Function at 0x1001faf0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x100f38c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push esi
push edi
push 0x208
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x220], 0x208
call fcn.10054d74
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
mov eax, dword [0x100e8014]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x214], eax
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
shr eax, 0x10
add esp, 4
test eax, eax
jne 0x1001fb7e
mov ecx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
movzx edx, cx
push edx
lea ecx, [ebp - 0x214]
call fcn.100015c0
jmp 0x1001fbba
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call ebx
mov esi, eax
test esi, esi
je 0x1001fbba
push esi
lea ecx, [ebp - 0x214]
call fcn.10001200
test eax, eax
je 0x1001fbba
lea eax, [esi + esi]
lea ecx, [eax + 2]
cmp ecx, eax
jb 0x1001fbba
mov edx, dword [ebp - 0x214]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push edx
call fcn.100558b0
add esp, 0xc
mov eax, dword [0x100e8014]
mov ecx, str.SmartAudio
shr ecx, 0x10
mov dword [ebp - 0x218], eax
test ecx, ecx
jne 0x1001fbe7
mov edx, str.SmartAudio
movzx eax, dx
push eax
lea ecx, [ebp - 0x218]
call fcn.100015c0
jmp 0x1001fc23
push str.SmartAudio
call ebx
mov esi, eax
test esi, esi
je 0x1001fc23
push esi
lea ecx, [ebp - 0x218]
call fcn.10001200
test eax, eax
je 0x1001fc23
lea eax, [esi + esi]
lea ecx, [eax + 2]
cmp ecx, eax
jb 0x1001fc23
mov edx, dword [ebp - 0x218]
push eax
push str.SmartAudio
push edx
call fcn.100558b0
add esp, 0xc
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x224], 0x80004005
call fcn.1001f9a0
mov eax, dword [ebp - 0x214]
cmp dword [eax - 0xc], 0
push ecx
lea ecx, [eax - 0xc]
mov dword [ebp - 0x248], esp
mov esi, esp
mov dword [ebp - 0x248], ecx
jl 0x1001fc61
push ecx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x1001fc7b
mov ecx, dword [0x100e8014]
push eax
mov dword [esi], ecx
call ebx
mov edx, dword [ebp - 0x214]
push edx
push eax
mov ecx, esi
call fcn.100014f0
mov ecx, dword [ebp + 8]
push SysReAllocStringLen
add ecx, 0xffffffec
call fcn.1001a340
test eax, eax
je 0x1001ff71
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocStringLen
mov dword [ebp - 0x21c], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1001fcda
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 0x244], edx
jmp 0x1001fd07
push 0
push 0
push 0x2001f
push 0x20106
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocStringLen
lea ecx, [ebp - 0x244]
call fcn.10001ee0
test eax, eax
jne 0x1001ff71
push 1
push str.SOFTWAREConexantSAII
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x238]
call fcn.10001f80
test eax, eax
je 0x1001fd40
push 0x101
push str.SOFTWAREConexantSAII
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x238]
call fcn.10001f80
test eax, eax
jne 0x1001fd9b
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push 0x10078b78
lea ecx, [ebp - 0x238]
call fcn.10017450
lea edx, [ebp - 0x20c]
push edx
mov esi, eax
call ebx
lea ecx, [ebp - 0x20c]
push ecx
push eax
lea ecx, [ebp - 0x210]
call fcn.100014f0
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x1001fd97
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x238], 0
test esi, esi
je 0x1001fdca
push 0x104
push edi
call fcn.10057335
add esp, 8
test edi, edi
jne 0x1001fdb1
xor eax, eax
jmp 0x1001fdb4
push edi
call ebx
push edi
push eax
lea ecx, [ebp - 0x210]
call fcn.100014f0
push edi
call fcn.100557bf
add esp, 4
mov esi, dword [ebp - 0x210]
cmp dword [esi - 8], 0
je 0x1001ff54
push 0x10078b74
lea ecx, [ebp - 0x220]
call fcn.1001e050
push 0x10078b70
lea ecx, [ebp - 0x228]
call fcn.1001e050
lea edx, [ebp - 0x220]
push edx
push str.SAIICpl.exe
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x22c]
push edx
call fcn.1001fa00
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.1001fa70
push eax
lea ecx, [ebp - 0x21c]
push ecx
call fcn.1001fa00
push eax
lea ecx, [ebp - 0x210]
call fcn.1001e0e0
mov eax, dword [ebp - 0x21c]
lea edx, [eax - 0xc]
cmp edx, dword [0x100e8010]
je 0x1001fe77
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x1001fe77
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff4
push eax
call fcn.10055c11
add esp, 4
mov eax, dword [ebp - 0x24c]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x100e8010]
je 0x1001feaa
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x1001feaa
mov edx, dword [ebp - 0x24c]
add edx, 0xfffffff4
push edx
call fcn.10055c11
add esp, 4
mov eax, dword [ebp - 0x22c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x100e8010]
je 0x1001fed7
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x1001fed7
mov edx, dword [ebp - 0x22c]
add edx, 0xfffffff4
push edx
call fcn.10055c11
add esp, 4
mov eax, dword [ebp - 0x228]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x100e8010]
je 0x1001fefb
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x1001fefb
push esi
call fcn.10055c11
add esp, 4
mov eax, dword [ebp - 0x220]
lea edx, [eax - 0xc]
cmp edx, dword [0x100e8010]
je 0x1001ff1f
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x1001ff1f
push esi
call fcn.10055c11
add esp, 4
mov esi, dword [ebp - 0x210]
test esi, esi
je 0x1001ff54
push esi
call ebx
mov ecx, dword [ebp - 0x218]
mov edx, dword [ebp - 0x244]
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1001ff54
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x1001ff77
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x244], 0
jmp 0x1001ff77
mov esi, dword [ebp - 0x210]
mov edi, dword [ebp - 0x218]
lea eax, [edi - 0xc]
cmp eax, dword [0x100e8010]
je 0x1001ff9f
add edi, 0xfffffff4
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x1001ff9f
push edi
call fcn.10055c11
add esp, 4
mov ecx, dword [ebp - 0x214]
add ecx, 0xfffffff4
cmp ecx, dword [0x100e8010]
je 0x1001ffca
mov edi, dword [ebp - 0x248]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x1001ffca
push edi
call fcn.10055c11
add esp, 4
lea edx, [esi - 0xc]
cmp edx, dword [0x100e8010]
je 0x1001ffec
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x1001ffec
push esi
call fcn.10055c11
add esp, 4
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x1001fffd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x1002000e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x224]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10055898
mov esp, ebp
pop ebp
ret 8