Function at 0x14000fb08
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x2230
call fcn.140015820
sub rsp, rax
mov rdi, rsp
mov ecx, 0x88c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2240]
mov rax, qword [0x140056008]
xor rax, rsp
mov qword [rsp + 0x2220], rax
lea rcx, [rsp + 0x38]
call fcn.140014494
nop
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x2a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x4d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x700]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x930]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0xb60]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0xd90]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0xfb4], 0x104
lea r9, [rsp + 0xfb4]
lea r8, [rsp + 0xd90]
lea rdx, [0x140041820]
mov rcx, qword [rsp + 0x2258]
call sub.msi.dll_MsiGetPropertyW
mov dword [rsp + 0xfc4], 0
lea rdx, [0x140041840]
mov rcx, qword [rsp + 0x2258]
call fcn.140003bb0
test rax, rax
je 0x14000fc45
mov dword [rsp + 0xfc4], 1
cmp dword [rsp + 0xfc4], 0
je 0x14000fc6b
lea r8, str.AcroExch
mov edx, 0x104
lea rcx, [rsp + 0x930]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
jmp 0x14000fc85
lea r8, [0x140041868]
mov edx, 0x104
lea rcx, [rsp + 0x930]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [0x140041878]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x14003ff54]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str.HKEY_CLASSES_ROOT.pdf
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rdx, str..msp
mov rcx, qword [rsp + 0x2248]
call fcn.140003bb0
test rax, rax
je 0x14000fd2c
mov rcx, qword [rsp + 0x2250]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
test rax, rax
jbe 0x14000fd2c
lea rdx, [0x14003fffc]
lea rcx, str._In_Patch_mode__not_changing_the_value_of_HKCR.pdf
call fcn.14001385c
jmp 0x14000fd66
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x1400400cc]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOT.pdf:
call fcn.14001385c
lea rcx, [rsp + 0xd90]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x14000ff15
lea rdx, [0x1400401cc]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [rsp + 0xfc4], 0
je 0x14000fdd0
lea rdx, str.AcroRd32Info.exe___PDFShell
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21a8], rax
jmp 0x14000fded
lea rdx, str.AcrobatInfo.exe___PDFShell
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21a8], rax
lea rdx, str.HKEY_CLASSES_ROOTCLSIDD38406DA_E8AA_484b_B80D_3D3DBDCC2FB2LocalServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14004024c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000fe81
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140040294]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDD38406DA_E8AA_484b_B80D_3D3DBDCC2FB2LocalServer32:
call fcn.14001385c
lea rdx, str.HKEY_CLASSES_ROOTCLSID98D9A6F1_4696_4B5E_A2E8_36B3F9C1E12CLocalServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14004045c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000ff15
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x14004049c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSID98D9A6F1_4696_4B5E_A2E8_36B3F9C1E12CLocalServer32:
call fcn.14001385c
lea rax, [rsp + 0xfe0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0xfe0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov rcx, qword [rsp + 0x2258]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x140010383
lea rcx, [rsp + 0xfe0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x140010383
lea rdx, [rsp + 0xfe0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.Installer_
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, qword [rsp + 0x2258]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [rsp + 0xfc4], 0
je 0x14000ffd2
lea rdx, str.PDFFile_8.ico_0
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21b0], rax
jmp 0x14000ffef
lea rdx, str._PDFFile.ico_0
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21b0], rax
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call main
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call main
lea r8, [0x140041cf8]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..acrobatsecuritysettings.1DefaultIcon
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400404bc]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010111
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x1400404e4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea r8, [0x140041d70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0xb60]
call fcn.14001385c
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call main
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call main
lea r8, [0x140041d80]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x140041da8]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x140040894]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str.DefaultIcon
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140040534]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010261
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x14004056c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea r8, [0x140041de0]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0xb60]
call fcn.14001385c
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call main
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call main
lea r8, [0x140041df0]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..pdfxml.1DefaultIcon
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140040604]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010383
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x14004061c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea r8, [0x140041e48]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0xb60]
call fcn.14001385c
lea rax, [rsp + 0x1210]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
cmp dword [rsp + 0xfc4], 0
je 0x1400103c0
lea rdx, [0x140041e58]
