Function at 0x406a90
Capabilities:
Hide graphical window
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5545b7
mov eax, dword fs:[0]
push eax
sub esp, 0x3ac
mov eax, dword [0x5c7cec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x239]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x358], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x35c], eax
mov dword [ebp - 0x31c], edi
mov dword [ebp - 0x220], 0
call fcn.004084b0
push 0x5cd524
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
push 0
call fcn.004084c0
add esp, 8
mov byte [ebp - 0x342], 1
call fcn.0040a420
movzx ecx, byte [ebp - 0x342]
xor edx, edx
cmp eax, 1
cmovl ecx, edx
mov dword [ebp - 0x350], ecx
call fcn.0040a890
mov ecx, str.type
mov dword [ebp - 0x364], 0
mov esi, eax
mov dword [ebp - 0x360], 0xf
mov dword [ebp - 0x258], esi
mov byte [ebp - 0x374], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406b60
sub ecx, edx
push ecx
push str.type
lea ecx, [ebp - 0x374]
call fcn.0040a8a0
lea eax, [ebp - 0x374]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28c]
mov ecx, esi
push eax
call fcn.0040a9e0
mov edx, dword [ebp - 0x360]
mov byte [ebp - 4], 4
cmp edx, 0x10
jb 0x406bd1
mov ecx, dword [ebp - 0x374]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406bc7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408456
push edx
push ecx
call fcn.004097e6
add esp, 8
push str.renderer
lea ecx, [ebp - 0x28c]
mov dword [ebp - 0x364], 0
mov dword [ebp - 0x360], 0xf
mov byte [ebp - 0x374], 0
mov byte [ebp - 4], 3
call fcn.0040b050
push str.compute_only_renderer
lea ecx, [ebp - 0x28c]
mov byte [ebp - 0x342], al
call fcn.0040b050
push str.compute_only_broker
lea ecx, [ebp - 0x28c]
mov byte [ebp - 0x343], al
call fcn.0040b050
mov byte [ebp - 0x219], al
call fcn.0040b0e0
cmp dword [ebp - 0x27c], 0
mov byte [ebp - 0x349], al
je 0x406c87
cmp byte [ebp - 0x342], 0
jne 0x406d43
cmp byte [ebp - 0x343], 0
jne 0x406d43
cmp byte [ebp - 0x219], 0
jne 0x406d43
lea ecx, [ebp - 0x28c]
mov byte [ebp - 4], 0
call fcn.0040ad30
mov edi, dword [ebp - 0x22c]
jmp 0x408351
xor eax, eax
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x290], 7
mov word [ebp - 0x2a4], ax
lea eax, [ebp - 0x2a4]
mov byte [ebp - 4], 5
push eax
call fcn.0040b400
add esp, 4
test al, al
je 0x406cfb
cmp dword [ebp - 0x294], 0
je 0x406cfb
push edi
call fcn.00488a30
add esp, 4
test al, al
je 0x406cfb
push 0x40100000
call fcn.00412620
add esp, 4
lea ecx, [ebp - 0x2a4]
call fcn.00408e50
lea ecx, [ebp - 0x28c]
xor edi, edi
call fcn.0040ad30
jmp 0x40835e
mov edx, dword [ebp - 0x290]
mov byte [ebp - 4], 6
cmp edx, 8
jb 0x406d3f
mov ecx, dword [ebp - 0x2a4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x406d35
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40845b
push edx
push ecx
call fcn.004097e6
add esp, 8
mov byte [ebp - 4], 3
call fcn.0040b940
test al, al
je 0x406c6d
mov eax, dword [ebp - 0x350]
mov esi, 1
test al, al
je 0x4070d9
cmp dword [ebp - 0x27c], 0
jne 0x406d89
push 0x56c318
push str.Acrobat_Reader
call fcn.0040d800
add esp, 8
test eax, eax
setne al
mov dword [ebp - 0x350], eax
test al, al
je 0x4070d9
cmp byte [ebp - 0x349], 0
je 0x406dcf
call fcn.0040a420
cmp eax, 3
jl 0x406dcf
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x406dcf
push str.SetProcessDPIAware
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x406dcf
mov ecx, esi
call dword [0x5677a4]
call esi
cmp dword [ebp - 0x27c], 0
je 0x406e16
push str.compute_only_broker
