Function at 0x406c50
Capabilities:
Create process on windows
Create thread
Hide graphical window
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x597e6d
mov eax, dword fs:[0]
push eax
sub esp, 0x3b0
mov eax, dword [0x62cf50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x275]
mov dword [ebp - 0x360], eax
xor edi, edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x358], eax
mov dword [ebp - 0x230], edi
call fcn.004090f0
push 0x635268
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push edi
push edi
call fcn.00409100
add esp, 8
mov byte [ebp - 0x351], 1
call fcn.0040b2e0
mov esi, eax
mov dword [ebp - 0x294], esi
call fcn.0040b2f0
movzx edx, byte [ebp - 0x351]
xor ecx, ecx
cmp eax, 1
cmovl edx, ecx
xor eax, eax
mov dword [ebp - 0x35c], edx
test dl, dl
je 0x406db0
push 8
push str._dllLoad
lea ecx, [ebp - 0x274]
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x260], 7
mov word [ebp - 0x274], ax
call fcn.00409db0
mov dword [ebp - 0x240], edi
xor eax, eax
mov edi, dword [ebp - 0x358]
mov ecx, edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x230], 1
mov dword [ebp - 0x23c], 7
mov word [ebp - 0x250], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406d56
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x250]
call fcn.00409db0
lea eax, [ebp - 0x274]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x250]
mov edi, 3
push eax
mov dword [ebp - 0x230], edi
call fcn.0040c9c0
add esp, 8
cmp eax, 0xffffffff
je 0x406dac
mov ecx, edi
mov byte [ebp - 0x221], 1
mov eax, ecx
jmp 0x406db7
mov eax, edi
mov ecx, eax
mov byte [ebp - 0x221], 0
test cl, 2
je 0x406e27
mov edx, dword [ebp - 0x23c]
and eax, 0xfffffffd
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x230], eax
cmp edx, 8
jb 0x406e18
mov ecx, dword [ebp - 0x250]
lea edx, [edx*2 + 2]
mov eax, ecx
mov dword [ebp - 4], 3
cmp edx, 0x1000
jb 0x406e08
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409014
push edx
push ecx
call fcn.0040a1a2
mov eax, dword [ebp - 0x350]
add esp, 8
mov edi, dword [ebp - 0x350]
xor ecx, ecx
mov word [ebp - 0x250], cx
mov dword [ebp - 4], 0
test al, 1
je 0x406e92
mov edx, dword [ebp - 0x260]
and eax, 0xfffffffe
mov dword [ebp - 0x350], eax
cmp edx, 8
jb 0x406e83
mov ecx, dword [ebp - 0x274]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 4
cmp edx, 0x1000
jb 0x406e75
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40905f
push edx
push ecx
call fcn.0040a1a2
add esp, 8
mov byte [ebp - 4], 0
mov edi, dword [ebp - 0x350]
xor eax, eax
mov word [ebp - 0x274], ax
cmp byte [ebp - 0x221], 0
je 0x406fe8
call fcn.00494a00
push 0x5bcb28
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x254], ecx
test esi, esi
je 0x406f04
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x360], eax
cmp esi, 0xffffffff
jne 0x406ee4
mov dword [ebp - 0x254], edi
jmp 0x406efd
mov edi, esi
mov dword [ebp - 0x22c], edi
call fcn.00413e80
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x254], esi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.004903a0
add esp, 4
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
xor esi, esi
mov dword [ebp - 0x360], eax
mov dword [ebp - 0x234], esi
test eax, eax
je 0x406f67
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0x360]
cmp eax, 0xffffffff
je 0x406f5b
mov esi, eax
mov dword [ebp - 0x234], esi
call fcn.00413e80
push dword [ebp - 0x358]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x254]
mov byte [ebp - 4], 6
test eax, eax
je 0x406fa5
cmp eax, 0xffffffff
je 0x406fa5
test esi, esi
je 0x406fa5
cmp esi, 0xffffffff
je 0x406fa5
push 0x1388
push 0
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], edi
push eax
push 2
mov dword [ebp - 0x21c], esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov byte [ebp - 4], 7
test esi, esi
je 0x406fc0
cmp esi, 0xffffffff
je 0x406fc0
call fcn.00413e80
push esi
call fcn.00415030
add esp, 4
mov eax, dword [ebp - 0x254]
mov byte [ebp - 4], 8
test eax, eax
je 0x406fe1
cmp eax, 0xffffffff
je 0x406fe1
call fcn.00413e80
push edi
call fcn.00415030
add esp, 4
xor edi, edi
jmp 0x408fea
xor eax, eax
mov dword [ebp - 0x2b8], 0x5c3e9c
cmp byte [0x5c3e9c], al
je 0x40700a
nop dword [eax]
