Function at 0x402c50
Capabilities:
Create process on windows
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x378
mov eax, dword [0x48b074]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x108]
mov dword [ebp - 0x318], 0x104
push 0
push eax
call fcn.00426910
push 0x104
lea eax, [ebp - 0x308]
push 0
push eax
call fcn.00426910
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x310]
add esp, 0x18
mov dword [ebp - 0x310], 0
mov dword [ebp - 0x320], 0
mov dword [ebp - 0x30c], 0
push eax
push 0x20019
push 0
push str.AcroExch.Document
push 0x80000000
call esi
test eax, eax
jne 0x402f83
push edi
push 0xfa
push eax
mov dword [ebp - 0x324], eax
lea eax, [ebp - 0x204]
push eax
call fcn.00426910
add esp, 0xc
mov dword [ebp - 0x314], 0
lea eax, [ebp - 0x314]
push eax
push 0x20019
push 0
push str.CurVer
push dword [ebp - 0x310]
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x402d75
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x324]
push eax
push 0
push 0
push dword [ebp - 0x314]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402d6d
lea eax, [ebp - 0x320]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x204]
push eax
push 0x80000000
call esi
push dword [ebp - 0x314]
call edi
lea eax, [ebp - 0x30c]
push eax
push 0x20019
push 0
push str.ShellOpenCommand
push dword [ebp - 0x320]
call esi
test eax, eax
je 0x402daf
lea eax, [ebp - 0x30c]
push eax
push 0x20019
push 0
push str.ShellOpenCommand
push dword [ebp - 0x310]
call esi
mov eax, dword [ebp - 0x30c]
test eax, eax
je 0x402f5e
lea ecx, [ebp - 0x318]
mov dword [ebp - 0x31c], 0
push ecx
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x318], 0x104
push ecx
lea ecx, [ebp - 0x31c]
push ecx
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
jne 0x402f34
mov eax, dword [ebp - 0x31c]
cmp eax, 2
jne 0x402e46
push 0x104
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0x104
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.004308e0
add esp, 0xc
mov dword [ebp - 0x31c], 1
jmp 0x402e4f
cmp eax, 1
jne 0x402f34
cmp byte [ebp - 0x108], 0x22
lea esi, [ebp - 0x108]
jne 0x402e6a
lea esi, [ebp - 0x107]
push 0x22
mov eax, esi
jmp 0x402e72
push 0x20
lea eax, [ebp - 0x108]
push eax
call fcn.00425720
add esp, 8
test eax, eax
je 0x402e82
mov byte [eax], 0
lea eax, [ebp - 0x378]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
cmp dword [0x48cac0], 0
mov eax, 0x4734b0
xorps xmm0, xmm0
cmove eax, dword [ebp - 0x370]
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x378]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
push esi
push 0
movups xmmword [ebp - 0x334], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x402f2c
push 0xffffffffffffffff
push dword [ebp - 0x334]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x334]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x330]
call esi
push dword [ebp - 0x30c]
mov esi, 1
call edi
push dword [ebp - 0x310]
call edi
push dword [ebp - 0x320]
call edi
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042419c
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push dword [ebp - 0x30c]
call edi
push dword [ebp - 0x310]
call edi
push dword [ebp - 0x320]
call edi
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042419c
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x310]
or esi, 0xffffffff
call edi
push dword [ebp - 0x320]
call edi
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042419c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0042419c
mov esp, ebp
pop ebp
ret