lea ecx, [ebp - 0x28c]
call fcn.0040b050
test al, al
jne 0x406e16
cmp dword [0x5cce50], 0
jne 0x406e0c
push 0xc0100010
mov edi, 3
call fcn.00473f70
add esp, 4
jmp 0x408342
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
jmp 0x406e6a
call fcn.0040f060
push 0x570200
push 0x8002
mov byte [0x5cbd2c], al
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
test edi, edi
je 0x406e64
push str.AcroExe_load_done
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov esi, eax
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [ebp - 0x22c]
push dword [ebp - 0x230]
push esi
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
mov edi, dword [ebp - 0x31c]
call fcn.0040f150
cmp byte [ebp - 0x219], 0
mov byte [0x5cb50b], al
jne 0x406e86
cmp byte [ebp - 0x343], 0
je 0x406e90
mov dword [str.acrord32_sbx], 0x570224
call fcn.0040fa30
mov byte [0x5cb50a], al
test al, al
je 0x406ed6
push str.renderer
lea ecx, [ebp - 0x28c]
call fcn.0040b050
test al, al
je 0x406ed6
mov eax, dword [0x5cbd30]
test eax, eax
je 0x406ed6
push eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test eax, eax
je 0x406ed6
mov eax, dword [0x5cbd34]
test eax, eax
je 0x406ed6
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov ecx, edi
mov dword [ebp - 0x264], 0
xor eax, eax
mov dword [ebp - 0x260], 7
mov word [ebp - 0x274], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406f00
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x274]
call fcn.00408740
push 3
mov edi, 1
mov byte [ebp - 4], 7
xor eax, eax
mov dword [ebp - 0x348], edi
push 0x56a24c
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 7
mov word [ebp - 0x254], ax
call fcn.00408740
lea eax, [ebp - 0x254]
mov dword [ebp - 4], 8
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.0040f420
add esp, 8
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x254]
mov esi, eax
call fcn.00408e50
cmp esi, 0xffffffff
jne 0x407317
mov esi, dword [ebp - 0x31c]
xor eax, eax
mov ecx, esi
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x290], 7
mov word [ebp - 0x2a4], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406fc0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x2a4]
call fcn.00408740
mov esi, 3
mov dword [ebp - 4], 9
push esi
xor eax, eax
mov dword [ebp - 0x220], esi
push 0x56a24c
lea ecx, [ebp - 0x254]
mov byte [ebp - 0x219], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 7
mov word [ebp - 0x254], ax
call fcn.00408740
lea eax, [ebp - 0x254]
mov dword [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x2a4]
push eax
call fcn.0040f420
add esp, 8
mov byte [ebp - 4], 9
mov edi, eax
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x22c], edi
call fcn.00408e50
cmp edi, 0xffffffff
je 0x407253
lea eax, [edi + 3]
mov edi, dword [ebp - 0x294]
cmp edi, eax
jbe 0x407253
push 2
xor eax, eax
mov dword [ebp - 0x2ac], 0
push 0x57008c
lea ecx, [ebp - 0x2bc]
mov dword [ebp - 0x2a8], 7
mov word [ebp - 0x2bc], ax
call fcn.00408740
mov edx, dword [ebp - 0x22c]
xor eax, eax
add edx, esi
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 7
mov word [ebp - 0x254], ax
cmp edi, edx
jb 0x408460
jmp 0x4071b6
mov ecx, edi
mov dword [ebp - 0x294], 0
xor eax, eax
mov dword [ebp - 0x290], 7
mov word [ebp - 0x2a4], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407100
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x2a4]
call fcn.00408740
push 0
push 0x56a24c
lea ecx, [ebp - 0x2a4]
call fcn.0040ec70
cmp eax, 0xffffffff
lea ecx, [ebp - 0x2a4]
push 0
push 0x56ad88
setne byte [ebp - 0x341]
call fcn.0040ec70
movzx ecx, byte [ebp - 0x341]
cmp eax, 0xffffffff
push 0
cmovne ecx, esi
mov dword [ebp - 0x22c], ecx
lea ecx, [ebp - 0x2a4]
push 0x56ca8c
call fcn.0040ec70
mov edx, dword [ebp - 0x22c]
cmp eax, 0xffffffff
movzx ecx, dl
cmovne ecx, esi
mov dword [ebp - 0x22c], ecx
lea ecx, [ebp - 0x2a4]
call fcn.00408e50
cmp byte [ebp - 0x22c], 0
je 0x4071a4
mov byte [ebp - 0x350], 1
jmp 0x406e6a
cmp byte [ebp - 0x350], 0
je 0x406ed6
jmp 0x406e6a
sub edi, edx
lea eax, [ebp - 0x2a4]
or ecx, 0xffffffff
cmp edi, 0xffffffff
cmovb ecx, edi
cmp dword [ebp - 0x290], 8
push ecx
cmovae eax, dword [ebp - 0x2a4]
lea ecx, [ebp - 0x254]
lea eax, [eax + edx*2]
push eax
call fcn.00408740
push 0
lea eax, [ebp - 0x2bc]
mov esi, 0x103
push eax
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x348], esi
mov dword [ebp - 0x220], esi
call fcn.0040d350
mov edi, eax
cmp edi, 0xffffffff
je 0x40722c
push 0
push str.pdfshell_prev
lea ecx, [ebp - 0x254]
call fcn.0040ec70
cmp eax, edi
sete byte [ebp - 0x219]
lea ecx, [ebp - 0x254]
call fcn.00408e50
lea ecx, [ebp - 0x2bc]
mov byte [ebp - 4], 9
call fcn.00408e50
cmp byte [ebp - 0x219], 0
jne 0x407317
mov edi, dword [ebp - 0x31c]
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 7
mov word [ebp - 0x254], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407280
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x254]
call fcn.00408740
push 3
or esi, 4
mov dword [ebp - 4], 0xc
xor eax, eax
mov dword [ebp - 0x348], esi
push 0x56ad88
lea ecx, [ebp - 0x2bc]
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x2a8], 7
mov word [ebp - 0x2bc], ax
call fcn.00408740
lea eax, [ebp - 0x2bc]
mov dword [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.0040f420
add esp, 8
lea ecx, [ebp - 0x2bc]
mov esi, eax
call fcn.00408e50
mov byte [ebp - 0x219], 1
cmp esi, 0xffffffff
je 0x40731e
mov byte [ebp - 0x219], 0
mov eax, dword [ebp - 0x348]
test al, 4
je 0x407384
and eax, 0xfffffffb
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x220], eax
mov edx, dword [ebp - 0x240]
mov dword [ebp - 4], 0xe
cmp edx, 8
jb 0x407384
mov ecx, dword [ebp - 0x254]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407374
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408465
push edx
push ecx
call fcn.004097e6
mov eax, dword [ebp - 0x348]
add esp, 8
test al, 2
je 0x4073e4
and eax, 0xfffffffd
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x220], eax
mov edx, dword [ebp - 0x290]
mov dword [ebp - 4], 0xf
cmp edx, 8
jb 0x4073e4
mov ecx, dword [ebp - 0x2a4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4073d4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40846a
push edx
push ecx
call fcn.004097e6
mov eax, dword [ebp - 0x348]
add esp, 8
and eax, 0xfffffffe
mov dword [ebp - 4], 3
mov dword [ebp - 0x348], eax
mov edx, dword [ebp - 0x260]
mov byte [ebp - 4], 0x10
cmp edx, 8
jb 0x407438
mov ecx, dword [ebp - 0x274]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40742e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40847e
push edx
push ecx
call fcn.004097e6
add esp, 8
cmp byte [ebp - 0x219], 0
mov byte [ebp - 4], 3
je 0x407472
cmp dword [ebp - 0x27c], 0
jne 0x407472
cmp byte [ebp - 0x350], 0
jne 0x407472
call fcn.0040f7b0
test al, al
je 0x407472
push 0x5cbd14
push 0x5cbd10
call fcn.004100c0
add esp, 8
lea eax, [ebp - 0x220]
mov esi, 1
push eax
push 0x20019
push 0
push str.SoftwareAdobeAdobe_AcrobatDCSecurity
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4074f8
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x22c], 4
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0x56ffd8
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4074e4
cmp dword [ebp - 0x228], eax
cmove esi, eax
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x40760c
lea eax, [ebp - 0x228]
xor esi, esi
push eax
push 0x20019
push esi
push 0x56ffdc
push 0x80000002
mov dword [ebp - 0x228], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407586
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x220], esi
push eax
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], esi
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x22c], 4
push eax
push esi
push str.bEnableATL7Compat
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40757a
cmp dword [ebp - 0x220], 4
jne 0x40757a
cmp dword [ebp - 0x224], 1
mov eax, 1
cmove esi, eax
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x569a5c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4075c2
push str.SetProcessDEPPolicy
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x4075c2
mov ecx, esi
xor ecx, 1
lea ecx, [ecx*2 + 1]
push ecx
mov ecx, edi
call dword [0x5677a4]
call edi
test eax, eax
jne 0x40760c
push 0x56b928
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40760c
push str.NtSetInformationProcess
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x40760c
push 4
lea eax, [ebp - 0x22c]
push eax
lea ecx, [esi*4 + 9]
push 0x22
mov dword [ebp - 0x22c], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov ecx, edi
call dword [0x5677a4]
call edi
cmp byte [ebp - 0x350], 0
je 0x407637
mov esi, dword [ebp - 0x27c]
test esi, esi
je 0x407637
push str.compute_only_broker
lea ecx, [ebp - 0x28c]
call fcn.0040b050
test al, al
je 0x4076b6
push 1
call fcn.0040fca0
add esp, 4
test eax, eax
je 0x407659
push 0xc0100010
xor edi, edi
call fcn.00473f70
add esp, 4
jmp 0x408342
mov edi, dword [str.AdobeAcrobatSpeedLaunchCmdWnd]
xor esi, esi
push 0
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x407681
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendNotifyMessageW]
inc esi
cmp esi, 0x14
jb 0x407661
mov edi, dword [str.AdobeReaderSpeedLaunchCmdWnd]
xor esi, esi
nop dword [eax]
push 0
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x4076b0
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendNotifyMessageW]
inc esi
cmp esi, 0x14
jb 0x407690
mov esi, dword [ebp - 0x27c]
xor edi, edi
mov dword [ebp - 0x228], edi
test esi, esi
jne 0x40770f
push dword [ebp - 0x31c]
call fcn.00410140
add esp, 4
test al, al
je 0x40770f
push str.Acrobat_Viewer_Safe_DDE
push 3
push 3
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov edi, eax
mov dword [ebp - 0x228], edi
test edi, edi
je 0x40770f
push 0x927c0
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40770f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov dword [ebp - 0x228], edi
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
test eax, eax
je 0x407794
push 0
push 1
push 5
call fcn.00410300
add esp, 0xc
test al, al
je 0x407794
push 0
push 0
push 6
call fcn.00410300
add esp, 0xc
test al, al
jne 0x407794
mov dword [ebp - 0x224], 2
call fcn.0049b750
mov dword [ebp - 0x22c], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, eax
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x40777e
push 4
lea ecx, [ebp - 0x224]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
test esi, esi
je 0x407794
push 4
