Function at 0x401ca0
Capabilities:
Extract resource via kernel32 functions
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411f4c
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x41e010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x94], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov dword [ebp - 0x94], 1
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], al
push 0x3e7
push 0x67
push eax
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4020dc
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x90], eax
test eax, eax
je 0x4020dc
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x90]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4020dc
push esi
push eax
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
call fcn.004017f0
movups xmm0, xmmword [ebp - 0x70]
mov esi, dword [ebp - 0x60]
mov edx, dword [ebp - 0x70]
movups xmmword [ebp - 0x88], xmm0
movq xmm0, qword [ebp - 0x60]
movq qword [ebp - 0x78], xmm0
test esi, esi
je 0x4020ad
cmp dword [ebp - 0x5c], 0x10
lea eax, [ebp - 0x88]
cmovae eax, edx
mov dword [ebp - 0x9c], eax
cmp esi, 0x10
jae 0x401dd3
movups xmm0, xmmword [eax]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x8c], 0xf
movups xmmword [ebp - 0x28], xmm0
jmp 0x401e13
mov eax, esi
mov ecx, 0x7fffffff
or eax, 0xf
cmp eax, ecx
cmova eax, ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x8c], eax
inc eax
push eax
call fcn.004015d0
mov ecx, eax
lea eax, [esi + 1]
push eax
push dword [ebp - 0x9c]
mov dword [ebp - 0x28], ecx
push ecx
call fcn.00404550
mov eax, dword [ebp - 0x8c]
add esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x8c], 0x10
lea eax, [ebp - 0x28]
push 0xa
cmovae eax, dword [ebp - 0x28]
push str.Continuous
push esi
push eax
mov byte [ebp - 4], 2
call fcn.00401b40
add esp, 0x10
test eax, eax
jne 0x401e46
push 2
push 0x4122b4
jmp 0x401e70
cmp dword [ebp - 0x8c], 0x10
lea eax, [ebp - 0x28]
push 9
cmovae eax, dword [ebp - 0x28]
push str.Perpetual
push esi
push eax
call fcn.00401b40
add esp, 0x10
test eax, eax
jne 0x401e78
push 4
push str.2017
lea ecx, [ebp - 0x28]
call fcn.004017f0
mov esi, dword [ebp - 0x18]
add esi, 0x1d
mov byte [ebp - 4], 3
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
mov dword [ebp - 0x94], 3
cmp esi, 0xf
jbe 0x401eeb
cmp esi, 0x7fffffff
ja 0x4020f9
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x401ec1
mov esi, 0x7fffffff
jmp 0x401ecb
mov eax, 0x16
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x40]
call fcn.004015d0
mov ecx, eax
mov dword [ebp - 0x2c], esi
mov al, byte [ebp - 0x40]
mov byte [ecx], al
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x30], 0
push 0x1d
push str.SOFTWAREAdobeAdobe_Acrobat_
lea ecx, [ebp - 0x40]
call fcn.00401690
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x40]
push eax
call fcn.00401690
push 0xc
push str.InstallPath
lea ecx, [ebp - 0x40]
call fcn.00401690
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x58], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x48], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov dword [ebp - 0x94], 5
mov edx, dword [ebp - 0x2c]
mov byte [ebp - 4], 5
cmp edx, 0x10
jb 0x401f92
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x401f88
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4020fe
push edx
push ecx
call fcn.004031dc
add esp, 8
cmp dword [ebp - 0x44], 0x10
lea ecx, [ebp - 0x98]
push ecx
push 1
lea eax, [ebp - 0x58]
mov dword [ebp - 0x30], 0
cmovae eax, dword [ebp - 0x58]
push 0
push eax
push 0x80000002
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402034
lea eax, [ebp - 0x90]
push eax
push 0
push 0
push 0
push 0
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402028
push dword [ebp - 0x90]
call fcn.00403223
add esp, 4
mov esi, eax
lea eax, [ebp - 0x90]
push eax
push esi
push 0
push 0
push 0
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40201f
push esi
mov ecx, edi
call fcn.004022a0
push esi
call fcn.004031ea
add esp, 4
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x44]
cmp edx, 0x10
jb 0x402068
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40205e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402103
push edx
push ecx
call fcn.004031dc
add esp, 8
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
cmp edx, 0x10
jb 0x4020aa
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4020a0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402103
push edx
push ecx
call fcn.004031dc
add esp, 8
mov edx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x5c]
cmp eax, 0x10
jb 0x4020dc
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x4020d2
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402108
push ecx
push edx
call fcn.004031dc
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004031ef
mov esp, ebp
pop ebp
ret
call fcn.004015b0
call fcn.00406aaa
call fcn.00406aaa
call fcn.00406aaa
int3