Function at 0x11d3df50
Capabilities:
Check for time delay via gettickcount
Check if file exists
Create process on windows
Get file attributes
Resolve function by parsing pe exports
Resume thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11fa8450
push eax
mov eax, dword [0x12133f80]
mov dword fs:[0], esp
mov ecx, dword [esp + 0x10]
sub esp, 0x4d4
push ebx
xor ebx, ebx
push ebp
push esi
mov esi, dword [esp + 0x4f4]
cmp eax, ebx
push edi
je 0x11d3dfb5
cmp esi, ebx
mov edx, str.NULL
je 0x11d3df90
mov edx, esi
cmp ecx, ebx
jne 0x11d3df99
mov ecx, str.NULL
mov eax, dword [0x12126854]
push edx
push ecx
push eax
push str.__s__CSafeInject::OnIExecuteCommandExecuteSafeDoc_Called__Verb:_s__File:__s_n
push str.SafeInject
push 1
call fcn.11ca5810
add esp, 0x18
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xd6]
mov word [esp + 0xd4], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x11fd6250]
mov dword [esp + 0x58], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x60], eax
xor ecx, ecx
mov dword [esp + 0x4ec], ebx
mov dword [esp + 0x74], ecx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], ecx
call fcn.11dda000
mov edi, dword [esp + 0x500]
mov ebp, dword [esp + 0x4fc]
test eax, eax
je 0x11d3ef37
call fcn.11e5b260
test eax, eax
je 0x11d3e3a2
mov ecx, 0x1212b5c0
call fcn.11da8be0
test eax, eax
je 0x11d3e3a2
call fcn.11e5b370
test eax, eax
je 0x11d3e07f
lea edx, [esp + 0x18]
mov ecx, 0x1212b5c0
push edx
call fcn.11d94490
mov eax, dword [esp + 0x18]
mov byte [esp + 0x4ec], 4
cmp dword [eax - 8], ebx
je 0x11d3e06f
push ebx
push ebx
push esi
call fcn.11e5bb20
add esp, 0xc
cmp eax, ebx
jne 0x11d3f017
mov byte [esp + 0x4ec], bl
lea ecx, [esp + 0x18]
jmp 0x11d3e39d
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], ebx
call fcn.11e7eae0
push ebx
mov ecx, 0x1212b5c0
mov byte [esp + 0x4f0], 7
call fcn.11d87b70
test eax, eax
je 0x11d3e0e1
call fcn.11de3e90
test eax, eax
jne 0x11d3e0e1
cmp dword [0x12133f80], ebx
je 0x11d3e392
mov ecx, dword [esp + 0x10]
mov eax, dword [0x12126854]
push ecx
push eax
push str.__s__CSafeInject::OnIExecuteCommandExecuteSafeDoc:_smart_pro_had_not_visited_ProctectIP__can_not_transform_File__s_
push str.SDTransform
push 0xffffffffffffffff
call fcn.11ca5810
add esp, 0x14
jmp 0x11d3e392
call fcn.11e5b490
test eax, eax
jne 0x11d3e392
mov edx, dword [esp + 0x10]
push ebx
push ebx
push edx
call fcn.11e5bb20
add esp, 0xc
test eax, eax
je 0x11d3e392
lea ecx, [esp + 0x14]
call fcn.11e923e0
lea ecx, [esp + 0x18]
mov byte [esp + 0x4ec], 8
call fcn.11e923e0
mov eax, dword [esp + 0x10]
mov byte [esp + 0x4ec], 9
push eax
call fcn.11e5d180
add esp, 4
cmp eax, ebx
je 0x11d3e175
mov eax, dword [0x12133f80]
xor esi, esi
cmp eax, ebx
mov dword [esp + 0x2c], 0x33
mov dword [esp + 0x34], 5
je 0x11d3e2ed
mov ecx, dword [esp + 0x10]
push ecx
push str.CSafeInject::OnIExecuteCommandExecuteSafeDoc_Path__s__will_not_transform_GSDES_backup_file_
push str.SDTransform
push 0xffffffffffffffff
call fcn.11ca5810
add esp, 0x10
jmp 0x11d3e2ed
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
lea eax, [esp + 0x14]
push edx
push eax
push ecx
mov ecx, 0x1212b5c0
call fcn.11d70140
test eax, eax
jne 0x11d3e1a4
lea ecx, [esp + 0x14]
call fcn.11e928f0
lea ecx, [esp + 0x18]
call fcn.11e928f0
push ebx
push ebx
push ebx
mov ecx, 0x1212b5c0
call fcn.11d60760
test eax, eax
je 0x11d3e23c
mov edx, dword [esp + 0x10]
push 0xffffffffffffffff
push edx
mov ecx, 0x1212b5c0
call fcn.11d6a700
test eax, eax
jne 0x11d3e216
mov eax, dword [esp + 0x10]
push ebx
push ebx
push ebx
push eax
mov ecx, 0x1212b5c0
call fcn.11d70510
test eax, eax
jne 0x11d3e216
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, 0x1212b5c0
call fcn.11d9b7f0
test eax, eax
jne 0x11d3e20f
mov edx, dword [esp + 0x10]
push ebx
push 1
push ebx
push ebx
push edx
mov ecx, 0x1212b5c0
call fcn.11d6cfd0
test eax, eax
je 0x11d3e216
mov esi, 1
jmp 0x11d3e218
xor esi, esi
cmp dword [0x12133f80], ebx
je 0x11d3e294
mov eax, dword [esp + 0x10]
