Function at 0x401217
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x40af50
sub esp, 0x640
mov eax, dword [0x4b7870]
xor eax, esp
mov dword [esp + 0x63c], eax
xor eax, eax
push eax
lea ecx, [esp + 0x1c]
push ecx
mov word [esp + 0x20], ax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
call fcn.004011e5
add esp, 8
test eax, eax
jne 0x40afa9
jmp 0x40af90
movzx ecx, word [eax + 0x49b464]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40af90
jmp 0x40b3c4
cmp eax, 0xffffffff
jne 0x40b3c4
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
movzx eax, ax
mov edx, eax
and edx, 0x3ff
lea ecx, [edx - 1]
cmp ecx, 0x26
ja case.0x40afcf.3
jmp dword [ecx*4 + 0x40b564]
xor eax, eax
jmp 0x40afe0
movzx ecx, word [eax + 0x49b458]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40afe0
jmp 0x40b3c4
xor eax, eax
jmp 0x40b000
movzx ecx, word [eax + 0x49b44c]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b000
jmp 0x40b3c4
xor eax, eax
jmp 0x40b020
movzx ecx, word [eax + 0x49b440]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b020
jmp 0x40b3c4
xor eax, eax
jmp 0x40b040
movzx ecx, word [eax + 0x49b434]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b040
jmp 0x40b3c4
xor eax, eax
jmp 0x40b060
movzx ecx, word [eax + 0x49b428]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b060
jmp 0x40b3c4
xor eax, eax
jmp 0x40b080
movzx ecx, word [eax + 0x49b41c]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b080
jmp 0x40b3c4
xor eax, eax
jmp 0x40b0a0
movzx ecx, word [eax + 0x49b410]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b0a0
jmp 0x40b3c4
xor eax, eax
jmp 0x40b0c0
movzx ecx, word [eax + 0x49b404]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b0c0
jmp 0x40b3c4
and eax, 0xfc00
cmp eax, 0x800
jne 0x40b109
xor eax, eax
jmp 0x40b0f0
movzx ecx, word [eax + 0x49b3f8]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b0f0
jmp 0x40b3c4
xor eax, eax
jmp 0x40b110
movzx ecx, word [eax + 0x49b3ec]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b110
jmp 0x40b3c4
xor eax, eax
jmp 0x40b130
movzx ecx, word [eax + 0x49b3e0]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b130
jmp 0x40b3c4
xor eax, eax
jmp 0x40b150
movzx ecx, word [eax + 0x49b3d4]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b150
jmp 0x40b3c4
xor eax, eax
jmp 0x40b170
movzx ecx, word [eax + 0x49b3c8]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b170
jmp 0x40b3c4
xor eax, eax
jmp 0x40b190
movzx ecx, word [eax + 0x49b3bc]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b190
jmp 0x40b3c4
xor eax, eax
jmp 0x40b1b0
movzx ecx, word [eax + 0x49b3b0]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b1b0
jmp 0x40b3c4
xor eax, eax
jmp 0x40b1d0
movzx ecx, word [eax + 0x49b3a4]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b1d0
jmp 0x40b3c4
xor eax, eax
jmp 0x40b1f0
movzx ecx, word [eax + 0x49b398]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b1f0
jmp 0x40b3c4
xor eax, eax
jmp 0x40b210
movzx ecx, word [eax + 0x49b38c]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b210
jmp 0x40b3c4
xor eax, eax
jmp 0x40b230
movzx ecx, word [eax + 0x49b380]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b230
jmp 0x40b3c4
xor eax, eax
jmp 0x40b250
movzx ecx, word [eax + 0x49b374]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b250
jmp 0x40b3c4
xor eax, eax
jmp 0x40b270
movzx ecx, word [eax + 0x49b368]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b270
jmp 0x40b3c4
xor eax, eax
jmp 0x40b290
movzx ecx, word [eax + 0x49b35c]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b290
jmp 0x40b3c4
xor eax, eax
jmp 0x40b2b0
movzx ecx, word [eax + 0x49b350]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b2b0
jmp 0x40b3c4
xor eax, eax
jmp 0x40b2d0
movzx ecx, word [eax + 0x49b344]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b2d0
jmp 0x40b3c4
xor eax, eax
jmp 0x40b2f0
movzx ecx, word [eax + 0x49b338]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b2f0
jmp 0x40b3c4
xor eax, eax
jmp 0x40b310
movzx ecx, word [eax + 0x49b32c]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b310
jmp 0x40b3c4
xor eax, eax
jmp 0x40b330
movzx ecx, word [eax + 0x49b320]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b330
jmp 0x40b3c4
xor eax, eax
jmp 0x40b350
movzx ecx, word [eax + 0x49b314]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b350
jmp 0x40b3c4
xor eax, eax
jmp 0x40b370
movzx ecx, word [eax + 0x49b308]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b370
jmp 0x40b3c4
xor eax, eax
jmp 0x40b390
movzx ecx, word [eax + 0x49b2fc]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b390
jmp 0x40b3c4
xor eax, eax
jmp 0x40b3b0
movzx ecx, word [eax + 0x49b464]
mov word [esp + eax + 0x18], cx
add eax, 2
test cx, cx
jne 0x40b3b0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push str.SoftwareAdobePDF_Admin_Settings
push SysFreeString
call esi
test eax, eax
jne 0x40b54d
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push edx
push eax
call esi
test eax, eax
je 0x40b410
mov ecx, dword [esp + 0x10]
push ecx
jmp 0x40b547
push 0
lea edx, [esp + 0x1c]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareAdobeAcrobat_DistillerAdobePDFSettingsDisplayName
push SysFreeString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40b542
push ebx
push edi
push 0x206
xor esi, esi
lea ecx, [esp + 0x36]
push esi
push ecx
mov word [esp + 0x3c], ax
call fcn.004461c0
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
add esp, 0xc
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x23c]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x28]
push esi
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x44]
push eax
push esi
mov ebx, 0x208
push ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x2c], esi
call edi
test eax, eax
jne 0x40b535
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [esp + 0x23c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b4b0
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
push edx
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x240]
push eax
push 1
push 0
lea ecx, [esp + 0x44]
push ecx
push edx
call ebp
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x3e]
push ecx
inc esi
mov word [esp + 0x40], ax
call fcn.004461c0
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x240]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x2c]
push 0
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x48]
push eax
push esi
push ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x30], 0
call edi
test eax, eax
je 0x40b4a3
pop ebp
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x640]
pop esi
xor ecx, esp
call fcn.004461a7
add esp, 0x640
ret