Function at 0x40d0f3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41398f
mov eax, dword fs:[0]
push eax
mov eax, 0x1f94
call fcn.00411e40
push esi
push edi
push ecx
lea edi, [ebp - 0x1fa0]
mov ecx, 0x7e5
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x43b004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x24]
call fcn.00411016
and dword [ebp - 4], 0
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x444]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x654]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x864]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xa74]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc84]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xe94]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0xea0], 0x104
lea eax, [ebp - 0xea0]
push eax
lea eax, [ebp - 0xe94]
push eax
push 0x42d6f4
push dword [ebp + 0x10]
call sub.msi.dll_MsiGetPropertyW
and dword [ebp - 0xea8], 0
push 0x42d714
push dword [ebp + 0x10]
call fcn.00401896
pop ecx
pop ecx
test eax, eax
je 0x40d22a
mov dword [ebp - 0xea8], 1
cmp dword [ebp - 0xea8], 0
je 0x40d258
mov esi, esp
push str.AcroExch
push 0x104
lea eax, [ebp - 0xa74]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
jmp 0x40d27b
mov esi, esp
push str.Acrobat
push 0x104
lea eax, [ebp - 0xa74]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push 0x42d744
push 0x104
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push 0x42d75c
push 0x104
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push str.HKEY_CLASSES_ROOT.pdf
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
push str..msp
push dword [ebp + 8]
call fcn.00401896
pop ecx
pop ecx
test eax, eax
je 0x40d346
mov esi, esp
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
cmp esi, esp
call fcn.00411bb8
test eax, eax
jbe 0x40d346
push 0x42d7a0
push str._In_Patch_mode__not_changing_the_value_of_HKCR.pdf
call fcn.00410c9e
pop ecx
pop ecx
jmp 0x40d376
push 0
lea eax, [ebp - 0x444]
push eax
push 0x42d7a4
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
lea eax, [ebp - 0x444]
push eax
push 0x42d818
call fcn.00410c9e
pop ecx
pop ecx
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
jle 0x40d535
mov esi, esp
push 0x42d814
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
cmp dword [ebp - 0xea8], 0
je 0x40d3f8
mov esi, esp
push str.AcroRd32Info.exe___PDFShell
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f68], eax
jmp 0x40d419
mov esi, esp
push str.AcrobatInfo.exe___PDFShell
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f68], eax
mov esi, esp
push str.HKEY_CLASSES_ROOTCLSIDD38406DA_E8AA_484b_B80D_3D3DBDCC2FB2LocalServer32
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42d8cc
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40d4a7
push 0
lea eax, [ebp - 0x444]
push eax
push 0x42d96c
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTCLSIDD38406DA_E8AA_484b_B80D_3D3DBDCC2FB2LocalServer32:
call fcn.00410c9e
pop ecx
pop ecx
mov esi, esp
push str.HKEY_CLASSES_ROOTCLSID98D9A6F1_4696_4B5E_A2E8_36B3F9C1E12CLocalServer32
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42dabc
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40d535
push 0
lea eax, [ebp - 0x444]
push eax
push 0x42dac0
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTCLSID98D9A6F1_4696_4B5E_A2E8_36B3F9C1E12CLocalServer32:
call fcn.00410c9e
pop ecx
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x10b4]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x104
lea eax, [ebp - 0x10b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
jle 0x40da7e
mov esi, esp
lea eax, [ebp - 0x10b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
jle 0x40da7e
mov esi, esp
lea eax, [ebp - 0x10b4]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push str.Installer_
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push dword [ebp + 0x10]
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
cmp dword [ebp - 0xea8], 0
je 0x40d61b
mov esi, esp
push str.PDFFile_8.ico_0
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f6c], eax
jmp 0x40d63c
mov esi, esp
push str._PDFFile.ico_0
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f6c], eax
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc84]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x42dbd0
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push str..acrobatsecuritysettings.1DefaultIcon
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42dc48
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40d790
push 0
lea eax, [ebp - 0x444]
push eax
push 0x42dc4c
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
mov esi, esp
push 0x42dc50
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0x234]
push eax
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0xc84]
push eax
call fcn.00410c9e
pop ecx
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc84]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x42dc5c
