Function at 0x44ed80
Capabilities:
Parse pe header
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x244
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x520400
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x23c], 7
mov dword [ebp - 0x240], 0
mov word [ebp - 0x250], 0
sub esp, 0xc
mov al, byte [ebp - 0x44]
lea ecx, [ebp - 0x250]
mov byte [esp + 4], al
mov dword [esp + 8], str.bDisableCryptBroker
mov dword [esp], 0x13
call fcn.00405590
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], 0
mov dword [ebp - 0x10], 3
sub esp, 0xc
mov al, byte [ebp - 0x24]
lea ecx, [ebp - 0x44]
mov byte [esp + 4], al
mov dword [esp + 8], str.SoftwarePoliciesAdobeAcrobat_ReaderDCFeatureLockDown
mov dword [esp], 0x39
call fcn.00405590
lea eax, [ebp - 0x48]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x44]
push eax
push 0x80000002
call fcn.004114c0
add esp, 0x10
cmp dword [ebp - 0x48], 0
mov ecx, dword [ebp - 0x30]
mov ebx, eax
setne bh
cmp ecx, 8
jb 0x44ee9b
mov eax, dword [ebp - 0x44]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x44ee91
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x44f9c2
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov ecx, dword [ebp - 0x23c]
mov byte [ebp - 0x1f], bh
mov byte [ebp - 0x1d], bl
cmp ecx, 8
jb 0x44eee2
mov eax, dword [ebp - 0x250]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x44eed8
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x44f9ce
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov esi, dword [0x6d1ebc]
mov dword [ebp - 0x10], 0xffffffff
lea edi, [esi + 8]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov al, byte [esi + 0x58]
mov dword [ebp - 0x10], 2
mov byte [ebp - 0x1e], al
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov bl, byte [ebp - 0x1d]
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x250]
and bl, byte [ebp - 0x1f]
cmp byte [ebp - 0x1e], 0
je 0x44ef93
mov byte [ebp - 0x1d], bl
mov dword [ebp - 0x44], 0
push 0x208
push 0
push edi
call fcn.0061e8c0
add esp, 0xc
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x10], 0xffffffff
push str.SoftwareAdobeAcrobat_ReaderDCFeatureState
push 0x104
push edi
call fcn.005cfe48
add esp, 0xc
lea eax, [ebp - 0x44]
push eax
push 0x20019
push 0
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x44f707
xor ebx, ebx
xor edi, edi
jmp 0x44f743
mov dword [ebp - 0x10], 0xffffffff
mov ecx, esi
push 0x39
push 0x5bf250
push 2
push 0x67f7ec
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x3a
push 0x5bf550
push 2
push 0x67f7fd
push str.Advapi32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x3b
push 0x420510
push 2
push 0x67f688
push str.Advapi32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x3c
push 0x421680
push 2
push 0x67f812
push str.Advapi32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x3d
push 0x5bfa50
push 2
push 0x67f826
push str.Advapi32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x3e
push 0x5bff90
push 2
push 0x67f835
push str.Advapi32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x3f
push 0x5c0300
push 2
push 0x67f845
push str.Advapi32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x40
push 0x5c0570
push 2
push 0x67f857
push str.Advapi32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x41
push 0x420ed0
push 2
push 0x67f869
push str.Advapi32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x65
push 0x5ca050
push 2
push 0x67f878
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x66
push 0x5ca4a0
push 2
push 0x67f889
push str.Crypt32.dll
call fcn.0044dd00
mov ecx, eax
xor cl, 1
or bl, cl
jne 0x44f9ad
mov ecx, esi
push 0x45
push 0x5c0cd0
push 2
push 0x67f8ab
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x46
push 0x5c7d60
push 2
push 0x67f8c0
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x47
push 0x5c1300
push 2
push 0x67f8db
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x48
push 0x5c1540
push 2
push 0x67f732
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x49
push 0x5c19a0
push 2
push 0x67f752
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x4a
push 0x5c1c10
push 2
push 0x67f8fa
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x4b
push 0x5c2630
push 2
push 0x67f7d1
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x4c
push 0x5c29b0
push 2
push 0x67f909
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x4d
push 0x5c2db0
push 2
push 0x67f92a
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x4e
push 0x5c3190
push 2
push 0x67f716
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x4f
push 0x5c3670
push 2
push 0x67f94b
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x50
push 0x5c3af0
push 2
push 0x67f963
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x51
push 0x5c3e30
push 2
push 0x67f707
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x52
push 0x5c4cc0
push 2
push 0x67f6f6
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x53
push 0x5c4140
push 2
push 0x67f97c
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x54
push 0x5c44c0
push 2
push 0x67f98f
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x55
push 0x5c4720
push 2
push 0x67f6e8
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x56
push 0x5c4fd0
push 2
push 0x67f9a2
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x57
push 0x5c57c0
push 2
push 0x67f6b8
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x58
push 0x5c6460
push 2
push 0x67f9c4
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x59
push 0x5c6780
push 2
push 0x67f9d2
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x5a
push 0x5c69d0
push 2
push 0x67f9e3
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x5b
push 0x5c6da0
push 2
push 0x67f9f8
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x5c
push 0x5c7420
push 2
push 0x67fa0d
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x5d
push 0x4211e0
push 2
push 0x67fa1c
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x42
push 0x5c0960
push 2
push 0x67fa2f
push str.Advapi32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x43
push 0x5c7a30
push 2
push 0x67fa3f
push str.Advapi32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x44
push 0x5c7720
push 2
push 0x67fa4c
push str.Advapi32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x5e
push 0x5c87a0
push 2
push 0x67fa5d
push str.Advapi32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x5f
push 0x5c8d70
push 2
push 0x67fa6d
push str.Advapi32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x60
push 0x5c90a0
push 2
push 0x67fa7b
push str.Advapi32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x61
push 0x5c9410
push 2
push 0x67fa8c
push str.Advapi32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x62
push 0x5c97b0
push 2
push 0x67fa9b
push str.Advapi32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x63
push 0x5c9b50
push 2
push 0x67faaa
push str.Advapi32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x64
push 0x5c9db0
push 2
push 0x67fabc
push str.Advapi32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x67
push 0x5cab80
push 2
push 0x67f774
push str.Ncrypt.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x68
push 0x5cad50
push 2
push 0x67face
push str.Ncrypt.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x69
push 0x5cb100
push 2
push 0x67fae0
push str.Ncrypt.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x6a
push 0x5cb450
push 2
push 0x67f7b5
push str.Ncrypt.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x6b
push 0x5cb850
push 2
push 0x67faf2
push str.Ncrypt.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x6c
push 0x5cbdb0
push 2
push 0x67fb02
push str.Ncrypt.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x6d
push 0x5cc2d0
push 2
push 0x67fb12
push str.Ncrypt.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x6e
push 0x5cc7a0
push 2
push 0x67f7c3
push str.Ncrypt.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x6f
push 0x5ccb40
push 2
push 0x67fb28
push str.Ncrypt.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x70
push 0x5ccf30
push 2
push 0x67f7a4
push str.Ncrypt.dll
jmp 0x44f95b
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x24]
push eax
push ecx
push edx
push 0
push str.4350232
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x24]
xor ecx, 4
or ecx, eax
sete bl
cmp dword [ebp - 0x28], 0
setne al
and al, bl
movzx edi, al
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
mov bl, byte [ebp - 0x1d]
jne 0x44f7b0
mov dword [ebp - 0x44], 0
push 0x208
push 0
lea edi, [ebp - 0x250]
push edi
call fcn.0061e8c0
add esp, 0xc
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 4
push str.SoftwareAdobeAdobe_AcrobatDCFeatureState
push 0x104
push edi
call fcn.005cfe48
add esp, 0xc
lea eax, [ebp - 0x44]
push eax
push 0x20019
push 0
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x44f966
xor edi, edi
test di, di
je 0x44f9ab
mov ecx, esi
push 0x3b
push 0x420510
push 2
push 0x67f688
push str.Advapi32.dll
call fcn.0044dd00
mov ecx, eax
xor cl, 1
or bl, cl
jne 0x44f9ad
mov ecx, esi
push 0x57
push 0x5c57c0
push 2
push 0x67f6b8
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x55
push 0x5c4720
push 2
push 0x67f6e8
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x52
push 0x5c4cc0
push 2
push 0x67f6f6
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x51
push 0x5c3e30
push 2
push 0x67f707
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x4e
push 0x5c3190
push 2
push 0x67f716
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x48
push 0x5c1540
push 2
push 0x67f732
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x49
push 0x5c19a0
push 2
push 0x67f752
push str.Crypt32.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x67
push 0x5cab80
push 2
push 0x67f774
push str.Ncrypt.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x70
push 0x5ccf30
push 2
push 0x67f7a4
push str.Ncrypt.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x6a
push 0x5cb450
push 2
push 0x67f7b5
push str.Ncrypt.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x6e
push 0x5cc7a0
push 2
push 0x67f7c3
push str.Ncrypt.dll
call fcn.0044dd00
test al, al
je 0x44f962
mov ecx, esi
push 0x4b
push 0x5c2630
push 2
push 0x67f7d1
push str.Crypt32.dll
call fcn.0044dd00
jmp 0x44f9ad
xor eax, eax
jmp 0x44f9ad
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x24]
push eax
push ecx
push edx
push 0
push str.4350232
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x24]
xor ecx, 4
or ecx, eax
sete al
cmp dword [ebp - 0x28], 0
setne cl
and cl, al
movzx edi, cl
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test di, di
jne 0x44f7b9
mov al, 1
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x244
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
call fcn.006207e0
mov dword [ebp - 0x10], 1
call fcn.006207e0
nop word [eax + eax]
push ebp
sub esp, 0x18
add ebp, 0xc
call fcn.0061de80
nop dword [eax]
push ebp
sub esp, 0x18
add ebp, 0xc
call fcn.0061de80
nop dword [eax]
push ebp
sub esp, 0x18
add ebp, 0xc
call fcn.0061de80
nop dword [eax]
push ebp
sub esp, 0x18
add ebp, 0xc
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x44fa4e
mov eax, dword [ebp - 0x44]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x44fa44
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x44fa67
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], 0
add esp, 0x18
pop ebp
ret
call fcn.006207e0
nop dword [eax]
push ebp
sub esp, 0x18
add ebp, 0xc
mov ecx, dword [ebp - 0x23c]
cmp ecx, 8
jb 0x44fab4
mov eax, dword [ebp - 0x250]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jb 0x44faaa
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x44fab9
add ecx, ecx
add ecx, 0x25
mov edx, ecx
push edx
push eax
call fcn.005d319e
add esp, 8
add esp, 0x18
pop ebp
ret
call fcn.006207e0
int3