Function at 0x40aed0
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41270f
mov eax, dword fs:[0]
push eax
sub esp, 0x6ec
mov eax, dword [0x419038]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x250
lea eax, [ebp - 0x6a0]
mov dword [ebp - 4], 0
push 0
push eax
mov bl, 1
call sub.MSVCR120.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x6a0]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x40b109
push eax
call dword [sym.imp.kernel32.dll_FindClose]
xor eax, eax
push 0x40e
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x6bc], 0x208
lea eax, [ebp - 0x6a4]
mov dword [ebp - 0x6b4], 0
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsAcroRd32.exe
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40afd2
lea eax, [ebp - 0x6bc]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x6b4]
push eax
push 0
push 0
push dword [ebp - 0x6a4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x6a4]
xor ecx, ecx
movzx ebx, bl
test eax, eax
cmovne ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp + 0x20], 0
jne 0x40b0b5
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x450]
push 0x414cd4
push eax
call fcn.00404ae0
push 0x414cd4
push eax
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 1
push eax
call fcn.00404ae0
mov esi, eax
add esp, 0x18
lea eax, [ebp + 8]
cmp eax, esi
je 0x40b041
cmp dword [ebp + 0x1c], 8
jb 0x40b024
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
push esi
lea ecx, [ebp + 8]
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
call fcn.00404ae0
cmp dword [ebp - 0x424], 8
jb 0x40b058
push dword [ebp - 0x438]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [ebp - 0x424], 7
cmp dword [ebp - 0x43c], 8
mov dword [ebp - 0x428], 0
mov word [ebp - 0x438], ax
mov byte [ebp - 4], al
jb 0x40b08f
push dword [ebp - 0x450]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 1
cmovae eax, dword [ebp + 8]
push 0
push eax
lea eax, [ebp - 0x420]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40b10b
push 0x3c
lea eax, [ebp - 0x6f8]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x6f8], 0x3c
lea eax, [ebp - 0x420]
mov dword [ebp - 0x6f4], 0x540
mov dword [ebp - 0x6e8], eax
lea eax, [ebp - 0x6f8]
mov dword [ebp - 0x6dc], 5
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x40b13a
call dword [sym.imp.kernel32.dll_GetLastError]
xor bl, bl
cmp dword [ebp + 0x1c], 8
jb 0x40b11c
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00410c15
mov esp, ebp
pop ebp
ret
call fcn.00404ae0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40b156
push 0x80004005
call fcn.00404ae0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6a8], eax
push str._FileOpenUntitled__
lea ecx, [ebp - 0x6b8]
mov byte [ebp - 4], 2
call fcn.00404ae0
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
cmovae ecx, dword [ebp + 8]
push ecx
push eax
lea eax, [ebp - 0x6ac]
push eax
call fcn.00404ae0
push 0x4151f0
push eax
lea eax, [ebp - 0x6b0]
mov byte [ebp - 4], 4
push eax
call fcn.00404ae0
add esp, 0x18
push eax
lea ecx, [ebp - 0x6a8]
mov byte [ebp - 4], 5
call fcn.00404ae0
mov edx, dword [ebp - 0x6b0]
or edi, 0xffffffff
add edx, 0xfffffff0
mov byte [ebp - 4], 4
mov eax, edi
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x40b1e6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x6ac]
mov ecx, edi
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b209
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x6b8]
mov ecx, edi
add edx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b22c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x6a8]
push esi
push str.Control
push str.AcroviewR18
call fcn.00404ae0
add esi, 0xfffffff0
mov byte [ebp - 4], 0
add esp, 0xc
mov bl, al
lea ecx, [esi + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x40b10b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x40b10b