lea eax, [ebp - 0x224]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
cmp byte [ebp - 0x350], 0
je 0x407965
cmp byte [0x5cb50a], 0
mov byte [ebp - 0x219], 1
mov dword [ebp - 0x220], 0
je 0x40786e
cmp dword [ebp - 0x27c], 0
jne 0x407877
push 0x10000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov esi, eax
mov dword [ebp - 0x320], 0
test esi, esi
je 0x40786e
lea eax, [ebp - 0x320]
mov dword [ebp - 0x230], 0
push eax
push 0
push 7
push 7
push 7
push 7
push 7
push 7
push 7
push 7
lea eax, [ebp - 0x230]
mov word [ebp - 0x22c], 0x400
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x407856
push dword [ebp - 0x320]
lea ecx, [ebp - 0x3b8]
call fcn.004108d0
push 0xd0130
push 3
lea eax, [ebp - 0x3b8]
push eax
push 7
push esi
call fcn.004109d0
add esp, 0x14
mov eax, dword [ebp - 0x320]
test eax, eax
je 0x407867
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call dword [sym.imp.USER32.dll_CloseDesktop]
cmp dword [ebp - 0x27c], 0
je 0x40788b
push str.compute_only_broker
lea ecx, [ebp - 0x28c]
call fcn.0040b050
test al, al
je 0x407892
mov byte [0x5cbd2e], 1
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x219]
push eax
push dword [ebp - 0x358]
call fcn.00410c20
mov esi, eax
add esp, 0xc
cmp esi, 6
je 0x4078ba
cmp esi, 7
jne 0x4078d8
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x219]
push eax
push dword [ebp - 0x358]
call fcn.00410c20
add esp, 0xc
mov esi, eax
mov eax, dword [0x5cbd28]
test eax, eax
je 0x4078f4
push eax
call fcn.0041e6ef
add esp, 4
mov dword [0x5cbd28], 0
test esi, esi
je 0x40793b
cmp dword [ebp - 0x27c], 0
jne 0x40793b
mov byte [ebp - 0x350], 0
cmp esi, 5
jne 0x407965
test edi, edi
je 0x407923
push 0
push 1
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x220]
push 0xc0100010
call fcn.00473f70
add esp, 4
jmp 0x408342
cmp byte [ebp - 0x219], 0
jne 0x407965
test edi, edi
je 0x40795a
push 0
push 1
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x220]
jmp 0x408342
mov byte [0x5cbd2e], 0
call fcn.00411f40
cmp byte [ebp - 0x350], 0
mov byte [ebp - 0x351], al
je 0x407d7b
push str.renderer
lea ecx, [ebp - 0x28c]
call fcn.0040b050
test al, al
je 0x407d88
push 3
xor eax, eax
mov dword [ebp - 0x264], 0
push 0x56a24c
lea ecx, [ebp - 0x274]
mov dword [ebp - 0x260], 7
mov word [ebp - 0x274], ax
call fcn.00408740
mov ecx, dword [ebp - 0x258]
lea eax, [ebp - 0x274]
push eax
mov byte [ebp - 4], 0x11
call fcn.0040c1d0
mov byte [ebp - 0x219], al
mov edx, dword [ebp - 0x260]
mov byte [ebp - 4], 0x12
cmp edx, 8
jb 0x407a31
mov ecx, dword [ebp - 0x274]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407a21
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40846f
push edx
push ecx
call fcn.004097e6
mov al, byte [ebp - 0x219]
add esp, 8
mov byte [ebp - 4], 3
test al, al
je 0x407ad5
lea eax, [ebp - 0x2bc]
push 0x56a24c
push eax
call fcn.0048f0c0
or dword [ebp - 0x348], 8
add esp, 8
mov ecx, eax
mov dword [ebp - 0x224], eax
cmp dword [eax + 0x14], 8
jb 0x407a6e
mov ecx, dword [eax]
mov dword [ebp - 0x224], ecx
mov eax, dword [eax + 0x10]
cmp eax, 0xd
jb 0x407ad5
add eax, 0xfffffff4
lea eax, [ecx + eax*2]
mov dword [ebp - 0x258], eax
sub eax, ecx
sar eax, 1
je 0x407ad5
cmp word [ecx], 0x70
je 0x407a98
add ecx, 2
sub eax, 1
jne 0x407a88
jmp 0x407ad5
test ecx, ecx
je 0x407ad5
mov edx, str.pdfshell_prev
mov edi, ecx
mov esi, 0xd
sub edi, edx
nop word [eax + eax]
mov ax, word [edx + edi]
cmp ax, word [edx]
jne 0x407b2b
add edx, 2
sub esi, 1
jne 0x407ab0
sub ecx, dword [ebp - 0x224]
sar ecx, 1
mov byte [ebp - 0x341], 1
cmp ecx, 0xffffffff
jne 0x407adc
mov byte [ebp - 0x341], 0
mov eax, dword [ebp - 0x348]
test al, 8
je 0x407b4d
and eax, 0xfffffff7
mov dword [ebp - 0x348], eax
mov edx, dword [ebp - 0x2a8]
mov byte [ebp - 4], 0x13
cmp edx, 8
jb 0x407b49
mov ecx, dword [ebp - 0x2bc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407b39
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408474
jmp 0x407b39
mov eax, dword [ebp - 0x258]
add ecx, 2
jmp 0x407a82
push edx
push ecx
call fcn.004097e6
mov eax, dword [ebp - 0x348]
add esp, 8
mov byte [ebp - 4], 3
mov dword [ebp - 0x258], eax
lea ecx, [ebp - 0x254]
mov esi, eax
mov dword [ebp - 0x244], 0
push 7
xor eax, eax
mov dword [ebp - 0x240], 7
push str._slMode
mov word [ebp - 0x254], ax
call fcn.00408740
mov edi, dword [ebp - 0x348]
or edi, 0x10
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x220], edi
xor eax, eax
mov edi, dword [ebp - 0x31c]
mov ecx, edi
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x260], 7
mov word [ebp - 0x274], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407bc0
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x274]
call fcn.00408740
lea eax, [ebp - 0x254]
mov dword [ebp - 4], 0x15
push eax
lea eax, [ebp - 0x274]
or esi, 0x30
push eax
mov dword [ebp - 0x220], esi
call fcn.0040f420
add esp, 8
cmp eax, 0xffffffff
jne 0x407c22
cmp byte [ebp - 0x219], 0
je 0x407c19
cmp byte [ebp - 0x341], 0
je 0x407c22
mov byte [ebp - 0x341], 1
jmp 0x407c29
mov byte [ebp - 0x341], 0
and esi, 0xffffffdf
mov dword [ebp - 0x220], esi
mov edx, dword [ebp - 0x260]
mov dword [ebp - 4], 0x16
cmp edx, 8
jb 0x407c79
mov ecx, dword [ebp - 0x274]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407c6f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408479
push edx
push ecx
call fcn.004097e6
add esp, 8
mov edi, dword [ebp - 0x258]
mov dword [ebp - 4], 3
mov dword [ebp - 0x348], edi
mov edx, dword [ebp - 0x240]
mov byte [ebp - 4], 0x17
cmp edx, 8
jb 0x407cd0
mov ecx, dword [ebp - 0x254]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407cc6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40847e
push edx
push ecx
call fcn.004097e6
add esp, 8
cmp byte [ebp - 0x341], 0
mov byte [ebp - 4], 3
je 0x407d2e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0
push 0
push 0
push 0
push 0xffffc000
push 0xffffc000
push 0x10000000
push 0x569908
push str.EDIT
push 0x80
call fcn.004172d0
cmp byte [ebp - 0x349], 0
mov dword [0x5cbd3c], eax
jne 0x407d2e
test eax, eax
je 0x407d2e
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0041d340
push 0x40100001
call fcn.00412620
add esp, 4
cmp byte [ebp - 0x349], 0
je 0x407d65
call fcn.004a8bb0
mov eax, dword [0x5cbd3c]
test eax, eax
je 0x407d65
push 0x8000000
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
cmp byte [0x5cbd2d], 0
je 0x407d8e
push str.UseSandboxModalWndReparenting
call dword [sym.imp.KERNEL32.dll_AddAtomW]
jmp 0x407d8e
push 0x40100001
call fcn.00412620
add esp, 4
mov edi, dword [ebp - 0x348]
push 0x5c
lea eax, [ebp - 0x318]
mov dword [ebp - 0x22c], 0
push 0
push eax
call fcn.005290f0
add esp, 0xc
lea ecx, [ebp - 0x318]
call fcn.00413c20
cmp byte [ebp - 0x350], 0
mov byte [ebp - 4], 0x18
je 0x407f3d
xorps xmm0, xmm0
lea eax, [ebp - 0x318]
movups xmmword [ebp - 0x340], xmm0
push str.compute_only_renderer
lea ecx, [ebp - 0x28c]
mov dword [ebp - 0x340], 1
movups xmmword [ebp - 0x330], xmm0
mov dword [ebp - 0x33c], fcn.0041d340