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push 0x42dc84
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push 0x42dc9c
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push str.DefaultIcon
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42dcc0
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40d92a
push 0
lea eax, [ebp - 0x444]
push eax
push 0x42dcc4
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
mov esi, esp
push 0x42dcc8
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0x234]
push eax
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0xc84]
push eax
call fcn.00410c9e
pop ecx
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc84]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x42dcd4
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push str..pdfxml.1DefaultIcon
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42dd28
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40da7e
push 0
lea eax, [ebp - 0x444]
push eax
push 0x42dd2c
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
mov esi, esp
push 0x42dd30
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0x234]
push eax
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0xc84]
push eax
call fcn.00410c9e
pop ecx
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x12c4]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
cmp dword [ebp - 0xea8], 0
je 0x40dac0
mov esi, esp
push 0x42dd3c
lea eax, [ebp - 0x12c4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f70], eax
jmp 0x40dae1
mov esi, esp
push 0x42dd48
lea eax, [ebp - 0x12c4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f70], eax
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc84]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x42dd54
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push str..acrobatsecuritysettings.1_shell
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42dd7c
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40dc35
push 0
lea eax, [ebp - 0x12c4]
push eax
push 0x42ddc4
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
mov esi, esp
push 0x42ddc8
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0x234]
push eax
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0xc84]
push eax
call fcn.00410c9e
pop ecx
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc84]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x42ddd4
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push str..FDFDoc_shell
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42de18
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40dd89
push 0
lea eax, [ebp - 0x12c4]
push eax
push 0x42de1c
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
mov esi, esp
push 0x42de20
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0x234]
push eax
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0xc84]
push eax
call fcn.00410c9e
pop ecx
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc84]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x42de2c
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push 0x42de54
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push 0x42de6c
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push str._shell
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42de84
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40df23
push 0
lea eax, [ebp - 0x12c4]
push eax
push 0x42de88
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
mov esi, esp
push 0x42de8c
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0x234]
push eax
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0xc84]
push eax
call fcn.00410c9e
pop ecx
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc84]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x42de98
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push str..pdfxml.1_shell
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42dee0
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40e077
push 0
lea eax, [ebp - 0x12c4]
push eax
push 0x42dee4
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
mov esi, esp
push 0x42dee8
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0x234]
push eax
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0xc84]
push eax
call fcn.00410c9e
pop ecx
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc84]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x42def4
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push str..RMFFile_shell
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42df3c
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40e1cb
push 0
lea eax, [ebp - 0x12c4]
push eax
push 0x42df40
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
mov esi, esp
push 0x42df44
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0x234]
push eax
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0xc84]
push eax
call fcn.00410c9e
pop ecx
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc84]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x42df50
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push str..XDPDoc_shell
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42df94
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40e31f
push 0
lea eax, [ebp - 0x12c4]
push eax
push 0x42df98
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
mov esi, esp
push 0x42df9c
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0x234]
push eax
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0xc84]
push eax
call fcn.00410c9e
pop ecx
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc84]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x42dfa8
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push str..XFDFDoc_shell
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42dff0
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40e473
push 0
lea eax, [ebp - 0x12c4]
push eax
push 0x42dff4
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
mov esi, esp
push str.set:
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0x234]
push eax
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0xc84]
push eax
call fcn.00410c9e
pop ecx
pop ecx
mov esi, esp
push 0x42e008
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push 0x42e004
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
cmp dword [ebp - 0xea8], 0
je 0x40e4f2
mov esi, esp
push str.ReaderAcroRd32.exe_
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f74], eax
jmp 0x40e513
mov esi, esp
push str.AcrobatAcrobat.exe_
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f74], eax
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42e0bc
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40e586
push 0
lea eax, [ebp - 0x444]
push eax
push 0x42e0c0
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
lea eax, [ebp - 0x444]
push eax
push 0x42e0c8
call fcn.00410c9e
pop ecx
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x14d4]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x42e0c4
push 0x104
lea eax, [ebp - 0x14d4]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
push 0x104
lea eax, [ebp - 0x14d4]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
cmp dword [ebp - 0xea8], 0
je 0x40e612
mov esi, esp
push str.ReaderAcroRd32.exe____u___1_
push 0x104
lea eax, [ebp - 0x14d4]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
jmp 0x40e635
mov esi, esp
push str.AcrobatAcrobat.exe____u___1_
push 0x104
lea eax, [ebp - 0x14d4]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
push 0
lea eax, [ebp - 0x14d4]
push eax
push 0x42e1b0
push 0x42e1b8
lea ecx, [ebp - 0x24]
call fcn.00411917
mov esi, esp
push str.HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push 0x42e1b4
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
cmp dword [ebp - 0xea8], 0
je 0x40e6cf
mov esi, esp
push 0x42e214
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f78], eax
jmp 0x40e6f0
mov esi, esp
push 0x42e224
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f78], eax
mov esi, esp
push str.pdfprevhndlr.dll__101
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42e2e4
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40e77e
push 0
lea eax, [ebp - 0x444]
push eax
push str.DisplayName
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193_DisplayName_:
call fcn.00410c9e
pop ecx
pop ecx
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
cmp dword [ebp - 0xea8], 0
je 0x40e7c7
mov esi, esp
push 0x42e3d8
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f7c], eax
jmp 0x40e7e8
mov esi, esp
push 0x42e314
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f7c], eax
mov esi, esp
push str.pdfprevhndlr.dll
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push str.HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193InprocServer32
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42e40c
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40e891
push 0
lea eax, [ebp - 0x444]
push eax
push 0x42e4ac
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193InprocServer32:
call fcn.00410c9e
pop ecx
pop ecx
mov esi, esp
push str.HKEY_CLASSES_ROOTTypeLib41738EEA_442F_477F_92CF_2889BD6CD7E71.00win32
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
cmp dword [ebp - 0xea8], 0
je 0x40e8f5
mov esi, esp
push 0x42e5fc
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f80], eax
jmp 0x40e916
mov esi, esp
push 0x42e60c
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f80], eax
mov esi, esp
push str.AcroBroker.exe
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42e640
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40e9a4
push 0
lea eax, [ebp - 0x444]
push eax
push 0x42e644
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTTypeLib41738EEA_442F_477F_92CF_2889BD6CD7E71.00win32:
call fcn.00410c9e
pop ecx
pop ecx
mov esi, esp
push str.HKEY_CLASSES_ROOTCLSIDBD57A9B2_4E7D_4892_9107_9F4106472DA4LocalServer32
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push 0x42e794
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
cmp dword [ebp - 0xea8], 0
je 0x40ea23
mov esi, esp
push 0x42e798
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f84], eax
jmp 0x40ea44
mov esi, esp
push 0x42e7a8
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f84], eax
mov esi, esp
push str.AcroBroker.exe_
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42e7dc
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40ead2
push 0
lea eax, [ebp - 0x444]
push eax
push 0x42e7e0
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTCLSIDBD57A9B2_4E7D_4892_9107_9F4106472DA4LocalServer32:
call fcn.00410c9e
pop ecx
pop ecx
mov esi, esp
push str.HKEY_CLASSES_ROOTCLSID17F2E344_8227_4AA7_A25A_E89424566BBAInprocServer32
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42e7e4
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40eb60
push 0
lea eax, [ebp - 0x444]
push eax
push 0x42e934
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTCLSID17F2E344_8227_4AA7_A25A_E89424566BBAInprocServer32:
call fcn.00410c9e
pop ecx
pop ecx
mov esi, esp
push str.HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.00win32
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42e9ec
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40ebee
push 0
lea eax, [ebp - 0x444]
push eax
push 0x42ea8c
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.00win32:
call fcn.00410c9e
pop ecx
pop ecx
mov esi, esp
push str.HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.0HELPDIR
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
cmp dword [ebp - 0xea8], 0
je 0x40ec52
mov esi, esp
push 0x42ebdc
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f88], eax
jmp 0x40ec73
mov esi, esp
push 0x42ebec
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f88], eax
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42ec00
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40ece6
push 0
lea eax, [ebp - 0x444]
push eax
push 0x42ec04
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.0HELPDIR:
call fcn.00410c9e
pop ecx
pop ecx
mov esi, esp
push str.HKEY_CLASSES_ROOTCLSID12BA069D_0FC6_4577_97C6_5DF634CE6E84InProcServer32
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
cmp dword [ebp - 0xea8], 0
je 0x40ed4a
mov esi, esp
push str.Reader_
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f8c], eax
jmp 0x40ed6b
mov esi, esp
push str.Acrobat_
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f8c], eax
mov esi, esp
push str.ViewerPS.dll
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42ed94
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40edf9
push 0
lea eax, [ebp - 0x444]
push eax
push 0x42ed98
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTCLSID12BA069D_0FC6_4577_97C6_5DF634CE6E84InProcServer32:
call fcn.00410c9e
pop ecx
pop ecx
mov esi, esp
push str.HKEY_CLASSES_ROOTMIMEDatabaseContent_Type_application_pdf
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push 0x42eee0
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42ed9c
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40eea2
push 0
lea eax, [ebp - 0x444]
push eax
push 0x42eed4
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
lea eax, [ebp - 0x444]
push eax
push 0x42ef30
call fcn.00410c9e
pop ecx
pop ecx
mov esi, esp
push str.HKEY_CLASSES_ROOTCLSIDB801CA65_A1FC_11D0_85AD_444553540000LocalServer32
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
cmp dword [ebp - 0xea8], 0
je 0x40ef06
mov esi, esp
push str.ReaderAcroRd32.exe
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f90], eax
jmp 0x40ef27
mov esi, esp
push 0x42f084
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f90], eax
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42efbc
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40ef9a
push 0
lea eax, [ebp - 0x444]
push eax
push 0x42f0ac
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTCLSIDB801CA65_A1FC_11D0_85AD_444553540000LocalServer32:
call fcn.00410c9e
pop ecx
pop ecx
mov esi, esp
push str.HKEY_CLASSES_ROOTCLSIDB801CA65_A1FC_11D0_85AD_444553540000ProgID
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push 0x42f1ec
push 0x104
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push 0x42f204
push 0x104
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42f20c
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40f093
push 0
lea eax, [ebp - 0x444]
push eax
push 0x42f210
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTCLSIDBD57A9B2_4E7D_4892_9107_9F4106472DA4ProgID:
call fcn.00410c9e
pop ecx
pop ecx
mov esi, esp
push str.HKEY_LOCAL_MACHINESOFTWAREGoogleChromeNativeMessagingHostscom.adobe.acrobat.chrome_webcapture
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
cmp dword [ebp - 0xea8], 0
je 0x40f0f7
mov esi, esp
push str.ReaderBrowserWCChromeExtnmanifest.json
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f94], eax
jmp 0x40f118
mov esi, esp
push 0x42f3d8
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f94], eax
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42f214
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
push str.AcrobatBrowserWCChromeExtnmanifest.json
lea eax, [ebp - 0x654]
push eax
call fcn.00401896
pop ecx
pop ecx
test eax, eax
je 0x40f15a
mov byte [ebp - 0x1f95], 1
jmp 0x40f161
mov byte [ebp - 0x1f95], 0
mov al, byte [ebp - 0x1f95]
mov byte [ebp - 0x14d9], al
movzx eax, byte [ebp - 0x14d9]
test eax, eax
je 0x40f18d
lea eax, [ebp - 0x654]
push eax
call fcn.00401961
pop ecx
test eax, eax
jne 0x40f292
lea eax, [ebp - 0x444]
push eax
call fcn.00401961
pop ecx
test eax, eax
je 0x40f27f
call fcn.004072a6
mov dword [ebp - 0x14e0], eax
cmp dword [ebp - 0xea8], 0
je 0x40f1e7
cmp dword [ebp - 0xea8], 0
je 0x40f232
push str.45CF91C1_9080_4F1F_913A_79E790513EF3
push dword [ebp + 0x10]
call fcn.004102f6
pop ecx
pop ecx
movzx eax, al
test eax, eax
jne 0x40f1e7
cmp dword [ebp - 0x14e0], 1
je 0x40f1e7
cmp dword [ebp - 0x14e0], 2
jne 0x40f232
push 0
lea eax, [ebp - 0x444]
push eax
push 0x42f3d4
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
push 0
push str.https:__clients2.google.com_service_update2_crx
push str.update_url
push 0x42f550
lea ecx, [ebp - 0x24]
call fcn.00411917
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_LOCAL_MACHINESOFTWAREGoogleChromeNativeMessagingHostscom.adobe.acrobat.chrome_webcapture:
call fcn.00410c9e
pop ecx
pop ecx
jmp 0x40f27d
cmp dword [ebp - 0xea8], 0
je 0x40f27d
lea eax, [ebp - 0x654]
push eax
call fcn.00401961
pop ecx
test eax, eax
jne 0x40f27d
push 0x42f5fc
push str.Ownership:_Deleting_Chrome_Extension_registry_entries
call fcn.00410c9e
pop ecx
pop ecx
push 0
push str.HKEY_LOCAL_MACHINESOFTWAREGoogleChromeExtensionsefaidnbmnnnibpcajpcglclefindmkaj
lea ecx, [ebp - 0x24]
call fcn.0041109b
push 0
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041109b
jmp 0x40f292
lea eax, [ebp - 0x444]
push eax
push str.File_does_not_exist:
call fcn.00410c9e
pop ecx
pop ecx
push 0x400
lea eax, [ebp - 0x1ce4]
push eax
call fcn.00407be8
pop ecx
pop ecx
test eax, eax
jne 0x40f2c7
push 0x400
lea eax, [ebp - 0x1ce4]
push eax
call fcn.00407a1a
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x40f3b2
mov esi, esp
push 0x42f81c
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0x1ce4]
push eax
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push str.SoftwareClassesMIMEDatabaseContent_Type_application_pdf
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push str.CA8A9780_280D_11CF_A24D_444553540000
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42f834
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
lea eax, [ebp - 0x654]
test eax, eax
je 0x40f3b2
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40f3b2
push 0
lea eax, [ebp - 0x444]
push eax
push str.CLSID
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTMIMEDatabaseContent_Type_application_pdf
call fcn.00410c9e
pop ecx
pop ecx
cmp dword [0x43b2fc], 0
jne 0x40f591
call fcn.004105bd
movzx eax, al
test eax, eax
jne 0x40f591
push 0x208
push 0
lea eax, [ebp - 0x1ef4]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x1ef4]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push str..Document.
push 0x104
lea eax, [ebp - 0x1ef4]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push 0x42f9bc
push 0x104
lea eax, [ebp - 0x1ef4]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f20], 0x42f9c4
mov dword [ebp - 0x1f1c], 0x42f9d0
mov dword [ebp - 0x1f18], 0x42f9e0
mov dword [ebp - 0x1f14], 0x42fa14
mov dword [ebp - 0x1f10], 0x42fa20
mov dword [ebp - 0x1f0c], 0x42fa2c
mov dword [ebp - 0x1f08], 0x42fa38
mov dword [ebp - 0x1f04], 0x42fa44
mov dword [ebp - 0x1f00], 0x42fa50
mov dword [ebp - 0x1f58], 0x42fa64
mov dword [ebp - 0x1f54], 0x42fa70
mov dword [ebp - 0x1f50], 0x42fa80
mov dword [ebp - 0x1f4c], 0x42fab4
mov dword [ebp - 0x1f48], 0x42fac0
mov dword [ebp - 0x1f44], 0x42facc
mov dword [ebp - 0x1f40], 0x42fad8
mov dword [ebp - 0x1f3c], 0x42fae4
mov dword [ebp - 0x1f38], 0x42faf0
mov dword [ebp - 0x1f34], 0x42fb04
mov dword [ebp - 0x1f30], 0x42fb10
mov dword [ebp - 0x1f2c], 0x42fb1c
cmp dword [ebp - 0xea8], 0
je 0x40f537
mov dword [ebp - 0x1f9c], 9
jmp 0x40f541
mov dword [ebp - 0x1f9c], 0xc
mov eax, dword [ebp - 0x1f9c]
mov dword [ebp - 0x1f60], eax
cmp dword [ebp - 0xea8], 0
je 0x40f564
lea eax, [ebp - 0x1f20]
mov dword [ebp - 0x1fa0], eax
jmp 0x40f570
lea eax, [ebp - 0x1f58]
mov dword [ebp - 0x1fa0], eax
lea eax, [ebp - 0x1ef4]
push eax
push dword [ebp - 0xea8]
push dword [ebp - 0x1f60]
push dword [ebp - 0x1fa0]
call fcn.00405ced
add esp, 0x10
mov esi, esp
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f64], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00411040
mov eax, dword [ebp - 0x1f64]
push edx
mov ecx, ebp
push eax
lea edx, [0x40f603]
call fcn.00411b62
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411bf0
add esp, 0x1fa0
cmp ebp, esp
call fcn.00411bb8
leave
ret 0xc