Function at 0x4026b0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437f20
mov eax, dword fs:[0]
push eax
sub esp, 0x824
mov eax, dword [0x4493b4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x81c], ebx
or edi, 0xffffffff
mov dword [ebp - 0x820], edi
mov dword [ebp - 0x824], ebx
mov dword [ebp - 0x82c], ebx
mov dword [ebp - 0x828], ebx
mov dword [ebp - 4], ebx
push 0x400
push ebx
lea eax, [ebp - 0x818]
push eax
call fcn.00423cc0
add esp, 0xc
mov dword [ebp - 0x828], 0x400
lea ecx, [ebp - 0x81c]
push ecx
push 0x20019
push ebx
push str.CLSIDD27CDB6E_AE6D_11cf_96B8_444553540000InprocServer32
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4027b9
lea edx, [ebp - 0x828]
push edx
lea eax, [ebp - 0x818]
push eax
lea ecx, [ebp - 0x82c]
push ecx
push ebx
push ebx
mov edx, dword [ebp - 0x81c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4027b9
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 0x820], edi
cmp edi, 0xffffffff
je 0x4027b9
push str.Flash_player_was_installed____
mov ecx, 0x44d258
call fcn.00404e20
add esp, 4
mov dword [ebp - 4], 0xffffffff
jmp 0x402923
push str.Flash_player_was_not_installed____
mov ecx, 0x44d258
call fcn.00404e20
add esp, 4
push 0x400
push ebx
lea ecx, [ebp - 0x418]
push ecx
call fcn.00423cc0
add esp, 0xc
add esi, 0x1070
push esi
push 0x400
lea edx, [ebp - 0x418]
push edx
push 0x43e748
push str.INSTALLER
push str.REQUIREMENT
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
ja 0x402821
push 0x400
push ebx
lea eax, [ebp - 0x418]
push eax
call fcn.00423cc0
add esp, 0xc
lea eax, [ebp - 0x418]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x402830
sub eax, edx
jne 0x402856
push str.._setupdatainstall_flash_player_10_active_x.exe__s
push 0x400
lea ecx, [ebp - 0x418]
push ecx
call fcn.00422999
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
push str.Call_Flash_player_Installer___s_
mov ecx, 0x44d258
call fcn.00404e20
push 1
lea eax, [ebp - 0x824]
push eax
xor edx, edx
lea ecx, [ebp - 0x418]
call fcn.00406730
add esp, 0x10
test eax, eax
jne 0x402905
lea ecx, [ebp - 0x418]
push ecx
push str.Call_Flash_player_Installer___s____Success
mov ecx, 0x44d258
call fcn.00404e20
add esp, 8
mov eax, dword [ebp - 0x824]
cmp eax, 8
ja case.0x4028ad.1
jmp dword [eax*4 + 0x40295c]
push ebx
push str.Flash_player_was_installed_successfully___d_
jmp 0x4028f8
push 3
push str.Flash_player_was_installed_fail___Does_not_have_admi_permissions___d_
jmp 0x4028f8
push 4
push str.Flash_player_was_installed_fail___Unsupported_OS___d_
jmp 0x4028f8
push 5
push str.Flash_player_was_installed_fail___Previously_installed_with_elevated_permissions___d_
jmp 0x4028f8
push 6
push str.Flash_player_was_installed_fail___Insufficient_Disk_Space___d_
jmp 0x4028f8
push 7
push str.Flash_player_was_installed_fail___Trying_ot_install_older_revision___d_
jmp 0x4028f8
push 8
push str.Flash_player_was_installed_fail___Browser_is_open___d_
jmp 0x4028f8
push eax
push str.Flash_player_was_installed_fail___Not_defined___d_
mov ecx, 0x44d258
call fcn.00404e20
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x402923
mov eax, dword [ebp - 0x81c]
cmp eax, ebx
je 0x402934
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
je 0x40293f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00422383
mov esp, ebp
pop ebp
ret