lea rcx, [rsp + 0x1210]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov qword [rsp + 0x21b8], rax
jmp 0x1400103dd
lea rdx, [0x140041e68]
lea rcx, [rsp + 0x1210]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov qword [rsp + 0x21b8], rax
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call main
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call main
lea r8, [0x140041e78]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..acrobatsecuritysettings.1_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14004069c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400104ff
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x1400406d4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea r8, [0x140041ee8]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.14001385c
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call main
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call main
lea r8, [0x140041ef8]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..FDFDoc_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14004076c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010621
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x140040794]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea r8, [0x140041f40]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.14001385c
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call main
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call main
lea r8, [0x140041f50]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x140041f78]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x1400409a4]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str._shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140040a94]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010771
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x140040c94]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea r8, [0x140041fa0]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.14001385c
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call main
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call main
lea r8, [0x140041fb0]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..pdfxml.1_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140040db4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010893
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x140040dc4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea r8, [0x140041ff8]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.14001385c
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call main
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call main
lea r8, [0x140042008]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..RMFFile_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140040ddc]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400109b5
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x140040dec]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea r8, [0x140042050]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.14001385c
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call main
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call main
lea r8, [0x140042060]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..XDPDoc_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140040e84]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010ad7
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x140040ee4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea r8, [0x1400420a8]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.14001385c
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call main
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call main
lea r8, [0x1400420b8]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..XFDFDoc_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140040f74]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010bf9
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x14004107c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea r8, str.set:
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.14001385c
lea rdx, str.HKEY_CLASSES_ROOTSOFTWAREAdobeAcrobatExe
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x1400410b4]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [rsp + 0xfc4], 0
je 0x140010c5f
lea rdx, str.ReaderAcroRd32.exe_
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21c0], rax
jmp 0x140010c7c
lea rdx, str.AcrobatAcrobat.exe_
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21c0], rax
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14004133c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010cfe
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x14004137c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTSOFTWAREAdobeAcrobatExe:
call fcn.14001385c
lea rax, [rsp + 0x1440]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea r8, [0x14004147c]
mov edx, 0x104
lea rcx, [rsp + 0x1440]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0xd90]
mov edx, 0x104
lea rcx, [rsp + 0x1440]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
cmp dword [rsp + 0xfc4], 0
je 0x140010d6d
lea r8, str.ReaderAcroRd32.exe___u___1_
mov edx, 0x104
lea rcx, [rsp + 0x1440]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
jmp 0x140010d87
lea r8, str.AcrobatAcrobat.exe___u___1_
mov edx, 0x104
lea rcx, [rsp + 0x1440]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1440]
lea r8, [0x1400416c4]
lea rdx, str.HKEY_CLASSES_ROOT_acrobat_shellopencommand
lea rcx, [rsp + 0x38]
call fcn.140015084
lea rdx, str.HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x1400416d4]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [rsp + 0xfc4], 0
je 0x140010e15
lea rdx, [0x1400423a0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21c8], rax
jmp 0x140010e32
lea rdx, [0x1400423b0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21c8], rax
lea rdx, str.pdfprevhndlr.dll__101
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400423f8]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010ec9
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, str.DisplayName
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193_DisplayName_:
call fcn.14001385c
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x140010f08
lea rdx, [0x1400424f0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21d0], rax
jmp 0x140010f25
lea rdx, [0x140042428]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21d0], rax
lea rdx, str.pdfprevhndlr.dll
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193InprocServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400417dc]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010fce
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x1400417ec]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193InprocServer32:
call fcn.14001385c
lea rdx, str.HKEY_CLASSES_ROOTTypeLib41738EEA_442F_477F_92CF_2889BD6CD7E71.00win32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x14001101f
lea rdx, [0x140042528]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21d8], rax
jmp 0x14001103c
lea rdx, [0x140042538]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21d8], rax
lea rdx, str.AcroBroker.exe
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140041804]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400110d3
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x14004184c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTTypeLib41738EEA_442F_477F_92CF_2889BD6CD7E71.00win32:
call fcn.14001385c
lea rdx, str.HKEY_CLASSES_ROOTCLSIDBD57A9B2_4E7D_4892_9107_9F4106472DA4LocalServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x140041864]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [rsp + 0xfc4], 0
je 0x140011139
lea rdx, [0x1400428b0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21e0], rax
jmp 0x140011156
lea rdx, [0x1400428c0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21e0], rax
lea rdx, str.AcroBroker.exe_
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140041984]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400111ed
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140041cd4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDBD57A9B2_4E7D_4892_9107_9F4106472DA4LocalServer32:
call fcn.14001385c
lea rdx, str.HKEY_CLASSES_ROOTCLSID17F2E344_8227_4AA7_A25A_E89424566BBAInprocServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140041d7c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140011281
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140041ddc]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSID17F2E344_8227_4AA7_A25A_E89424566BBAInprocServer32:
call fcn.14001385c
lea rdx, str.HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.00win32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140041dec]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140011315
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140041e44]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.00win32:
call fcn.14001385c
lea rdx, str.HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.0HELPDIR
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x140011366
lea rdx, [0x140042b18]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21e8], rax
jmp 0x140011383
lea rdx, [0x1400428f8]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21e8], rax
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140041e54]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140011405
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140041e64]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.0HELPDIR:
call fcn.14001385c
lea rdx, str.HKEY_CLASSES_ROOTCLSID12BA069D_0FC6_4577_97C6_5DF634CE6E84InProcServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x140011456
lea rdx, [0x140042e80]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21f0], rax
jmp 0x140011473
lea rdx, [0x140042b28]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21f0], rax
lea rdx, str.ViewerPS.dll
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140041e74]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14001150a
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140041ee4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSID12BA069D_0FC6_4577_97C6_5DF634CE6E84InProcServer32:
call fcn.14001385c
lea rdx, str.HKEY_CLASSES_ROOTMIMEDatabaseContent_Type_application_pdf
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x140042fe0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140043030]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400115b3
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140043040]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea rdx, [rsp + 0x2a0]
lea rcx, [0x140043050]
call fcn.14001385c
lea rdx, str.HKEY_CLASSES_ROOTCLSIDB801CA65_A1FC_11D0_85AD_444553540000LocalServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x140011604
lea rdx, str.ReaderAcroRd32.exe
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21f8], rax
jmp 0x140011621
lea rdx, [0x1400431a8]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21f8], rax
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140041ef4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400116a3
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140041f3c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDB801CA65_A1FC_11D0_85AD_444553540000LocalServer32:
call fcn.14001385c
lea rdx, str.HKEY_CLASSES_ROOTCLSIDB801CA65_A1FC_11D0_85AD_444553540000ProgID
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [0x140043310]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x140043328]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140041f4c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140011786
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140041fac]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDBD57A9B2_4E7D_4892_9107_9F4106472DA4ProgID:
