Function at 0x1400023f0
Capabilities:
Accept command line arguments
Delete registry value
Query or enumerate registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc60]
sub rsp, 0xd60
mov rax, qword [0x140014010]
xor rax, rsp
mov qword [rbp + 0xc50], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor edx, edx
lea rcx, [rbp + 0x830]
mov r8d, 0x208
mov r14, rax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0xa40]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x620]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor ebx, ebx
lea r8, str.Acrobat_Reader
mov edx, 0x104
lea rcx, [rbp + 0x830]
mov r12d, ebx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str.Acrobat.Reader.Notification.Manager
mov edx, 0x104
lea rcx, [rbp + 0xa40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov ecx, dword [rbp - 0x30]
lea r9d, [rbx + 0xa]
xor eax, eax
mov dword [rsp + 0x30], ebx
lea r8d, [rbx + 5]
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x28]
mov word [rbp - 0x20], ax
mov r13d, ebx
mov r15d, ebx
mov esi, ebx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow_s]
cmp dword [rbp - 0x30], 2
lea rdi, [rbx - 1]
lea r9d, [rbx + 1]
jl 0x140002765
mov rdx, qword [r14 + 8]
lea r8, [0x14000db08]
mov ecx, ebx
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
jne 0x14000252a
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x14000252a
add rcx, 2
cmp rcx, 0x10
jne 0x140002500
mov r12d, r9d
jmp 0x140002765
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, str.SOFTWAREAdobeAdobe_Acrobat_
mov edx, 0x104
lea rcx, [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str.DCInstallPath
mov edx, 0x104
lea rcx, [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov ecx, 0x208
call fcn.14000be28
xor edx, edx
mov r8d, 0x208
mov rcx, rax
mov rsi, rax
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp - 0x48]
mov dword [rbp - 0x3c], 0x208
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002601
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, [0x14000d8a0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002601
mov rax, rdi
nop
inc rax
cmp word [rsi + rax*2], bx
jne 0x1400025e0
cmp rax, 0x206
jae 0x140002601
mov rdx, rsi
lea rcx, [rbp + 0x620]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call fcn.14000bc78
lea rcx, [rbp + 0x620]
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], bx
jne 0x140002620
test rax, rax
je 0x140002647
lea r8, str._acrobat_reader_appicon_16.png
mov edx, 0x104
lea rcx, [rbp + 0x620]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov r8, qword [r14 + 8]
lea rdx, str._Reader
mov rcx, rbx
nop word [rax + rax]
movzx eax, word [r8 + rcx*2]
inc rcx
cmp ax, word [rdx + rcx*2 - 2]
jne 0x1400026b9
cmp rcx, 8
jne 0x140002660
mov esi, 1
lea r8, [0x14000dbd8]
mov edx, 0x104
lea rcx, [rbp + 0x830]
mov r13d, esi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str.Adobe.Acrobat.Notification.Manager
mov edx, 0x104
lea rcx, [rbp + 0xa40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov r14d, esi
mov esi, ebx
jmp 0x140002768
lea rdx, str._ReaderSync
mov rcx, rbx
movzx eax, word [r8 + rcx*2]
cmp ax, word [rdx + rcx*2]
jne 0x140002726
movzx eax, word [r8 + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x140002726
add rcx, 2
cmp rcx, 0xc
jne 0x1400026c3
mov esi, 1
lea r8, [0x14000dbd8]
mov edx, 0x104
mov dword [rsp + 0x30], esi
lea rcx, [rbp + 0x830]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str.Adobe.Acrobat.Notification.Manager
mov edx, 0x104
lea rcx, [rbp + 0xa40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r14d, [rsi + 1]
jmp 0x140002768
lea r9, str._CollabSync
mov rcx, rbx
movzx edx, word [r8 + rcx*2]
movzx eax, word [r9 + rcx*2]
sub edx, eax
jne 0x140002758
movzx edx, word [r8 + rcx*2 + 2]
movzx eax, word [r9 + rcx*2 + 2]
sub edx, eax
jne 0x140002758
add rcx, 2
cmp rcx, 0xc
jne 0x140002730
mov esi, 1
test edx, edx
cmove r15d, esi
mov esi, ebx
mov r14d, ebx
mov qword [rsp + 0x48], rbx
lea rax, [rbp + 0x620]
mov qword [rsp + 0x50], 7
mov r8, rdi
mov word [rsp + 0x38], bx
inc r8
cmp word [rax + r8*2], bx
jne 0x140002785
lea rdx, [rbp + 0x620]
lea rcx, [rsp + 0x38]
call fcn.140004790
lea rax, [rbp + 0x830]
mov qword [rsp + 0x68], rbx
mov r8, rdi
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], bx
nop dword [rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x1400027c0
lea rdx, [rbp + 0x830]
lea rcx, [rsp + 0x58]
call fcn.140004790
lea rax, [rbp + 0xa40]
mov qword [rbp - 0x78], rbx
mov r8, rdi
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], bx
inc r8
cmp word [rax + r8*2], bx
jne 0x1400027f6
lea rdx, [rbp + 0xa40]
lea rcx, [rsp + 0x78]
call fcn.140004790
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x78]
call fcn.140006410
test r12d, r12d
jne 0x1400030ed
test r13d, r13d
jne 0x14000284e
test r15d, r15d
je 0x14000284e
test esi, esi
jne 0x14000297f
call fcn.14000a3e0
test eax, eax
jne 0x140002856
jmp 0x140002d31
test esi, esi
jne 0x14000297f
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, str.SOFTWAREAdobeAdobe_Acrobat_
mov edx, 0x104
lea rcx, [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str.DCWebResource
mov edx, 0x104
lea rcx, [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov ecx, 0x208
call fcn.14000be28
xor edx, edx
mov r8d, 0x208
mov rcx, rax
mov rsi, rax
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp - 0x48]
mov dword [rbp - 0x40], ebx
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp - 0x3c], 4
lea rdx, [rbp - 0x10]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002916
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x38]
lea rax, [rbp - 0x40]
xor r8d, r8d
lea rdx, str.irandom
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp - 0x40]
test eax, eax
cmovne ecx, ebx
mov dword [rbp - 0x40], ecx
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call fcn.14000bc78
mov esi, dword [rbp - 0x40]
call fcn.14000a0f0
test r15d, r15d
jne 0x140002955
imul ecx, eax, 0x1770
mov eax, 0x51eb851f
mul ecx
shr edx, 5
cmp edx, esi
jb 0x140002d31
mov ecx, ebx
lea r12d, [r15 + 1]
jmp 0x140002988
cmp esi, 0x1770
jbe 0x140002d2a
imul ecx, eax, 0xfa0
mov eax, 0x51eb851f
mul ecx
shr edx, 5
add edx, 0x1770
cmp esi, edx
ja 0x140002d2a
mov r12d, 1
mov ecx, r12d
xor edx, edx
call fcn.14000a8b0
test eax, eax
jne 0x140002d25
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002d25
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140002d25
lea rcx, [rbp - 0x10]
mov dword [rbp - 0x10], 0x11c
call qword [case.0x140005863.0]
test eax, eax
jne 0x140002d25
cmp dword [rbp - 0xc], 0xa
ja 0x1400029fd
jne 0x140002d25
cmp dword [rbp - 8], ebx
ja 0x1400029fd
cmp dword [rbp - 4], 0x294f
jbe 0x140002d25
xor edx, edx
lea rcx, [rbp + 0x410]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x200]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, str.SOFTWAREAdobeAdobe_Acrobat_
mov edx, 0x104
lea rcx, [rbp + 0x200]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str.DCLanguagecurrent
mov edx, 0x104
lea rcx, [rbp + 0x200]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov ecx, 0x208
call fcn.14000be28
xor edx, edx
mov r8d, 0x208
mov rcx, rax
mov rsi, rax
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp - 0x48]
mov dword [rbp - 0x3c], 0x208
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x200]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002af3
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, [0x14000d8a0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002af3
mov rax, rdi
inc rax
cmp word [rsi + rax*2], bx
jne 0x140002ad2
cmp rax, 0x206
jae 0x140002af3
mov rdx, rsi
lea rcx, [rbp + 0x410]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call fcn.14000bc78
lea rdx, str..dll
lea rcx, [rbp + 0x410]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140002d25
call fcn.14000ac80
test eax, eax
jne 0x140002d25
xor edx, edx
lea rcx, [rbp + 0x200]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x410]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, str.SOFTWAREAdobeAdobe_Acrobat_
mov edx, 0x104
lea rcx, [rbp + 0x200]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str.DCInstaller
mov edx, 0x104
lea rcx, [rbp + 0x200]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov ecx, 0x208
call fcn.14000be28
xor edx, edx
mov r8d, 0x208
mov rcx, rax
mov rsi, rax
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp - 0x48]
mov dword [rbp - 0x3c], 0x208
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x200]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002c25
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, str.SetupCacheExport
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002c25
mov rax, rdi
inc rax
cmp word [rsi + rax*2], bx
jne 0x140002c04
cmp rax, 0x206
jae 0x140002c25
mov rdx, rsi
lea rcx, [rbp + 0x410]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call fcn.14000bc78
lea rdx, str.enterprise.mnt
lea rcx, [rbp + 0x410]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140002d25
lea r8, [rbp - 0x48]
mov qword [rbp - 0x48], rbx
lea rdx, str.SystemCurrentControlSetControlCitrix
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x140002d63
xor edx, edx
mov dword [rbp - 0x40], r12d
mov r8d, 0xff
lea rcx, [rbp - 0x10]
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x40]
lea rax, [rbp - 0x10]
mov dword [rbp - 0x2c], 0xff
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x14000f080]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002cc7
cmp dword [rbp - 0x40], 1
je 0x140002d1b
mov ecx, 0x1000
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x140002d63
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x3c]
lea rax, [rbp - 0x38]
mov dword [rbp - 0x3c], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.ProductVersionNum
mov dword [rbp - 0x34], 4
mov dword [rbp - 0x38], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002d63
cmp dword [rbp - 0x3c], 4
jne 0x140002d63
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15d, r15d
je 0x140002d31
xor ecx, ecx
call fcn.14000ab70
xor eax, eax
mov rcx, qword [rbp + 0xc50]
xor rcx, rsp
call fcn.14000b8b0
lea r11, [rsp + 0xd60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
lea rcx, [rbp + 0x410]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, str.SOFTWAREAdobeAdobe_ARM1.0ARM
mov edx, 0x104
lea rcx, [rbp + 0x410]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov ecx, 0x208
call fcn.14000be28
xor edx, edx
mov r8d, 0x208
mov rcx, rax
mov rsi, rax
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp - 0x48]
mov dword [rbp - 0x40], ebx
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp - 0x38], 4
lea rdx, [rbp + 0x410]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002e20
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x34]
lea rax, [rbp - 0x40]
xor r8d, r8d
lea rdx, str.iOwnershipNotificationCount
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp - 0x40]
test eax, eax
cmovne ecx, ebx
mov dword [rbp - 0x40], ecx
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call fcn.14000bc78
cmp dword [rbp - 0x40], 3
jae 0x140002d25
test r15d, r15d
je 0x140002fac
call fcn.14000a690
test eax, eax
jne 0x140002fa4
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x200]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, str.SOFTWAREAdobeAdobe_Acrobat_
mov edx, 0x104
lea rcx, [rbp + 0x200]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str.DCInstallPath
mov edx, 0x104
lea rcx, [rbp + 0x200]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov ecx, 0x208
call fcn.14000be28
xor edx, edx
mov r8d, 0x208
mov rcx, rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp - 0x48]
mov dword [rbp - 0x38], 0x208
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x200]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002f43
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x14000d8a0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002f43
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x140002f24
cmp rax, 0x206
jae 0x140002f43
mov rdx, rbx
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.14000bc78
lea rax, [rbp - 0x10]
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140002f60
test rdi, rdi
je 0x140002fa4
lea r8, [0x14000e968]
mov edx, 0x104
lea rcx, [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str.AdobeCollabSync.exe
mov edx, 0x104
lea rcx, [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rcx, [rbp - 0x10]
call fcn.14000b220
mov ecx, r12d
jmp 0x140002d2c
mov esi, dword [rsp + 0x30]
test esi, esi
jne 0x1400030f1
mov dword [rbp - 0x48], 8
mov dword [rbp - 0x3c], ebx
lea rcx, [rbp - 0x48]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x1400030fd
xor edx, edx
lea r8, [rbp - 0x3c]
xor r9d, r9d
lea ecx, [rdx + 0x72]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
je 0x1400030fd
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [rbp - 0x44]
cmp eax, 0x1388
jae 0x140003008
cmp dword [rbp - 0x3c], 0
je 0x1400030fd
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x18
jl 0x140002fc2
xor edx, edx
lea rcx, [rbp + 0x410]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x200]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, str.SOFTWAREAdobeAdobe_ARM1.0ARM
mov edx, 0x104
lea rcx, [rbp + 0x410]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str.iLastProcessedMAU
mov edx, 0x104
lea rcx, [rbp + 0x200]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov ecx, 0x208
call fcn.14000be28
xor edx, edx
mov r8d, 0x208
mov rcx, rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp - 0x48]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x410]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400030cc
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp + 0x200]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.14000bc78
mov ecx, 0x7e0
call fcn.14000af40
jmp 0x140002d31
test esi, esi
je 0x1400030fd
mov ecx, 0x7d0
call fcn.14000b0b0
jmp 0x140003107
mov ecx, 0x7d0
call fcn.14000af40
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.140004910
mov rcx, rax
call fcn.140006e60
test esi, esi
jne 0x14000312a
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, r14d
call fcn.1400035b0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3