inc eax
cmp byte [eax + 0x5c3e9c], 0
jne 0x407000
mov dword [ebp - 0x2b4], eax
mov ecx, esi
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x2b0]
push eax
call fcn.0040d010
push 0x5c3f34
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 9
call fcn.0040d2f0
push 0x5c2bb4
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 0x351], al
call fcn.0040d2f0
push 0x5c2ba0
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 0x354], al
call fcn.0040d2f0
mov byte [ebp - 0x349], al
call fcn.0040d380
cmp dword [ebp - 0x2a0], 0
mov byte [ebp - 0x353], al
je 0x4070b4
cmp byte [ebp - 0x351], 0
jne 0x4070eb
cmp byte [ebp - 0x354], 0
jne 0x4070eb
cmp byte [ebp - 0x349], 0
jne 0x4070eb
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0
call fcn.004138c0
mov edi, dword [ebp - 0x22c]
jmp 0x408fdd
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x22c], 4
push eax
push 0x631c64
push 0
push 0x10
push str.bLTEnableDLLOptimization
push 0x5bcba0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x40719e
mov dword [0x631c64], 0
cmp dword [ebp - 0x2a0], 0
jne 0x407334
xor eax, eax
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x27c], 7
mov word [ebp - 0x290], ax
lea eax, [ebp - 0x290]
mov byte [ebp - 4], 0xc
push eax
call fcn.0040d7d0
add esp, 4
test al, al
je 0x4072df
cmp dword [ebp - 0x280], 0
je 0x4072df
push dword [ebp - 0x358]
call fcn.00494d40
add esp, 4
test al, al
je 0x4072df
push 0x40100000
call fcn.00414660
add esp, 4
mov eax, dword [ebp - 0x27c]
mov byte [ebp - 4], 0xd
cmp eax, 8
jb 0x40718c
inc eax
lea ecx, [ebp - 0x290]
push eax
push dword [ebp - 0x290]
call fcn.0040a5e0
lea ecx, [ebp - 0x2b0]
xor edi, edi
call fcn.004138c0
jmp 0x408fea
cmp dword [0x631c64], 0
je 0x4070f5
call fcn.0040b2e0
lea ecx, [ebp - 0x25c]
mov dword [ebp - 0x254], 0
xorps xmm0, xmm0
push ecx
mov ecx, eax
movq qword [ebp - 0x25c], xmm0
call fcn.0040d4f0
mov ecx, dword [ebp - 0x258]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x25c]
sub ecx, esi
imul ecx
mov ecx, 0
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x234], eax
je 0x407224
nop
cmp dword [esi + 0x10], 1
jb 0x40721c
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x407210
mov eax, dword [esi]
cmp word [eax], 0x2f
je 0x407259
mov eax, dword [ebp - 0x234]
inc ecx
add esi, 0x18
cmp ecx, eax
jb 0x407200
mov byte [ebp - 0x221], 0
lea ecx, [ebp - 0x25c]
call fcn.00432b00
cmp byte [ebp - 0x221], 0
jne 0x4070f5
push 4
call fcn.00406b5e
add esp, 4
test eax, eax
je 0x407262
mov dword [eax], 0x494700
jmp 0x407264
mov byte [ebp - 0x221], 1
jmp 0x40722b
xor eax, eax
mov dword [ebp - 0x234], eax
or edi, 0x400
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 0xa
push ecx
push 0
push eax
push 0x45ce90
push 0
push 0
call fcn.0043758e
add esp, 0x18
mov dword [ebp - 0x258], eax
test eax, eax
je 0x409026
mov dword [ebp - 0x234], 0
mov ecx, dword [ebp - 0x254]
mov byte [ebp - 4], 0xb
test ecx, ecx
je 0x409019
push ecx
push eax
call fcn.0045bbcf
add esp, 8
test eax, eax
jne 0x409020
xorps xmm0, xmm0
mov byte [ebp - 4], 9
movlpd qword [ebp - 0x258], xmm0
jmp 0x4070f5
mov edx, dword [ebp - 0x27c]
mov byte [ebp - 4], 9
cmp edx, 8
jb 0x40732b
mov ecx, dword [ebp - 0x290]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 0xe
cmp edx, 0x1000
jb 0x40731d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409037
push edx
push ecx
call fcn.0040a1a2
add esp, 8
mov byte [ebp - 4], 9
xor eax, eax
mov word [ebp - 0x290], ax
call fcn.0040de40
test al, al
je 0x40709a
mov eax, dword [ebp - 0x35c]
test al, al
je 0x407772
cmp dword [ebp - 0x2a0], 0
jne 0x407375
push 0x5bcc14
push 0x5bcc1c
call fcn.00410310
add esp, 8
test eax, eax
setne al
mov dword [ebp - 0x35c], eax
test al, al
je 0x407772
cmp dword [ebp - 0x2a0], 0
je 0x40739a
push 0x5c2ba0
lea ecx, [ebp - 0x2b0]
call fcn.0040d2f0
test al, al
je 0x4073a4
call fcn.004118b0
mov byte [0x631c49], al
cmp byte [ebp - 0x353], 0
je 0x4073e2
call fcn.0040b2f0
cmp eax, 3
jl 0x4073e2
push 0x5bca08
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4073e2
push str.SetProcessDPIAware
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4073e2
mov ecx, esi
call dword [0x5b1854]
call esi
cmp dword [ebp - 0x2a0], 0
