Function at 0x10002a1d
Capabilities:
Create directory
Persist via run registry key
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0c
and dword [ebp - 0x60c], 0
mov dword [ebp - 0x104], 0x3ff
call fcn.1000101a
lea eax, [ebp - 0x208]
push eax
push 0x20019
push 0
push 0x1000a2d0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10002a6a
push dword [ebp - 0x208]
call fcn.10002630
pop ecx
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x208]
push eax
push 0x20019
push 0
push 0x1000a300
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10002aa4
push dword [ebp - 0x208]
call fcn.10002630
pop ecx
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x1000b1fc], 3
jg 0x10002ac3
mov dword [ebp - 0x60c], 1
lea eax, [ebp - 0x208]
push eax
push 0xf003f
push 0
push 0x1000a330
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10002b2c
mov dword [ebp - 0x104], 0x3ff
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0xa0c]
push eax
push 0
push 0
push 0x1000a360
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10002b20
mov dword [ebp - 0x60c], 1
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xff
lea eax, [ebp - 0x100]
push eax
push str.ProgramFiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x10002b61
push str.Program_Files
push 0x1000a390
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x100]
push eax
push str._sAdobe
push 0xff
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
push 0
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x100]
push eax
push str._sInternet_Explorer
push 0xff
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
push 0
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x100]
push eax
push str._sAdobe_acrotray_.exe
push 0xff
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
push dword [0x1000b200]
call fcn.10001b61
pop ecx
pop ecx
lea eax, [ebp - 0x100]
push eax
push str._sAdobe_acrotray.exe
push 0xff
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
push dword [0x1000b200]
call fcn.10001b61
pop ecx
pop ecx
lea eax, [ebp - 0x100]
push eax
push 0x1000a3e8
push 0xff
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
push dword [0x1000b200]
call fcn.10001b61
pop ecx
pop ecx
push 2
push 0x1000a40c
lea eax, [ebp - 0x204]
push eax
call fcn.100028c3
add esp, 0xc
and dword [ebp - 0x104], 0
cmp dword [ebp - 0x60c], 0
je 0x10002cf9
lea eax, [ebp - 0x208]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10002cf9
lea eax, [ebp - 0x204]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
mov dword [ebp - 0x104], eax
push dword [ebp - 0x104]
lea eax, [ebp - 0x204]
push eax
push 1
push 0
push str.Adobe_Reader
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x1000b1e8], 3
je 0x10002d0f
lea eax, [ebp - 0x204]
push eax
call fcn.10002768
pop ecx
lea eax, [ebp - 0x100]
push eax
push str._sAdobe_acrord32.exe
push 0xff
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
call fcn.100026f8
pop ecx
lea eax, [ebp - 0x100]
push eax
push str._sAdobeAcrobatInfo.exe
push 0xff
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
call fcn.100026f8
pop ecx
lea eax, [ebp - 0x100]
push eax
push str._sInternet_Explorerwmpscfgs.exe
push 0xff
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
call fcn.100026f8
pop ecx
call fcn.10001000
leave
ret