mov dword [ebp - 0x338], eax
call fcn.0040b050
cmp byte [0x5cb508], 0
movzx eax, al
mov dword [ebp - 0x334], eax
movzx eax, byte [ebp - 0x351]
mov dword [ebp - 0x330], eax
jne 0x407e3a
cmp byte [0x5cb509], 0
mov dword [ebp - 0x32c], 0
je 0x407e44
mov dword [ebp - 0x32c], 1
mov eax, dword [0x5cbd3c]
mov dword [ebp - 0x328], eax
call fcn.0040a890
push 0xb
push str.channelType
lea ecx, [ebp - 0x2bc]
mov dword [ebp - 0x2ac], 0
mov esi, eax
mov dword [ebp - 0x2a8], 0xf
mov byte [ebp - 0x2bc], 0
call fcn.0040a8a0
lea eax, [ebp - 0x2bc]
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0x274]
mov ecx, esi
push eax
call fcn.0040aa80
lea ecx, [ebp - 0x2bc]
mov byte [ebp - 4], 0x1b
call fcn.0040ad30
cmp dword [ebp - 0x264], 0
je 0x407f1a
call fcn.00411120
cmp dword [ebp - 0x260], 8
lea esi, [ebp - 0x274]
mov dword [ebp - 0x22c], eax
cmovae esi, dword [ebp - 0x274]
mov dword [eax], 0
lea eax, [ebp - 0x258]
push 0xa
push eax
push esi
call fcn.0053560c
add esp, 0xc
mov ecx, eax
cmp esi, dword [ebp - 0x258]
je 0x408483
mov eax, dword [ebp - 0x22c]
cmp dword [eax], 0x22
je 0x40848d
xor eax, eax
cmp ecx, 1
sete al
mov dword [ebp - 0x22c], eax
mov esi, eax
jmp 0x407f1c
xor esi, esi
lea ecx, [ebp - 0x274]
mov byte [ebp - 4], 0x18
call fcn.00408e50
lea eax, [ebp - 0x340]
mov dword [ebp - 0x324], esi
mov dword [ebp - 0x22c], eax
push 7
xor eax, eax
mov dword [ebp - 0x244], 0
push str._slMode
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x240], 7
mov word [ebp - 0x254], ax
call fcn.00408740
mov eax, dword [ebp - 0x348]
mov esi, dword [ebp - 0x31c]
or eax, 0x40
mov ecx, esi
mov dword [ebp - 0x220], eax
xor eax, eax
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x260], 7
mov word [ebp - 0x274], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407fa7
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x274]
call fcn.00408740
lea eax, [ebp - 0x254]
mov dword [ebp - 4], 0x1d
push eax
lea eax, [ebp - 0x274]
or edi, 0xc0
push eax
mov dword [ebp - 0x220], edi
call fcn.0040f420
add esp, 8
cmp eax, 0xffffffff
je 0x40800c
cmp byte [ebp - 0x350], 0
je 0x408003
cmp byte [ebp - 0x342], 0
je 0x40800c
mov byte [ebp - 0x342], 1
jmp 0x408013
mov byte [ebp - 0x342], 0
and edi, 0xffffff7f
mov dword [ebp - 0x220], edi
mov edx, dword [ebp - 0x260]
mov dword [ebp - 4], 0x1e
cmp edx, 8
jb 0x408066
mov ecx, dword [ebp - 0x274]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40805c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408497
push edx
push ecx
call fcn.004097e6
add esp, 8
mov edx, dword [ebp - 0x240]
mov dword [ebp - 4], 0x1f
cmp edx, 8
jb 0x4080ad
mov ecx, dword [ebp - 0x254]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4080a3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40849c
push edx
push ecx
call fcn.004097e6
add esp, 8
cmp byte [ebp - 0x342], 0
mov byte [ebp - 4], 0x18
je 0x4081b5
cmp byte [ebp - 0x350], 0
je 0x4080db
cmp byte [ebp - 0x343], 0
jne 0x4080db
lea ecx, [ebp - 0x318]
call fcn.00422ef0
push dword [ebp + 0x14]
push esi
push dword [ebp - 0x35c]
push dword [ebp - 0x358]
call fcn.00484ae0
mov edi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x238]
movq qword [ebp - 0x25c], xmm0
push eax
movups xmmword [ebp - 0x238], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x31c], 0
push eax
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x40819a
lea eax, [ebp - 0x31c]
push eax
push 2
push 0
push str.SoftwareAdobeAcrobat_ReaderDCAVGeneral
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40819a