je 0x40771c
push 0x5c2ba0
lea ecx, [ebp - 0x2b0]
call fcn.0040d2f0
test al, al
jne 0x40771c
cmp dword [0x634c18], 0
jne 0x407427
push 0xc0100010
mov edi, 3
call fcn.00480ed0
add esp, 4
jmp 0x408fce
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, dword [ebp - 0x358]
call fcn.00411990
cmp byte [ebp - 0x349], 0
mov byte [0x631c48], al
jne 0x407451
cmp byte [ebp - 0x354], 0
je 0x40745b
mov dword [str.acrord32_sbx], 0x5bcc4c
call fcn.00412160
mov byte [0x631c6a], al
test al, al
je 0x4074a1
push 0x5c3f34
lea ecx, [ebp - 0x2b0]
call fcn.0040d2f0
test al, al
je 0x4074a1
mov eax, dword [0x631c58]
test eax, eax
je 0x4074a1
push eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test eax, eax
je 0x4074a1
mov eax, dword [0x631c5c]
test eax, eax
je 0x4074a1
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov ecx, esi
mov dword [ebp - 0x368], 0
xor eax, eax
mov dword [ebp - 0x364], 7
mov word [ebp - 0x378], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4074c3
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x378]
call fcn.00409db0
push 3
or edi, 4
mov byte [ebp - 4], 0x10
xor eax, eax
mov dword [ebp - 0x350], edi
push 0x5bc8a4
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 7
mov word [ebp - 0x250], ax
call fcn.00409db0
lea eax, [ebp - 0x250]
mov dword [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x378]
push eax
call fcn.0040c9c0
mov edx, dword [ebp - 0x23c]
add esp, 8
mov byte [ebp - 4], 0x10
mov esi, eax
cmp edx, 8
jb 0x40758f
mov ecx, dword [ebp - 0x250]
lea edx, [edx*2 + 2]
mov eax, ecx
mov dword [ebp - 4], 0x12
cmp edx, 0x1000
jb 0x407581
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40905a
push edx
push ecx
call fcn.0040a1a2
add esp, 8
mov byte [ebp - 4], 0x10
xor eax, eax
mov word [ebp - 0x250], ax
cmp esi, 0xffffffff
jne 0x407c2b
mov esi, dword [ebp - 0x358]
mov ecx, esi
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], 7
mov word [ebp - 0x250], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4075c3
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x250]
call fcn.00409db0
mov eax, dword [ebp - 0x350]
lea ecx, [ebp - 0x274]
or eax, 8
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x230], eax
xor eax, eax
push 3
push 0x5bc8ac
mov byte [ebp - 0x349], 0
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x260], 7
mov word [ebp - 0x274], ax
call fcn.00409db0
lea eax, [ebp - 0x274]
mov dword [ebp - 4], 0x14
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.0040c9c0
mov edx, dword [ebp - 0x260]
add esp, 8
mov byte [ebp - 4], 0x13
mov edi, eax
cmp edx, 8
jb 0x40769f
mov ecx, dword [ebp - 0x274]
lea edx, [edx*2 + 2]
mov eax, ecx
mov dword [ebp - 4], 0x15
cmp edx, 0x1000
jb 0x407691
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409055
push edx
push ecx
call fcn.0040a1a2
add esp, 8
mov byte [ebp - 4], 0x13
xor eax, eax
mov word [ebp - 0x274], ax
cmp edi, 0xffffffff
je 0x407c05
mov esi, dword [ebp - 0x240]
add edi, 3
cmp esi, edi
jbe 0x407bfa
push 2
push 0x5bc8b4
lea ecx, [ebp - 0x274]
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x260], 7
mov word [ebp - 0x274], ax
call fcn.00409db0
xor eax, eax
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x27c], 7
mov word [ebp - 0x290], ax
cmp esi, edi
jb 0x40903c
jmp 0x4078bb
push 0x5bcc3c
push 0x8002
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x22c], eax
test eax, eax
je 0x40742f
push str.AcroExe_load_done
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov esi, eax
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [ebp - 0x234]
push dword [ebp - 0x238]
push esi
push dword [ebp - 0x22c]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x40742f
mov esi, dword [ebp - 0x358]
xor eax, eax
mov ecx, esi
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x27c], 7
mov word [ebp - 0x290], ax
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4077a0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x290]
call fcn.00409db0
push 0
push 0x5bc9e4
lea ecx, [ebp - 0x290]
call fcn.00411540
cmp eax, 0xffffffff
lea ecx, [ebp - 0x290]
push 0
push 0x5bc9ec
setne byte [ebp - 0x221]
call fcn.00411540
movzx ecx, byte [ebp - 0x221]
cmp eax, 0xffffffff
