Function at 0x1401d63e0
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x90
mov qword [rsp + 0x78], 0xfffffffffffffffe
call fcn.1401fa4b0
mov rdx, rax
xor ebx, ebx
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
jne 0x1401d6418
mov ecx, 0x80004005
call fcn.140003d20
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xc8], rax
call fcn.1401fa4b0
mov rdx, rax
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
jne 0x1401d644c
mov ecx, 0x80004005
call fcn.140003d20
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
call fcn.1401fa4b0
mov rdx, rax
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
jne 0x1401d647d
mov ecx, 0x80004005
call fcn.140003d20
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xd8], rax
call fcn.1401fafc0
test rax, rax
je 0x1401d64c7
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0xe8]
test rax, rax
je 0x1401d64c7
mov rbp, qword [rax + 0xc0]
test rbp, rbp
jne 0x1401d64be
mov rbp, rbx
jmp 0x1401d64ca
add dword [rbp + 0x1ab4], 1
jmp 0x1401d64ca
mov rbp, rbx
bt dword [rbp + 0xc], 0x14
jae 0x1401d6630
bt dword [rbp + 0x38], 9
jae 0x1401d6588
xor eax, eax
or r12, 0xffffffffffffffff
mov rcx, r12
lea rdi, [0x140273028]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x140273028]
lea rcx, [rsp + 0xc8]
call fcn.140007880
call fcn.1401ed45c
movzx r9d, word [rbp + 0x53c]
mov r8d, 0x109a
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d62c0
xor r11d, r11d
lea rdi, [0x140273028]
mov rsi, qword [rsp + 0xc8]
mov ecx, 1
repe cmpsw word [rsi], word [rdi]
je 0x1401d6554
sbb r11d, r11d
sbb r11d, r12d
test r11d, r11d
sete al
test al, al
je 0x1401d68e9
call fcn.1401ed45c
mov r9w, 0x409
mov r8d, 0x109a
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d62c0
jmp 0x1401d68e9
xor eax, eax
or r12, 0xffffffffffffffff
mov rcx, r12
lea rdi, [0x140273028]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x140273028]
lea rcx, [rsp + 0xc8]
call fcn.140007880
call fcn.1401ed45c
movzx r9d, word [rbp + 0x53c]
mov r8d, 0xcaf
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d62c0
xor r11d, r11d
lea rdi, [0x140273028]
mov rsi, qword [rsp + 0xc8]
mov ecx, 1
repe cmpsw word [rsi], word [rdi]
je 0x1401d65fc
sbb r11d, r11d
sbb r11d, r12d
test r11d, r11d
sete al
test al, al
je 0x1401d68e9
call fcn.1401ed45c
mov r9w, 0x409
mov r8d, 0xcaf
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d62c0
jmp 0x1401d68e9
bt dword [rbp + 0x10], 0xa
jae 0x1401d66e3
xor eax, eax
or r12, 0xffffffffffffffff
mov rcx, r12
lea rdi, [0x140273028]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x140273028]
lea rcx, [rsp + 0xc8]
call fcn.140007880
call fcn.1401ed45c
movzx r9d, word [rbp + 0x53c]
mov r8d, 0xce7
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d62c0
xor r11d, r11d
lea rdi, [0x140273028]
mov rsi, qword [rsp + 0xc8]
mov ecx, 1
repe cmpsw word [rsi], word [rdi]
je 0x1401d66af
sbb r11d, r11d
sbb r11d, r12d
test r11d, r11d
sete al
test al, al
je 0x1401d68e9
call fcn.1401ed45c
mov r9w, 0x409
mov r8d, 0xce7
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d62c0
jmp 0x1401d68e9
mov eax, dword [rbp + 0x38]
bt eax, 0xb
jae 0x1401d6798
xor eax, eax
or r12, 0xffffffffffffffff
mov rcx, r12
lea rdi, [0x140273028]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x140273028]
lea rcx, [rsp + 0xc8]
call fcn.140007880
call fcn.1401ed45c
movzx r9d, word [rbp + 0x53c]
mov r8d, 0x109b
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d62c0
xor r11d, r11d
lea rdi, [0x140273028]
mov rsi, qword [rsp + 0xc8]
mov ecx, 1
repe cmpsw word [rsi], word [rdi]
je 0x1401d6764
sbb r11d, r11d
sbb r11d, r12d
test r11d, r11d
sete al
test al, al
je 0x1401d68e9
call fcn.1401ed45c
mov r9w, 0x409
mov r8d, 0x109b
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d62c0
jmp 0x1401d68e9
bt eax, 0x17
jae 0x1401d684a
xor eax, eax
or r12, 0xffffffffffffffff
mov rcx, r12
lea rdi, [0x140273028]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x140273028]
lea rcx, [rsp + 0xc8]
call fcn.140007880
call fcn.1401ed45c
movzx r9d, word [rbp + 0x53c]
mov r8d, 0x109a
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d62c0
xor r11d, r11d
lea rdi, [0x140273028]
mov rsi, qword [rsp + 0xc8]
mov ecx, 1
repe cmpsw word [rsi], word [rdi]
je 0x1401d6816
sbb r11d, r11d
sbb r11d, r12d
