Function at 0x1400ca360
Capabilities:
Persist via run registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17f0]
mov eax, 0x18f0
call fcn.1400e8ab0
sub rsp, rax
mov rax, qword [0x140178010]
xor rax, rsp
mov qword [rbp + 0x17e0], rax
mov r14d, edx
mov r15, rcx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
call fcn.14000bb10
test dword [rax + 0x138], 0x800000
je 0x1400ca72f
test r14d, r14d
jne 0x1400ca3cb
call fcn.1400ca120
test eax, eax
jne 0x1400cab98
lea r8, [0x140103060]
mov edx, 0x208
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str.RtkAudUService64_BG
mov edx, 0x104
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov edx, 0x800
lea rcx, [rbp + 0x7e0]
call fcn.14002f3c0
call fcn.14000bb10
test dword [rax + 0xc0], 0x20000000
je 0x1400ca435
call fcn.14000bb10
movzx r8d, byte [rax + 0x1f3]
jmp 0x1400ca43b
mov r8d, 0x1e
lea r9, str._background
lea rcx, str.RtkAudUService64_BG
call fcn.14005b020
mov dword [rbp - 0x60], eax
lea r9, str.RtkAudUService64_BG
lea r8, str.RunCplByTaskScheduler__s
mov edx, 0x104
lea rcx, [rbp - 0x50]
call fcn.14002f3c0
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x50]
call fcn.14005aa80
lea r13, str.SetScheduler_at_FirstTime
mov rdi, 0xffffffffffffffff
test r14d, r14d
jne 0x1400ca5d8
mov dword [rsp + 0x34], r12d
mov qword [rsp + 0x48], r12
call fcn.140004e00
mov rcx, rax
test rax, rax
je 0x1400cabcd
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140050923.0]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x30], 1
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x140102b58]
lea rcx, [rsp + 0x48]
call fcn.140006d30
lea r9, [rsp + 0x34]
mov r8, r13
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
mov rcx, qword [0x140178498]
call fcn.1400902e0
mov esi, r12d
test eax, eax
cmovne esi, dword [rsp + 0x34]
mov dword [rsp + 0x30], r12d
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400ca537
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140050923.0]
cmp esi, 1
jne 0x1400ca5d8
mov qword [rsp + 0x50], r12
call fcn.140004e00
mov rcx, rax
test rax, rax
je 0x1400cabd8
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140050923.0]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x30], 2
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x140102b58]
lea rcx, [rsp + 0x50]
call fcn.140006d30
mov r9d, esi
lea r8, str.SetScheduler_EntryDisappear
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
mov rcx, qword [0x140178498]
call fcn.140090400
mov dword [rsp + 0x30], r12d
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, esi
jg 0x1400ca5d8
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140050923.0]
call fcn.1400ca120
test eax, eax
jne 0x1400ca66a
mov qword [rsp + 0x58], r12
call fcn.140004e00
mov rcx, rax
test rax, rax
je 0x1400cabe3
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140050923.0]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x30], 4
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x140102b58]
lea rcx, [rsp + 0x58]
call fcn.140006d30
lea rax, str.AlreadySetScheduler_but_NoEntry_at_FirstTime
lea r8, str.AlreadySetScheduler_but_NoEntry
test r14d, r14d
cmovne r8, rax
mov r9d, 1
mov rbx, qword [rsp + 0x58]
mov rdx, rbx
mov rcx, qword [0x140178498]
call fcn.140090400
nop
jmp 0x1400ca6e6
mov qword [rsp + 0x60], r12
call fcn.140004e00
mov rcx, rax
test rax, rax
je 0x1400cabee
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140050923.0]
add rax, 0x18
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x30], 8
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x140102b58]
lea rcx, [rsp + 0x60]
call fcn.140006d30
lea r8, str.SetScheduler
test r14d, r14d
cmovne r8, r13
mov r9d, 1
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, qword [0x140178498]
call fcn.140090400
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400ca707
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140050923.0]
mov dword [r15 + 0x1b0], 1
call fcn.14000be90
mov rcx, rax
mov edx, 0x400
mov r8d, 0x7918
call fcn.1400d3e30
jmp 0x1400cab98
call fcn.1400928f0
mov r15d, eax
test eax, eax
je 0x1400ca744
test r14d, r14d
je 0x1400cab98
call fcn.140004e00
mov rcx, rax
test rax, rax
je 0x1400cabf9
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140050923.0]
add rax, 0x18
mov qword [rbp - 0x58], rax
mov r13d, 0x22
lea rbx, [0x140178490]
cmp word [0x1401784b8], 0
jne 0x1400ca7b4
mov word [0x1401784b8], r13w
mov r8d, 0xfe
lea rdx, [0x1401784ba]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
lea rcx, [0x1401784b8]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
movsxd rcx, eax
mov word [rbx + rcx*2 + 0x28], r13w
lea rsi, str._background
mov r9, rsi
lea r8, [0x1401784b8]
lea rdx, str._s__s
lea rcx, [rbp - 0x58]
call fcn.140006d30
mov rbx, qword [rbp - 0x58]
mov r9, rbx
mov r8d, 0x26
lea rdx, str.CRegKeyMgr::AddRtkAudUServiceRunKey
lea rcx, str._s__d_szPath_s
call fcn.14006dd20
mov r9, rbx
lea r8, str.RtkAudUService
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
mov rcx, 0xffffffff80000002
call fcn.140091240
nop
lea rdx, [rbx - 0x18]
mov rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400ca83d
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140050923.0]
call fcn.1400dbe80
test eax, eax
je 0x1400ca90d
lea rax, [rsp + 0x40]
mov qword [rbp - 0x70], rax
call fcn.140004e00
mov rcx, rax
test rax, rax
je 0x1400cac04
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140050923.0]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.140004560
test al, al
jne 0x1400ca8ab
mov rax, rdi
nop
inc rax
cmp word [rsi + rax*2], 0
jne 0x1400ca890
mov r8d, eax
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.1400047f0
nop
cmp word [0x1401784b8], 0
jne 0x1400ca8ef
mov word [0x1401784b8], r13w
mov r8d, 0xfe
lea rdx, [0x1401784ba]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
lea rcx, [0x1401784b8]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
movsxd rcx, eax
lea rax, [0x140178490]
mov word [rax + rcx*2 + 0x28], r13w
lea rdx, [0x1401784b8]
lea rcx, [rbp - 0x78]
call fcn.140004490
nop
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.1400db140
test r15d, r15d
jne 0x1400cab98
lea r15, str.AddRtkAudUServiceRunKey_at_FirstTime
test r14d, r14d
jne 0x1400caa6d
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x68], r12
call fcn.140004e00
mov rcx, rax
test rax, rax
je 0x1400cac0f
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140050923.0]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x30], SafeArrayUnaccessData
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x140102b58]
lea rcx, [rsp + 0x68]
call fcn.140006d30
lea r9, [rsp + 0x38]
mov r8, r15
mov rbx, qword [rsp + 0x68]
mov rdx, rbx
mov rcx, qword [0x140178498]
call fcn.1400902e0
mov esi, r12d
test eax, eax
cmovne esi, dword [rsp + 0x38]
mov dword [rsp + 0x30], r12d
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400ca9cc
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140050923.0]
cmp esi, 1
jne 0x1400caa6d
mov qword [rsp + 0x70], r12
call fcn.140004e00
mov rcx, rax
test rax, rax
je 0x1400cac1a
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140050923.0]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x30], 0x20
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x140102b58]
lea rcx, [rsp + 0x70]
call fcn.140006d30
mov r9d, esi
lea r8, str.AddRtkAudUServiceRunKey_RunKeyDisappear
mov rbx, qword [rsp + 0x70]
mov rdx, rbx
mov rcx, qword [0x140178498]
call fcn.140090400
mov dword [rsp + 0x30], r12d
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, esi
jg 0x1400caa6d
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140050923.0]
call fcn.1400928f0
test eax, eax
jne 0x1400caaff
mov qword [rsp + 0x78], r12
call fcn.140004e00
mov rcx, rax
test rax, rax
je 0x1400cac25
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140050923.0]
add rax, 0x18
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x30], 0x40
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x140102b58]
lea rcx, [rsp + 0x78]
call fcn.140006d30
lea rax, str.AddRtkAudUServiceRunKey_but_NoEntry_at_FirstTime
lea r8, str.AddRtkAudUServiceRunKey_but_NoEntry
test r14d, r14d
cmovne r8, rax
mov r9d, 1
mov rbx, qword [rsp + 0x78]
mov rdx, rbx
mov rcx, qword [0x140178498]
call fcn.140090400
nop
jmp 0x1400cab77
mov qword [rbp - 0x80], r12
call fcn.140004e00
mov rcx, rax
test rax, rax
je 0x1400cabc2
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140050923.0]
add rax, 0x18
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x30], 0x80
lea r9, str.DebugLog
lea r8, str.SoftwareRealtekAudioRtkAudUService
lea rdx, [0x140102b58]
lea rcx, [rbp - 0x80]
call fcn.140006d30
lea r8, str.AddRtkAudUServiceRunKey
test r14d, r14d
cmovne r8, r15
mov r9d, 1
mov rbx, qword [rbp - 0x80]
mov rdx, rbx
mov rcx, qword [0x140178498]
call fcn.140090400
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400cab98
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140050923.0]
mov rcx, qword [rbp + 0x17e0]
xor rcx, rsp
call fcn.1400df340
mov rbx, qword [rsp + 0x1940]
add rsp, 0x18f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140004f30
nop
mov ecx, 0x80004005
call fcn.140004f30
nop
mov ecx, 0x80004005
call fcn.140004f30
nop
mov ecx, 0x80004005
call fcn.140004f30
nop
mov ecx, 0x80004005
call fcn.140004f30
nop
mov ecx, 0x80004005
call fcn.140004f30
int3
mov ecx, 0x80004005
call fcn.140004f30
nop
mov ecx, 0x80004005
call fcn.140004f30
nop
mov ecx, 0x80004005
call fcn.140004f30
nop
mov ecx, 0x80004005
call fcn.140004f30
int3