push eax
push esi
push str.CSafeInject::OnIExecuteCommandExecuteSafeDoc_IsTargetProcess__bTranEncrypt__d__File__s_
push str.SDTransform
push 0xffffffffffffffff
call fcn.11ca5810
add esp, 0x14
jmp 0x11d3e294
mov ecx, 0x1212b458
call fcn.11df40d0
test eax, eax
je 0x11d3e25f
mov ecx, dword [esp + 0x10]
push ecx
call fcn.11e5fad0
add esp, 4
test eax, eax
jne 0x11d3e25f
xor esi, esi
jmp 0x11d3e264
mov esi, 1
cmp dword [0x12133f80], ebx
je 0x11d3e294
mov edx, dword [esp + 0x10]
push edx
call fcn.11e5fad0
add esp, 4
push eax
mov eax, dword [esp + 0x14]
push eax
push esi
push str.CSafeInject::OnIExecuteCommandExecuteSafeDoc_Is_not_TargetProcess__bTranEncrypt__d__File__s__IsGsDesEncrypt__d_
push str.SDTransform
push 0xffffffffffffffff
call fcn.11ca5810
add esp, 0x18
lea ecx, [esp + 0x18]
call fcn.11e925e0
push eax
lea ecx, [esp + 0x1c]
call fcn.11e92d00
push eax
push esi
push ebx
lea ecx, [esp + 0x24]
call fcn.11e925e0
push eax
lea ecx, [esp + 0x28]
call fcn.11e92d00
lea ecx, [esp + 0x48]
push eax
lea edx, [esp + 0x44]
push ecx
push edx
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x54], esp
push eax
call fcn.11e7e880
mov ecx, 0x12132fc4
mov byte [esp + 0x510], 9
call fcn.11e5f390
mov esi, eax
push str._File_Transform_
lea ecx, [esp + 0x2c]
call fcn.11e7eae0
lea ecx, [esp + 0x10]
mov byte [esp + 0x4ec], 0xb
push ecx
lea ecx, [esp + 0x2c]
call fcn.11e7ff30
cmp esi, ebx
je 0x11d3f124
lea ecx, [esp + 0x14]
xor edi, edi
call fcn.11e925e0
test eax, eax
jbe 0x11d3e333
lea ecx, [esp + 0x14]
call fcn.11e92ce0
mov edi, eax
lea ecx, [esp + 0x18]
xor esi, esi
call fcn.11e925e0
test eax, eax
jbe 0x11d3e34d
lea ecx, [esp + 0x18]
call fcn.11e92ce0
mov esi, eax
mov edx, dword [esp + 0x28]
push esi
push edi
push ebx
push edx
mov ecx, 0x1212b560
call fcn.11dee5b0
lea ecx, [esp + 0x28]
mov byte [esp + 0x4ec], 9
call fcn.11e7f280
lea ecx, [esp + 0x18]
mov byte [esp + 0x4ec], 8
call fcn.11e92540
lea ecx, [esp + 0x14]
mov byte [esp + 0x4ec], 7
call fcn.11e92540
mov byte [esp + 0x4ec], bl
lea ecx, [esp + 0x10]
call fcn.11e7f280
lea eax, [esp + 0x64]
lea ecx, [esp + 0x20]
push eax
xor ebp, ebp
push ecx
mov ecx, 0x1212b028
mov dword [esp + 0x34], ebp
mov dword [esp + 0x6c], ebx
call fcn.11d205c0
mov edx, dword [esp + 0x20]
mov byte [esp + 0x4ec], 0xe
cmp dword [edx - 8], ebx
je 0x11d3e4d1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x64]
cmp eax, 0x1f4
jae 0x11d3e4d1
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x92]
mov word [esp + 0x90], bx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x4f8]
push 0x1f
stosw word es:[edi], ax
lea eax, [esp + 0x94]
mov ebp, 1
push eax
push ecx
mov dword [esp + 0x38], ebp
call fcn.11dbbdf0
add esp, 0xc
lea ecx, [esp + 0x28]
push 0x1207c188
call fcn.11e7eae0
lea edx, [esp + 0x90]
lea ecx, [esp + 0x28]
push edx
mov byte [esp + 0x4f0], 0xf
call fcn.11e7fed0
push 0x12119948
lea ecx, [esp + 0x18]
call fcn.11e7eae0
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x28]
push 0x104
push 0x104
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4f4], 0x10
call fcn.11e7ff50
push eax
push esi
push edi
call fcn.11c93260
add esp, 0x10
lea ecx, [esp + 0x14]
push 0xffffffffffffffff
call fcn.11e80020
mov eax, dword [esp + 0x14]
cmp dword [eax - 8], ebx
je 0x11d3e4af
push eax
lea eax, [esp + 0xd8]
push eax
call fcn.11e6749a
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x4ec], 0xf
call fcn.11e7f280
lea ecx, [esp + 0x28]
mov byte [esp + 0x4ec], 0xe
call fcn.11e7f280
cmp dword [0x1212acbc], ebx
jne 0x11d3e4e8
push 0x12119948
mov ecx, 0x1212ab38
call fcn.11e58340
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x12118d80
call fcn.11c92760
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2ee]
mov word [esp + 0x2ec], bx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xe4]
stosw word es:[edi], ax
push ecx
mov edi, 1
call fcn.11e67d05
add esp, 0x14
test eax, eax
je 0x11d3e546
lea edx, [esp + 0xd4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x11d3e61a
