Function at 0x4c659c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x84c
mov eax, 0x563000
call fcn.00505228
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x858], esi
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x854], ebx
call fcn.004c0e6f
mov eax, dword [esi]
xor edi, edi
inc edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x854], edi
mov dword [eax + 4], 2
call fcn.004cbff2
mov ecx, eax
mov dword [esp], str.Acrobat
call fcn.0046c0d6
lea ecx, [ebp - 0x850]
test al, al
push ecx
push edi
mov edx, str.SoftwareAdobeAdobe_AcrobatDCAcroLogging
mov ecx, str.SoftwareAdobeAcrobat_ReaderDCAcroLogging
push ebx
cmovne ecx, edx
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c6867
push 4
pop edi
lea eax, [ebp - 0x84c]
mov dword [ebp - 0x84c], edi
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push str.uEnableAcroLogging
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4c6657
mov ecx, dword [esi]
mov eax, dword [ebp - 0x848]
mov dword [ecx], eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push str.LogLevel
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4c6695
cmp dword [ebp - 0x844], edi
jne 0x4c6695
mov ecx, dword [esi]
mov eax, dword [ebp - 0x848]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push str.MaxFileSize
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4c66d3
cmp dword [ebp - 0x844], edi
jne 0x4c66d3
mov ecx, dword [esi]
mov eax, dword [ebp - 0x848]
mov dword [ecx + 8], eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push str.FlushPolicy
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4c6711
cmp dword [ebp - 0x844], edi
jne 0x4c6711
mov ecx, dword [esi]
mov eax, dword [ebp - 0x848]
mov dword [ecx + 0xc], eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push str.FlushLogLevel
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4c674f
cmp dword [ebp - 0x844], edi
jne 0x4c674f
mov ecx, dword [esi]
mov eax, dword [ebp - 0x848]
mov dword [ecx + 0x10], eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push str.FlushTimeout
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4c678d
cmp dword [ebp - 0x844], edi
jne 0x4c678d
mov ecx, dword [esi]
mov eax, dword [ebp - 0x848]
mov dword [ecx + 0x14], eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push str.RotatingFiles
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4c67cb
cmp dword [ebp - 0x844], edi
jne 0x4c67cb
mov ecx, dword [esi]
mov eax, dword [ebp - 0x848]
mov dword [ecx + 0x18], eax
lea eax, [ebp - 0x84c]
mov dword [ebp - 0x84c], 0x800
push eax
lea eax, [ebp - 0x810]
xor edi, edi
push eax
lea eax, [ebp - 0x844]
inc edi
push eax
push ebx
push str.LogFilteringStr
push dword [ebp - 0x850]
mov dword [ebp - 0x844], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4c685b
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x828]
call fcn.00452fe1
lea eax, [ebp - 0x828]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x840]
push eax
call fcn.004ccc9c
pop ecx
pop ecx
mov ecx, dword [esi]
push eax
add ecx, 0x24
mov byte [ebp - 4], 2
call fcn.00461d44
lea ecx, [ebp - 0x840]
call fcn.00456855
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], bl
call fcn.0045687b
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.005051d7
ret