qword [rbp - 0x41], rsi
mov dword [rbp - 0x39], esi
mov qword [rbp - 0x31], rsi
call fcn.1400f9930
mov rcx, rax
test rax, rax
je 0x140013d39
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x49], rax
lea rbx, str.SoftwareRealtekSBCoexist
mov rdx, rbx
lea rcx, [rbp - 0x49]
call fcn.140015a40
or rdi, 0xffffffffffffffff
test al, al
jne 0x140013bcb
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x140013bb1
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x49]
call fcn.1400105e0
nop
mov r9d, 0x20019
mov rbx, qword [rbp - 0x49]
mov r8, rbx
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x41]
call fcn.140015610
test eax, eax
jne 0x140013cb9
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x140013c03
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x41], rsi
mov dword [rbp - 0x39], esi
mov r9d, 0x20006
mov r8, rbx
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x41]
call fcn.140015610
test eax, eax
je 0x140013c6b
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8, rbx
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x41]
call fcn.1400153d0
test eax, eax
je 0x140013c6b
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x140013c66
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x41], rsi
mov dword [rbp - 0x39], esi
jmp 0x140013cb9
mov dword [rbp - 0x29], r14d
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.DisablePopUp
mov r14, qword [rbp - 0x41]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r15d, eax
test r14, r14
je 0x140013caf
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x41], rsi
mov dword [rbp - 0x39], esi
test r15d, r15d
sete sil
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140013cd1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x140013ce0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x140013d19
lea rcx, [rbx - 8]
call fcn.140012780
jmp 0x140013d19
mov edx, 0x23000212
mov rax, qword [rbx]
xor r9d, r9d
mov r8d, r14d
mov rcx, rbx
call qword [rax + 0x28]
mov rax, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x23000220
mov rcx, rbx
call qword [rax + 0x28]
xor eax, eax
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.14029d880
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000de90
int3