Function at 0x40e165
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x435ef9
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x44a1ac]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push esi
push edi
mov eax, dword [0x44a1ac]
xor eax, esp
push eax
lea eax, [esp + 0x128]
mov dword fs:[0], eax
xor edi, edi
inc edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], 0x80000002
xor ebx, ebx
mov dword [esp + 0x130], ebx
push str.SOFTWAREPoliciesAdobeAPIP
lea ecx, [esp + 0xd0]
mov dword [esp + 0x1c], 0xf003f
call fcn.00407afd
lea edx, [esp + 0x18]
lea ecx, [esp + 0xcc]
lea esi, [esp + 0x14]
mov byte [esp + 0x130], 1
call fcn.0041304d
push ebx
push edi
lea ecx, [esp + 0xd4]
mov byte [esp + 0x1b], al
mov byte [esp + 0x138], bl
call fcn.004069c7
cmp byte [esp + 0x13], bl
je 0x40e3d9
xor eax, eax
mov dword [esp + 0xfc], 7
mov dword [esp + 0xf8], ebx
mov word [esp + 0xe8], ax
push str.DEPPolicy
lea ecx, [esp + 0xd0]
mov byte [esp + 0x134], 2
call fcn.00407afd
mov byte [esp + 0x130], 3
cmp dword [esp + 0x14], ebx
jne 0x40e261
mov byte [esp + 0x13], bl
jmp 0x40e399
mov edi, 0x802
push edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], 0x400
call fcn.0041d30e
pop ecx
push edi
mov esi, eax
push ebx
push esi
call dword [sym.imp.MSVCR100.dll_memset]
mov eax, dword [esp + 0xd8]
add esp, 0xc
cmp dword [esp + 0xe0], 8
jae 0x40e29f
lea eax, [esp + 0xcc]
lea ecx, [esp + 0x20]
push ecx
push esi
lea ecx, [esp + 0x20]
push ecx
push ebx
push eax
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cdq
cmp eax, ebx
jne 0x40e2bf
cmp edx, ebx
je 0x40e2f9
lea eax, [esp + 0x104]
push str.Query_registry_value_with_key:
push eax
lea edi, [esp + 0xd4]
call fcn.00410777
pop ecx
pop ecx
push ebx
push 1
lea ecx, [esp + 0x10c]
call fcn.004069c7
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
mov byte [esp + 0x17], bl
jmp 0x40e398
cmp dword [esp + 0x18], 4
jne 0x40e376
mov edi, dword [esi]
lea eax, [esp + 0x24]
push eax
call fcn.004131b4
push edi
lea ecx, [esp + 0x38]
mov byte [esp + 0x134], 4
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int_]
lea ecx, [esp + 0x104]
lea eax, [esp + 0x24]
call fcn.00413261
push eax
lea ecx, [esp + 0xec]
mov byte [esp + 0x134], 5
call fcn.00406827
push ebx
push 1
lea ecx, [esp + 0x10c]
call fcn.004069c7
lea ecx, [esp + 0x84]
mov byte [esp + 0x130], 3
call fcn.00413224
lea ecx, [esp + 0x84]
call dword [sym.imp.MSVCP100.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
jmp 0x40e38c
push esi
call dword [sym.imp.MSVCR100.dll_wcslen]
pop ecx
push eax
push esi
lea ecx, [esp + 0xf0]
call fcn.00406770
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
mov byte [esp + 0x17], 1
pop ecx
push ebx
push 1
lea ecx, [esp + 0xd4]
mov byte [esp + 0x138], 2
call fcn.004069c7
cmp byte [esp + 0x13], bl
je 0x40e3ca
lea esi, [esp + 0xe8]
call fcn.00410720
test al, al
je 0x40e3ca
mov dword [esp + 0x1c], ebx
push ebx
push 1
lea ecx, [esp + 0xf0]
call fcn.004069c7
cmp dword [esp + 0x14], ebx
je 0x40e3e9
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x128]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0041d3a4
mov esp, ebp
pop ebp
ret