Function at 0x100025ac
Capabilities:
Create directory
Persist via run registry key
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0c
and dword [ebp - 0x60c], 0
mov dword [ebp - 0x104], 0x3ff
lea eax, [ebp - 0x208]
push eax
push 0x20019
push 0
push 0x1000a280
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100025f4
push dword [ebp - 0x208]
call fcn.100021d7
pop ecx
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x208]
push eax
push 0x20019
push 0
push 0x1000a2b0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000262e
push dword [ebp - 0x208]
call fcn.100021d7
pop ecx
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x1000b144], 3
jg 0x1000264d
mov dword [ebp - 0x60c], 1
lea eax, [ebp - 0x208]
push eax
push 0xf003f
push 0
push 0x1000a2e0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100026b6
mov dword [ebp - 0x104], 0x3ff
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0xa0c]
push eax
push 0
push 0
push 0x1000a310
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100026aa
mov dword [ebp - 0x60c], 1
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xff
lea eax, [ebp - 0x100]
push eax
push str.ProgramFiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x100026eb
push str.Program_Files
push 0x1000a340
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x100]
push eax
push str._sAdobe
push 0xff
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
push 0
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x100]
push eax
push str._sAdobe_acrotray_.exe
push 0xff
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
push dword [0x1000b148]
call fcn.1000177b
pop ecx
pop ecx
lea eax, [ebp - 0x100]
push eax
push str._sAdobe_acrotray.exe
push 0xff
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
push dword [0x1000b148]
call fcn.1000177b
pop ecx
pop ecx
push 2
push str.acrotray
lea eax, [ebp - 0x204]
push eax
call fcn.1000246a
add esp, 0xc
and dword [ebp - 0x104], 0
cmp dword [ebp - 0x60c], 0
je 0x1000281e
lea eax, [ebp - 0x208]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000281e
lea eax, [ebp - 0x204]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
mov dword [ebp - 0x104], eax
push dword [ebp - 0x104]
lea eax, [ebp - 0x204]
push eax
push 1
push 0
push str.Adobe_Reader
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x1000b138], 3
je 0x10002834
lea eax, [ebp - 0x204]
push eax
call fcn.1000230f
pop ecx
lea eax, [ebp - 0x100]
push eax
push str._sAdobe_acrord32.exe
push 0xff
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
call fcn.1000229f
pop ecx
lea eax, [ebp - 0x100]
push eax
push str._sAdobeAcrobatInfo.exe
push 0xff
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
call fcn.1000229f
pop ecx
leave
ret