Function at 0x465d90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x522509
mov eax, dword fs:[0]
push eax
sub esp, 0xd18
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xd0c], ecx
xor eax, eax
mov dword [ebp - 0xc7c], 7
mov dword [ebp - 0xc80], 0
mov word [ebp - 0xc90], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc94], 7
mov dword [ebp - 0xc98], eax
mov word [ebp - 0xca8], ax
xorps xmm0, xmm0
mov dword [ebp - 0xcc0], eax
movq qword [ebp - 0xcc8], xmm0
mov dword [ebp - 0xcc8], eax
mov dword [ebp - 0xcc4], eax
mov dword [ebp - 0xcc0], eax
lea eax, [ebp - 0xcbc]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0xcf8]
mov dword [ebp - 0xcbc], str.SOFTWAREAdobeAcrobat_Reader_
mov dword [ebp - 0xcb8], str.A6EADE66_0000_0000_484E_7E8A45000000
call fcn.004650f0
push eax
lea ecx, [ebp - 0xcc8]
mov byte [ebp - 4], 3
call fcn.00468a60
cmp dword [ebp - 0xccc], 8
mov byte [ebp - 4], 2
jb 0x465e73
push dword [ebp - 0xce0]
call fcn.004085be
add esp, 4
xor eax, eax
mov dword [ebp - 0xccc], 7
cmp dword [ebp - 0xce4], 8
mov dword [ebp - 0xcd0], 0
mov word [ebp - 0xce0], ax
jb 0x465ea7
push dword [ebp - 0xcf8]
call fcn.004085be
add esp, 4
lea eax, [ebp - 0xcbc]
mov dword [ebp - 0xcbc], str.SOFTWAREAdobeAdobe_Acrobat_
push eax
lea ecx, [ebp - 0xcf8]
mov dword [ebp - 0xcb8], str.AC76BA86_0000_0000_7761_7E8A45000000
call fcn.004650f0
push eax
lea ecx, [ebp - 0xcc8]
mov byte [ebp - 4], 4
call fcn.00468a60
cmp dword [ebp - 0xccc], 8
mov byte [ebp - 4], 2
jb 0x465ef8
push dword [ebp - 0xce0]
call fcn.004085be
add esp, 4
xor eax, eax
mov dword [ebp - 0xccc], 7
cmp dword [ebp - 0xce4], 8
mov dword [ebp - 0xcd0], 0
mov word [ebp - 0xce0], ax
jb 0x465f2c
push dword [ebp - 0xcf8]
call fcn.004085be
add esp, 4
lea eax, [ebp - 0xcbc]
mov dword [ebp - 0xcbc], str.SOFTWAREAdobeAdobe_Acrobat_
push eax
lea ecx, [ebp - 0xcf8]
mov dword [ebp - 0xcb8], str.AC76BA86_0000_0000_7760_7E8A45000000
call fcn.004650f0
push eax
lea ecx, [ebp - 0xcc8]
mov byte [ebp - 4], 5
call fcn.00468a60
cmp dword [ebp - 0xccc], 8
mov byte [ebp - 4], 2
jb 0x465f7d
push dword [ebp - 0xce0]
call fcn.004085be
add esp, 4
xor eax, eax
mov dword [ebp - 0xccc], 7
cmp dword [ebp - 0xce4], 8
mov dword [ebp - 0xcd0], 0
mov word [ebp - 0xce0], ax
jb 0x465fb1
push dword [ebp - 0xcf8]
call fcn.004085be
add esp, 4
lea eax, [ebp - 0xcbc]
mov dword [ebp - 0xcbc], str.SOFTWAREAdobeAdobe_Acrobat_
push eax
lea ecx, [ebp - 0xcf8]
mov dword [ebp - 0xcb8], str.AC76BA86_0000_0000_BA7E_7E8A45000000
call fcn.004650f0
push eax
lea ecx, [ebp - 0xcc8]
mov byte [ebp - 4], 6
call fcn.00468a60
cmp dword [ebp - 0xccc], 8
mov byte [ebp - 4], 2
jb 0x466002
push dword [ebp - 0xce0]
call fcn.004085be
add esp, 4
xor eax, eax
mov dword [ebp - 0xccc], 7
cmp dword [ebp - 0xce4], 8
mov dword [ebp - 0xcd0], 0
mov word [ebp - 0xce0], ax
jb 0x466036
push dword [ebp - 0xcf8]
call fcn.004085be
add esp, 4
mov esi, dword [ebp - 0xcc4]
mov eax, 0x2aaaaaab
mov ebx, dword [ebp - 0xcc8]
mov ecx, esi
sub ecx, ebx
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0xd00], eax
je 0x4666b6
mov dword [ebp - 0xd08], ebx
lea esp, [esp]
lea eax, [ebp - 0xca8]
cmp eax, ebx
je 0x466086
push 0xffffffffffffffff
push 0
push ebx
mov ecx, eax
call fcn.00407d00
lea eax, [ebx + 0x18]
lea ecx, [ebp - 0xc90]
cmp ecx, eax
je 0x46609d
push 0xffffffffffffffff
push 0
push eax
call fcn.00407d00
xor ecx, ecx
mov dword [ebp - 0xcfc], ecx
jmp 0x4660b0
cmp dword [ebp - 0xc7c], 8
lea edx, [ebp - 0x420]
push edx
push ecx
lea eax, [ebp - 0xc90]
cmovae eax, dword [ebp - 0xc90]
