Function at 0x1001d520
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x100e57c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push esi
push edi
push 0x208
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x220], 0x208
call fcn.1004a7bc
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
mov eax, dword [0x100da014]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x214], eax
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
shr eax, 0x10
add esp, 4
test eax, eax
jne 0x1001d5ae
mov ecx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
movzx edx, cx
push edx
lea ecx, [ebp - 0x214]
call fcn.100018e0
jmp 0x1001d5ea
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call ebx
mov esi, eax
test esi, esi
je 0x1001d5ea
push esi
lea ecx, [ebp - 0x214]
call fcn.100010e0
test eax, eax
je 0x1001d5ea
lea eax, [esi + esi]
lea ecx, [eax + 2]
cmp ecx, eax
jb 0x1001d5ea
mov edx, dword [ebp - 0x214]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push edx
call fcn.1004b2e0
add esp, 0xc
mov eax, dword [0x100da014]
mov ecx, str.SmartAudio
shr ecx, 0x10
mov dword [ebp - 0x218], eax
test ecx, ecx
jne 0x1001d617
mov edx, str.SmartAudio
movzx eax, dx
push eax
lea ecx, [ebp - 0x218]
call fcn.100018e0
jmp 0x1001d653
push str.SmartAudio
call ebx
mov esi, eax
test esi, esi
je 0x1001d653
push esi
lea ecx, [ebp - 0x218]
call fcn.100010e0
test eax, eax
je 0x1001d653
lea eax, [esi + esi]
lea ecx, [eax + 2]
cmp ecx, eax
jb 0x1001d653
mov edx, dword [ebp - 0x218]
push eax
push str.SmartAudio
push edx
call fcn.1004b2e0
add esp, 0xc
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x224], 0x80004005
call fcn.1001d3d0
mov eax, dword [ebp - 0x214]
cmp dword [eax - 0xc], 0
push ecx
lea ecx, [eax - 0xc]
mov dword [ebp - 0x248], esp
mov esi, esp
mov dword [ebp - 0x248], ecx
jl 0x1001d691
push ecx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x1001d6ab
mov ecx, dword [0x100da014]
push eax
mov dword [esi], ecx
call ebx
mov edx, dword [ebp - 0x214]
push edx
push eax
mov ecx, esi
call fcn.100013d0
mov ecx, dword [ebp + 8]
push SysReAllocString
add ecx, 0xffffffec
call fcn.1001a0b0
test eax, eax
je 0x1001d9a1
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocString
mov dword [ebp - 0x21c], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1001d70a
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 0x244], edx
jmp 0x1001d737
push 0
push 0
push 0x2001f
push 0x20106
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocString
lea ecx, [ebp - 0x244]
call fcn.10002240
test eax, eax
jne 0x1001d9a1
push 1
push str.SOFTWAREConexantSAII
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x238]
call fcn.100022e0
test eax, eax
je 0x1001d770
push 0x101
push str.SOFTWAREConexantSAII
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x238]
call fcn.100022e0
test eax, eax
jne 0x1001d7cb
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push 0x1006d2d0
lea ecx, [ebp - 0x238]
call fcn.10017660
lea edx, [ebp - 0x20c]
push edx
mov esi, eax
call ebx
lea ecx, [ebp - 0x20c]
push ecx
push eax
lea ecx, [ebp - 0x210]
call fcn.100013d0
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x1001d7c7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x238], 0
test esi, esi
je 0x1001d7fa
push 0x104
push edi
call fcn.1004cde5
add esp, 8
test edi, edi
jne 0x1001d7e1
xor eax, eax
jmp 0x1001d7e4
push edi
call ebx
push edi
push eax
lea ecx, [ebp - 0x210]
call fcn.100013d0
push edi
call fcn.1004b207
add esp, 4
mov esi, dword [ebp - 0x210]
cmp dword [esi - 8], 0
je 0x1001d984
push 0x1006d2cc
lea ecx, [ebp - 0x220]
call fcn.1001bbb0
push 0x1006d2c8
lea ecx, [ebp - 0x228]
call fcn.1001bbb0
lea edx, [ebp - 0x220]
push edx
push str.SAIICpl.exe
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x22c]
push edx
call fcn.1001d430
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.1001d4a0
push eax
lea ecx, [ebp - 0x21c]
push ecx
call fcn.1001d430
push eax
lea ecx, [ebp - 0x210]
call fcn.1001bc40
mov eax, dword [ebp - 0x21c]
lea edx, [eax - 0xc]
cmp edx, dword [0x100da010]
je 0x1001d8a7
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x1001d8a7
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff4
push eax
call fcn.1004b641
add esp, 4
mov eax, dword [ebp - 0x24c]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x100da010]
je 0x1001d8da
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x1001d8da
mov edx, dword [ebp - 0x24c]
add edx, 0xfffffff4
push edx
call fcn.1004b641
add esp, 4
mov eax, dword [ebp - 0x22c]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x100da010]
je 0x1001d907
add eax, 0xfffffff4
push eax
call edi
test eax, eax
jg 0x1001d907
mov edx, dword [ebp - 0x22c]
add edx, 0xfffffff4
push edx
call fcn.1004b641
add esp, 4
mov eax, dword [ebp - 0x228]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x100da010]
je 0x1001d92b
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x1001d92b
push esi
call fcn.1004b641
add esp, 4
mov eax, dword [ebp - 0x220]
lea edx, [eax - 0xc]
cmp edx, dword [0x100da010]
je 0x1001d94f
lea esi, [eax - 0xc]
push esi
call edi
test eax, eax
jg 0x1001d94f
push esi
call fcn.1004b641
add esp, 4
mov esi, dword [ebp - 0x210]
test esi, esi
je 0x1001d984
push esi
call ebx
mov ecx, dword [ebp - 0x218]
mov edx, dword [ebp - 0x244]
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1001d984
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x1001d9a7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x244], 0
jmp 0x1001d9a7
mov esi, dword [ebp - 0x210]
mov edi, dword [ebp - 0x218]
lea eax, [edi - 0xc]
cmp eax, dword [0x100da010]
je 0x1001d9cf
add edi, 0xfffffff4
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x1001d9cf
push edi
call fcn.1004b641
add esp, 4
mov ecx, dword [ebp - 0x214]
add ecx, 0xfffffff4
cmp ecx, dword [0x100da010]
je 0x1001d9fa
mov edi, dword [ebp - 0x248]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x1001d9fa
push edi
call fcn.1004b641
add esp, 4
lea edx, [esi - 0xc]
cmp edx, dword [0x100da010]
je 0x1001da1c
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x1001da1c
push esi
call fcn.1004b641
add esp, 4
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x1001da2d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x1001da3e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x224]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004bb49
mov esp, ebp
pop ebp
ret 8