Function at 0x45a740
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5076f9
mov eax, dword fs:[0]
push eax
sub esp, 0xd18
mov eax, dword [0x556620]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xd0c], ecx
xor eax, eax
mov dword [ebp - 0xc7c], 7
mov dword [ebp - 0xc80], 0
mov word [ebp - 0xc90], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc94], 7
mov dword [ebp - 0xc98], eax
mov word [ebp - 0xca8], ax
xorps xmm0, xmm0
mov dword [ebp - 0xcc0], eax
movq qword [ebp - 0xcc8], xmm0
mov dword [ebp - 0xcc8], eax
mov dword [ebp - 0xcc4], eax
mov dword [ebp - 0xcc0], eax
lea eax, [ebp - 0xcbc]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0xcf8]
mov dword [ebp - 0xcbc], str.SOFTWAREAdobeAcrobat_Reader_
mov dword [ebp - 0xcb8], str.A6EADE66_0000_0000_484E_7E8A45000000
call fcn.00459e70
push eax
lea ecx, [ebp - 0xcc8]
mov byte [ebp - 4], 3
call fcn.0045cb60
cmp dword [ebp - 0xccc], 8
mov byte [ebp - 4], 2
jb 0x45a823
push dword [ebp - 0xce0]
call fcn.0040823e
add esp, 4
xor eax, eax
mov dword [ebp - 0xccc], 7
cmp dword [ebp - 0xce4], 8
mov dword [ebp - 0xcd0], 0
mov word [ebp - 0xce0], ax
jb 0x45a857
push dword [ebp - 0xcf8]
call fcn.0040823e
add esp, 4
lea eax, [ebp - 0xcbc]
mov dword [ebp - 0xcbc], str.SOFTWAREAdobeAdobe_Acrobat_
push eax
lea ecx, [ebp - 0xcf8]
mov dword [ebp - 0xcb8], str.AC76BA86_0000_0000_7761_7E8A45000000
call fcn.00459e70
push eax
lea ecx, [ebp - 0xcc8]
mov byte [ebp - 4], 4
call fcn.0045cb60
cmp dword [ebp - 0xccc], 8
mov byte [ebp - 4], 2
jb 0x45a8a8
push dword [ebp - 0xce0]
call fcn.0040823e
add esp, 4
xor eax, eax
mov dword [ebp - 0xccc], 7
cmp dword [ebp - 0xce4], 8
mov dword [ebp - 0xcd0], 0
mov word [ebp - 0xce0], ax
jb 0x45a8dc
push dword [ebp - 0xcf8]
call fcn.0040823e
add esp, 4
lea eax, [ebp - 0xcbc]
mov dword [ebp - 0xcbc], str.SOFTWAREAdobeAdobe_Acrobat_
push eax
lea ecx, [ebp - 0xcf8]
mov dword [ebp - 0xcb8], str.AC76BA86_0000_0000_7760_7E8A45000000
call fcn.00459e70
push eax
lea ecx, [ebp - 0xcc8]
mov byte [ebp - 4], 5
call fcn.0045cb60
cmp dword [ebp - 0xccc], 8
mov byte [ebp - 4], 2
jb 0x45a92d
push dword [ebp - 0xce0]
call fcn.0040823e
add esp, 4
xor eax, eax
mov dword [ebp - 0xccc], 7
cmp dword [ebp - 0xce4], 8
mov dword [ebp - 0xcd0], 0
mov word [ebp - 0xce0], ax
jb 0x45a961
push dword [ebp - 0xcf8]
call fcn.0040823e
add esp, 4
lea eax, [ebp - 0xcbc]
mov dword [ebp - 0xcbc], str.SOFTWAREAdobeAdobe_Acrobat_
push eax
lea ecx, [ebp - 0xcf8]
mov dword [ebp - 0xcb8], str.AC76BA86_0000_0000_BA7E_7E8A45000000
call fcn.00459e70
push eax
lea ecx, [ebp - 0xcc8]
mov byte [ebp - 4], 6
call fcn.0045cb60
cmp dword [ebp - 0xccc], 8
mov byte [ebp - 4], 2
jb 0x45a9b2
push dword [ebp - 0xce0]
call fcn.0040823e
add esp, 4
xor eax, eax
mov dword [ebp - 0xccc], 7
cmp dword [ebp - 0xce4], 8
mov dword [ebp - 0xcd0], 0
mov word [ebp - 0xce0], ax
jb 0x45a9e6
push dword [ebp - 0xcf8]
call fcn.0040823e
add esp, 4
mov esi, dword [ebp - 0xcc4]
mov eax, 0x2aaaaaab
mov ebx, dword [ebp - 0xcc8]
mov ecx, esi
sub ecx, ebx
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0xd00], eax
je 0x45b066
mov dword [ebp - 0xd08], ebx
lea esp, [esp]
lea eax, [ebp - 0xca8]
cmp eax, ebx
je 0x45aa36
push 0xffffffffffffffff
push 0
push ebx
mov ecx, eax
call fcn.00407980
lea eax, [ebx + 0x18]
lea ecx, [ebp - 0xc90]
cmp ecx, eax
je 0x45aa4d
push 0xffffffffffffffff
push 0
push eax
call fcn.00407980
xor ecx, ecx
mov dword [ebp - 0xcfc], ecx
jmp 0x45aa60
cmp dword [ebp - 0xc7c], 8
lea edx, [ebp - 0x420]
push edx
push ecx
lea eax, [ebp - 0xc90]
cmovae eax, dword [ebp - 0xc90]
