Function at 0x401970
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43af54
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x44eca0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.ARM.0
push str.AdobeARM.exe
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00402730
mov dword [ebp - 4], 0
push str.Adobe_Acrobat
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.00402730
mov byte [ebp - 4], 1
push str.Adobe_Reader
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.00402730
mov byte [ebp - 4], 2
push str.Adobe_Acrobat_Updater
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.00402730
mov byte [ebp - 4], 3
push str.Adobe_Reader_Updater
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.00402730
mov byte [ebp - 4], 4
push str.1.8.0.0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00402730
mov byte [ebp - 4], 5
push str.AdobeARMHelper.exe
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.00402730
mov byte [ebp - 4], 6
push str.AdobeARM.bin
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.00402730
mov byte [ebp - 4], 7
push str.AdobeARM.msi
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.00402730
mov byte [ebp - 4], 8
push str.AdobeARM
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.00402730
mov byte [ebp - 4], 9
push str.ArmManifest2.msi
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.00402730
mov byte [ebp - 4], 0xa
push str.RevertToSemiFromFullAuto
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00402730
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.00402690
mov byte [ebp - 4], 0xc
push str.thsnYaVieBoda
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.00402730
mov byte [ebp - 4], 0xd
push str.https:__armmf.adobe.com_arm_manifests_win_
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.00402730
mov byte [ebp - 4], 0xe
push str.http:__www.adobe.com_support_downloads_product.jsp_product1platformWindows
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.00402730
mov byte [ebp - 4], 0xf
push str.http:__www.adobe.com_support_downloads_product.jsp_product10platformWindows
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00402730
mov byte [ebp - 4], 0x10
push str.SOFTWAREAdobeAdobe_ARM1.0ARM
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.00402730
mov byte [ebp - 4], 0x11
push str.SOFTWAREAdobeAdobe_ARM1.0ARMCleanup
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.00402730
mov byte [ebp - 4], 0x12
push str.SOFTWAREAdobeAdobe_ARMProducts
mov ecx, dword [ebp - 0x10]
add ecx, 0x50
call fcn.00402730
mov byte [ebp - 4], 0x13
push str.iLogLevel
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
call fcn.00402730
mov byte [ebp - 4], 0x14
push str.iDebugArm
mov ecx, dword [ebp - 0x10]
add ecx, 0x58
call fcn.00402730
mov byte [ebp - 4], 0x15
push str.iCanExit
mov ecx, dword [ebp - 0x10]
add ecx, 0x5c
call fcn.00402730
mov byte [ebp - 4], 0x16
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov ecx, dword [ebp - 0x10]
add ecx, 0x60
call fcn.00402730
mov byte [ebp - 4], 0x17
push str.tUpgradeCache
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
call fcn.00402730
mov byte [ebp - 4], 0x18
push str.iStartTimeDaysRemaining
mov ecx, dword [ebp - 0x10]
add ecx, 0x68
call fcn.00402730
mov byte [ebp - 4], 0x19
push str.AdobeARM.log
mov ecx, dword [ebp - 0x10]
add ecx, 0x6c
call fcn.00402730
mov byte [ebp - 4], 0x1a
push str.AdobeARM_backup.log
mov ecx, dword [ebp - 0x10]
add ecx, 0x70
call fcn.00402730
mov byte [ebp - 4], 0x1b
push str.ForceError
mov ecx, dword [ebp - 0x10]
add ecx, 0x74
call fcn.00402730
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret