Function at 0x500ab7e
Capabilities:
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
and byte [ebp - 1], 0
push esi
lea eax, [ebp - 8]
push edi
push eax
push 0x20019
mov edi, str.SOFTWAREAdobeCommonFiles
push 0
mov esi, 0x80000002
push edi
push esi
call ebx
test eax, eax
jne 0x500ac1e
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x410
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.AdobeHome
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x500ac0b
cmp dword [ebp - 0x10], 1
jne 0x500ac0b
lea eax, [ebp - 0x420]
push 0x505fc70
push eax
call fcn.05041a60
pop ecx
test eax, eax
pop ecx
je 0x500ac0b
push eax
push dword [ebp + 8]
call fcn.0500a79d
pop ecx
test al, al
pop ecx
je 0x500ac0b
mov byte [ebp - 1], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 1], 0
jne 0x500aca3
cmp byte [ebp + 0xc], 0
jne 0x500ac2b
xor al, al
jmp 0x500adab
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x500ac24
push dword [ebp + 8]
call fcn.0500adb0
pop ecx
xor ecx, ecx
cmp eax, ecx
je 0x500ac24
and byte [eax], cl
mov byte [eax - 1], 0x3b
lea eax, [ebp - 8]
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, dword [ebp + 8]
test eax, eax
jne 0x500ac94
push edi
call fcn.05041440
pop ecx
inc eax
push eax
push edi
push 1
push 0
push str.AdobeHome
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x505fc6c
push edi
call fcn.05041a60
pop ecx
pop ecx
jmp 0x500aca6
mov edi, dword [ebp + 8]
push edi
call fcn.05041440
test eax, eax
pop ecx
je 0x500ac24
push edi
call fcn.05041440
cmp byte [eax + edi - 1], 0x5c
pop ecx
je 0x500acd8
push 0x505fc08
push edi
call fcn.0500a7cb
pop ecx
test al, al
pop ecx
je 0x500ac24
and byte [ebp + 0xb], 0
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push esi
call ebx
test eax, eax
jne 0x500ad5c
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x410
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.CommonFilesDir
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x500ad4d
lea eax, [ebp - 0x420]
push eax
call fcn.0500adb0
test eax, eax
pop ecx
je 0x500ad4d
push eax
push edi
call fcn.0500a7cb
pop ecx
test al, al
pop ecx
jne 0x500ad49
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x500ac24
mov byte [ebp + 0xb], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp + 0xb], 0
jne 0x500ad71
push str.Program_FilesCommon_Files
push edi
call fcn.0500a7cb
pop ecx
test al, al
pop ecx
je 0x500ac24
push str.Adobe_
push edi
call fcn.0500a7cb
pop ecx
test al, al
pop ecx
je 0x500ac24
push edi
call fcn.0500aad2
test al, al
pop ecx
je 0x500ad95
mov al, 1
jmp 0x500adab
cmp byte [ebp + 0xc], 0
je 0x500ac24
push edi
call fcn.0500aaeb
test al, al
pop ecx
setne al
pop edi
pop esi
pop ebx
leave
ret