Function at 0x43b83d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x42c
mov eax, 0x4778dd
call fcn.0043cbbb
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x424]
push eax
mov edi, str.SoftwareAdobeAdobe_Acrobat11.0LanguageNext
push edi
mov ebx, SysReAllocString
push ebx
call esi
test eax, eax
je 0x43b8c7
lea eax, [ebp - 0x424]
push eax
push edi
lea edi, [ebx + 1]
push edi
call esi
test eax, eax
je 0x43b8c7
lea eax, [ebp - 0x424]
push eax
push str.SoftwareAdobeAcrobat_Reader11.0LanguageNext
push ebx
call esi
test eax, eax
je 0x43b8c7
lea eax, [ebp - 0x424]
push eax
push str.SoftwareAdobeAcrobat_Reader11.0LanguageNext
push edi
call esi
test eax, eax
je 0x43b8c7
lea eax, [ebp - 0x424]
push eax
push str.SoftwareAdobeAcrobat_Reader11.0LanguageCurrent
push edi
call esi
test eax, eax
je 0x43b8c7
or eax, 0xffffffff
jmp 0x43bac2
mov esi, 0x200
push esi
call fcn.0043ca7f
pop ecx
mov dword [ebp - 0x428], eax
lea ecx, [ebp - 0x430]
push ecx
push eax
lea eax, [ebp - 0x434]
push eax
xor edi, edi
push edi
push edi
push dword [ebp - 0x424]
mov dword [ebp - 4], edi
mov dword [ebp - 0x430], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x424]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x430]
shr esi, 1
mov dword [ebp - 0x424], edi
cmp ebx, edi
jne 0x43b9e3
cmp dword [ebp - 0x434], 1
jne 0x43b9e3
cmp esi, 4
jb 0x43b9e3
mov ebx, dword [ebp - 0x428]
mov edi, dword [sym.imp.MSVCR100.dll__wcsicmp]
xor eax, eax
mov word [ebx + 0x1fe], ax
lea ebx, [ebx + esi*2 - 8]
push 0x488c6c
push ebx
call edi
pop ecx
pop ecx
test eax, eax
je 0x43bab4
push 0x488c64
push ebx
call edi
pop ecx
pop ecx
test eax, eax
je 0x43bab4
mov ebx, dword [ebp - 0x428]
push ebx
call fcn.0043b079
pop ecx
test eax, eax
jne 0x43b98f
push ebx
jmp 0x43baba
lea eax, [ebp - 0x42c]
push eax
push 0x100
push ebx
call fcn.0043b3a4
push ebx
test eax, eax
js 0x43baba
mov edi, 0x104
push edi
lea eax, [ebp - 0x420]
push eax
call fcn.00401268
test eax, eax
jns 0x43b9d4
xor esi, esi
push dword [ebp - 0x428]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
mov eax, esi
jmp 0x43bac1
push 0x5c
push ebx
call dword [sym.imp.MSVCR100.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
jne 0x43b9e8
or esi, 0xffffffff
jmp 0x43b9c2
mov ebx, dword [ebp - 0x438]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x42c]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.0043b3a4
test eax, eax
js 0x43b9c0
mov eax, dword [ebp - 0x42c]
inc eax
cmp eax, edi
jae 0x43b9e3
push ebx
push edi
lea eax, [ebp - 0x218]
push eax
call fcn.00401268
test eax, eax
js 0x43b9c0
lea eax, [ebp - 0x42c]
push eax
push 0x100
push dword [ebp - 0x428]
call fcn.0043b3a4
test eax, eax
js 0x43b9c0
mov eax, dword [ebp - 0x42c]
inc eax
cmp eax, edi
jae 0x43b9e3
push dword [ebp - 0x428]
mov edi, dword [ebp + 0xc]
push edi
push ebx
call fcn.00401268
test eax, eax
js 0x43b9c0
push 0x488c5c
push edi
push ebx
call fcn.0040129b
test eax, eax
js 0x43b9c0
lea eax, [ebp - 0x218]
push eax
push edi
push ebx
call fcn.0040129b
test eax, eax
js 0x43b9c0
cmp esi, 5
jbe 0x43b9e3
lea eax, [ebp + esi*2 - 0x42a]
push eax
push edi
push ebx
call fcn.0040129b
test eax, eax
js 0x43b9c0
xor esi, esi
inc esi
jmp 0x43b9c2
push dword [ebp - 0x428]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
xor eax, eax
pop ecx
call fcn.0043cc3e
ret