push 0
push eax
call sub.msi.dll_MsiSourceListClearAllW
mov ecx, eax
mov dword [ebp - 0xd10], ecx
test ecx, ecx
jne 0x466675
push 0x206
push eax
mov word [ebp - 0xc40], ax
lea eax, [ebp - 0xc3e]
push eax
call fcn.004f9050
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.004f9050
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x628], ax
lea eax, [ebp - 0x626]
push eax
call fcn.004f9050
add esp, 0x24
mov dword [ebp - 0xc44], 0xa
lea eax, [ebp - 0xc44]
push eax
lea eax, [ebp - 0x218]
push eax
push str.VersionMajor
lea eax, [ebp - 0x420]
push eax
call sub.msi.dll_MsiGetPropertyW
test eax, eax
jne 0x466675
push 0x206
push eax
mov word [ebp - 0x830], ax
lea eax, [ebp - 0x82e]
push eax
mov dword [ebp - 0xc44], 0xa
call fcn.004f9050
add esp, 0xc
lea eax, [ebp - 0xc44]
push eax
lea eax, [ebp - 0x830]
push eax
push str.VersionMinor
lea eax, [ebp - 0x420]
push eax
call sub.msi.dll_MsiGetPropertyW
lea eax, [ebp - 0x830]
push eax
call fcn.004f9d09
mov esi, eax
lea eax, [ebp - 0x218]
push eax
call fcn.004f9d09
add esp, 8
cmp esi, 9
jb 0x46621a
cmp eax, 0xb
jne 0x46621a
lea eax, [ebp - 0x218]
mov esi, 0x52ff98
mov ecx, eax
mov edx, 0x104
sub esi, ecx
jmp 0x4661f0
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x46620e
movzx ecx, word [esi + eax]
test cx, cx
je 0x46620e
mov word [eax], cx
add eax, 2
dec edx
jne 0x4661f0
jmp 0x466212
test edx, edx
jne 0x466215
sub eax, 2
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x218]
push eax
call fcn.004f9d09
add esp, 4
cmp eax, dword [ebp + 8]
jb 0x466675
lea eax, [ebp - 0xc44]
mov dword [ebp - 0xc44], 0x14
push eax
lea eax, [ebp - 0xc40]
push eax
push str.VersionString
lea eax, [ebp - 0x420]
push eax
call sub.msi.dll_MsiGetPropertyW
test eax, eax
jne 0x466675
lea eax, [ebp - 0xc44]
mov dword [ebp - 0xc44], 0x104
push eax
lea eax, [ebp - 0x628]
push eax
push str.InstalledProductName
lea eax, [ebp - 0x420]
push eax
call sub.msi.dll_MsiGetPropertyW
test eax, eax
mov byte [ebp - 0xcb1], 0
lea ecx, [ebp - 0x628]
mov byte [ebp - 0xcb2], 0
mov ebx, str.Adobe_Acrobat
mov dword [ebp - 0xc64], 7
cmove ebx, ecx
mov dword [ebp - 0xc68], 0
xor eax, eax
mov dword [ebp - 0xd04], ebx
mov word [ebp - 0xc78], ax
mov byte [ebp - 4], 7
mov dword [ebp - 0xc4c], 7
mov dword [ebp - 0xc50], eax
mov word [ebp - 0xc60], ax
cmp word [ebx], ax
jne 0x4662f1
xor ecx, ecx
jmp 0x466305
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4662f6
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0xc60]
call fcn.00407750
mov esi, dword [ebp - 0xc4c]
lea ecx, [ebp - 0xc60]
mov edx, dword [ebp - 0xc60]
lea edi, [ebp - 0xc60]
mov eax, dword [ebp - 0xc50]
cmp esi, 8
mov byte [ebp - 4], 8
cmovae ecx, edx
cmovae edi, edx
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0xc60]
cmovae ecx, edx
cmp ecx, eax
je 0x466366
push 0x40b2f6
push edi
push eax
push ecx
lea eax, [ebp - 0xd14]
push eax
call fcn.0040b280
add esp, 0x14
jmp 0x46636c
mov dword [ebp - 0xd14], edi
push 6
push 0
push str.reader
lea ecx, [ebp - 0xc60]
call fcn.0040cdd0
movzx ebx, byte [ebp - 0xcb2]
cmp eax, 0xffffffff
mov eax, 1
mov dword [ebp - 0xc48], 0
push str.kernel32
cmovne ebx, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4663be
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x57db6c], eax
jmp 0x4663c3
mov eax, dword [0x57db6c]
test eax, eax
je 0x4663df
lea eax, [ebp - 0xc48]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x57db6c]
test eax, eax
je 0x466413
cmp dword [ebp - 0xc48], 0
je 0x466413
test bl, bl
mov edx, str.SOFTWAREWow6432NodeAdobeAcrobat_Reader_
mov eax, str.SOFTWAREWow6432NodeAdobeAdobe_Acrobat_
cmove edx, eax
cmp word [edx], 0
jne 0x466401
xor ecx, ecx
jmp 0x466440
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x466406
jmp 0x46643c
test bl, bl
mov edx, str.SOFTWAREAdobeAcrobat_Reader_
mov eax, str.SOFTWAREAdobeAdobe_Acrobat_
cmove edx, eax
cmp word [edx], 0
jne 0x46642c
xor ecx, ecx
jmp 0x466440
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x466431
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0xc78]
call fcn.00407750
cmp word [ebp - 0x218], 0
jne 0x46645b
xor ecx, ecx
jmp 0x466473
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x466464
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0xc78]
call fcn.0040ef80
push 2
push 0x5300c4
lea ecx, [ebp - 0xc78]
call fcn.0040ef80
push 0xa
push str.Installer
lea ecx, [ebp - 0xc78]
call fcn.0040ef80
cmp dword [ebp - 0xc64], 8
lea ecx, [ebp - 0xcb0]
push ecx
push 0x20019
lea eax, [ebp - 0xc78]
mov dword [ebp - 0xcb0], 0
cmovae eax, dword [ebp - 0xc78]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x466550
push 0x208
push eax
lea eax, [ebp - 0xa38]
push eax
call fcn.004f9050
add esp, 0xc
mov dword [ebp - 0xc48], 0x206
lea eax, [ebp - 0xc48]
push eax
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0xcac]
push eax
push 0
push str.PATH
push dword [ebp - 0xcb0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xcb0]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x466550
lea eax, [ebp - 0xa38]
push eax
call fcn.00467ae0
add esp, 4
jmp 0x466556
mov al, byte [ebp - 0xcb1]
test al, al
lea ecx, [ebp - 0xcf8]
mov eax, dword [ebp - 0xd04]
je 0x4665a8
mov dword [ebp - 0xd24], eax
lea eax, [ebp - 0x420]
mov dword [ebp - 0xd20], eax
lea eax, [ebp - 0xd24]
push eax
call fcn.004650f0
mov ecx, dword [ebp - 0xd0c]
lea eax, [ebp - 0xcf8]
add ecx, 4
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0xcb8]
push dword [ecx]
push eax
call fcn.00465550
jmp 0x4665df
mov dword [ebp - 0xd1c], eax
lea eax, [ebp - 0x420]
mov dword [ebp - 0xd18], eax
lea eax, [ebp - 0xd1c]
push eax
call fcn.004650f0
mov ecx, dword [ebp - 0xd0c]
lea eax, [ebp - 0xcf8]
push eax
mov byte [ebp - 4], 0xa
lea ecx, [ecx + 4]
call fcn.00468a60
cmp dword [ebp - 0xccc], 8
jb 0x4665f6
push dword [ebp - 0xce0]
call fcn.004085be
add esp, 4
xor eax, eax
mov dword [ebp - 0xccc], 7
cmp dword [ebp - 0xce4], 8
mov word [ebp - 0xce0], ax
mov dword [ebp - 0xcd0], eax
jb 0x466626
push dword [ebp - 0xcf8]
call fcn.004085be
add esp, 4
cmp dword [ebp - 0xc4c], 8
jb 0x46663d
push dword [ebp - 0xc60]
call fcn.004085be
add esp, 4
xor eax, eax
mov dword [ebp - 0xc4c], 7
cmp dword [ebp - 0xc64], 8
mov dword [ebp - 0xc50], 0
mov word [ebp - 0xc60], ax
mov byte [ebp - 4], 2
jb 0x466675
push dword [ebp - 0xc78]
call fcn.004085be
add esp, 4
mov ecx, dword [ebp - 0xcfc]
inc ecx
cmp dword [ebp - 0xd10], 0
mov dword [ebp - 0xcfc], ecx
je 0x4660b0
mov ebx, dword [ebp - 0xd08]
add ebx, 0x30
dec dword [ebp - 0xd00]
mov dword [ebp - 0xd08], ebx
jne 0x466070
mov ebx, dword [ebp - 0xcc8]
mov esi, dword [ebp - 0xcc4]
test ebx, ebx
je 0x4666d7
push dword [ebp - 0xcb8]
lea eax, [ebp - 0xcb2]
push eax
push esi
push ebx
call fcn.004651c0
push ebx
call fcn.004085be
add esp, 0x14
cmp dword [ebp - 0xc94], 8
jb 0x4666ee
push dword [ebp - 0xca8]
call fcn.004085be
add esp, 4
xor eax, eax
mov dword [ebp - 0xc94], 7
cmp dword [ebp - 0xc7c], 8
mov dword [ebp - 0xc98], 0
mov word [ebp - 0xca8], ax
jb 0x466722
push dword [ebp - 0xc90]
call fcn.004085be
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret 4