Function at 0x429cd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c618
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
mov eax, dword [0x438c60]
xor eax, ebp
mov dword [ebp - 0x80], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x78], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.00401dc0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x7c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00429390
add esp, 0xc
lea ecx, [ebp - 0x7c]
call fcn.00402630
movzx eax, al
test eax, eax
je 0x429d8d
push 0x431db8
lea ecx, [ebp - 0xa4]
call fcn.00401e00
mov byte [ebp - 4], 1
push 0
lea ecx, [ebp - 0xa4]
push ecx
push 1
call fcn.0042b300
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa4]
call fcn.00401f00
mov edx, dword [ebp - 0x78]
mov dword [ebp - 0xa8], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.00401f00
mov eax, dword [ebp - 0xa8]
jmp 0x42a347
lea eax, [ebp - 0x7c]
push eax
push 0x431d2c
lea ecx, [ebp - 0x20]
push ecx
call fcn.00402450
add esp, 0xc
mov byte [ebp - 4], 2
cmp dword [ebp + 0xc], 0
je 0x429db8
mov dword [ebp - 0xd8], str.ReaderAcroRd32.exe
jmp 0x429dc2
mov dword [ebp - 0xd8], str.AcrobatAcrobat.exe
mov edx, dword [ebp - 0xd8]
push edx
lea ecx, [ebp - 0x20]
call fcn.00401f80
push 0x431db4
lea ecx, [ebp - 0x20]
call fcn.00401f80
push 1
lea ecx, [ebp - 0x20]
call fcn.004015a0
push eax
push 0x431e90
push str.SoftwareAdobeAcrobatExe
push 0x80000000
call fcn.00429020
add esp, 0x14
test eax, eax
jne 0x429e6b
push str.HKEY_CLASSES_ROOTSoftwareAdobeAcrobatExe_set_failed.
lea ecx, [ebp - 0xac]
call fcn.00401e00
mov byte [ebp - 4], 3
push 0
lea eax, [ebp - 0xac]
push eax
push 1
call fcn.0042b300
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xac]
call fcn.00401f00
mov ecx, dword [ebp - 0x78]
mov dword [ebp - 0xb0], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00401f00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.00401f00
mov eax, dword [ebp - 0xb0]
jmp 0x42a347
push str.HKEY_CLASSES_ROOTSoftwareAdobeAcrobatExe_set_successfully
lea ecx, [ebp - 0xb4]
call fcn.00401e00
mov byte [ebp - 4], 4
push 0
lea edx, [ebp - 0xb4]
push edx
push 1
call fcn.0042b300
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb4]
call fcn.00401f00
cmp dword [ebp + 0xc], 0
je 0x429eb3
mov dword [ebp - 0xdc], 0x431fc4
jmp 0x429ebd
mov dword [ebp - 0xdc], 0x431fd0
mov eax, dword [ebp - 0xdc]
push eax
lea ecx, [ebp - 0x20]
call fcn.00401f40
push 1
lea ecx, [ebp - 0x20]
call fcn.004015a0
push eax
push 0x431fdc
push str.AcroExch.Document.7_shell
push 0x80000000
call fcn.00429020
add esp, 0x14
test eax, eax
je 0x429fe2
push 1
lea ecx, [ebp - 0x20]
call fcn.004015a0
push eax
push 0x432014
push str.AcroExch.FDFDoc_shell
push 0x80000000
call fcn.00429020
add esp, 0x14
test eax, eax
je 0x429fe2
push 1
lea ecx, [ebp - 0x20]
call fcn.004015a0
push eax
push 0x432044
push str.AcroExch.RMFFile_shell
push 0x80000000
call fcn.00429020
add esp, 0x14
test eax, eax
je 0x429fe2
push 1
lea ecx, [ebp - 0x20]
call fcn.004015a0
push eax
push 0x432078
push str.AcroExch.XDPDoc_shell
push 0x80000000
call fcn.00429020
add esp, 0x14
test eax, eax
je 0x429fe2
push 1
lea ecx, [ebp - 0x20]
call fcn.004015a0
push eax
push 0x4320a8
push str.AcroExch.XFDFDoc_shell
push 0x80000000
call fcn.00429020
add esp, 0x14
test eax, eax
je 0x429fe2
push 1
lea ecx, [ebp - 0x20]
call fcn.004015a0
push eax
push 0x4320dc
push str.AcroExch.pdfxml.1_shell
push 0x80000000
call fcn.00429020
add esp, 0x14
test eax, eax
je 0x429fe2
push 1
lea ecx, [ebp - 0x20]
call fcn.004015a0
push eax
push 0x432110
push str.AcroExch.acrobatsecuritysettings.1_shell
push 0x80000000
call fcn.00429020
add esp, 0x14
test eax, eax
jne 0x42a049
push str.Setting_default_verb_shell_values_failed.
lea ecx, [ebp - 0xb8]
call fcn.00401e00
mov byte [ebp - 4], 5
push 0
lea ecx, [ebp - 0xb8]
push ecx
push 1
call fcn.0042b300
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb8]
call fcn.00401f00
mov edx, dword [ebp - 0x78]
mov dword [ebp - 0xbc], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00401f00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.00401f00
mov eax, dword [ebp - 0xbc]
jmp 0x42a347
push str.Setting_default_verb_shell_values_succeeded
lea ecx, [ebp - 0xc0]
call fcn.00401e00
mov byte [ebp - 4], 6
push 0
lea eax, [ebp - 0xc0]
push eax
push 1
call fcn.0042b300
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xc0]
call fcn.00401f00
push str.msiexec.exe__I
lea ecx, [ebp - 0x70]
call fcn.00401e00
mov byte [ebp - 4], 7
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x70]
call fcn.00401f60
push str._REINSTALL
lea ecx, [ebp - 0x70]
call fcn.00401f80
cmp dword [ebp + 0xc], 0
je 0x42a0bb
mov dword [ebp - 0xe0], str.ReaderProgramFiles_ReaderBrowserIntegration_ReaderPDFIntegration
jmp 0x42a0c5
mov dword [ebp - 0xe0], str.ViewerProgramFiles_AcrobatBrowserIntegration_AcrobatPDFIntegration
mov edx, dword [ebp - 0xe0]
push edx
lea ecx, [ebp - 0x70]
call fcn.00401f80
push str._DEFAULT_VERB_
lea ecx, [ebp - 0x70]
call fcn.00401f80
cmp dword [ebp + 0xc], 0
je 0x42a0f3
mov dword [ebp - 0xe4], 0x4321c4
jmp 0x42a0fd
mov dword [ebp - 0xe4], 0x4322e4
mov eax, dword [ebp - 0xe4]
push eax
lea ecx, [ebp - 0x70]
call fcn.00401f80
push str.__IW_DEFAULT_VERB_
lea ecx, [ebp - 0x70]
call fcn.00401f80
cmp dword [ebp + 0xc], 0
je 0x42a12b
mov dword [ebp - 0xe8], str.Read
jmp 0x42a135
mov dword [ebp - 0xe8], str.Open
mov ecx, dword [ebp - 0xe8]
push ecx
lea ecx, [ebp - 0x70]
call fcn.00401f80
push str.___qb_
lea ecx, [ebp - 0x70]
call fcn.00401f80
push 0x44
push 0
lea edx, [ebp - 0x6c]
push edx
call fcn.00412a60
add esp, 0xc
mov dword [ebp - 0x6c], 0x44
push 0x10
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00412a60
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x6c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x70]
call fcn.004025b0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x42a1e1
push str.CreateProcess_failed
lea ecx, [ebp - 0xc4]
call fcn.00401e00
mov byte [ebp - 4], 8
push 0
lea eax, [ebp - 0xc4]
push eax
push 1
call fcn.0042b300
add esp, 0xc
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xc4]
call fcn.00401f00
jmp 0x42a240
push 0x2bf20
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [ebp - 0x74]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x42a20a
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0x78], ecx
jmp 0x42a240
push str.GetExitCodeProcess_failed
lea ecx, [ebp - 0xc8]
call fcn.00401e00
mov byte [ebp - 4], 9
push 0
lea edx, [ebp - 0xc8]
push edx
push 1
call fcn.0042b300
add esp, 0xc
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xc8]
call fcn.00401f00
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
lea ecx, [ebp - 0x70]
call fcn.00402650
xor edx, edx
mov word [ebp - 0xa0], dx
xor eax, eax
mov dword [ebp - 0x9e], eax
mov dword [ebp - 0x9a], eax
mov dword [ebp - 0x96], eax
mov dword [ebp - 0x92], eax
mov dword [ebp - 0x8e], eax
mov dword [ebp - 0x8a], eax
mov dword [ebp - 0x86], eax
mov word [ebp - 0x82], ax
push 0xa
lea ecx, [ebp - 0xa0]
push ecx
mov edx, dword [ebp - 0x78]
push edx
call fcn.00412b2e
add esp, 0xc
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0xcc]
call fcn.00401e00
mov byte [ebp - 4], 0xa
push str.Return_code_from_MSI_Engine:
lea ecx, [ebp - 0xd0]
call fcn.00401e00
mov byte [ebp - 4], 0xb
push 0
lea ecx, [ebp - 0xcc]
push ecx
lea edx, [ebp - 0xd0]
push edx
push 1
call fcn.0042acb0
add esp, 0x10
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xd0]
call fcn.00401f00
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xcc]
call fcn.00401f00
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x70]
call fcn.00401f00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00401f00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.00401f00
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x80]
xor ecx, ebp
call fcn.004124a8
mov esp, ebp
pop ebp
ret