call fcn.14001385c
lea rdx, str.HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeGoogleChromeNativeMessagingHostscom.adobe.acrobat.chrome_webcapture
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x1400117d7
lea rdx, str.ReaderBrowserWCChromeExtnmanifest.json
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x2200], rax
jmp 0x1400117f4
lea rdx, [0x140043510]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x2200], rax
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140042004]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rdx, str.AcrobatBrowserWCChromeExtnmanifest.json
lea rcx, [rsp + 0x4d0]
call fcn.140003bb0
test rax, rax
je 0x140011845
mov byte [rsp + 0x2208], 1
jmp 0x14001184d
mov byte [rsp + 0x2208], 0
mov al, byte [rsp + 0x2208]
mov byte [rsp + 0x1654], al
movzx eax, byte [rsp + 0x1654]
test eax, eax
je 0x14001187c
lea rcx, [rsp + 0x4d0]
call fcn.140003fbc
test eax, eax
jne 0x1400119dc
lea rcx, [rsp + 0x2a0]
call fcn.140003fbc
test eax, eax
je 0x1400119c8
call fcn.14000a210
mov dword [rsp + 0x1658], eax
cmp dword [rsp + 0xfc4], 0
jne 0x1400118bd
call fcn.14001292c
test eax, eax
jne 0x1400118bd
mov dword [rsp + 0x220c], 0
jmp 0x1400118c8
mov dword [rsp + 0x220c], 1
mov al, byte [rsp + 0x220c]
mov byte [rsp + 0x165c], al
movzx eax, byte [rsp + 0x165c]
test eax, eax
je 0x140011921
movzx eax, byte [rsp + 0x165c]
test eax, eax
je 0x140011984
lea rdx, str.E3AFF032_DE15_45DA_8C24_B74F922C62EC
mov rcx, qword [rsp + 0x2258]
call fcn.140012860
movzx eax, al
test eax, eax
jne 0x140011921
cmp dword [rsp + 0x1658], 1
je 0x140011921
cmp dword [rsp + 0x1658], 2
jne 0x140011984
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x14004205c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
mov dword [rsp + 0x20], 0
lea r9, str.https:__clients2.google.com_service_update2_crx
lea r8, str.update_url
lea rdx, str.HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeGoogleChromeExtensionsefaidnbmnnnibpcajpcglclefindmkaj
lea rcx, [rsp + 0x38]
call fcn.140015084
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_LOCAL_MACHINESOFTWAREGoogleChromeNativeMessagingHostscom.adobe.acrobat.chrome_webcapture:
call fcn.14001385c
jmp 0x1400119c6
movzx eax, byte [rsp + 0x165c]
test eax, eax
je 0x1400119c6
lea rcx, [rsp + 0x4d0]
call fcn.140003fbc
test eax, eax
jne 0x1400119c6
lea rdx, [0x1400420a4]
lea rcx, str.Ownership:_Deleting_Chrome_Extension_registry_entries
call fcn.14001385c
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.1400145f4
jmp 0x1400119dc
lea rdx, [rsp + 0x2a0]
lea rcx, str.File_does_not_exist:
call fcn.14001385c
mov edx, 0x400
lea rcx, [rsp + 0x1670]
call fcn.14000aa40
test eax, eax
jne 0x140011a0f
mov edx, 0x400
lea rcx, [rsp + 0x1670]
call fcn.14000a860
movzx eax, al
test eax, eax
je 0x140011aea
lea rdx, [0x1400435d8]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x1670]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.SoftwareClassesMIMEDatabaseContent_Type_application_pdf
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.CA8A9780_280D_11CF_A24D_444553540000
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400439d0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014b58
lea rax, [rsp + 0x4d0]
test rax, rax
je 0x140011aea
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140011aea
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, str.CLSID
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015084
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTMIMEDatabaseContent_Type_application_pdf
call fcn.14001385c
cmp dword [0x1400564a0], 0
jne 0x140011d27
call fcn.140012ccc
movzx eax, al
test eax, eax
jne 0x140011d27
lea rax, [rsp + 0x1e90]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x1e90]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str..Document.
mov edx, 0x104
lea rcx, [rsp + 0x1e90]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x140043504]
mov edx, 0x104
lea rcx, [rsp + 0x1e90]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rax, [0x140043a80]
mov qword [rsp + 0x20c0], rax
lea rax, [0x140043a90]
mov qword [rsp + 0x20c8], rax
lea rax, [0x140043aa0]
mov qword [rsp + 0x20d0], rax
lea rax, [0x140043ad8]
mov qword [rsp + 0x20d8], rax
lea rax, [0x140043ae8]
mov qword [rsp + 0x20e0], rax
lea rax, [0x140043af8]
mov qword [rsp + 0x20e8], rax
lea rax, [0x140043b08]
mov qword [rsp + 0x20f0], rax
lea rax, [0x140043b18]
mov qword [rsp + 0x20f8], rax
lea rax, [0x140043b28]
mov qword [rsp + 0x2100], rax
lea rax, [0x140043b40]
mov qword [rsp + 0x2130], rax
lea rax, [0x140043b50]
mov qword [rsp + 0x2138], rax
lea rax, [0x140043b60]
mov qword [rsp + 0x2140], rax
lea rax, [0x140043b98]
mov qword [rsp + 0x2148], rax
lea rax, [0x140043ba8]
mov qword [rsp + 0x2150], rax
lea rax, [0x140043bb8]
mov qword [rsp + 0x2158], rax
lea rax, [0x140043bc8]
mov qword [rsp + 0x2160], rax
lea rax, [0x140043bd8]
mov qword [rsp + 0x2168], rax
lea rax, [0x140043be8]
mov qword [rsp + 0x2170], rax
lea rax, [0x140043c00]
mov qword [rsp + 0x2178], rax
lea rax, [0x140043c10]
mov qword [rsp + 0x2180], rax
lea rax, [0x140043c20]
mov qword [rsp + 0x2188], rax
cmp dword [rsp + 0xfc4], 0
je 0x140011cbd
mov qword [rsp + 0x2210], 9
jmp 0x140011cc9
mov qword [rsp + 0x2210], 0xc
mov eax, dword [rsp + 0x2210]
mov dword [rsp + 0x2194], eax
cmp dword [rsp + 0xfc4], 0
je 0x140011cf3
lea rax, [rsp + 0x20c0]
mov qword [rsp + 0x2218], rax
jmp 0x140011d03
lea rax, [rsp + 0x2130]
mov qword [rsp + 0x2218], rax
lea r9, [rsp + 0x1e90]
mov r8d, dword [rsp + 0xfc4]
mov edx, dword [rsp + 0x2194]
mov rcx, qword [rsp + 0x2218]
call fcn.140008818
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
mov dword [rsp + 0x21a0], 1
lea rcx, [rsp + 0x38]
call fcn.1400144c8
mov eax, dword [rsp + 0x21a0]
mov edi, eax
mov rcx, rsp
lea rdx, [0x1400472f0]
call fcn.140015370
mov eax, edi
mov rcx, qword [rsp + 0x2220]
xor rcx, rsp
call fcn.140015470
add rsp, 0x2230
pop rdi
ret