Function at 0x4349a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5076b2
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x54e938]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x54], ebx
push 0x13
xor eax, eax
mov edi, 7
push 0x513634
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], ax
call fcn.00406300
xor ecx, ecx
push 0x3b
mov word [ebp - 0x2c], cx
push str.SoftwarePoliciesAdobeAcrobat_Reader11.0FeatureLockDown
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
call fcn.00406300
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
push ecx
push 0x80000002
mov dword [ebp - 4], 1
mov dword [ebp - 0x54], 3
call fcn.004100f0
add esp, 0x10
test al, al
je 0x434a4f
mov byte [ebp - 0x49], 1
cmp dword [ebp - 0x50], ebx
jne 0x434a53
mov byte [ebp - 0x49], 0
mov ebx, 8
cmp dword [ebp - 0x18], ebx
jb 0x434a69
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00406ec9
add esp, 4
xor eax, eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x34], ebx
jb 0x434a91
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.00406ec9
add esp, 4
push 0x29
push 0x4fa900
push 2
push 0x52cf0c
xor edx, edx
push str.Crypt32.dll
mov ecx, esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], dx
call fcn.004340d0
test al, al
je 0x4351a7
push 0x2a
push 0x4fbb90
push 2
push 0x52cedc
push str.Advapi32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x2b
push 0x41d8a0
push 2
push 0x52cec4
push str.Advapi32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x2c
push 0x4fbda0
push 2
push 0x52ceb0
push str.Advapi32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x2d
push 0x4fbec0
push 2
push 0x52cea0
push str.Advapi32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x2e
push 0x4fc090
push 2
push 0x52ce90
push str.Advapi32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x2f
push 0x4fc1b0
push 2
push 0x52ce7c
push str.Advapi32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x30
push 0x4fc2e0
push 2
push 0x52ce68
push str.Advapi32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x31
push 0x41e630
push 2
push 0x52ce58
push str.Advapi32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
cmp byte [ebp - 0x49], 0
mov al, 1
jne 0x4351a9
push 0x35
push 0x4fc5f0
push 2
push 0x52ce40
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x36
push 0x4febf0
push 2
push 0x52ce24
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x37
push 0x4fc780
push 2
push 0x52ce04
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x38
push 0x4fc890
push 2
push 0x52cde4
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x39
push 0x4fca10
push 2
push 0x52cdc0
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x3a
push 0x4fcba0
push 2
push 0x52cdb0
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x3b
push 0x4fcd20
push 2
push 0x52cd94
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x3c
push 0x4fce90
push 2
push 0x52cd70
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x3d
push 0x4fd010
push 2
push 0x52cd4c
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x3e
push 0x4fd200
push 2
push 0x52cd30
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x3f
push 0x4fd3f0
push 2
push 0x52cd18
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x40
push 0x4fd580
push 2
push 0x52ccfc
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x41
push 0x4fd6f0
push 2
push 0x52ccec
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x42
push 0x4fdcf0
push 2
push 0x52ccd8
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x43
push 0x4fd810
push 2
push 0x52ccc4
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x44
push 0x4fd990
push 2
push 0x52ccb0
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x45
push 0x4fdb00
push 2
push 0x52cca0
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x46
push 0x4fde20
push 2
push 0x52cc7c
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x47
push 0x4fe0d0
push 2
push 0x52cc64
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x48
push 0x4fe260
push 2
push 0x52cc54
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x49
push 0x4fe3c0
push 2
push 0x52cc40
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x4a
push 0x4fe520
push 2
push 0x52cc28
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x4b
push 0x4fe660
push 2
push 0x52cc10
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x4c
push 0x4fe820
push 2
push 0x52cc00
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x4d
push 0x41e940
push 2
push 0x52cbec
push str.Crypt32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x32
push 0x4fc460
push 2
push 0x52cbdc
push str.Advapi32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x33
push 0x4fea80
push 2
push 0x52cbcc
push str.Advapi32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x34
push 0x4fe960
push 2
push 0x52cbb8
push str.Advapi32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x4e
push 0x4fee10
push 2
push 0x52cba8
push str.Advapi32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x4f
push 0x4fefe0
push 2
push 0x52cb98
push str.Advapi32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x50
push 0x4ff100
push 2
push 0x52cb84
push str.Advapi32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x51
push 0x4ff220
push 2
push 0x52cb74
push str.Advapi32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x52
push 0x4ff370
push 2
push 0x52cb64
push str.Advapi32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x53
push 0x4ff4c0
push 2
push 0x52cb50
push str.Advapi32.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x54
push 0x4ff620
push 2
push 0x52cb34
push str.Ncrypt.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x55
push 0x4ff740
push 2
push 0x52cb08
push str.Ncrypt.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x56
push 0x4ff8b0
push 2
push 0x52caf4
push str.Ncrypt.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x57
push 0x4ffa00
push 2
push 0x52cae4
push str.Ncrypt.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x58
push 0x4ffb40
push 2
push 0x52cad4
push str.Ncrypt.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x59
push 0x4ffcd0
push 2
push 0x52cac4
push str.Ncrypt.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x5a
push 0x4fff60
push 2
push 0x52caac
push str.Ncrypt.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x5b
push 0x5000b0
push 2
push 0x52ca9c
push str.Ncrypt.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x5c
push 0x500240
push 2
push 0x52ca8c
push str.Ncrypt.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
push 0x5d
push 0x5003e0
push 2
push 0x52ca78
push str.Ncrypt.dll
mov ecx, esi
call fcn.004340d0
test al, al
je 0x4351a7
mov al, 1
jmp 0x4351a9
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401316
mov esp, ebp
pop ebp
ret