Function at 0x43db37
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x42c
mov eax, 0x47a7c5
call fcn.0043eed3
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x424]
push eax
mov edi, str.SoftwareAdobeAdobe_Acrobat11.0LanguageNext
push edi
mov ebx, SysReAllocString
push ebx
call esi
test eax, eax
je 0x43dbc1
lea eax, [ebp - 0x424]
push eax
push edi
lea edi, [ebx + 1]
push edi
call esi
test eax, eax
je 0x43dbc1
lea eax, [ebp - 0x424]
push eax
push str.SoftwareAdobeAcrobat_Reader11.0LanguageNext
push ebx
call esi
test eax, eax
je 0x43dbc1
lea eax, [ebp - 0x424]
push eax
push str.SoftwareAdobeAcrobat_Reader11.0LanguageNext
push edi
call esi
test eax, eax
je 0x43dbc1
lea eax, [ebp - 0x424]
push eax
push str.SoftwareAdobeAcrobat_Reader11.0LanguageCurrent
push edi
call esi
test eax, eax
je 0x43dbc1
or eax, 0xffffffff
jmp 0x43ddbc
mov esi, 0x200
push esi
call fcn.0043ed97
pop ecx
mov dword [ebp - 0x428], eax
lea ecx, [ebp - 0x430]
push ecx
push eax
lea eax, [ebp - 0x434]
push eax
xor edi, edi
push edi
push edi
push dword [ebp - 0x424]
mov dword [ebp - 4], edi
mov dword [ebp - 0x430], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x424]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x430]
shr esi, 1
mov dword [ebp - 0x424], edi
cmp ebx, edi
jne 0x43dcdd
cmp dword [ebp - 0x434], 1
jne 0x43dcdd
cmp esi, 4
jb 0x43dcdd
mov ebx, dword [ebp - 0x428]
mov edi, dword [sym.imp.MSVCR100.dll__wcsicmp]
xor eax, eax
mov word [ebx + 0x1fe], ax
lea ebx, [ebx + esi*2 - 8]
push 0x48be6c
push ebx
call edi
pop ecx
pop ecx
test eax, eax
je 0x43ddae
push 0x48be64
push ebx
call edi
pop ecx
pop ecx
test eax, eax
je 0x43ddae
mov ebx, dword [ebp - 0x428]
push ebx
call fcn.0043d373
pop ecx
test eax, eax
jne 0x43dc89
push ebx
jmp 0x43ddb4
lea eax, [ebp - 0x42c]
push eax
push 0x100
push ebx
call fcn.0043d69e
push ebx
test eax, eax
js 0x43ddb4
mov edi, 0x104
push edi
lea eax, [ebp - 0x420]
push eax
call fcn.00401268
test eax, eax
jns 0x43dcce
xor esi, esi
push dword [ebp - 0x428]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
mov eax, esi
jmp 0x43ddbb
push 0x5c
push ebx
call dword [sym.imp.MSVCR100.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
jne 0x43dce2
or esi, 0xffffffff
jmp 0x43dcbc
mov ebx, dword [ebp - 0x438]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x42c]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.0043d69e
test eax, eax
js 0x43dcba
mov eax, dword [ebp - 0x42c]
inc eax
cmp eax, edi
jae 0x43dcdd
push ebx
push edi
lea eax, [ebp - 0x218]
push eax
call fcn.00401268
test eax, eax
js 0x43dcba
lea eax, [ebp - 0x42c]
push eax
push 0x100
push dword [ebp - 0x428]
call fcn.0043d69e
test eax, eax
js 0x43dcba
mov eax, dword [ebp - 0x42c]
inc eax
cmp eax, edi
jae 0x43dcdd
push dword [ebp - 0x428]
mov edi, dword [ebp + 0xc]
push edi
push ebx
call fcn.00401268
test eax, eax
js 0x43dcba
push 0x48be5c
push edi
push ebx
call fcn.0040129b
test eax, eax
js 0x43dcba
lea eax, [ebp - 0x218]
push eax
push edi
push ebx
call fcn.0040129b
test eax, eax
js 0x43dcba
cmp esi, 5
jbe 0x43dcdd
lea eax, [ebp + esi*2 - 0x42a]
push eax
push edi
push ebx
call fcn.0040129b
test eax, eax
js 0x43dcba
xor esi, esi
inc esi
jmp 0x43dcbc
push dword [ebp - 0x428]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
xor eax, eax
pop ecx
call fcn.0043ef56
ret