Function at 0x1000d50a
Capabilities:
Get file version info
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x6d0]
sub esp, 0x750
mov eax, dword [0x100141e0]
xor eax, ebp
mov dword [ebp + 0x6cc], eax
push ebx
mov ebx, dword [sym.imp.MSVCR80.dll__wcsicmp]
push esi
push edi
mov esi, ecx
xor edi, edi
push 0x10010bf8
push dword [esi + 0x48]
mov dword [ebp - 0x6c], edi
mov word [esi + 0x46], di
mov word [ebp - 0x64], di
mov word [ebp + 0x334], di
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x1000d6d1
lea eax, [ebp - 0x6c]
push eax
push 0x20019
push edi
push str.SoftwareAdobeAcrobatExe
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x1000d6d1
push 0x398
lea eax, [ebp - 0x64]
push edi
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x80]
push eax
push edi
push edi
push dword [ebp - 0x6c]
mov dword [ebp - 0x70], 0x396
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x68], eax
push 0x1cc
lea eax, [ebp - 0x64]
push eax
push dword [esi + 0x48]
call dword [sym.imp.MSVCR80.dll_wcsncpy]
add esp, 0xc
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x68], edi
jne 0x1000d6d1
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
test eax, eax
pop ecx
je 0x1000d6d1
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
cmp eax, 0x1be
pop ecx
jae 0x1000d6d1
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x334]
push 0x1cb
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
lea eax, [ebp + 0x334]
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
add esp, 0x10
cmp eax, 4
mov dword [ebp - 0x70], eax
mov word [ebp + eax*2 + 0x332], di
jle 0x1000d669
lea eax, [ebp + eax*2 + 0x32a]
push str..exe
push eax
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x1000d669
mov eax, dword [ebp - 0x70]
mov ecx, 0x1cb
sub ecx, eax
push str..DLL
push ecx
lea eax, [ebp + eax*2 + 0x32a]
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x336]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, edi
mov dword [ebp - 0x78], eax
jbe 0x1000d6d1
push eax
call dword [sym.imp.MSVCR80.dll_malloc]
cmp eax, edi
pop ecx
mov dword [ebp - 0x68], eax
je 0x1000d6d1
cmp dword [esi + 0x50], edi
jne 0x1000d6d1
push eax
push dword [ebp - 0x78]
lea eax, [ebp + 0x336]
push edi
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1000d6c7
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x10010b04
push dword [ebp - 0x68]
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + 8]
mov dword [esi + 0x50], eax
push dword [ebp - 0x68]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
push 0x398
call dword [esi + 0x28]
mov word [eax], di
mov dword [esp], 0x10010bf8
push dword [esi + 0x4c]
mov dword [ebp - 0x68], eax
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x1000d711
push 0x1cc
push dword [ebp - 0x68]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x1cc
push dword [esi + 0x4c]
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push 0x5c
push dword [esi + 0x4c]
call dword [sym.imp.MSVCR80.dll_wcsrchr]
cmp eax, edi
pop ecx
pop ecx
je 0x1000d736
push str.FormDesigner.exe
push eax
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x1000d736
mov word [esi + 0x46], 1
push dword [ebp - 0x68]
call dword [esi + 0x2c]
movzx eax, word [esi + 0x52]
cmp ax, 9
pop ecx
jb 0x1000d754
cmp word [esi + 0x46], di
jne 0x1000d754
call fcn.1000d203
jmp 0x1000d768
cmp ax, 7
jb 0x1000d763
mov edi, esi
call fcn.1000d09f
jmp 0x1000d768
mov eax, 0x400f006a
mov ecx, dword [ebp + 0x6cc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000e3d8
add ebp, 0x6d0
leave
ret