mov eax, 1
cmovne ecx, eax
push 0
mov dword [ebp - 0x234], ecx
lea ecx, [ebp - 0x290]
push 0x5bc9f4
call fcn.00411540
cmp eax, 0xffffffff
je 0x407845
push 0
push str._act
lea ecx, [ebp - 0x290]
call fcn.00411540
mov edx, dword [ebp - 0x234]
cmp eax, 0xffffffff
movzx ecx, dl
mov eax, 1
cmove ecx, eax
mov byte [ebp - 0x234], cl
mov edx, dword [ebp - 0x27c]
cmp edx, 8
jb 0x40788d
mov ecx, dword [ebp - 0x290]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 0xf
cmp edx, 0x1000
jb 0x40787f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409041
push edx
push ecx
call fcn.0040a1a2
add esp, 8
mov byte [ebp - 4], 9
xor eax, eax
mov word [ebp - 0x290], ax
cmp byte [ebp - 0x234], al
je 0x4078aa
mov byte [ebp - 0x35c], 1
jmp 0x407435
cmp byte [ebp - 0x35c], al
je 0x4074a1
jmp 0x407435
or ecx, 0xffffffff
lea eax, [ebp - 0x250]
sub esi, edi
cmp esi, 0xffffffff
lfence
cmovb ecx, esi
cmp dword [ebp - 0x23c], 8
push ecx
cmovae eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x290]
lea eax, [eax + edi*2]
push eax
call fcn.00409db0
mov edi, dword [ebp - 0x350]
lea eax, [ebp - 0x274]
mov edx, dword [ebp - 0x290]
or edi, 0x800
cmp dword [ebp - 0x260], 8
mov esi, dword [ebp - 0x280]
cmovae eax, dword [ebp - 0x274]
cmp dword [ebp - 0x27c], 8
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x290]
cmovae eax, edx
mov dword [ebp - 0x350], edi
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x234], eax
test esi, esi
je 0x407a52
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.0056aed0
mov eax, dword [ebp - 0x254]
add esp, 0xc
mov edx, dword [ebp - 0x264]
mov ecx, eax
mov dword [ebp - 0x22c], 0x100
lea edx, [eax + edx*2]
cmp eax, edx
je 0x40799e
nop
movzx eax, word [ecx]
cmp ax, word [ebp - 0x22c]
jae 0x4079d3
movzx eax, al
add ecx, 2
mov byte [ebp + eax - 0x110], 1
cmp ecx, edx
jne 0x407980
mov edx, dword [ebp - 0x234]
lea ecx, [edx + esi*2]
mov esi, edx
cmp edx, ecx
jae 0x407a4c
movzx eax, word [esi]
cmp ax, word [ebp - 0x22c]
jae 0x407a28
cmp byte [ebp + eax - 0x110], 0
je 0x407a28
add esi, 2
cmp esi, ecx
jb 0x4079b1
jmp 0x407a4c
mov ecx, dword [ebp - 0x234]
lea eax, [ecx + esi*2]
mov esi, ecx
mov dword [ebp - 0x22c], eax
cmp ecx, eax
jae 0x407a23
nop dword [eax + eax]
mov ecx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x254]
test ecx, ecx
je 0x407a10
movzx edx, word [esi]
cmp word [eax], dx
je 0x407a18
add eax, 2
sub ecx, 1
jne 0x407a03
sub esi, dword [ebp - 0x234]
jmp 0x407a2a
add esi, 2
cmp esi, dword [ebp - 0x22c]
jb 0x4079f0
or esi, 0xffffffff
jmp 0x407a2c
sub esi, edx
sar esi, 1
cmp esi, 0xffffffff
je 0x407a4c
push 0
push 0x5bc8bc
lea ecx, [ebp - 0x290]
call fcn.00411540
cmp eax, esi
sete byte [ebp - 0x349]
mov edx, dword [ebp - 0x290]
mov eax, dword [ebp - 0x27c]
cmp eax, 8
jb 0x407a90
lea ecx, [eax*2 + 2]
mov eax, edx
mov byte [ebp - 4], 0x17
cmp ecx, 0x1000
jb 0x407a86
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409046
push ecx
push edx
call fcn.0040a1a2
add esp, 8
xor eax, eax
mov dword [ebp - 0x280], 0
mov word [ebp - 0x290], ax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x27c], 7
mov byte [ebp - 4], 0x13
cmp eax, 8
jb 0x407afc
mov edx, dword [ebp - 0x274]
lea ecx, [eax*2 + 2]
mov eax, edx
mov dword [ebp - 4], 0x18
cmp ecx, 0x1000
jb 0x407aee
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40904b
push ecx
push edx
call fcn.0040a1a2
add esp, 8
mov byte [ebp - 4], 0x13
cmp byte [ebp - 0x349], 0
jne 0x407c2b
mov esi, dword [ebp - 0x358]
mov ecx, esi
mov dword [ebp - 0x280], 0
xor eax, eax
mov dword [ebp - 0x27c], 7
mov word [ebp - 0x290], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407b31
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x290]
call fcn.00409db0
push 3
or edi, 0x10
mov dword [ebp - 4], 0x19
xor eax, eax
mov dword [ebp - 0x350], edi
push 0x5bc8d8
lea ecx, [ebp - 0x274]
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x260], 7
mov word [ebp - 0x274], ax
call fcn.00409db0
lea eax, [ebp - 0x274]
mov dword [ebp - 4], 0x1a
push eax
lea eax, [ebp - 0x290]
push eax
call fcn.0040c9c0
mov edx, dword [ebp - 0x260]
add esp, 8
cmp eax, 0xffffffff
setne al
mov byte [ebp - 0x349], al
cmp edx, 8
jb 0x407c20
mov ecx, dword [ebp - 0x274]
lea edx, [edx*2 + 2]
mov eax, ecx
mov dword [ebp - 4], 0x1b
cmp edx, 0x1000
jb 0x407c10
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409050
jmp 0x407c10
mov edi, dword [ebp - 0x350]
jmp 0x407b09
mov edi, dword [ebp - 0x350]
jmp 0x407b0f
push edx
push ecx
call fcn.0040a1a2
mov al, byte [ebp - 0x349]
add esp, 8
mov byte [ebp - 0x349], 1
test al, al
je 0x407c32
mov byte [ebp - 0x349], 0
mov eax, dword [ebp - 0x350]
test al, 0x10
je 0x407c98
mov edx, dword [ebp - 0x27c]
and eax, 0xffffffef
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x230], eax
cmp edx, 8
jb 0x407c98
mov ecx, dword [ebp - 0x290]
lea edx, [edx*2 + 2]
mov eax, ecx
mov dword [ebp - 4], 0x1c
cmp edx, 0x1000
jb 0x407c88
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409055
push edx
push ecx
call fcn.0040a1a2
mov eax, dword [ebp - 0x350]
add esp, 8
test al, 8
je 0x407cf8
mov edx, dword [ebp - 0x23c]
and eax, 0xfffffff7
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x230], eax
cmp edx, 8
jb 0x407cf8
mov ecx, dword [ebp - 0x250]
lea edx, [edx*2 + 2]
mov eax, ecx
mov dword [ebp - 4], 0x1d
cmp edx, 0x1000
jb 0x407ce8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40905a
push edx
push ecx
call fcn.0040a1a2
mov eax, dword [ebp - 0x350]
add esp, 8
mov dword [ebp - 4], 9
test al, 4
je 0x407d54
mov edx, dword [ebp - 0x364]
and eax, 0xfffffffb
mov dword [ebp - 0x350], eax
cmp edx, 8
jb 0x407d54
mov ecx, dword [ebp - 0x378]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 0x1e
cmp edx, 0x1000
jb 0x407d46
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40905f
push edx
push ecx
call fcn.0040a1a2
add esp, 8
mov byte [ebp - 4], 9
cmp byte [ebp - 0x349], 0
je 0x407d8a
cmp dword [ebp - 0x2a0], 0
jne 0x407d8a
cmp byte [ebp - 0x35c], 0
jne 0x407d8a
call fcn.00411b10
test al, al
je 0x407d8a
push 0x631c3c
push 0x631c38
call fcn.00411db0
add esp, 8
lea eax, [ebp - 0x234]
mov esi, 1
push eax
push 0x20019
push 0
push str.SoftwareAdobeAdobe_AcrobatDCSecurity
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407e10
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x254], 4
push eax
lea eax, [ebp - 0x230]
push eax
push 0
push 0x5bc758
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407dfc
cmp dword [ebp - 0x22c], eax
cmove esi, eax
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x407f24
lea eax, [ebp - 0x234]
xor esi, esi
push eax
push 0x20019
push esi
push 0x5bc75c
push 0x80000002
mov dword [ebp - 0x234], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407e9e
lea eax, [ebp - 0x230]
mov dword [ebp - 0x22c], esi
push eax
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], esi
push eax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x230], 4
push eax
push esi
push str.bEnableATL7Compat
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407e92
cmp dword [ebp - 0x22c], 4
jne 0x407e92
cmp dword [ebp - 0x254], 1
mov eax, 1
cmove esi, eax
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x5bc7dc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x407eda
push 0x5bc7f8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x407eda
mov ecx, esi
xor ecx, 1
lea ecx, [ecx*2 + 1]
push ecx
mov ecx, edi
call dword [0x5b1854]
call edi
test eax, eax
jne 0x407f24
push 0x5bc80c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x407f24
push 0x5bc820
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x407f24
push 4
lea eax, [ebp - 0x22c]
push eax
lea ecx, [esi*4 + 9]
push 0x22
mov dword [ebp - 0x22c], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov ecx, edi
call dword [0x5b1854]
call edi
cmp byte [ebp - 0x35c], 0
je 0x407f4f
mov esi, dword [ebp - 0x2a0]
test esi, esi
je 0x407f4f
push 0x5c2ba0
lea ecx, [ebp - 0x2b0]
call fcn.0040d2f0
test al, al
je 0x407fd6
push 1
call fcn.00412620
add esp, 4
test eax, eax
je 0x407f71
push 0xc0100010
xor edi, edi
call fcn.00480ed0
add esp, 4
jmp 0x408fce
mov edi, dword [str.AdobeAcrobatSpeedLaunchCmdWnd]
xor esi, esi
nop dword [eax]
push 0
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x407fa0
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendNotifyMessageW]
inc esi
cmp esi, 0x14
jb 0x407f80
