Function at 0x412f16
Capabilities:
Copy file
Delete file
Delete registry key
Delete registry value
Get file attributes
Persist via app paths registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8f8
push ebx
push esi
push edi
push 0x4e
call fcn.0045d7b1
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x2e0]
xor ebx, ebx
mov dword [esp], str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsAcrobat.exe
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
call fcn.0044bca0
pop ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop ecx
lea eax, [ebp - 4]
push eax
push 0x20019
lea eax, [ebp - 0x2e0]
push ebx
mov edi, reloc.CoolType.dll_Ordinal_2
push eax
push edi
mov dword [ebp - 0x18], 1
call esi
cmp eax, ebx
jne 0x412fc8
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
lea eax, [ebp - 0x8f8]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x412faf
lea eax, [ebp - 0x8f8]
push ebx
push eax
call fcn.0044d414
pop ecx
cmp eax, 0xffffffff
pop ecx
jne 0x412fb6
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], ebx
je 0x413053
lea eax, [ebp - 0x2e0]
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsAcroRd32.exe
push eax
call fcn.0044bca0
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
push 0x20019
lea eax, [ebp - 0x2e0]
push ebx
push eax
push edi
call esi
cmp eax, ebx
jne 0x41304b
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
lea eax, [ebp - 0x8f8]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x41302f
lea eax, [ebp - 0x8f8]
push ebx
push eax
call fcn.0044d414
pop ecx
cmp eax, 0xffffffff
pop ecx
jne 0x413036
mov dword [ebp - 8], 2
push dword [ebp - 4]
mov dword [ebp - 0x18], 2
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], ebx
je 0x413053
xor ax, ax
jmp 0x4139d5
lea eax, [ebp - 0xa8]
push str.SOFTWARENetscapeNetscape_Navigator
push eax
call fcn.0044bca0
pop ecx
lea eax, [ebp - 4]
pop ecx
mov byte [ebp - 0x15c], bl
push eax
push 0x20019
lea eax, [ebp - 0xa8]
push ebx
push eax
push edi
mov byte [ebp - 0x4e8], bl
mov byte [ebp - 0x260], bl
call esi
test eax, eax
jne 0x413177
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push str.CurrentVersion
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x413125
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x128]
push str._s_sMain
push eax
call fcn.0044d095
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
push 0x20019
lea eax, [ebp - 0x128]
push ebx
push eax
push edi
call esi
test eax, eax
jne 0x413125
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push str.Plugins_Directory
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x260], bl
je 0x413177
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
jne 0x413171
lea eax, [ebp - 0x260]
push str.nppdf32.dll
push eax
lea eax, [ebp - 0x4e8]
push 0x66fd64
push eax
mov dword [ebp - 0x1c], 1
call fcn.0044d095
add esp, 0x10
jmp 0x413177
mov byte [ebp - 0x260], bl
lea eax, [ebp - 0xa8]
push str.SOFTWARENetscapeNetscape_NavigatorMain
push eax
call fcn.0044bca0
pop ecx
lea eax, [ebp - 4]
pop ecx
mov byte [ebp - 0x3e4], bl
push eax
push 0x20019
lea eax, [ebp - 0xa8]
push ebx
push eax
push Ordinal_3
mov byte [ebp - 0x7f4], bl
call esi
test eax, eax
jne 0x413258
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
lea eax, [ebp - 0x7f4]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push str.Install_Directory
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x7f4], bl
je 0x413258
lea eax, [ebp - 0x7f4]
push str.ProgramPlugins
push eax
call fcn.0044bcb0
lea eax, [ebp - 0x7f4]
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.0044c190
add esp, 0x10
test eax, eax
je 0x413252
lea eax, [ebp - 0x7f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
jne 0x413252
lea eax, [ebp - 0x7f4]
push str.nppdf32.dll
push eax
lea eax, [ebp - 0x3e4]
push 0x66fd64
push eax
mov dword [ebp - 0x20], 1
call fcn.0044d095
add esp, 0x10
jmp 0x413258
mov byte [ebp - 0x7f4], bl
lea eax, [ebp - 4]
mov byte [ebp - 0x5ec], bl
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIExplore.exe
push edi
mov byte [ebp - 0x6f0], bl
call esi
test eax, eax
jne 0x413313
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
lea eax, [ebp - 0x6f0]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], ebx
jne 0x41330d
lea eax, [ebp - 0x6f0]
push 0x5c
push eax
call fcn.0044df50
pop ecx
cmp eax, ebx
pop ecx
je 0x41330d
mov byte [eax], bl
lea eax, [ebp - 0x6f0]
push str.Plugins
push eax
call fcn.0044bcb0
pop ecx
lea eax, [ebp - 0x6f0]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
jne 0x41330d
lea eax, [ebp - 0x6f0]
push str.nppdf32.dll
push eax
lea eax, [ebp - 0x5ec]
push 0x66fd64
push eax
call fcn.0044d095
add esp, 0x10
jmp 0x413313
mov byte [ebp - 0x6f0], bl
lea eax, [ebp - 0xa8]
push str.MIMEDatabaseContent_Type_application_pdf
push eax
call fcn.0044bca0
cmp dword [ebp - 0xc], ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], ebx
jne 0x413660
cmp byte [ebp - 0x4e8], bl
je 0x413395
lea eax, [ebp - 0x4e8]
push ebx
push eax
call fcn.0044d414
pop ecx
cmp eax, 0xffffffff
pop ecx
je 0x413395
lea eax, [ebp - 0x4e8]
push 2
push eax
call fcn.0044d414
pop ecx
cmp eax, 0xffffffff
pop ecx
jne 0x413372
cmp dword [0x6b04cc], 0xd
jne 0x41338e
cmp word [ebp + 8], bx
jmp 0x41338c
cmp word [ebp + 8], bx
jne 0x4139ac
lea eax, [ebp - 0x4e8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test ax, ax
jne 0x413395
mov dword [ebp - 0xc], 1
cmp byte [ebp - 0x3e4], bl
je 0x4133f8
lea eax, [ebp - 0x3e4]
push ebx
push eax
call fcn.0044d414
pop ecx
cmp eax, 0xffffffff
pop ecx
je 0x4133f8
lea eax, [ebp - 0x3e4]
push 2
push eax
call fcn.0044d414
pop ecx
cmp eax, 0xffffffff
pop ecx
jne 0x4133d5
cmp dword [0x6b04cc], 0xd
jne 0x4133f1
cmp word [ebp + 8], bx
jmp 0x4133ef
cmp word [ebp + 8], bx
jne 0x4139ac
lea eax, [ebp - 0x3e4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test ax, ax
jne 0x4133f8
mov dword [ebp - 0xc], 1
cmp byte [ebp - 0x5ec], bl
je 0x41345b
lea eax, [ebp - 0x5ec]
push ebx
push eax
call fcn.0044d414
pop ecx
cmp eax, 0xffffffff
pop ecx
je 0x41345b
lea eax, [ebp - 0x5ec]
push 2
push eax
call fcn.0044d414
pop ecx
cmp eax, 0xffffffff
pop ecx
jne 0x413438
cmp dword [0x6b04cc], 0xd
jne 0x413454
cmp word [ebp + 8], bx
jmp 0x413452
cmp word [ebp + 8], bx
jne 0x4139ac
lea eax, [ebp - 0x5ec]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test ax, ax
jne 0x41345b
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], ebx
je 0x413474
push ebx
push ebx
push 0xef28
call fcn.0040fb3f
add esp, 0xc
jmp 0x413922
cmp word [ebp + 8], bx
lea eax, [ebp - 4]
push eax
push 0x20006
lea eax, [ebp - 0xa8]
push ebx
push eax
push Ordinal_3
je 0x41357d
call esi
test eax, eax
jne 0x4134c6
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 0x28]
push ebx
push eax
push ebx
push str.CLSID
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4139ac
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xa8]
push str.SOFTWAREMicrosoftInternet_ExplorerPluginsMIME_application_pdf
push eax
call fcn.0044bca0
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
push 0x20019
lea eax, [ebp - 0xa8]
push ebx
push eax
push edi
call esi
push dword [ebp - 4]
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], ebx
je 0x4139ac
lea eax, [ebp - 0xa8]
push str.SOFTWAREMicrosoftInternet_ExplorerPluginsExtension.pdf
push eax
call fcn.0044bca0
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
push 0x20019
lea eax, [ebp - 0xa8]
push ebx
push eax
push edi
call esi
push dword [ebp - 4]
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], ebx
je 0x4139ac
lea eax, [ebp - 0xa8]
push str.SOFTWAREMicrosoftCode_Store_DatabaseDistribution_UnitsCA8A9780_280D_11CF_A24D_444553540000
push eax
call fcn.0044bca0
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
push 0x20019
lea eax, [ebp - 0xa8]
push ebx
push eax
push edi
call esi
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x413922
jmp 0x4139ac
call esi
test eax, eax
jne 0x41359a
push str.CLSID
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xa8]
push str.SOFTWAREMicrosoftInternet_ExplorerPluginsMIME
push eax
call fcn.0044bca0
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
push 0x20006
lea eax, [ebp - 0xa8]
push ebx
push eax
push edi
call esi
test eax, eax
jne 0x4135dc
push str.application_pdf
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xa8]
push str.SOFTWAREMicrosoftInternet_ExplorerPluginsExtension
push eax
call fcn.0044bca0
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
push 0x20006
lea eax, [ebp - 0xa8]
push ebx
push eax
push edi
call esi
test eax, eax
jne 0x41361e
push str..pdf
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xa8]
push str.SOFTWAREMicrosoftCode_Store_DatabaseDistribution_Units
push eax
call fcn.0044bca0
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
push 0x20006
lea eax, [ebp - 0xa8]
push ebx
push eax
push edi
call esi
test eax, eax
jne 0x413922
push str.CA8A9780_280D_11CF_A24D_444553540000
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x413919
cmp byte [ebp - 0x4e8], bl
jne 0x41367c
cmp byte [ebp - 0x3e4], bl
jne 0x41367c
cmp byte [ebp - 0x5ec], bl
je 0x413842
lea eax, [ebp - 4]
mov byte [ebp - 0x260], bl
push eax
push 0x20019
lea eax, [ebp - 0x2e0]
push ebx
push eax
push edi
call esi
test eax, eax
jne 0x413703
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push str.Path
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x260]
push eax
call fcn.0044c220
test eax, eax
pop ecx
je 0x413703
mov cl, byte [ebp - 0x260]
xor eax, eax
cmp cl, bl
je 0x413842
cmp cl, 0x3b
je 0x4136fc
mov cl, byte [ebp + eax - 0x25f]
inc eax
cmp cl, bl
jne 0x4136e9
jmp 0x413703
mov byte [ebp + eax - 0x260], bl
cmp byte [ebp - 0x260], bl
je 0x413842
lea eax, [ebp - 0x260]
push str.nppdf32.dll
push eax
lea eax, [ebp - 0x128]
push str._sBrowser_s