push 0
push eax
call sub.msi.dll_MsiSourceListClearAllW
mov ecx, eax
mov dword [ebp - 0xd10], ecx
test ecx, ecx
jne 0x45b025
push 0x206
push eax
mov word [ebp - 0xc40], ax
lea eax, [ebp - 0xc3e]
push eax
call fcn.004dead0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.004dead0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x628], ax
lea eax, [ebp - 0x626]
push eax
call fcn.004dead0
add esp, 0x24
mov dword [ebp - 0xc44], 0xa
lea eax, [ebp - 0xc44]
push eax
lea eax, [ebp - 0x218]
push eax
push str.VersionMajor
lea eax, [ebp - 0x420]
push eax
call sub.msi.dll_MsiGetPropertyW
test eax, eax
jne 0x45b025
push 0x206
push eax
mov word [ebp - 0x830], ax
lea eax, [ebp - 0x82e]
push eax
mov dword [ebp - 0xc44], 0xa
call fcn.004dead0
add esp, 0xc
lea eax, [ebp - 0xc44]
push eax
lea eax, [ebp - 0x830]
push eax
push str.VersionMinor
lea eax, [ebp - 0x420]
push eax
call sub.msi.dll_MsiGetPropertyW
lea eax, [ebp - 0x830]
push eax
call fcn.004df5f3
mov esi, eax
lea eax, [ebp - 0x218]
push eax
call fcn.004df5f3
add esp, 8
cmp esi, 9
jb 0x45abca
cmp eax, 0xb
jne 0x45abca
lea eax, [ebp - 0x218]
mov esi, 0x5137f8
mov ecx, eax
mov edx, 0x104
sub esi, ecx
jmp 0x45aba0
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x45abbe
movzx ecx, word [esi + eax]
test cx, cx
je 0x45abbe
mov word [eax], cx
add eax, 2
dec edx
jne 0x45aba0
jmp 0x45abc2
test edx, edx
jne 0x45abc5
sub eax, 2
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x218]
push eax
call fcn.004df5f3
add esp, 4
cmp eax, dword [ebp + 8]
jb 0x45b025
lea eax, [ebp - 0xc44]
mov dword [ebp - 0xc44], 0x14
push eax
lea eax, [ebp - 0xc40]
push eax
push str.VersionString
lea eax, [ebp - 0x420]
push eax
call sub.msi.dll_MsiGetPropertyW
test eax, eax
jne 0x45b025
lea eax, [ebp - 0xc44]
mov dword [ebp - 0xc44], 0x104
push eax
lea eax, [ebp - 0x628]
push eax
push str.InstalledProductName
lea eax, [ebp - 0x420]
push eax
call sub.msi.dll_MsiGetPropertyW
test eax, eax
mov byte [ebp - 0xcb1], 0
lea ecx, [ebp - 0x628]
mov byte [ebp - 0xcb2], 0
mov ebx, str.Adobe_Acrobat
mov dword [ebp - 0xc64], 7
cmove ebx, ecx
mov dword [ebp - 0xc68], 0
xor eax, eax
mov dword [ebp - 0xd04], ebx
mov word [ebp - 0xc78], ax
mov byte [ebp - 4], 7
mov dword [ebp - 0xc4c], 7
mov dword [ebp - 0xc50], eax
mov word [ebp - 0xc60], ax
cmp word [ebx], ax
jne 0x45aca1
xor ecx, ecx
jmp 0x45acb5
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45aca6
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0xc60]
call fcn.004073d0
mov esi, dword [ebp - 0xc4c]
lea ecx, [ebp - 0xc60]
mov edx, dword [ebp - 0xc60]
lea edi, [ebp - 0xc60]
mov eax, dword [ebp - 0xc50]
cmp esi, 8
mov byte [ebp - 4], 8
cmovae ecx, edx
cmovae edi, edx
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0xc60]
cmovae ecx, edx
cmp ecx, eax
je 0x45ad16
push fcn.0041155e
push edi
push eax
push ecx
lea eax, [ebp - 0xd14]
push eax
call fcn.004114c0
add esp, 0x14
jmp 0x45ad1c
mov dword [ebp - 0xd14], edi
push 6
push 0
push str.reader
lea ecx, [ebp - 0xc60]
call fcn.0040b680
movzx ebx, byte [ebp - 0xcb2]
cmp eax, 0xffffffff
mov eax, 1
mov dword [ebp - 0xc48], 0
push str.kernel32
cmovne ebx, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x45ad6e
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x55a310], eax
jmp 0x45ad73
mov eax, dword [0x55a310]
test eax, eax
je 0x45ad8f
lea eax, [ebp - 0xc48]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x55a310]
test eax, eax
je 0x45adc3
cmp dword [ebp - 0xc48], 0
je 0x45adc3
test bl, bl
mov edx, str.SOFTWAREWow6432NodeAdobeAcrobat_Reader_
mov eax, str.SOFTWAREWow6432NodeAdobeAdobe_Acrobat_
cmove edx, eax
cmp word [edx], 0
jne 0x45adb1
xor ecx, ecx
jmp 0x45adf0
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45adb6
jmp 0x45adec
test bl, bl
mov edx, str.SOFTWAREAdobeAcrobat_Reader_
mov eax, str.SOFTWAREAdobeAdobe_Acrobat_
cmove edx, eax
cmp word [edx], 0
jne 0x45addc
xor ecx, ecx
jmp 0x45adf0
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45ade1
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0xc78]
call fcn.004073d0
cmp word [ebp - 0x218], 0
jne 0x45ae0b
xor ecx, ecx
jmp 0x45ae23
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45ae14
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0xc78]
call fcn.0040efb0
push 2
push 0x513924
lea ecx, [ebp - 0xc78]
call fcn.0040efb0
push 0xa
push str.Installer
lea ecx, [ebp - 0xc78]
call fcn.0040efb0
cmp dword [ebp - 0xc64], 8
lea ecx, [ebp - 0xcb0]
push ecx
push 0x20019
lea eax, [ebp - 0xc78]
mov dword [ebp - 0xcb0], 0
cmovae eax, dword [ebp - 0xc78]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45af00
push 0x208
push eax
lea eax, [ebp - 0xa38]
push eax
call fcn.004dead0
add esp, 0xc
mov dword [ebp - 0xc48], 0x206
lea eax, [ebp - 0xc48]
push eax
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0xcac]
push eax
push 0
push str.PATH
push dword [ebp - 0xcb0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xcb0]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x45af00
lea eax, [ebp - 0xa38]
push eax
call fcn.0045c0a0
add esp, 4
jmp 0x45af06
mov al, byte [ebp - 0xcb1]
test al, al
lea ecx, [ebp - 0xcf8]
mov eax, dword [ebp - 0xd04]
je 0x45af58
mov dword [ebp - 0xd24], eax
lea eax, [ebp - 0x420]
mov dword [ebp - 0xd20], eax
lea eax, [ebp - 0xd24]
push eax
call fcn.00459e70
mov ecx, dword [ebp - 0xd0c]
lea eax, [ebp - 0xcf8]
add ecx, 4
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0xcb8]
push dword [ecx]
push eax
call fcn.0045a2d0
jmp 0x45af8f
mov dword [ebp - 0xd1c], eax
lea eax, [ebp - 0x420]
mov dword [ebp - 0xd18], eax
lea eax, [ebp - 0xd1c]
push eax
call fcn.00459e70
mov ecx, dword [ebp - 0xd0c]
lea eax, [ebp - 0xcf8]
push eax
mov byte [ebp - 4], 0xa
lea ecx, [ecx + 4]
call fcn.0045cb60
cmp dword [ebp - 0xccc], 8
jb 0x45afa6
push dword [ebp - 0xce0]
call fcn.0040823e
add esp, 4
xor eax, eax
mov dword [ebp - 0xccc], 7
cmp dword [ebp - 0xce4], 8
mov word [ebp - 0xce0], ax
mov dword [ebp - 0xcd0], eax
jb 0x45afd6
push dword [ebp - 0xcf8]
call fcn.0040823e
add esp, 4
cmp dword [ebp - 0xc4c], 8
jb 0x45afed
push dword [ebp - 0xc60]
call fcn.0040823e
add esp, 4
xor eax, eax
mov dword [ebp - 0xc4c], 7
cmp dword [ebp - 0xc64], 8
mov dword [ebp - 0xc50], 0
mov word [ebp - 0xc60], ax
mov byte [ebp - 4], 2
jb 0x45b025
push dword [ebp - 0xc78]
call fcn.0040823e
add esp, 4
mov ecx, dword [ebp - 0xcfc]
inc ecx
cmp dword [ebp - 0xd10], 0
mov dword [ebp - 0xcfc], ecx
je 0x45aa60
mov ebx, dword [ebp - 0xd08]
add ebx, 0x30
dec dword [ebp - 0xd00]
mov dword [ebp - 0xd08], ebx
jne 0x45aa20
mov ebx, dword [ebp - 0xcc8]
mov esi, dword [ebp - 0xcc4]
test ebx, ebx
je 0x45b087
push dword [ebp - 0xcb8]
lea eax, [ebp - 0xcb2]
push eax
push esi
push ebx
call fcn.00459f40
push ebx
call fcn.0040823e
add esp, 0x14
cmp dword [ebp - 0xc94], 8
jb 0x45b09e
push dword [ebp - 0xca8]
call fcn.0040823e
add esp, 4
xor eax, eax
mov dword [ebp - 0xc94], 7
cmp dword [ebp - 0xc7c], 8
mov dword [ebp - 0xc98], 0
mov word [ebp - 0xca8], ax
jb 0x45b0d2
push dword [ebp - 0xc90]
call fcn.0040823e
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401580
mov esp, ebp
pop ebp
ret 4