Function at 0x4d8190
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x238
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4dd1d0
mov edi, ecx
lea eax, [ebp - 0x18]
mov esi, dword [ebp + 8]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov ebx, dword [edi + 4]
test ebx, ebx
jne 0x4d81d6
mov ecx, edi
call fcn.004dc720
mov ebx, dword [edi + 4]
mov dword [ebp - 0x3c], edi
inc dword [edi + 0x28]
mov ecx, esi
call dword [0x64689c]
push dword [ebp + 0x10]
push ebx
call esi
mov ecx, dword [0x6d301c]
mov edx, dword fs:[0x2c]
mov ebx, eax
mov eax, dword [0x6d262c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4d827c
cmp byte [0x6d2628], 0
mov edi, dword [ebp - 0x3c]
je 0x4d8264
mov eax, dword [edi + 0x40]
mov dword [ebp - 0x10], 0xffffffff
test eax, eax
je 0x4d8231
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [edi + 0x40], 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
test eax, eax
mov dword [edi + 0x40], eax
je 0x4d8264
mov esi, eax
mov eax, dword [edi + 4]
test eax, eax
jne 0x4d8259
mov ecx, edi
call fcn.004dc720
mov eax, dword [edi + 4]
inc dword [edi + 0x28]
push esi
push eax
call dword [sym.imp.GDI32.dll_GetClipRgn]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x238
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
push 0x6d262c
call fcn.005d3d07
add esp, 4
cmp dword [0x6d262c], 0xffffffff
jne 0x4d8209
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x24], 0
lea esi, [ebp - 0x244]
push 0x208
push 0
push esi
call fcn.0061e8c0
add esp, 0xc
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x10], 0
push str.SoftwareAdobeAcrobat_ReaderDCFeatureState
push 0x104
push esi
call fcn.005cfe48
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x244]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4d830e
mov cx, 1
xor eax, eax
jmp 0x4d835b
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x2c]
lea edx, [ebp - 0x30]
push eax
push ecx
push edx
push 0
push str.4221516
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x30]
xor ecx, 4
or eax, ecx
sete byte [ebp - 0x1e]
setne byte [ebp - 0x25]
cmp dword [ebp - 0x2c], 0
setne byte [ebp - 0x1d]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x25]
xor ecx, ecx
mov cl, al
mov al, byte [ebp - 0x1e]
and al, byte [ebp - 0x1d]
movzx eax, al
test cx, cx
je 0x4d8410
mov dword [ebp - 0x24], 0
push 0x208
push 0
lea esi, [ebp - 0x244]
push esi
call fcn.0061e8c0
add esp, 0xc
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x34], 4
push str.SoftwareAdobeAdobe_AcrobatDCFeatureState
push 0x104
push esi
call fcn.005cfe48
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x244]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4d83ce
xor eax, eax
jmp 0x4d8410
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x2c]
lea edx, [ebp - 0x30]
push eax
push ecx
push edx
push 0
push str.4221516
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x30]
xor ecx, 4
or eax, ecx
sete byte [ebp - 0x1e]
cmp dword [ebp - 0x2c], 0
setne byte [ebp - 0x1d]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x1e]
and al, byte [ebp - 0x1d]
movzx eax, al
mov byte [0x6d2628], al
push 0x6d262c
call fcn.005d3d59
add esp, 4
mov ebx, dword [ebp - 0x38]
jmp 0x4d8209