push 4
lea eax, [ebp - 0x258]
push eax
push 4
push 0
push str.iSLExitTimeHighPart
push dword [ebp - 0x31c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp - 0x25c]
push eax
push 4
push 0
push str.iSLExitTimeLowPart
push dword [ebp - 0x31c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x31c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x318]
call fcn.00414df0
lea ecx, [ebp - 0x28c]
call fcn.0040ad30
jmp 0x40835e
mov edi, str.AcroRd32.dll
call fcn.00413d50
test al, al
mov esi, str.Acrobat.dll
mov eax, dword [0x5cbd40]
cmove esi, edi
test eax, eax
jne 0x408239
push 0x208
call fcn.00406939
add esp, 4
mov dword [0x5cbd40], eax
test eax, eax
je 0x4082f9
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 3
jbe 0x4082e1
cmp eax, 0x104
je 0x4082e1
push 0x5c
push dword [0x5cbd40]
call fcn.0040d709
add esp, 8
test eax, eax
je 0x4082e1
xor ecx, ecx
mov word [eax + 2], cx
mov eax, dword [0x5cbd40]
test eax, eax
je 0x4082f9
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0040d6fe
add esp, 0x10
test eax, eax
jne 0x4082f9
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00413e7e
add esp, 0x10
test eax, eax
jne 0x4082f9
lea eax, [ebp - 0x218]
push eax
call fcn.00413ea0
mov dword [ebp - 0x224], eax
test eax, eax
je 0x4082f9
cmp byte [ebp - 0x350], 0
je 0x4082aa
cmp byte [ebp - 0x343], 0
jne 0x4082aa
lea ecx, [ebp - 0x318]
call fcn.00422ef0
push dword [ebp - 0x31c]
call fcn.00414ad3
add esp, 4
mov dword [ebp - 0x31c], eax
lea ecx, [ebp - 0x224]
call fcn.00414b40
mov esi, dword [ebp - 0x224]
test al, al
jne 0x408388
mov edi, 0xff
jmp 0x4083c8
push dword [0x5cbd40]
call fcn.004097f9
add esp, 4
mov dword [0x5cbd40], 0
cmp byte [ebp - 0x350], 0
jne 0x408316
push 0
push str.Fatal_Error
push str.Acrobat_failed_to_load_its_Core_DLL
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, dword [ebp - 0x228]
test esi, esi
je 0x408332
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x318]
mov edi, 0xff
call fcn.00414df0
lea ecx, [ebp - 0x28c]
mov byte [ebp - 4], 0
call fcn.0040ad30
push 0x40100000
call fcn.00412620
add esp, 4
lea ecx, [ebp - 0x239]
call fcn.00415450
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040154f
mov esp, ebp
pop ebp
ret 0x10
push str.AcroWinMainSandbox
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x4083a1
mov edi, 0xff
jmp 0x4083c8
push dword [ebp - 0x22c]
mov ecx, edi
push dword [ebp + 0x14]
push dword [ebp - 0x31c]
push dword [ebp - 0x358]
push esi
call dword [0x5677a4]
call edi
mov edi, eax
neg edi
sbb edi, edi
inc edi
push dword [ebp - 0x31c]
call fcn.004097f9
add esp, 4
lea ecx, [ebp - 0x318]
call fcn.00414d10
test esi, esi
je 0x4083ec
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp - 0x228]
test esi, esi
je 0x408408
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x318]
call fcn.00414df0
mov edx, dword [ebp - 0x278]
mov byte [ebp - 4], 0x20
cmp edx, 0x10
jb 0x40844d
mov ecx, dword [ebp - 0x28c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x408443
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4084a1
push edx
push ecx
call fcn.004097e6
add esp, 8
mov byte [ebp - 4], 0
jmp 0x408351
call fcn.0052cae1
call fcn.0052cae1
call fcn.00472980
call fcn.0052cae1
call fcn.0052cae1
call fcn.0052cae1
call fcn.0052cae1
call fcn.0052cae1
call fcn.0052cae1
push str.invalid_stoi_argument
call fcn.005258c7
push str.stoi_argument_out_of_range
call fcn.00525907
call fcn.0052cae1
call fcn.0052cae1
call fcn.0052cae1
int3