mov edi, dword [str.AdobeReaderSpeedLaunchCmdWnd]
xor esi, esi
nop dword [eax + eax]
push 0
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x407fd0
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendNotifyMessageW]
inc esi
cmp esi, 0x14
jb 0x407fb0
mov esi, dword [ebp - 0x2a0]
xor eax, eax
mov dword [ebp - 0x254], eax
test esi, esi
jne 0x40802f
push dword [ebp - 0x358]
call fcn.00412970
add esp, 4
test al, al
je 0x40802f
push str.Acrobat_Viewer_Safe_DDE
push 3
push 3
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov edi, eax
mov dword [ebp - 0x254], edi
test edi, edi
je 0x40802f
push 0x927c0
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40802f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [ebp - 0x254], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
test eax, eax
je 0x4080aa
push 0
push 1
push 5
call fcn.004129f0
add esp, 0xc
test al, al
je 0x4080aa
push 0
push 0
push 6
call fcn.004129f0
add esp, 0xc
test al, al
jne 0x4080aa
mov dword [ebp - 0x22c], 2
call fcn.004b1e40
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, eax
test edi, edi
je 0x408094
push 4
lea eax, [ebp - 0x22c]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
test esi, esi
je 0x4080aa
push 4
lea eax, [ebp - 0x22c]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
call fcn.0040b2e0
mov dword [ebp - 0x238], str.channeltype
xor ecx, ecx
nop dword [eax + eax]
inc ecx
cmp byte [ecx + str.channeltype], 0
jne 0x4080c0
mov dword [ebp - 0x234], ecx
lea ecx, [ebp - 0x238]
push ecx
lea ecx, [ebp - 0x250]
push ecx
mov ecx, eax
call fcn.0040d0f0
cmp dword [ebp - 0x240], 0
mov byte [ebp - 4], 0x1f
je 0x4081db
call fcn.00413006
cmp dword [ebp - 0x23c], 8
lea esi, [ebp - 0x250]
mov edi, eax
lea eax, [ebp - 0x22c]
cmovae esi, dword [ebp - 0x250]
push 0xa
push eax
push esi
mov dword [edi], 0
call fcn.0044c954
add esp, 0xc
cmp esi, dword [ebp - 0x22c]
je 0x409064
cmp dword [edi], 0x22
je 0x4090b6
mov edx, dword [ebp - 0x23c]
cmp eax, 2
mov byte [ebp - 4], 9
sete al
mov byte [ebp - 0x349], al
cmp edx, 8
jb 0x40819c
mov ecx, dword [ebp - 0x250]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 0x20
cmp edx, 0x1000
jb 0x408188
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4090c0
push edx
push ecx
call fcn.0040a1a2
mov al, byte [ebp - 0x349]
add esp, 8
mov byte [ebp - 4], 9
test al, al
je 0x408227
mov eax, dword fs:[0x2c]
mov ecx, dword [0x6359c4]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x632488]
cmp eax, dword [ecx + 4]
jg 0x40906e
mov eax, dword [0x6352f8]
test eax, eax
je 0x408227
cmp eax, 0xffffffff
je 0x408227
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x408227
mov edx, dword [ebp - 0x23c]
mov byte [ebp - 4], 9
cmp edx, 8
jb 0x408227
mov ecx, dword [ebp - 0x250]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 0x21
cmp edx, 0x1000
jb 0x408219
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4090c0
push edx
push ecx
call fcn.0040a1a2
add esp, 8
mov byte [ebp - 4], 9
cmp byte [ebp - 0x35c], 0
je 0x408401
cmp byte [0x631c6a], 0
mov byte [ebp - 0x221], 1
mov dword [ebp - 0x230], 0
je 0x408301
cmp dword [ebp - 0x2a0], 0
jne 0x40830a
push 0x10000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov esi, eax
mov dword [ebp - 0x320], 0
test esi, esi
je 0x408301
lea eax, [ebp - 0x320]
mov dword [ebp - 0x22c], 0
push eax
push 0
push 7
push 7
push 7
push 7
push 7
push 7
push 7
push 7
lea eax, [ebp - 0x22c]
mov word [ebp - 0x228], 0x400
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4082e9
push dword [ebp - 0x320]
lea ecx, [ebp - 0x3bc]
call fcn.00412d40
push 0xd0130
push 3
lea eax, [ebp - 0x3bc]
push eax
push 7
push esi
call fcn.00412f10
add esp, 0x14
mov eax, dword [ebp - 0x320]
test eax, eax
je 0x4082fa
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call dword [sym.imp.USER32.dll_CloseDesktop]
cmp dword [ebp - 0x2a0], 0
je 0x40831e
push 0x5c2ba0
lea ecx, [ebp - 0x2b0]
call fcn.0040d2f0
test al, al
je 0x408325
mov byte [0x631c4b], 1
mov edi, dword [ebp - 0x360]
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x221]
push eax
push edi
call fcn.00413020
mov esi, eax
add esp, 0xc
cmp esi, 7
je 0x40834e
cmp esi, 8
jne 0x408367