push eax
call fcn.0044d095
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 0x10
cmp byte [ebp - 0x4e8], bl
je 0x413789
lea eax, [ebp - 0x4e8]
push ebx
push eax
call fcn.0044d414
pop ecx
cmp eax, 0xffffffff
pop ecx
jne 0x413789
cmp dword [0x6b04cc], 2
jne 0x413765
cmp word [ebp + 8], bx
je 0x41376b
jmp 0x4139ac
cmp word [ebp + 8], bx
jne 0x413789
lea eax, [ebp - 0x4e8]
push 1
push eax
lea eax, [ebp - 0x128]
push eax
call edi
test ax, ax
jne 0x413789
mov dword [ebp - 0xc], 1
cmp byte [ebp - 0x3e4], bl
je 0x4137dd
lea eax, [ebp - 0x3e4]
push ebx
push eax
call fcn.0044d414
pop ecx
cmp eax, 0xffffffff
pop ecx
jne 0x4137dd
cmp dword [0x6b04cc], 2
jne 0x4137b9
cmp word [ebp + 8], bx
je 0x4137bf
jmp 0x4139ac
cmp word [ebp + 8], bx
jne 0x4137dd
lea eax, [ebp - 0x3e4]
push 1
push eax
lea eax, [ebp - 0x128]
push eax
call edi
test ax, ax
jne 0x4137dd
mov dword [ebp - 0xc], 1
cmp byte [ebp - 0x5ec], bl
je 0x413831
lea eax, [ebp - 0x5ec]
push ebx
push eax
call fcn.0044d414
pop ecx
cmp eax, 0xffffffff
pop ecx
jne 0x413831
cmp dword [0x6b04cc], 2
jne 0x41380d
cmp word [ebp + 8], bx
je 0x413813
jmp 0x4139ac
cmp word [ebp + 8], bx
jne 0x413831
lea eax, [ebp - 0x5ec]
push 1
push eax
lea eax, [ebp - 0x128]
push eax
call edi
test ax, ax
jne 0x413831
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], ebx
je 0x413842
push ebx
push ebx
push 0xef29
jmp 0x413467
cmp word [ebp + 8], bx
lea eax, [ebp - 4]
push eax
je 0x4138bb
push 0x20019
lea eax, [ebp - 0xa8]
push ebx
push eax
push Ordinal_3
call esi
test eax, eax
jne 0x4139ac
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x80
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push str.CLSID
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4139ac
push dword [0x66f084]
lea eax, [ebp - 0x128]
push eax
call fcn.0044c190
pop ecx
test eax, eax
pop ecx
je 0x413922
jmp 0x4139ac
mov edi, 0x20006
lea eax, [ebp - 0xa8]
push edi
push ebx
push eax
push Ordinal_3
call esi
cmp eax, ebx
je 0x4138f4
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push edi
push ebx
push ebx
lea eax, [ebp - 0xa8]
push ebx
push eax
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x413922
push dword [0x66f084]
call fcn.0044c220
pop ecx
inc eax
push eax
push dword [0x66f084]
push 1
push ebx
push str.CLSID
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x20], bx
jne 0x41392e
cmp word [ebp - 0x1c], bx
je 0x413970
lea eax, [ebp - 0x8f8]
push eax
push 0x66fb18
push str.application_vnd.fdf
push dword [ebp + 8]
call fcn.00413c37
add esp, 0x10
test ax, ax
jne 0x4139ac
lea eax, [ebp - 0x8f8]
push eax
push str.xfdf
push str.application_vnd.adobe.xfdf
push dword [ebp + 8]
call fcn.00413c37
add esp, 0x10
test ax, ax
jne 0x4139ac
push str.AcroExch.FDFDoc
push dword [ebp + 8]
call fcn.00413fe4
pop ecx
test ax, ax
pop ecx
jne 0x4139ac
push str.AcroExch.XFDFDoc
push dword [ebp + 8]
call fcn.00413fe4
pop ecx
test ax, ax
pop ecx
jne 0x4139ac
cmp word [ebp + 8], bx
je 0x4139b2
push dword [ebp - 0x18]
call fcn.004139da
test ax, ax
pop ecx
je 0x4139d1
mov ax, 1
jmp 0x4139d5
lea eax, [ebp - 0x8f8]
push eax
push dword [ebp - 0x18]
call fcn.00413b3a
pop ecx
pop ecx
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ax, word [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret