Function at 0x100788e1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x274
mov eax, 0x101291c6
call fcn.10123c77
mov ebx, ecx
cmp dword [ebx + 4], 0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x278], edx
je 0x10078ba2
test eax, eax
je 0x10078ba2
mov edi, 0x10131ee8
test ecx, ecx
mov esi, edi
cmovne esi, ecx
push esi
call fcn.100063d1
pop ecx
push eax
push esi
lea ecx, [ebx + 0x3c]
call fcn.10006229
mov eax, dword [ebp - 0x278]
test eax, eax
cmovne edi, eax
push edi
call fcn.100063d1
pop ecx
push eax
push edi
lea ecx, [ebx + 0xc]
call fcn.10006229
mov esi, str.NP_GetEntryPoints
lea edi, [ebp - 0x34]
push 6
pop ecx
push 5
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, str.NP_Initialize
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, str.NP_Acrobat_GetEntryPoints
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
pop ecx
movsw word es:[edi], word [esi]
mov esi, str.NP_Acrobat_Initialize
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [ebp - 0x274]
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x3c]
push eax
mov ecx, ebx
call fcn.10078061
test al, al
jne 0x10078b9a
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x48]
cmp eax, 0x64
je 0x10078ba2
lea eax, [ebp - 0x274]
mov dword [ebp - 0x278], 0x208
push eax
push 0x20019
push 0
push str.SOFTWAREMozillaPlugins_adobe.com_FlashPlayer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10078a18
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x280]
push eax
push 0
push 0x1013c750
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x278], 0
jbe 0x10078ba2
cmp word [ebp - 0x270], 0
je 0x10078ba2
lea eax, [ebp - 0x270]
push eax
call fcn.1007b0bd
mov esi, eax
test esi, esi
je 0x10078ba2
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x48]
cmp eax, 0x65
je 0x10078ba2
lea eax, [ebp - 0x68]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x27c], eax
test eax, eax
je 0x10078ba2
push 0x18
pop eax
push eax
push 0
push dword [ebx + 0x9c]
call sub.MSVCR120.dll_memset
mov eax, dword [ebx + 0x9c]
add esp, 0xc
push 0x18
pop ecx
mov word [eax], cx
xor ecx, ecx
mov eax, dword [ebx + 0x9c]
mov word [eax + 2], cx
push dword [ebx + 0x9c]
call dword [ebp - 0x27c]
test ax, ax
jne 0x10078ba2
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x27c], eax
test eax, eax
je 0x10078ba2
push 0x50
pop eax
push eax
push 0
push dword [ebx + 0x98]
call sub.MSVCR120.dll_memset
mov eax, dword [ebx + 0x98]
add esp, 0xc
push 0x50
pop ecx
mov word [eax], cx
mov eax, dword [ebx + 0x98]
push 0x11
pop ecx
mov word [eax + 2], cx
push dword [ebx + 0x98]
call dword [ebp - 0x27c]
test ax, ax
jne 0x10078ba2
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10078ba2
push dword [ebx + 0xa0]
call eax
test ax, ax
jne 0x10078ba2
lea eax, [ebp - 0x4c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10078ba2
push dword [ebx + 0xa4]
call eax
movzx eax, ax
test ax, ax
jne 0x10078ba2
cmp dword [0x10173924], 0
jne 0x10078b8b
push 8
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
pop ecx
mov dword [ebp - 0x27c], esi
xor eax, eax
mov dword [ebp - 4], eax
test esi, esi
je 0x10078b7f
mov ecx, esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.1007a361
mov dword [esi], eax
jmp 0x10078b81
mov esi, eax
or dword [ebp - 4], 0xffffffff
mov dword [0x10173924], esi
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x3c]
push eax
mov ecx, ebx
call fcn.1007a1ba
mov byte [ebx + 8], 1
mov al, 1
jmp 0x10078ba4
xor al, al
call fcn.10123c26
ret 0x10