test r11d, r11d
sete al
test al, al
je 0x1401d68e9
call fcn.1401ed45c
mov r9w, 0x409
mov r8d, 0x109a
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d62c0
jmp 0x1401d68e9
xor eax, eax
or r12, 0xffffffffffffffff
mov rcx, r12
lea rdi, [0x140273028]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x140273028]
lea rcx, [rsp + 0xc8]
call fcn.140007880
call fcn.1401ed45c
movzx r9d, word [rbp + 0x53c]
mov r8d, 0x93d
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d62c0
xor r11d, r11d
lea rdi, [0x140273028]
mov rsi, qword [rsp + 0xc8]
mov ecx, 1
repe cmpsw word [rsi], word [rdi]
je 0x1401d68be
sbb r11d, r11d
sbb r11d, r12d
test r11d, r11d
sete al
test al, al
je 0x1401d68e9
call fcn.1401ed45c
mov r9w, 0x409
mov r8d, 0x93d
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0xc8]
call fcn.1400d62c0
mov rdi, qword [rsp + 0xc8]
mov r8, rdi
lea rdx, str.MicrosoftWindowsStart_MenuPrograms_s.lnk
lea rcx, [rsp + 0x68]
call fcn.1400040e0
mov r8, rdi
lea rdx, str._s.lnk
lea rcx, [rsp + 0xd8]
call fcn.1400040e0
add dword [rbp + 0x1ab4], 0xffffffff
jne 0x1401d6935
mov rax, qword [rbp]
mov edx, 1
mov rcx, rbp
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov qword [rsp + 0x58], rbx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SOFTWARERealtekAudioGUI_INFORMATION
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d69dd
mov rsi, qword [rsp + 0x58]
mov qword [rsp + 0x70], rsi
mov rdi, qword [rsp + 0xd8]
cmp dword [rdi - 8], 1
jle 0x1401d6995
mov edx, dword [rdi - 0x10]
lea rcx, [rsp + 0xd8]
call fcn.140003da0
mov rdi, qword [rsp + 0xd8]
mov eax, ebx
test rdi, rdi
setne al
test eax, eax
jne 0x1401d69ac
mov ecx, 0x80004005
call fcn.140003d20
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
lea rdx, str.ShortCutLnk
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1401d6a34
mov qword [rsp + 0x60], rbx
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWARERealtekAudioGUI_INFORMATION
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, rbx
test eax, eax
cmove rcx, qword [rsp + 0x60]
mov qword [rsp + 0x70], rcx
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x80], rax
call fcn.1401fa4b0
mov rcx, rax
test rax, rax
setne bl
test ebx, ebx
jne 0x1401d6a61
mov ecx, 0x80004005
call fcn.140003d20
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xd0], rax
lea rdx, str.Realtek.GUI.ToastMsg
test rdx, 0xffffffffffff0000
jne 0x1401d6aa7
movzx edi, dx
mov ecx, edi
call fcn.1401fc234
test rax, rax
je 0x1401d6ac7
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.140007610
jmp 0x1401d6ac7
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0xd0]
call fcn.140007880
nop
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x88], rax
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x1401d6b00
cmp rax, qword [rdi - 0x18]
jne 0x1401d6b00
lea rsi, [rdi - 0x18]
lock add dword [rdi - 8], 1
jmp 0x1401d6b3e
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rsi, rax
test rax, rax
jne 0x1401d6b1c
call fcn.140003e50
int3
mov eax, dword [rdi - 0x10]
mov dword [rsi + 8], eax
mov eax, dword [rdi - 0x10]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rsi + 0x18]
call fcn.1402279d0
lea rax, [rsi + 0x18]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x80], rax
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov rdx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x50]
call sub.ToastDll64.dll_bool___cdecl_TryCreateShortcut_wchar_t__const___ptr64__wchar_t__const___ptr64_
movzx esi, al
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1401d6b9f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xd0]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1401d6bc4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1401d6bd5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0xd8]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1401d6bfa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, r12d
lock xadd dword [rdi - 8], eax
add eax, 0xffffffff
test eax, eax
jg 0x1401d6c18
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xc8]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
add r12d, 0xffffffff
test r12d, r12d
jg 0x1401d6c3c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, esi
add rsp, 0x90
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret