Function at 0x4d032b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x84c
mov eax, 0x563011
call fcn.00503628
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x858], esi
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x854], ebx
call fcn.004caf7f
xor edi, edi
mov dword [ebp - 4], ebx
inc edi
mov dword [ebp - 0x854], edi
call fcn.004d5a54
mov ecx, eax
mov dword [esp], str.Acrobat
call fcn.00460886
lea ecx, [ebp - 0x850]
test al, al
push ecx
push edi
mov edx, str.SoftwareAdobeAdobe_AcrobatDCAcroLogging
mov ecx, str.SoftwareAdobeAcrobat_ReaderDCAcroLogging
push ebx
cmovne ecx, edx
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4d05ed
push 4
pop edi
lea eax, [ebp - 0x84c]
mov dword [ebp - 0x84c], edi
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push str.uEnableAcroLogging
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4d03dd
mov ecx, dword [esi]
mov eax, dword [ebp - 0x848]
mov dword [ecx], eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push str.LogLevel
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4d041b
cmp dword [ebp - 0x844], edi
jne 0x4d041b
mov ecx, dword [esi]
mov eax, dword [ebp - 0x848]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push str.MaxFileSize
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4d0459
cmp dword [ebp - 0x844], edi
jne 0x4d0459
mov ecx, dword [esi]
mov eax, dword [ebp - 0x848]
mov dword [ecx + 8], eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push str.FlushPolicy
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4d0497
cmp dword [ebp - 0x844], edi
jne 0x4d0497
mov ecx, dword [esi]
mov eax, dword [ebp - 0x848]
mov dword [ecx + 0xc], eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push str.FlushLogLevel
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4d04d5
cmp dword [ebp - 0x844], edi
jne 0x4d04d5
mov ecx, dword [esi]
mov eax, dword [ebp - 0x848]
mov dword [ecx + 0x10], eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push str.FlushTimeout
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4d0513
cmp dword [ebp - 0x844], edi
jne 0x4d0513
mov ecx, dword [esi]
mov eax, dword [ebp - 0x848]
mov dword [ecx + 0x14], eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push str.RotatingFiles
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4d0551
cmp dword [ebp - 0x844], edi
jne 0x4d0551
mov ecx, dword [esi]
mov eax, dword [ebp - 0x848]
mov dword [ecx + 0x18], eax
lea eax, [ebp - 0x84c]
mov dword [ebp - 0x84c], 0x800
push eax
lea eax, [ebp - 0x810]
xor edi, edi
push eax
lea eax, [ebp - 0x844]
inc edi
push eax
push ebx
push str.LogFilteringStr
push dword [ebp - 0x850]
mov dword [ebp - 0x844], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4d05e1
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x828]
call fcn.0044b93e
lea eax, [ebp - 0x828]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x840]
push eax
call fcn.004d66fc
pop ecx
pop ecx
mov ecx, dword [esi]
push eax
add ecx, 0x24
mov byte [ebp - 4], 2
call fcn.00456234
lea ecx, [ebp - 0x840]
call fcn.0044d7bd
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], bl
call fcn.0044d7e3
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.005035d7
ret