Function at 0x100785f1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x274
mov eax, 0x10128bb9
call fcn.101236c7
mov ebx, ecx
cmp dword [ebx + 4], 0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x278], edx
je 0x100788b2
test eax, eax
je 0x100788b2
mov edi, 0x10130ee8
test ecx, ecx
mov esi, edi
cmovne esi, ecx
push esi
call fcn.100b3c7b
pop ecx
push eax
push esi
lea ecx, [ebx + 0x3c]
call fcn.100b3c7b
mov eax, dword [ebp - 0x278]
test eax, eax
cmovne edi, eax
push edi
call fcn.100b3c7b
pop ecx
push eax
push edi
lea ecx, [ebx + 0xc]
call fcn.100b3c7b
mov esi, str.NP_GetEntryPoints
lea edi, [ebp - 0x34]
push 6
pop ecx
push 5
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, str.NP_Initialize
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, str.NP_Acrobat_GetEntryPoints
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
pop ecx
movsw word es:[edi], word [esi]
mov esi, str.NP_Acrobat_Initialize
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [ebp - 0x274]
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x3c]
push eax
mov ecx, ebx
call fcn.100b3c7b
test al, al
jne 0x100788aa
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x48]
cmp eax, 0x64
je 0x100788b2
lea eax, [ebp - 0x274]
mov dword [ebp - 0x278], 0x208
push eax
push 0x20019
push 0
push str.SOFTWAREMozillaPlugins_adobe.com_FlashPlayer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10078728
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x280]
push eax
push 0
push 0x1013b320
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x278], 0
jbe 0x100788b2
cmp word [ebp - 0x270], 0
je 0x100788b2
lea eax, [ebp - 0x270]
push eax
call fcn.1007ad75
mov esi, eax
test esi, esi
je 0x100788b2
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x48]
cmp eax, 0x65
je 0x100788b2
lea eax, [ebp - 0x68]
push eax
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebp - 0x27c], eax
test eax, eax
je 0x100788b2
push 0x18
pop eax
push eax
push 0
push dword [ebx + 0x9c]
call sub.MSVCR120.dll_memset
mov eax, dword [ebx + 0x9c]
add esp, 0xc
push 0x18
pop ecx
mov word [eax], cx
xor ecx, ecx
mov eax, dword [ebx + 0x9c]
mov word [eax + 2], cx
push dword [ebx + 0x9c]
call dword [ebp - 0x27c]
test ax, ax
jne 0x100788b2
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebp - 0x27c], eax
test eax, eax
je 0x100788b2
push 0x50
pop eax
push eax
push 0
push dword [ebx + 0x98]
call sub.MSVCR120.dll_memset
mov eax, dword [ebx + 0x98]
add esp, 0xc
push 0x50
pop ecx
mov word [eax], cx
mov eax, dword [ebx + 0x98]
push 0x11
pop ecx
mov word [eax + 2], cx
push dword [ebx + 0x98]
call dword [ebp - 0x27c]
test ax, ax
jne 0x100788b2
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x100788b2
push dword [ebx + 0xa0]
call eax
test ax, ax
jne 0x100788b2
lea eax, [ebp - 0x4c]
push eax
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x100788b2
push dword [ebx + 0xa4]
call eax
movzx eax, ax
test ax, ax
jne 0x100788b2
cmp dword [0x10172924], 0
jne 0x1007889b
push 8
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
pop ecx
mov dword [ebp - 0x27c], esi
xor eax, eax
mov dword [ebp - 4], eax
test esi, esi
je 0x1007888f
mov ecx, esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.100278bc
mov dword [esi], eax
jmp 0x10078891
mov esi, eax
or dword [ebp - 4], 0xffffffff
mov dword [0x10172924], esi
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x3c]
push eax
mov ecx, ebx
call fcn.100b3c7b
mov byte [ebx + 8], 1
mov al, 1
jmp 0x100788b4
xor al, al
call fcn.10123676
ret 0x10