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x221]
push eax
push edi
call fcn.00413020
add esp, 0xc
mov esi, eax
mov eax, dword [0x631c54]
test eax, eax
je 0x408383
push eax
call fcn.0041e935
add esp, 4
mov dword [0x631c54], 0
cmp esi, 1
je 0x4083d1
cmp dword [ebp - 0x2a0], 0
jne 0x4083d1
mov byte [ebp - 0x35c], 0
cmp esi, 6
jne 0x408401
mov esi, dword [ebp - 0x254]
test esi, esi
je 0x4083b9
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x230]
push 0xc0100010
call fcn.00480ed0
add esp, 4
jmp 0x408fce
cmp byte [ebp - 0x221], 0
jne 0x408401
mov esi, dword [ebp - 0x254]
test esi, esi
je 0x4083f6
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x230]
jmp 0x408fce
mov byte [0x631c4b], 0
call fcn.004143f0
cmp byte [ebp - 0x35c], 0
mov byte [ebp - 0x352], al
je 0x40884f
push 0x5c3f34
lea ecx, [ebp - 0x2b0]
call fcn.0040d2f0
test al, al
je 0x40885c
push 3
xor eax, eax
mov dword [ebp - 0x368], 0
push 0x5bcc74
lea ecx, [ebp - 0x378]
mov dword [ebp - 0x364], 7
mov word [ebp - 0x378], ax
call fcn.00409db0
mov ecx, dword [ebp - 0x294]
lea eax, [ebp - 0x378]
push eax
mov byte [ebp - 4], 0x23
call fcn.0040e5a0
mov edx, dword [ebp - 0x364]
mov byte [ebp - 0x349], al
mov byte [ebp - 4], 9
cmp edx, 8
jb 0x4084d5
mov ecx, dword [ebp - 0x378]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 0x24
cmp edx, 0x1000
jb 0x4084c1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4090c5
push edx
push ecx
call fcn.0040a1a2
mov al, byte [ebp - 0x349]
add esp, 8
mov byte [ebp - 4], 9
test al, al
je 0x40856b
lea eax, [ebp - 0x378]
push 0x5bcc7c
push eax
call fcn.0049b3e0
or dword [ebp - 0x350], 0x20
add esp, 8
mov ecx, eax
mov dword [ebp - 0x22c], eax
cmp dword [eax + 0x14], 8
jb 0x40850e
mov ecx, dword [eax]
mov dword [ebp - 0x22c], ecx
mov eax, dword [eax + 0x10]
cmp eax, 0xd
jb 0x40856b
add eax, 0xfffffff4
lea eax, [ecx + eax*2]
mov dword [ebp - 0x294], eax
sub eax, ecx
sar eax, 1
je 0x40856b
cmp word [ecx], 0x70
je 0x408538
add ecx, 2
sub eax, 1
jne 0x408528
jmp 0x40856b
mov edx, str.pdfshell_prev
mov edi, ecx
mov esi, 0xd
sub edi, edx
mov ax, word [edx + edi]
cmp ax, word [edx]
jne 0x4085c1
add edx, 2
sub esi, 1
jne 0x408546
sub ecx, dword [ebp - 0x22c]
sar ecx, 1
mov byte [ebp - 0x221], 1
cmp ecx, 0xffffffff
jne 0x408572
mov byte [ebp - 0x221], 0
mov eax, dword [ebp - 0x350]
test al, 0x20
je 0x4085dd
mov edx, dword [ebp - 0x364]
and eax, 0xffffffdf
mov dword [ebp - 0x350], eax
cmp edx, 8
jb 0x4085dd
mov ecx, dword [ebp - 0x378]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 0x25
cmp edx, 0x1000
jb 0x4085cf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4090ca
jmp 0x4085cf
mov eax, dword [ebp - 0x294]
add ecx, 2
jmp 0x408522
push edx
push ecx
call fcn.0040a1a2
add esp, 8
mov byte [ebp - 4], 9
push 7
xor eax, eax
mov dword [ebp - 0x264], 0
push 0x5bcca0
lea ecx, [ebp - 0x274]
mov dword [ebp - 0x260], 7
mov word [ebp - 0x274], ax
call fcn.00409db0
mov eax, dword [ebp - 0x350]
mov esi, dword [ebp - 0x358]
or eax, 0x40
mov ecx, esi
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x230], eax
xor eax, eax
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 7
lea edx, [ecx + 2]
mov word [ebp - 0x250], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408650
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x250]
call fcn.00409db0
mov eax, dword [ebp - 0x350]
or eax, 0x80
mov dword [ebp - 4], 0x27
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.0040c9c0
add esp, 8
cmp eax, 0xffffffff
jne 0x4086c0
cmp byte [ebp - 0x349], 0
je 0x4086b7
cmp byte [ebp - 0x221], 0
je 0x4086c0
mov byte [ebp - 0x349], 1
jmp 0x4086c7
mov byte [ebp - 0x349], 0
mov eax, dword [ebp - 0x350]
and eax, 0xffffff7f
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x230], eax
mov ecx, dword [ebp - 0x23c]
mov dword [ebp - 4], 0x28
cmp ecx, 8
jb 0x40870b
lea eax, [ecx + 1]
push eax
push dword [ebp - 0x250]
lea ecx, [ebp - 0x250]
call fcn.0040a5e0
mov eax, dword [ebp - 0x350]
and eax, 0xffffffbf
mov dword [ebp - 4], 9
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0x260]
mov byte [ebp - 4], 0x29
cmp eax, 8
jb 0x40873d
inc eax
lea ecx, [ebp - 0x274]
push eax
push dword [ebp - 0x274]
