Function at 0x1001e991
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x88
mov eax, 0x10025b81
call fcn.10023418
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x8c], edi
mov dword [ebp - 0x78], ebx
mov byte [ebp - 0x69], bl
cmp eax, ebx
je 0x1001e9c6
mov dword [eax], ebx
cmp esi, ebx
je 0x1001e9cc
mov dword [esi], ebx
cmp edi, ebx
je 0x1001e9d2
mov dword [edi], ebx
cmp ecx, ebx
je 0x1001e9d8
mov dword [ecx], ebx
lea eax, [ebp - 0x78]
push eax
push 0x20019
push ebx
push str.SoftwareAdobeAcrobatExe
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001ed19
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x70]
push eax
push ebx
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push dword [ebp - 0x78]
mov dword [ebp - 0x70], ebx
call esi
test eax, eax
jne 0x1001ed10
cmp dword [ebp - 0x80], 1
jne 0x1001ed10
mov eax, dword [ebp - 0x70]
shr eax, 1
inc eax
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x70], eax
mul edx
seto cl
mov dword [ebp - 4], ebx
neg ecx
or ecx, eax
push ecx
call fcn.10015970
mov edi, eax
pop ecx
mov dword [ebp - 0x90], edi
cmp edi, ebx
je 0x1001ed10
push dword [ebp - 0x70]
push ebx
push edi
call fcn.10015970
mov eax, dword [ebp - 0x70]
add esp, 0xc
lea eax, [eax + eax - 2]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x70]
push eax
push edi
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push dword [ebp - 0x78]
call esi
test eax, eax
jne 0x1001ed04
cmp dword [ebp - 0x80], 1
jne 0x1001ed04
shr dword [ebp - 0x70], 1
cmp dword [ebp - 0x70], 0x11
jb 0x1001ed04
push edi
lea ecx, [ebp - 0x4c]
call fcn.10015970
cmp dword [ebp - 0x38], 8
mov edx, dword [ebp - 0x4c]
mov byte [ebp - 4], 1
jae 0x1001ec9d
lea edx, [ebp - 0x4c]
mov eax, edx
cmp dword [ebp - 0x38], 8
mov ecx, dword [ebp - 0x3c]
lea eax, [eax + ecx*2]
mov ecx, dword [ebp - 0x4c]
jae 0x1001eacd
lea ecx, [ebp - 0x4c]
mov edi, dword [sym.imp.MSVCR100.dll_towlower]
push edi
push edx
push eax
push ecx
lea eax, [ebp - 0x7c]
push eax
call fcn.10015970
add esp, 0x14
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x7c], ebx
call fcn.1001e2e8
or esi, 0xffffffff
pop ecx
pop ecx
mov dword [ebp - 0x84], esi
cmp dword [ebp - 0x74], ebx
je 0x1001eb77
push dword [ebp - 0x74]
lea ecx, [ebp - 0x30]
call fcn.10015970
mov edx, dword [ebp - 0x30]
push 8
pop esi
mov byte [ebp - 4], 2
cmp dword [ebp - 0x1c], esi
jae 0x1001eca5
lea edx, [ebp - 0x30]
mov eax, edx
mov ecx, dword [ebp - 0x20]
lea eax, [eax + ecx*2]
mov ecx, dword [ebp - 0x30]
cmp dword [ebp - 0x1c], esi
jae 0x1001eb3a
lea ecx, [ebp - 0x30]
push edi
push edx
push eax
push ecx
lea eax, [ebp - 0x88]
push eax
call fcn.10015970
mov eax, dword [ebp - 0x30]
add esp, 0x14
cmp dword [ebp - 0x1c], esi
jae 0x1001eb58
lea eax, [ebp - 0x30]
push dword [ebp - 0x20]
lea ecx, [ebp - 0x4c]
push 0xffffffffffffffff
push eax
call fcn.10015970
push ebx
push 1
lea ecx, [ebp - 0x30]
mov esi, eax
mov byte [ebp - 4], 1
call fcn.10015970
mov ebx, dword [ebp - 0x7c]
test ebx, ebx
je 0x1001ebf2
push ebx
lea ecx, [ebp - 0x30]
call fcn.10015970
cmp dword [ebp - 0x1c], 8
mov edx, dword [ebp - 0x30]
mov byte [ebp - 4], 3
jae 0x1001ecad
lea edx, [ebp - 0x30]
mov eax, edx
cmp dword [ebp - 0x1c], 8
mov ecx, dword [ebp - 0x20]
lea eax, [eax + ecx*2]
mov ecx, dword [ebp - 0x30]
jae 0x1001ebaf
lea ecx, [ebp - 0x30]
push edi
push edx
push eax
push ecx
lea eax, [ebp - 0x88]
push eax
call fcn.10015970
mov eax, dword [ebp - 0x30]
add esp, 0x14
cmp dword [ebp - 0x1c], 8
jae 0x1001ebce
lea eax, [ebp - 0x30]
push dword [ebp - 0x20]
lea ecx, [ebp - 0x4c]
push 0xffffffffffffffff
push eax
call fcn.10015970
push 0
push 1
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x84], eax
mov byte [ebp - 4], 1
call fcn.10015970
cmp dword [ebp - 0x74], 0
je 0x1001ec01
push dword [ebp - 0x74]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
test ebx, ebx
je 0x1001ec0c
push ebx
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
cmp esi, 0xffffffff
jne 0x1001ec27
cmp dword [ebp - 0x84], esi
je 0x1001ecf8
cmp esi, esi
jne 0x1001ec27
mov esi, dword [ebp - 0x84]
push str.adobe_reader
lea ecx, [ebp - 0x30]
call fcn.10015970
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], 4
jae 0x1001ec44
lea eax, [ebp - 0x30]
push dword [ebp - 0x20]
lea ecx, [ebp - 0x4c]
push esi
push eax
call fcn.10015970
mov edi, eax
cmp edi, 0xffffffff
je 0x1001ecec
mov eax, dword [ebp - 0x94]
test eax, eax
je 0x1001ec6c
mov dword [eax], 1
mov ebx, dword [ebp - 0x8c]
mov byte [ebp - 0x69], 1
test ebx, ebx
je 0x1001ecec
mov esi, 0x10029d04
push esi
call dword [sym.imp.MSVCR100.dll_wcslen]
pop ecx
push eax
push edi
push esi
lea ecx, [ebp - 0x4c]
call fcn.10015970
cmp eax, 0xffffffff
jne 0x1001ecb5
mov byte [ebp - 0x69], 0
jmp 0x1001ecec
mov eax, dword [ebp - 0x4c]
jmp 0x1001eabb
mov eax, dword [ebp - 0x30]
jmp 0x1001eb29
mov eax, dword [ebp - 0x30]
jmp 0x1001eb9d
push 2
add eax, 0xfffffffe
push eax
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x4c]
call fcn.10015970
cmp dword [ebp - 0x54], 8
mov eax, dword [ebp - 0x68]
jae 0x1001ecd3
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCR100.dll__wtol]
pop ecx
push 0
shl eax, 0x10
push 1
lea ecx, [ebp - 0x68]
mov dword [ebx], eax
call fcn.10015970
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.10015970
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.10015970
push dword [ebp - 0x90]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [ebp - 0x69]
call fcn.10023474
ret