Function at 0x409836
Capabilities:
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40b6e9
mov eax, dword fs:[0]
push eax
mov eax, 0x14e8
call fcn.0040a9f0
mov eax, dword [0x412120]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14e8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14ec], eax
xor eax, eax
mov ebx, 0x206
push ebx
mov word [ebp - 0x648], ax
xor edi, edi
lea eax, [ebp - 0x646]
push edi
push eax
call sub.MSVCR100.dll_memset
xor eax, eax
push ebx
mov word [ebp - 0x440], ax
lea eax, [ebp - 0x43e]
push edi
push eax
call sub.MSVCR100.dll_memset
xor eax, eax
push ebx
mov word [ebp - 0xe68], ax
lea eax, [ebp - 0xe66]
push edi
push eax
call sub.MSVCR100.dll_memset
add esp, 0x24
mov esi, 0x104
push esi
lea eax, [ebp - 0x440]
push eax
push dword [ebp - 0x14e8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x14f4]
push eax
lea eax, [ebp - 0xe68]
push eax
push esi
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push dword [ebp - 0x14f4]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
mov dword [ebp - 0x14dc], 1
sub dword [ebp - 0x14dc], eax
lea eax, [ebp - 0x440]
push eax
call esi
add eax, dword [ebp - 0x14dc]
push eax
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x648]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
xor eax, eax
push ebx
mov word [ebp - 0xa58], ax
lea eax, [ebp - 0xa56]
push edi
push eax
call sub.MSVCR100.dll_memset
xor eax, eax
push ebx
mov word [ebp - 0xc60], ax
lea eax, [ebp - 0xc5e]
push edi
push eax
call sub.MSVCR100.dll_memset
mov esi, 0x40d130
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
lea edi, [ebp - 0x26]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, 0x40d12c
push edi
lea eax, [ebp - 0xa58]
push eax
lea eax, [ebp - 0x14dc]
push eax
push dword [ebp - 0x14ec]
xor esi, esi
mov dword [ebp - 0x14e8], esi
mov dword [ebp - 0x14dc], esi
call fcn.0040140d
add esp, 0x28
cmp dword [ebp - 0x14dc], 0xffffffff
je 0x409a0f
push edi
lea eax, [ebp - 0xc60]
push eax
lea eax, [ebp - 0x14dc]
push eax
push dword [ebp - 0x14ec]
call fcn.0040140d
lea eax, [ebp - 0xc60]
push eax
call dword [sym.imp.MSVCR100.dll__wtoi64]
add esp, 0x14
cmp dword [ebp - 0x14dc], 0xffffffff
mov dword [ebp - 0x14e8], eax
je 0x409a0f
push edi
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x14dc]
push eax
push dword [ebp - 0x14ec]
call fcn.0040140d
add esp, 0x10
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push ebx
mov word [ebp - 0x238], ax
lea eax, [ebp - 0x236]
push esi
push eax
call sub.MSVCR100.dll_memset
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00401626
add esp, 0x18
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.Legal_
lea eax, [ebp - 0x238]
push eax
call edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x238]
push eax
call edi
push 0x40d128
lea eax, [ebp - 0x238]
push eax
call edi
xor eax, eax
push ebx
mov word [ebp - 0x850], ax
lea eax, [ebp - 0x84e]
push esi
push eax
mov dword [ebp - 0x14e0], esi
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x850]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.eula.ini
lea eax, [ebp - 0x850]
push eax
call edi
lea eax, [ebp - 0x850]
push eax
push esi
push str.RightToLeft
push str.labels
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0xa58]
lea ecx, [ebp - 0x14d8]
push eax
je 0x409b2e
call fcn.00402242
push esi
push dword [ebp - 0x14e8]
lea ecx, [ebp - 0x14d8]
mov dword [ebp - 4], esi
call fcn.004096d2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14d8]
mov dword [ebp - 0x14e0], eax
call fcn.004035be
jmp 0x409b61
call fcn.00403816
push esi
push dword [ebp - 0x14e8]
lea ecx, [ebp - 0x14d8]
mov dword [ebp - 4], 1
call fcn.0040972b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14d8]
mov dword [ebp - 0x14e0], eax
call fcn.00403fe2
cmp dword [ebp - 0x14e0], 1
jne 0x409c11
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x14f0]
push eax
lea eax, [ebp - 0x14e4]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
mov ebx, str.SoftwareAdobeAcrobat_Reader11.0AdobeViewer
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x409bc5
push 4
lea eax, [ebp - 0x14e0]
push eax
push 4
push esi
push 0x40d0a4
push dword [ebp - 0x14e4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14e4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14f0]
push eax
lea eax, [ebp - 0x14e4]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push ebx
push SysReAllocStringLen
call edi
test eax, eax
jne 0x409c11
push 4
lea eax, [ebp - 0x14e0]
push eax
push 4
push esi
push 0x40d0a4
push dword [ebp - 0x14e4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14e4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 0x14e0], esi
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040a788
leave
ret 0x10