Function at 0x4c57cc
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x84c
mov eax, 0x571e3c
call fcn.00513d1f
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x858], esi
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x854], ebx
call fcn.004c00a1
mov eax, dword [esi]
xor edi, edi
inc edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x854], edi
mov dword [eax + 4], 2
call fcn.004cb222
mov ecx, eax
mov dword [esp], str.Acrobat
call fcn.0046b416
lea ecx, [ebp - 0x850]
test al, al
push ecx
push edi
mov edx, str.SoftwareAdobeAdobe_AcrobatDCAcroLogging
mov ecx, str.SoftwareAdobeAcrobat_ReaderDCAcroLogging
push ebx
cmovne ecx, edx
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c5a97
push 4
pop edi
lea eax, [ebp - 0x84c]
mov dword [ebp - 0x84c], edi
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push str.uEnableAcroLogging
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4c5887
mov ecx, dword [esi]
mov eax, dword [ebp - 0x848]
mov dword [ecx], eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push str.LogLevel
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4c58c5
cmp dword [ebp - 0x844], edi
jne 0x4c58c5
mov ecx, dword [esi]
mov eax, dword [ebp - 0x848]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push str.MaxFileSize
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4c5903
cmp dword [ebp - 0x844], edi
jne 0x4c5903
mov ecx, dword [esi]
mov eax, dword [ebp - 0x848]
mov dword [ecx + 8], eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push str.FlushPolicy
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4c5941
cmp dword [ebp - 0x844], edi
jne 0x4c5941
mov ecx, dword [esi]
mov eax, dword [ebp - 0x848]
mov dword [ecx + 0xc], eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push str.FlushLogLevel
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4c597f
cmp dword [ebp - 0x844], edi
jne 0x4c597f
mov ecx, dword [esi]
mov eax, dword [ebp - 0x848]
mov dword [ecx + 0x10], eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push str.FlushTimeout
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4c59bd
cmp dword [ebp - 0x844], edi
jne 0x4c59bd
mov ecx, dword [esi]
mov eax, dword [ebp - 0x848]
mov dword [ecx + 0x14], eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x844]
push eax
push ebx
push str.RotatingFiles
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4c59fb
cmp dword [ebp - 0x844], edi
jne 0x4c59fb
mov ecx, dword [esi]
mov eax, dword [ebp - 0x848]
mov dword [ecx + 0x18], eax
lea eax, [ebp - 0x84c]
mov dword [ebp - 0x84c], 0x800
push eax
lea eax, [ebp - 0x810]
xor edi, edi
push eax
lea eax, [ebp - 0x844]
inc edi
push eax
push ebx
push str.LogFilteringStr
push dword [ebp - 0x850]
mov dword [ebp - 0x844], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4c5a8b
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x828]
call fcn.00450c25
lea eax, [ebp - 0x828]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x840]
push eax
call fcn.004cbecc
pop ecx
pop ecx
mov ecx, dword [esi]
push eax
add ecx, 0x24
mov byte [ebp - 4], 2
call fcn.00461866
lea ecx, [ebp - 0x840]
call fcn.00455548
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], bl
call fcn.0045556e
push dword [ebp - 0x850]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.00513cce
ret