Function at 0x40dd20
Capabilities:
Enumerate files on windows
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x87c
mov eax, dword [0x5a40e0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x61c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40e49b
lea ecx, [ebp - 0x61c]
lea edx, [ecx + 2]
jmp 0x40dd60
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40dd60
sub ecx, edx
sar ecx, 1
cmp ecx, 4
jbe 0x40e49b
push 0
lea eax, [ebp - 0x874]
mov dword [ebp - 0x874], 0
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push 0x554870
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40e49b
push 0x24c
push eax
mov dword [ebp - 0x86c], eax
lea eax, [ebp - 0x868]
push eax
call fcn.00525b40
lea edx, [ebp - 0x61c]
add esp, 0xc
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40ddd4
sub edx, ecx
mov ecx, 0x5548b4
sar edx, 1
lea eax, [edx*2 - 8]
sub eax, ecx
lea edx, [ebp - 0x61c]
add edx, eax
lea esp, [esp]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x40de00
push ebx
push esi
push edi
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x878], eax
cmp eax, 0xffffffff
je 0x40e3ca
lea eax, [ebp - 0x840]
push 0x2e
push eax
call fcn.00527dcc
mov esi, eax
add esp, 8
test esi, esi
je 0x40deb1
push str..ilk
push esi
call fcn.005280c6
add esp, 8
test eax, eax
je 0x40e3a1
push str..map
push esi
call fcn.005280c6
add esp, 8
test eax, eax
je 0x40e3a1
push str..manifest
push esi
call fcn.005280c6
add esp, 8
test eax, eax
je 0x40e3a1
push str..pdb
push esi
call fcn.005280c6
add esp, 8
test eax, eax
je 0x40e3a1
lea eax, [ebp - 0x840]
push eax
call fcn.00406b50
mov edi, eax
test edi, edi
je 0x40e39b
push str..EXE
push esi
mov dword [ebp - 0x870], 0
call fcn.005280c6
add esp, 8
test eax, eax
jne 0x40df00
mov ecx, str..ENU
mov edx, esi
sub edx, ecx
lea esp, [esp]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x40def0
push 0
lea eax, [ebp - 0x870]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
lea eax, [esi + 2]
push eax
push dword [ebp - 0x874]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40e498
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x414]
push 0x208
push eax
push 0xc8
push edi
call esi
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40df51
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push str.Standard
push dword [ebp - 0x870]
call ebx
push 0x208
lea eax, [ebp - 0x414]
push eax
push 0xc9
push edi
call esi
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40dfa0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push 0x5548f4
push dword [ebp - 0x870]
call ebx
push 0x208
lea eax, [ebp - 0x414]
push eax
push 0xca
push edi
call esi
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
jmp 0x40dff0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40dff0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push str.High_Quality_Print
push dword [ebp - 0x870]
call ebx
push 0x208
lea eax, [ebp - 0x414]
push eax
push 0xcb
push edi
call esi
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
jmp 0x40e040
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e040
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push str.Press_Quality
push dword [ebp - 0x870]
call ebx
push 0x208
lea eax, [ebp - 0x414]
push eax
push 0xcc
push edi
call esi
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
jmp 0x40e090
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e090
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push str.PDFX1a_2001
push dword [ebp - 0x870]
call ebx
push 0x208
lea eax, [ebp - 0x414]
push eax
push 0xd1
push edi
call esi
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
jmp 0x40e0e0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e0e0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push str.PDFX1a_2001_JPN
push dword [ebp - 0x870]
call ebx
push 0x208
lea eax, [ebp - 0x414]
push eax
push 0xce
push edi
call esi
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
jmp 0x40e130
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e130
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push str.PDFX1a_2003
push dword [ebp - 0x870]
call ebx
push 0x208
lea eax, [ebp - 0x414]
push eax
push 0xd0
push edi
call esi
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
jmp 0x40e180
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e180
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push str.PDFX1a_2003_JPN
push dword [ebp - 0x870]
call ebx
push 0x208
lea eax, [ebp - 0x414]
push eax
push 0xcd
push edi
call esi
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
jmp 0x40e1d0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e1d0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push str.PDFX3_2002
push dword [ebp - 0x870]
call ebx
push 0x208
lea eax, [ebp - 0x414]
push eax
push 0xd2
push edi
call esi
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
jmp 0x40e220
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e220
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push str.PDFX3_2002_JPN
push dword [ebp - 0x870]
call ebx
push 0x208
lea eax, [ebp - 0x414]
push eax
push 0xcf
push edi
call esi
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
jmp 0x40e270
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e270
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push str.PDFX3_2003
push dword [ebp - 0x870]
call ebx
push 0x208
lea eax, [ebp - 0x414]
push eax
push 0xd3
push edi
call esi
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
jmp 0x40e2c0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e2c0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push str.PDFX3_2003_JPN
push dword [ebp - 0x870]
call ebx
push 0x208
lea eax, [ebp - 0x414]
push eax
push 0xd4
push edi
call esi
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
jmp 0x40e310
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e310
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push str.PDFA1b_2005_CMYK
push dword [ebp - 0x870]
call ebx
push 0x208
lea eax, [ebp - 0x414]
push eax
push 0xd5
push edi
call esi
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
jmp 0x40e360
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e360
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push str.PDFA1b_2005_RGB
push dword [ebp - 0x870]
call ebx
push dword [ebp - 0x870]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
jmp 0x40e3a1
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x878]
lea eax, [ebp - 0x86c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40de42
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x87c]
push eax
push 0x20019
push 0
push 0x554b1c
push 0x554b20
call fcn.00403f40
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 8
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x40e498
lea eax, [ebp - 0x874]
push eax
push 0x2001f
push 0
push str.SoftwareAdobePDF_Admin_Settings
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x40e488
lea eax, [ebp - 0x878]
mov dword [ebp - 0x878], 0x208
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x870]
push eax
push 0
push 0x554c04
push dword [ebp - 0x87c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e488
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e460
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0
push 0
push dword [ebp - 0x874]
call ebx
push dword [ebp - 0x87c]
call edi
push dword [ebp - 0x874]
call edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00525b2c
mov esp, ebp
pop ebp
ret