mov ecx, dword [esp + 0x4f4]
mov esi, dword [esp + 0x4f8]
push ebx
push ebx
lea eax, [esp + 0xdc]
push 0x104
push eax
push ecx
push ebx
push ebx
push esi
call fcn.11d39ec0
add esp, 0x20
test eax, eax
jne 0x11d3e621
cmp dword [0x12133f80], ebx
je 0x11d3e599
mov eax, dword [0x12126854]
push eax
push str.__s__CSafeInject::OnIExecuteCommandExecuteSafeDoc_TFindExecutableW_Failed__n
push str.SafeInject
push 4
call fcn.11ca5810
add esp, 0x10
cmp ebp, ebx
je 0x11d3e616
push 0x12079418
push esi
call fcn.11e9bad0
add esp, 8
test eax, eax
je 0x11d3e616
push 0x207
lea edx, [esp + 0xd8]
push esi
push edx
call fcn.11e674bf
push 1
lea eax, [esp + 0x2ec]
push 0x104
push eax
call fcn.11c9d890
mov eax, dword [0x12133f80]
add esp, 0x18
lea esi, [esp + 0x2dc]
cmp eax, ebx
mov dword [esp + 0x4f8], esi
je 0x11d3e621
lea ecx, [esp + 0x2dc]
lea edx, [esp + 0xd4]
push ecx
push edx
push str.change_filename_to_processname__wszProcess__s__lpFileName__s_
push str.SafeInject
push 4
call fcn.11ca5810
add esp, 0x14
jmp 0x11d3e621
xor edi, edi
jmp 0x11d3e621
mov esi, dword [esp + 0x4f8]
mov ecx, 0x1212b458
call fcn.11df40d0
test eax, eax
je 0x11d3e655
push esi
call fcn.11d3a3f0
add esp, 4
test eax, eax
je 0x11d3e655
lea eax, [esp + 0xd4]
push eax
push esi
call fcn.11d3a500
add esp, 8
test eax, eax
jne 0x11d3f29c
cmp edi, ebx
je 0x11d3f79c
lea ecx, [esp + 0xd4]
push ecx
call fcn.11df3e70
add esp, 4
cmp eax, 0x311
mov dword [esp + 0x50], eax
jne 0x11d3e6d3
push ebx
mov ecx, 0x1212b5c0
call fcn.11d7d0c0
cmp dword [0x12133f80], ebx
je 0x11d3e6d3
lea edx, [esp + 0xd4]
lea ecx, [esp + 0x30]
push edx
call fcn.11e7eae0
mov eax, dword [eax]
mov ecx, dword [0x12126854]
push eax
push ecx
push str.__s_CSafeInject::OnIExecuteCommandExecuteSafeDoc_SetOpenEncryptFileFlag_FALSE__Process__s___n
push str.IPG_6733
push 1
mov byte [esp + 0x500], 0x11
call fcn.11ca5810
add esp, 0x14
lea ecx, [esp + 0x30]
mov byte [esp + 0x4ec], 0xe
call fcn.11e7f280
lea ecx, [esp + 0xd4]
push ebx
push ecx
mov ecx, 0x1212b5c0
call fcn.11d88070
mov edi, eax
cmp edi, ebx
je 0x11d3e706
lea edx, [esp + 0xd4]
mov ecx, 0x1212b5c0
push edx
call fcn.11da8010
test eax, eax
je 0x11d3f79c
lea eax, [esp + 0x6c]
lea ecx, [esp + 0xd4]
push eax
push ebx
push ecx
mov ecx, 0x1212b5c0
mov dword [esp + 0x78], ebx
call fcn.11d87ca0
cmp eax, ebx
mov dword [esp + 0x34], eax
je 0x11d3e74a
cmp dword [esp + 0x6c], ebx
je 0x11d3e74a
lea edx, [esp + 0xd4]
mov ecx, 0x1212b5c0
push edx
call fcn.11da8010
test eax, eax
je 0x11d3f79c
push 0x12119948
lea ecx, [esp + 0x20]
call fcn.11e7eae0
xor eax, eax
mov byte [esp + 0x4ec], 0x12
mov dword [esp + 0x84], eax
mov ebp, dword [esp + 0x4f8]
mov dword [esp + 0x88], eax
lea ecx, [esp + 0x80]
mov dword [esp + 0x8c], eax
lea edx, [esp + 0x3c]
push ecx
lea eax, [esp + 0x58]
push edx
lea ecx, [esp + 0x64]
push eax
lea edx, [esp + 0x44]
push ecx
lea eax, [esp + 0xe4]
push edx
push eax
push ebp
mov dword [esp + 0x54], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x9c], ebx
call fcn.11d44cc0
add esp, 0x1c
mov ecx, 0x1212b5c0
mov esi, eax
push ebp
call fcn.11d9cf40
mov ecx, 0x1212b5c0
mov ebp, eax
call fcn.11d71460
test eax, eax
je 0x11d3e7fd
lea ecx, [esp + 0xd4]
push ecx
mov ecx, 0x1212b5c0
call fcn.11d902f0
test eax, eax
mov dword [esp + 0x28], 1
jne 0x11d3e801
mov dword [esp + 0x28], ebx
cmp edi, ebx
jne 0x11d3e828
cmp dword [esp + 0x34], ebx
jne 0x11d3e828
call fcn.11dd84e0
test eax, eax
je 0x11d3e824
push 1
mov ecx, 0x1212b5c0
call fcn.11d8cdf0
test eax, eax
jne 0x11d3e828
xor edi, edi
jmp 0x11d3e82d
mov edi, 1
call fcn.11dac240
test eax, eax
jne 0x11d3e90a
mov ecx, 0x1212b5c0
call fcn.11db90c0
test eax, eax
jne 0x11d3e90a
lea edx, [esp + 0xd4]
mov ecx, 0x1212b5c0
push edx
call fcn.11d8d560
cmp esi, ebx
je 0x11d3ea0d
cmp eax, ebx
jne 0x11d3ea0d
cmp ebp, ebx
je 0x11d3ea0d
cmp dword [esp + 0x28], ebx
jne 0x11d3ea0d
cmp edi, ebx
jne 0x11d3ea0d
mov eax, dword [esp + 0x4f8]
mov ecx, dword [esp + 0x4f4]
push 1
push eax
push ecx
call fcn.11d3ac60
add esp, 0xc
test eax, eax
je 0x11d3ea0d
mov eax, dword [0x12126434]
push ebx
push 1
push ebx
push ebx
push ebx
push eax
push ebx
lea edx, [esp + 0xf0]
push ebx
push edx
mov ecx, 0x1212b5c0
call fcn.11d65bb0
test eax, eax
jne 0x11d3ea0d
lea eax, [esp + 0x10]
push eax
call fcn.11d3bd00
add esp, 4
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x4ec], 0x14
cmp dword [ecx - 8], ebx
jne 0x11d3f2bb
lea ecx, [esp + 0x10]
mov byte [esp + 0x4ec], 0x12
call fcn.11e7f280
jmp 0x11d3ea0d
mov ecx, 0x1212b5c0
call fcn.11d91590
cmp eax, ebx
jne 0x11d3e926
cmp dword [esp + 0x2c], ebx
jne 0x11d3e926
cmp esi, ebx
jne 0x11d3f491
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x4f8]
push eax
push edi
push ecx
mov ecx, dword [esp + 0x508]
push ebp
push esi
lea eax, [esp + 0xec]
push edx
push eax
push ecx
call fcn.11d46000
add esp, 0x24
cmp eax, ebx
mov dword [esp + 0x58], eax
jne 0x11d3f78b
mov ecx, 0x1212b5c0
call fcn.11db90c0
test eax, eax
je 0x11d3ea0d
lea ecx, [esp + 0x28]
call fcn.11e923e0
mov ebp, dword [esp + 0x4f8]
push 1
push ebx
lea edx, [esp + 0x30]
push ebx
push edx
lea eax, [esp + 0x3c]
push ebx
push eax
mov byte [esp + 0x504], 0x13
push ebp
mov ecx, 0x1212b028
mov dword [esp + 0x48], ebx
call fcn.11d0a950
lea ecx, [esp + 0x70]
lea edx, [esp + 0x28]
push ecx
push edx
push ebp
mov ecx, 0x1212b5c0
mov esi, eax
call fcn.11d70160
mov edi, eax
push ebp
neg edi
sbb edi, edi
lea ecx, [esp + 0x64]
inc edi
mov dword [esp + 0x6c], edi
call fcn.11e7f500
cmp dword [0x12133f80], ebx
je 0x11d3e9fc
mov eax, dword [esp + 0x2c]
push edi
push eax
push esi
push ebp
push str.OnIExecuteCommandExecuteSafeDoc_after_CheckAccessRight__file__s____d___d___d_
push str.SafeInject
push 4
call fcn.11ca5810
add esp, 0x1c
lea ecx, [esp + 0x28]
mov byte [esp + 0x4ec], 0x12
call fcn.11e92540
lea ecx, [esp + 0xd4]
xor esi, esi
push ecx
lea ecx, [esp + 0x28]
call fcn.11e7eae0
push 2
lea ecx, [esp + 0x44]
mov byte [esp + 0x4f0], 0x16
call fcn.11e15fa0
lea ecx, [esp + 0x30]
mov byte [esp + 0x4ec], 0x17
call fcn.11e16080
lea ecx, [esp + 0x24]
mov byte [esp + 0x4ec], 0x18
call fcn.11e805b0
mov edx, dword [esp + 0x24]
push str.shimgvw.dll
push edx
call fcn.11e68668
add esp, 8
test eax, eax
jne 0x11d3ea81
mov eax, dword [esp + 0x24]
push str.photoviewer.dll
push eax
call fcn.11e68668
add esp, 8
test eax, eax
je 0x11d3ead6
cmp dword [esp + 0x38], ebx
jne 0x11d3eab0
cmp dword [esp + 0x5c], ebx
jne 0x11d3eab0
cmp dword [esp + 0x3c], ebx
jne 0x11d3eab0
cmp dword [esp + 0x54], ebx
je 0x11d3ead6
mov ebp, dword [esp + 0x4f8]
push ebx
push ebp
call fcn.11ee5500
add esp, 8
test eax, eax
je 0x11d3eadd
jmp 0x11d3eab7
mov ebp, dword [esp + 0x4f8]
call fcn.11e97030
push eax
lea ecx, [esp + 0x28]
push str._s_rundll32.exe
push ecx
call fcn.11e82200
add esp, 0xc
mov esi, 1
jmp 0x11d3eadd
mov ebp, dword [esp + 0x4f8]
lea ecx, [esp + 0x30]
mov byte [esp + 0x4ec], 0x17
call fcn.11e16090
lea ecx, [esp + 0x40]
mov byte [esp + 0x4ec], 0x16
call fcn.11e15fd0
call fcn.11dd84e0
test eax, eax
jne 0x11d3eb46
call fcn.11dd8580
test eax, eax
jne 0x11d3eb46
mov edx, dword [esp + 0x24]
push ebx
push 1
push ebx
push ebx
push edx
mov ecx, 0x1212b5c0
call fcn.11d79290
test eax, eax
jne 0x11d3eb46
cmp dword [esp + 0x34], ebx
jne 0x11d3eb46
mov eax, dword [esp + 0x24]
mov ecx, 0x1212b5c0
push eax
call fcn.11da8010
test eax, eax
je 0x11d3f49e
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x12118d80
call fcn.11c92440
add esp, 0x14
cmp esi, ebx
jne 0x11d3f4c8
mov ecx, dword [esp + 0x54]
lea edx, [esp + 0xd4]
push ecx
push edx
call fcn.11d447c0
add esp, 8
test eax, eax
jne 0x11d3ef18
mov eax, dword [esp + 0x54]
lea ecx, [esp + 0xd4]
push eax
push ebp
push ecx
call fcn.11d44900
add esp, 0xc
mov ecx, 0x1212b5c0
call fcn.11d89790
test eax, eax
jne 0x11d3f606
mov ecx, 0x1212b5c0
call fcn.11d89e60
test eax, eax
jne 0x11d3f606
lea edx, [esp + 0xd4]
mov ecx, 0x1212b5c0
push edx
call fcn.11da8010
test eax, eax
jne 0x11d3f606
cmp dword [esp + 0x54], ebx
jne 0x11d3ece9
cmp dword [esp + 0x38], ebx
jne 0x11d3ece9
cmp dword [esp + 0x5c], ebx
jne 0x11d3ece9
cmp dword [esp + 0x3c], ebx
jne 0x11d3ece9
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x92]
mov word [esp + 0x90], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x90]
push 0x1f
push eax
push ebp
call fcn.11dbbdf0
lea ecx, [esp + 0x9c]
push ecx
call fcn.11e67d05
add esp, 0x10
cmp eax, 3
jb 0x11d3f77a
mov eax, dword [0x1206b3fc]
xor esi, esi
cmp eax, ebx
jle 0x11d3ec75
mov edi, 0x1206b3e0
mov edx, dword [edi]
lea eax, [esp + 0x90]
push edx
push eax
call fcn.11e67d22
add esp, 8
test eax, eax
je 0x11d3ec75
mov eax, dword [0x1206b3fc]
inc esi
add edi, 4
cmp esi, eax
jl 0x11d3ec51
cmp esi, dword [0x1206b3fc]
je 0x11d3f77a
push ebx
lea ecx, [esp + 0xd8]
push ebx
push ecx
call fcn.11dd82a0
add esp, 0xc
test eax, eax
je 0x11d3f77a
mov esi, dword [esp + 0x50]
cmp esi, 0x310
je 0x11d3ecc9
mov ecx, 0x1212b5c0
call fcn.11d84e40
test eax, eax
je 0x11d3ecbd
cmp esi, 0x311
je 0x11d3ecc9
cmp esi, 0x313
jne 0x11d3ee68
lea edx, [esp + 0xd4]
push ebp
push edx
lea eax, [esp + 0x24]
push str.__s____s___x
push eax
call fcn.11e82200
add esp, 0x10
jmp 0x11d3ee68
cmp dword [0x12133f80], ebx
je 0x11d3ed0c
mov eax, dword [0x12126854]
push ebp
push eax
push str.__s__CSafeInject::OnIExecuteCommandExecuteReadOnly_EncryptedFile__s__n
push str.SafeInject
push 1
call fcn.11ca5810
add esp, 0x14
push 2
lea ecx, [esp + 0x44]
call fcn.11e15fa0
lea ecx, [esp + 0x30]
mov byte [esp + 0x4ec], 0x1c
call fcn.11e16080
push ebx
push ebp
mov byte [esp + 0x4f4], 0x1d
call fcn.11ee5500
add esp, 8
test eax, eax
jne 0x11d3ed54
cmp dword [esp + 0x38], ebx
jne 0x11d3ed54
cmp dword [esp + 0x5c], ebx
jne 0x11d3ed54
cmp dword [esp + 0x3c], ebx
je 0x11d3f6d8
lea ecx, [esp + 0x30]
mov byte [esp + 0x4ec], 0x1c
call fcn.11e16090
lea ecx, [esp + 0x40]
mov byte [esp + 0x4ec], 0x16
call fcn.11e15fd0
mov ecx, 0x1212b5c0
call fcn.11d84e40
test eax, eax
jne 0x11d3edea
cmp dword [esp + 0x50], 0x311
jne 0x11d3edea
push 1
mov ecx, 0x1212b5c0
call fcn.11d7d0c0
cmp dword [0x12133f80], ebx
je 0x11d3edea
lea ecx, [esp + 0xd4]
push ecx
lea ecx, [esp + 0x34]
call fcn.11e7eae0
mov edx, dword [eax]
mov ecx, dword [0x12126854]
push edx
push ecx
push str.__s_CSafeInject::OnIExecuteCommandExecuteSafeDoc_SetOpenEncryptFileFlag_TRUE__Process__s___n
push str.IPG_6733
push 1
mov byte [esp + 0x500], 0x1e
call fcn.11ca5810
add esp, 0x14
lea ecx, [esp + 0x30]
mov byte [esp + 0x4ec], 0x16
call fcn.11e7f280
lea eax, [esp + 0x2c]
push eax
call fcn.11d3bd00
add esp, 4
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x4ec], 0x1f
cmp dword [eax - 8], ebx
je 0x11d3f71e
cmp dword [esp + 0x38], ebx
jne 0x11d3ee36
cmp dword [esp + 0x3c], ebx
jne 0x11d3ee36
lea ecx, [esp + 0xd4]
lea edx, [esp + 0x1c]
push ecx
push ebp
push eax
push str.__s____s___process:_s
push edx
call fcn.11e82200
add esp, 0x14
jmp 0x11d3ee57
lea ecx, [esp + 0xd4]
lea edx, [esp + 0x1c]
push ecx
push str.open_safe_disk
push ebp
push eax
push str.__s____s____s___process:_s
push edx
call fcn.11e82200
add esp, 0x18
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4ec], 0x16
call fcn.11e7f280
mov eax, dword [esp + 0x1c]
cmp dword [eax - 8], ebx
je 0x11d3f77a
cmp dword [0x12133f80], ebx
je 0x11d3ee97
push eax
push 0x2445
push str._CSafeInject::OnIExecuteCommandExecuteSafeDoc__Line:_d__CmdLine__s_
push str.SafeDisk
push 4
call fcn.11ca5810
add esp, 0x14
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x90]
lea edx, [esp + 0x90]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x40], eax
push ecx
push edx
push ebx
push ebx
push 0x4000010
mov dword [esp + 0x58], eax
push ebx
push ebx
mov dword [esp + 0x64], eax
push ebx
push 0x400
lea ecx, [esp + 0x40]
mov dword [esp + 0xb4], 0x44
mov dword [esp + 0x70], eax
call fcn.11e7ff50
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.11e80020
cmp esi, ebx
je 0x11d3f753
mov eax, dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x44]
