Function at 0x48e810
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb50
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x208
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.0056aed0
push str.NotificationAppx
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.004067bb
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.0056aed0
push 0x208
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.0056aed0
push str.SOFTWAREAdobeAcrobat_Reader_
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.004067bb
push 0x5b8808
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.00429db1
add esp, 0x48
lea eax, [ebp - 0x414]
push 0x5b880c
push 0x104
push eax
call fcn.00429db1
push 0x5b8814
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.00429db1
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.00429db1
push 0x5b8818
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.004067bb
push 0x5b8858
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.00429db1
push 0x5b885c
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.00429db1
add esp, 0x48
lea eax, [ebp - 0x61c]
push str.Installer_
push 0x104
push eax
call fcn.00429db1
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.00429db1
push 0
push 2
mov dword [ebp - 0xb50], 0
xor bl, bl
push 6
call fcn.004129f0
add esp, 0x24
test al, al
je 0x48ea8e
push 0x5b8cd8
push 0x5b8ce8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x48ea8e
push 0x110
lea eax, [ebp - 0xb48]
push 0
push eax
call fcn.0056aed0
add esp, 0xc
mov dword [ebp - 0xb4c], 0x114
lea eax, [ebp - 0xb4c]
mov ecx, esi
push eax
call dword [0x5b1854]
call esi
test eax, eax
js 0x48ea8e
mov eax, dword [ebp - 0xb48]
cmp eax, 0xa
ja 0x48ea01
jne 0x48ea8e
mov eax, dword [ebp - 0xb44]
test eax, eax
jne 0x48ea01
cmp dword [ebp - 0xb40], 0x3839
jb 0x48ea8e
push 0x100
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x120], 0x11c
push 0
push eax
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
call fcn.0056aed0
add esp, 0xc
mov dword [ebp - 8], 0x10000
xor eax, eax
mov dword [ebp - 0xc], eax
push 1
push 0x80
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 0x80
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x48ea8e
call fcn.0048e3d0
test al, al
jne 0x48ea8e
mov byte [0x631be1], 1
jmp 0x48ea9a
cmp byte [0x631be1], bl
je 0x48ec47
lea eax, [ebp - 0xb50]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x414]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48ec47
push 0x208
push eax
lea eax, [ebp - 0xa2c]
push eax
call fcn.0056aed0
add esp, 0xc
mov dword [ebp - 0xa34], 0x206
lea eax, [ebp - 0xa34]
push eax
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0xa38]
push eax
push 0
push 0x5b887c
push dword [ebp - 0xb50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xb50]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xb50], 0
test esi, esi
jne 0x48ec47
lea ecx, [ebp - 0xa2c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48eb32
sub ecx, edx
sar ecx, 1
je 0x48ec47
lea eax, [ebp - 0xb50]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x61c]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x48eb91
mov bl, 1
mov ecx, dword [ebp - 0xb50]
test ecx, ecx
je 0x48eb7f
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call int.004016cd
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x48eb6e
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0056aed0
add esp, 0xc
mov dword [ebp - 0xa30], 0x206
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push str.AppVersion
push dword [ebp - 0xb50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xb50]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 2
je 0x48ec33
test esi, esi
jne 0x48eb7f
lea ecx, [ebp - 0x20c]
lea eax, [ebp - 0xa2c]
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x48ec26
test dx, dx
je 0x48ec22
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x48ec26
add eax, 4
add ecx, 4
test dx, dx
jne 0x48ec00
xor eax, eax
jmp 0x48ec2b
sbb eax, eax
or eax, 1
test eax, eax
je 0x48eb7f
mov bl, 1
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call int.004016cd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop esi
xor ecx, ebp
pop ebx
call int.004016cd
mov esp, ebp
pop ebp
ret