Function at 0x42aea0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e14f2
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x5256a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x54], ebx
push 0x13
xor eax, eax
mov edi, 7
push str.bDisableCryptBroker
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], ax
call fcn.00406030
xor ecx, ecx
push 0x3b
mov word [ebp - 0x2c], cx
push str.SoftwarePoliciesAdobeAcrobat_Reader11.0FeatureLockDown
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
call fcn.00406030
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
push ecx
push 0x80000002
mov dword [ebp - 4], 1
mov dword [ebp - 0x54], 3
call fcn.0041cc00
add esp, 0x10
test al, al
je 0x42af4f
mov byte [ebp - 0x49], 1
cmp dword [ebp - 0x50], ebx
jne 0x42af53
mov byte [ebp - 0x49], 0
mov ebx, 8
cmp dword [ebp - 0x18], ebx
jb 0x42af69
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00406cf9
add esp, 4
xor eax, eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x34], ebx
jb 0x42af91
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.00406cf9
add esp, 4
push 0x29
push 0x4d4950
push 2
push 0x5059fc
xor edx, edx
push str.Crypt32.dll
mov ecx, esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], dx
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x2a
push 0x4d65d0
push 2
push 0x5059cc
push str.Advapi32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x2b
push 0x4d67e0
push 2
push 0x5059b4
push str.Advapi32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x2c
push 0x4d69f0
push 2
push 0x5059a0
push str.Advapi32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x2d
push 0x4d6b10
push 2
push 0x505990
push str.Advapi32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x2e
push 0x4d6ce0
push 2
push 0x505980
push str.Advapi32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x2f
push 0x4d6e00
push 2
push 0x50596c
push str.Advapi32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x30
push 0x4d6f40
push 2
push 0x505958
push str.Advapi32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x31
push 0x4d70c0
push 2
push 0x505948
push str.Advapi32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
cmp byte [ebp - 0x49], 0
mov al, 1
jne 0x42b6a9
push 0x35
push 0x4d7350
push 2
push 0x505930
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x36
push 0x4d9950
push 2
push 0x505914
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x37
push 0x4d74e0
push 2
push 0x5058f4
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x38
push 0x4d75f0
push 2
push 0x5058d4
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x39
push 0x4d7770
push 2
push 0x5058b0
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x3a
push 0x4d7900
push 2
push 0x5058a0
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x3b
push 0x4d7a80
push 2
push 0x505884
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x3c
push 0x4d7bf0
push 2
push 0x505860
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x3d
push 0x4d7d70
push 2
push 0x50583c
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x3e
push 0x4d7f70
push 2
push 0x505820
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x3f
push 0x4d8160
push 2
push 0x505808
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x40
push 0x4d82f0
push 2
push 0x5057ec
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x41
push 0x4d8460
push 2
push 0x5057dc
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x42
push 0x4d8a60
push 2
push 0x5057c8
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x43
push 0x4d8580
push 2
push 0x5057b4
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x44
push 0x4d8700
push 2
push 0x5057a0
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x45
push 0x4d8870
push 2
push 0x505790
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x46
push 0x4d8b90
push 2
push 0x50576c
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x47
push 0x4d8e40
push 2
push 0x505754
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x48
push 0x4d8fc0
push 2
push 0x505744
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x49
push 0x4d9120
push 2
push 0x505730
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x4a
push 0x4d9280
push 2
push 0x505718
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x4b
push 0x4d93c0
push 2
push 0x505700
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x4c
push 0x4d9580
push 2
push 0x5056f0
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x4d
push 0x4d51c0
push 2
push 0x5056dc
push str.Crypt32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x32
push 0x4d71c0
push 2
push 0x5056cc
push str.Advapi32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x33
push 0x4d97e0
push 2
push 0x5056bc
push str.Advapi32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x34
push 0x4d96c0
push 2
push 0x5056a8
push str.Advapi32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x4e
push 0x4d9b70
push 2
push 0x505698
push str.Advapi32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x4f
push 0x4d9d40
push 2
push 0x505688
push str.Advapi32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x50
push 0x4d9e80
push 2
push 0x505674
push str.Advapi32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x51
push 0x4d9fa0
push 2
push 0x505664
push str.Advapi32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x52
push 0x4da0f0
push 2
push 0x505654
push str.Advapi32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x53
push 0x4da240
push 2
push 0x505640
push str.Advapi32.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x54
push 0x4da3a0
push 2
push 0x505624
push str.Ncrypt.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x55
push 0x4da4c0
push 2
push 0x5055f8
push str.Ncrypt.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x56
push 0x4da630
push 2
push 0x5055e4
push str.Ncrypt.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x57
push 0x4da780
push 2
push 0x5055d4
push str.Ncrypt.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x58
push 0x4da8c0
push 2
push 0x5055c4
push str.Ncrypt.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x59
push 0x4daa50
push 2
push 0x5055b4
push str.Ncrypt.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x5a
push 0x4dace0
push 2
push 0x50559c
push str.Ncrypt.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x5b
push 0x4dae30
push 2
push 0x50558c
push str.Ncrypt.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x5c
push 0x4dafc0
push 2
push 0x50557c
push str.Ncrypt.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
push 0x5d
push 0x4db160
push 2
push 0x505568
push str.Ncrypt.dll
mov ecx, esi
call fcn.0042a5b0
test al, al
je 0x42b6a7
mov al, 1
jmp 0x42b6a9
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401306
mov esp, ebp
pop ebp
ret