push ecx
call esi
mov edx, dword [esp + 0x4fc]
mov eax, dword [esp + 0x500]
mov dword [edx], 1
mov dword [eax], 1
jmp 0x11d3f77a
call fcn.11dac240
test eax, eax
jne 0x11d3ef69
mov ecx, 0x1212b5c0
call fcn.11db90c0
test eax, eax
jne 0x11d3ef69
lea ecx, [esp + 0x60]
mov dword [esp + 0x4ec], 0xffffffff
call fcn.11e7f280
xor eax, eax
jmp 0x11d3f851
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x34]
push ecx
push edx
mov ecx, 0x1212b028
mov dword [esp + 0x34], ebx
call fcn.11d205c0
mov eax, dword [esp + 0x34]
mov byte [esp + 0x4ec], 1
cmp dword [eax - 8], ebx
je 0x11d3efa3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x2c]
cmp eax, 0x1f4
jb 0x11d3f007
push 2
lea ecx, [esp + 0x44]
call fcn.11e15fa0
lea ecx, [esp + 0x30]
mov byte [esp + 0x4ec], 2
call fcn.11e16080
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
mov byte [esp + 0x514], 3
call fcn.11ee1fb0
add esp, 0x28
test eax, eax
je 0x11d3efe5
mov dword [esp + 0x58], 1
lea ecx, [esp + 0x30]
mov byte [esp + 0x4ec], 2
call fcn.11e16090
lea ecx, [esp + 0x40]
mov byte [esp + 0x4ec], 1
call fcn.11e15fd0
mov byte [esp + 0x4ec], bl
lea ecx, [esp + 0x34]
jmp 0x11d3f7a7
mov eax, dword [0x12133f80]
cmp eax, ebx
je 0x11d3f04b
cmp esi, ebx
mov eax, str.NULL
je 0x11d3f02b
mov eax, esi
push eax
mov ecx, 0x1212b458
call fcn.11ec4a10
push eax
push str.__s__CSafeInject::OnIExecuteCommandExecuteSafeDoc_Transform___s__Failed__n
push str.SDTransform
push 4
call fcn.11ca5810
add esp, 0x14
push str._File_Transform:failed_
lea ecx, [esp + 0x18]
call fcn.11e7eae0
push esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x4f0], 5
call fcn.11e7fed0
cmp dword [0x12133f80], ebx
je 0x11d3f087
push str.SDTransform_fail_AddFailLog____16
push str.SDTransform
push 0xffffffffffffffff
call fcn.11ca5810
add esp, 0xc
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, 0x1212b560
call fcn.11dee590
lea ecx, [esp + 0x40]
call fcn.11e8af10
mov ecx, 0x1212b458
mov byte [esp + 0x4ec], 6
call fcn.11ec4670
mov edx, dword [esp + 0x44]
push eax
push edx
lea ecx, [esp + 0x48]
call fcn.11e8b150
lea eax, [esp + 0x40]
lea ecx, [esp + 0x14]
push eax
push ebx
push 0x1b
push ebx
call fcn.11e7ff50
push eax
call fcn.11e5f840
mov ecx, dword [esp + 0x28]
push ecx
call fcn.11d2b640
mov dword [ebp], 1
add esp, 0x14
mov dword [edi], 1
lea ecx, [esp + 0x40]
mov byte [esp + 0x4ec], 5
call fcn.11e8af20
lea ecx, [esp + 0x14]
mov byte [esp + 0x4ec], 4
call fcn.11e7f280
mov byte [esp + 0x4ec], bl
lea ecx, [esp + 0x18]
jmp 0x11d3f7a7
mov ecx, 0x1212b5c0
call fcn.11daa260
test eax, eax
je 0x11d3f168
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x30]
push ebx
push edx
push eax
mov dword [esp + 0x3c], ebx
call fcn.11e66690
add esp, 0xc
test eax, eax
jne 0x11d3f168
cmp dword [esp + 0x30], 1
jne 0x11d3f15b
push str.transform_auth_error
jmp 0x11d3f160
push str.transform_error
call fcn.11d45bb0
add esp, 4
push str._File_Transform:failed_
lea ecx, [esp + 0x54]
call fcn.11e7eae0
lea ecx, [esp + 0x10]
mov byte [esp + 0x4ec], 0xc
push ecx
lea ecx, [esp + 0x54]
call fcn.11e7ff30
cmp dword [0x12133f80], ebx
je 0x11d3f1a8
push str.SDTransform_fail_AddFailLog____17
push str.SDTransform
push 0xffffffffffffffff
call fcn.11ca5810
add esp, 0xc
mov edx, dword [esp + 0x50]
mov ecx, 0x1212b560
push edx
call fcn.11dee590
lea ecx, [esp + 0x40]
call fcn.11e8af10
mov ecx, 0x1212b458
mov byte [esp + 0x4ec], 0xd
call fcn.11ec4670
push eax
mov eax, dword [esp + 0x48]
push eax
lea ecx, [esp + 0x48]
call fcn.11e8b150
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x40]
push ecx
push edx
push eax
push ebx
lea ecx, [esp + 0x60]
call fcn.11e7ff50
push eax
call fcn.11e5f840
mov eax, dword [0x12133f80]
add esp, 0x10
cmp eax, ebx
je 0x11d3f22a
mov ecx, dword [esp + 0x10]
push ecx
push 0x22a3
push str._CSafeInject::OnIExecuteCommandExecuteSafeDoc__Line:_d____s__SDTransform_Fail_
push str.SDTransform
push 4
call fcn.11ca5810
add esp, 0x14
mov dword [ebp], 1
mov dword [edi], 1
lea ecx, [esp + 0x40]
mov byte [esp + 0x4ec], 0xc
call fcn.11e8af20
lea ecx, [esp + 0x50]
mov byte [esp + 0x4ec], 0xb
call fcn.11e7f280
lea ecx, [esp + 0x28]
mov byte [esp + 0x4ec], 9
call fcn.11e7f280
lea ecx, [esp + 0x18]
mov byte [esp + 0x4ec], 8
call fcn.11e92540
lea ecx, [esp + 0x14]
mov byte [esp + 0x4ec], 7
call fcn.11e92540
mov byte [esp + 0x4ec], bl
lea ecx, [esp + 0x10]
jmp 0x11d3f7a7
mov edx, dword [esp + 0x4fc]
mov eax, dword [esp + 0x500]
mov dword [edx], 1
mov dword [eax], 1
jmp 0x11d3f79c
mov ecx, 0x1212b5c0
call fcn.11da8be0
test eax, eax
je 0x11d3f308
mov ecx, dword [esp + 0x4f8]
push ecx
call fcn.11d46510
add esp, 4
test eax, eax
je 0x11d3f308
mov edx, dword [esp + 0x4fc]
mov eax, dword [esp + 0x500]
lea ecx, [esp + 0x10]
mov dword [edx], 1
mov dword [eax], 1
mov byte [esp + 0x4ec], 0x12
jmp 0x11d3f786
mov ecx, 0x1212b5c0
xor esi, esi
call fcn.11daa260
test eax, eax
je 0x11d3f367
mov edx, dword [esp + 0x4f8]
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x92]
mov word [esp + 0x90], bx
push 0x1f
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x94]
push ecx
push edx
stosw word es:[edi], ax
call fcn.11dbbdf0
lea eax, [esp + 0x9c]
push 0x1207b3dc
push eax
call fcn.11e67d22
add esp, 0x14
test eax, eax
jne 0x11d3f367
mov esi, 1
push 0x12119948
lea ecx, [esp + 0x1c]
call fcn.11e7eae0
mov ecx, 0x1212b5c0
mov byte [esp + 0x4ec], 0x15
call fcn.11daa260
test eax, eax
je 0x11d3f3b0
call fcn.11dd84b0
test eax, eax
je 0x11d3f3b0
call fcn.11dd84c0
test eax, eax
jne 0x11d3f3b0
call fcn.11dd84d0
test eax, eax
jne 0x11d3f3b0
push str.encryption_authorization_offline_oppo
jmp 0x11d3f431
cmp dword [esp + 0x38], ebx
je 0x11d3f3bd
push str.safedisk_auth_proc_warning
jmp 0x11d3f3f7
cmp dword [esp + 0x3c], ebx
je 0x11d3f3ca
push str.sharefolder_auth_proc_warning
jmp 0x11d3f41b
push ebx
mov ecx, 0x1212b5c0
call fcn.11da8010
test eax, eax
je 0x11d3f3ee
mov ecx, 0x1212b5c0
call fcn.11da8be0
test eax, eax
jne 0x11d3f3ee
push str.user_logon_warning
jmp 0x11d3f431
cmp esi, ebx
je 0x11d3f408
push str.safedoc_pdf_auth_proc_warning_oppo
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push 0x1207b29c
push ecx
jmp 0x11d3f440
mov ecx, 0x1212b5c0
call fcn.11daa260
test eax, eax
je 0x11d3f42c
push str.safedoc_auth_proc_warning_oppo
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push 0x1207b29c
push eax
jmp 0x11d3f440
push str.safedoc_auth_proc_warning
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push 0x1207b29c
push edx
call fcn.11e82200
mov eax, dword [esp + 0x28]
add esp, 0x10
push eax
call fcn.11d45c90
mov ecx, dword [esp + 0x500]
mov edx, dword [esp + 0x504]
add esp, 4
mov dword [ecx], 1
mov dword [edx], 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x4ec], 0x14
call fcn.11e7f280
mov byte [esp + 0x4ec], 0x12
lea ecx, [esp + 0x10]
jmp 0x11d3f786
mov dword [esp + 0x58], 2
jmp 0x11d3f78b
cmp dword [0x12133f80], ebx
je 0x11d3f77a
mov eax, dword [esp + 0x24]
push eax
push str.CSafeInject::OnIExecuteCommandExecuteReadOnly_no_need_to_add_double_click__wstrProcessTmp__s_
push str.SafeInject
push 4
call fcn.11ca5810
add esp, 0x10
jmp 0x11d3f77a
push 0x12119948
lea ecx, [esp + 0x18]
call fcn.11e7eae0
push ebp
mov byte [esp + 0x4f0], 0x19
call fcn.11e97030
mov ecx, dword [esp + 0x28]
push eax
push ecx
lea edx, [esp + 0x20]
push str._s__s_shimgvw.dll_imageview_fullscreen__s
push edx
call fcn.11e82200
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0xa4]
add esp, 0x14
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x40]
lea edx, [esp + 0x90]
push ecx
push edx
push ebx
mov dword [esp + 0x4c], eax
push ebx
push 0x4000014
mov dword [esp + 0x58], eax
push ebx
push ebx
mov dword [esp + 0x64], eax
push ebx
push 0x104
lea ecx, [esp + 0x38]
mov dword [esp + 0xb4], 0x44
mov dword [esp + 0x70], eax
call fcn.11e7ff50
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.11e80020
cmp esi, ebx
je 0x11d3f5af
mov eax, dword [esp + 0x48]
push ebx
push ebx
push 1
push eax
call fcn.11dc4fa0
mov ecx, dword [esp + 0x54]
add esp, 0x10
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x44]
push eax
call esi
cmp dword [0x12133f80], ebx
je 0x11d3f5d6
mov ecx, dword [esp + 0x14]
mov eax, dword [0x12126854]
push ecx
push eax
push str.__s__CSafeInject::OnIExecuteCommandExecuteReadOnly_Create_PhotoViewer_TarProc_success__strCmdLine__s___n
jmp 0x11d3f5c7
cmp dword [0x12133f80], ebx
je 0x11d3f5d6
mov edx, dword [esp + 0x14]
mov eax, dword [0x12126854]
push edx
push eax
push str.__s__CSafeInject::OnIExecuteCommandExecuteReadOnly_Create_PhotoViewer_TarProc_Failed__strCmdLine__s__n
push str.SafeInject
push 4
call fcn.11ca5810
add esp, 0x14
mov eax, dword [esp + 0x4fc]
mov ecx, dword [esp + 0x500]
mov dword [eax], 1
mov dword [ecx], 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x4ec], 0x16
call fcn.11e7f280
jmp 0x11d3f77a
push 2
lea ecx, [esp + 0x44]
call fcn.11e15fa0
lea ecx, [esp + 0x30]
mov byte [esp + 0x4ec], 0x1a
call fcn.11e16080
mov eax, dword [esp + 0x38]
mov byte [esp + 0x4ec], 0x1b
cmp eax, ebx
jne 0x11d3f652
cmp dword [esp + 0x5c], ebx
jne 0x11d3f652
cmp dword [esp + 0x3c], ebx
jne 0x11d3f652
cmp dword [esp + 0x54], ebx
je 0x11d3f6b1
push ebx
push ebp
call fcn.11ee5500
add esp, 8
test eax, eax
je 0x11d3f6b1
lea ecx, [esp + 0x80]
push ecx
push ebp
call fcn.11d45b00
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x9a]
mov word [esp + 0x98], bx
rep stosd dword es:[edi], eax
push 1
lea edx, [esp + 0x9c]
push 0x20
push edx
push ebp
stosw word es:[edi], ax
call fcn.11de3f60
add esp, 0x18
lea eax, [esp + 0x90]
push ebp
push eax
push 0x500
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x12118d80
call fcn.11c92440
add esp, 0x14
lea ecx, [esp + 0x30]
mov byte [esp + 0x4ec], 0x1a
call fcn.11e16090
lea ecx, [esp + 0x40]
mov byte [esp + 0x4ec], 0x16
call fcn.11e15fd0
jmp 0x11d3f77a
cmp dword [0x12133f80], ebx
je 0x11d3f6fa
mov eax, dword [0x12126854]
push eax
push str.__s__CSafeInject::OnIExecuteCommandExecuteReadOnly_CheckIntactSafeDoc_Failed__n
push str.SafeInject
push 4
call fcn.11ca5810
add esp, 0x10
lea ecx, [esp + 0x30]
mov byte [esp + 0x4ec], 0x1c
call fcn.11e16090
lea ecx, [esp + 0x40]
mov byte [esp + 0x4ec], 0x16
call fcn.11e15fd0
jmp 0x11d3f77a
cmp dword [0x12133f80], ebx
je 0x11d3f740
mov eax, dword [0x12126854]
push eax
push str.__s__CSafeInject::OnIExecuteCommandExecuteReadOnly_GetSDViewerPath_Failed__n
push str.SafeInject
push 4
call fcn.11ca5810
add esp, 0x10
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4ec], 0x16
call fcn.11e7f280
jmp 0x11d3f77a
cmp dword [0x12133f80], ebx
je 0x11d3f77a
mov ecx, dword [esp + 0x1c]
mov eax, dword [0x12126854]
push ecx
push eax
push str.__s__CSafeInject::OnIExecuteCommandExecuteReadOnly_CreateProcessW__s_Failed__n
push str.SafeInject
push 4
call fcn.11ca5810
add esp, 0x14
mov byte [esp + 0x4ec], 0x12
lea ecx, [esp + 0x24]
call fcn.11e7f280
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4ec], 0xe
call fcn.11e7f280
mov byte [esp + 0x4ec], bl
lea ecx, [esp + 0x20]
call fcn.11e7f280
cmp dword [0x12133f80], ebx
je 0x11d3f7d5
mov esi, dword [esp + 0x58]
mov eax, dword [0x12126854]
push esi
push eax
push str.__s_CSafeInject::OnShellExecuteExW_dwSdviewerWarning__d_
push str.SafeInject
push 1
call fcn.11ca5810
add esp, 0x14
jmp 0x11d3f7d9
mov esi, dword [esp + 0x58]
cmp esi, ebx
je 0x11d3f820
mov eax, dword [esp + 0x4f8]
lea edx, [esp + 0xd4]
push edx
push eax
push esi
call fcn.11d45de0
add esp, 0xc
mov ecx, 0x1212b5c0
call fcn.11d9df40
cmp eax, ebx
jne 0x11d3f838
mov ecx, dword [esp + 0x4fc]
mov edx, dword [esp + 0x500]
mov dword [ecx], 1
mov dword [edx], 1
jmp 0x11d3f838
cmp dword [esp + 0x68], ebx
je 0x11d3f838
mov ecx, dword [esp + 0x60]
lea eax, [esp + 0x70]
push eax
push ecx
call fcn.11d3a830
add esp, 8
lea ecx, [esp + 0x60]
mov dword [esp + 0x4ec], 0xffffffff
call fcn.11e7f280
mov eax, 1
mov ecx, dword [esp + 0x4e4]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x4e0
ret