call fcn.0040a5e0
cmp byte [ebp - 0x349], 0
mov byte [ebp - 4], 9
je 0x40879b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0
push 0
push 0
push 0
push 0xffffc000
push 0xffffc000
push 0x10000000
push 0x5bc9d4
push str.EDIT
push 0x80
call fcn.00419f80
cmp byte [ebp - 0x353], 0
mov dword [0x632470], eax
jne 0x40879b
test eax, eax
je 0x40879b
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0041db00
push 0x40100001
call fcn.00414660
add esp, 4
cmp byte [ebp - 0x353], 0
je 0x4087d2
call fcn.004c0240
mov eax, dword [0x632470]
test eax, eax
je 0x4087d2
push 0x8000000
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
xor eax, eax
mov dword [ebp - 0x234], eax
cmp byte [ebp - 0x353], al
je 0x408835
call fcn.0040b2f0
mov ecx, dword [ebp - 0x234]
cmp eax, 0xe
mov eax, 1
mov dword [ebp - 0x294], 4
cmovge ecx, eax
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x234]
mov dword [ebp - 0x234], ecx
push eax
push 0
push 0x10
push str.bAllowWindowCreationOnBrowser
push str.SoftwareAdobeAcrobat_ReaderDCPrivileged
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov eax, dword [ebp - 0x234]
cmp byte [0x631c4a], 0
jne 0x408842
test eax, eax
je 0x40885c
push str.UseSandboxModalWndReparenting
call dword [sym.imp.KERNEL32.dll_AddAtomW]
jmp 0x40885c
push 0x40100001
call fcn.00414660
add esp, 4
push 0x5c
xorps xmm0, xmm0
mov dword [ebp - 0x22c], 0
lea eax, [ebp - 0x31c]
movq qword [ebp - 0x328], xmm0
push 0
push eax
movups xmmword [ebp - 0x348], xmm0
movups xmmword [ebp - 0x338], xmm0
call fcn.0056aed0
add esp, 0xc
lea ecx, [ebp - 0x31c]
call fcn.00414c60
cmp byte [ebp - 0x35c], 0
mov byte [ebp - 4], 0x2a
je 0x408b33
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x324], 0
push 0x5c2bb4
lea ecx, [ebp - 0x2b0]
mov dword [ebp - 0x348], 1
mov dword [ebp - 0x344], fcn.0041db00
mov dword [ebp - 0x340], eax
call fcn.0040d2f0
cmp byte [0x631c68], 0
movzx eax, al
mov dword [ebp - 0x33c], eax
movzx eax, byte [ebp - 0x352]
mov dword [ebp - 0x338], eax
jne 0x40891a
cmp byte [0x631c69], 0
mov dword [ebp - 0x334], 0
je 0x408924
mov dword [ebp - 0x334], 1
mov eax, dword [0x632470]
mov dword [ebp - 0x330], eax
call fcn.0040b2e0
mov dword [ebp - 0x2b8], str.channeltype
xor ecx, ecx
inc ecx
cmp byte [ecx + str.channeltype], 0
jne 0x408940
mov dword [ebp - 0x2b4], ecx
lea ecx, [ebp - 0x2b8]
push ecx
lea ecx, [ebp - 0x250]
push ecx
mov ecx, eax
call fcn.0040d0f0
cmp dword [ebp - 0x240], 0
mov byte [ebp - 4], 0x2b
je 0x4089f6
call fcn.00413006
cmp dword [ebp - 0x23c], 8
lea esi, [ebp - 0x250]
mov edi, eax
lea eax, [ebp - 0x294]
cmovae esi, dword [ebp - 0x250]
push 0xa
push eax
push esi
mov dword [edi], 0
call fcn.0044c954
add esp, 0xc
cmp esi, dword [ebp - 0x294]
je 0x4090cf
cmp dword [edi], 0x22
je 0x4090b6
cmp eax, 1
sete al
mov byte [ebp - 0x352], al
mov ecx, dword [ebp - 0x23c]
mov byte [ebp - 4], 0x2c
cmp ecx, 8
jb 0x408a1a
lea eax, [ecx + 1]
push eax
push dword [ebp - 0x250]
lea ecx, [ebp - 0x250]
call fcn.0040a5e0
mov al, byte [ebp - 0x352]
jmp 0x408a1a
mov eax, dword [ebp - 0x23c]
mov byte [ebp - 4], 0x2d
cmp eax, 8
jb 0x408a18
inc eax
lea ecx, [ebp - 0x250]
push eax
push dword [ebp - 0x250]
call fcn.0040a5e0
xor al, al
movzx eax, al
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0x32c], eax
call fcn.0040b2e0
mov dword [ebp - 0x2b8], str.channeltype
xor ecx, ecx
nop dword [eax + eax]
inc ecx
cmp byte [ecx + str.channeltype], 0
jne 0x408a40
mov dword [ebp - 0x2b4], ecx
lea ecx, [ebp - 0x2b8]
push ecx
lea ecx, [ebp - 0x250]
push ecx
mov ecx, eax
call fcn.0040d0f0
cmp dword [ebp - 0x240], 0
mov byte [ebp - 4], 0x2e
je 0x408af6
call fcn.00413006
cmp dword [ebp - 0x23c], 8
lea esi, [ebp - 0x250]
mov edi, eax
lea eax, [ebp - 0x294]
cmovae esi, dword [ebp - 0x250]
push 0xa
push eax
push esi
mov dword [edi], 0
call fcn.0044c954
add esp, 0xc
cmp esi, dword [ebp - 0x294]
je 0x4090d9
cmp dword [edi], 0x22
je 0x4090b6
cmp eax, 2
sete al
mov byte [ebp - 0x352], al
mov ecx, dword [ebp - 0x23c]
mov byte [ebp - 4], 0x2f
cmp ecx, 8
jb 0x408b1a
lea eax, [ecx + 1]
push eax
push dword [ebp - 0x250]
lea ecx, [ebp - 0x250]
call fcn.0040a5e0
mov al, byte [ebp - 0x352]
jmp 0x408b1a
mov eax, dword [ebp - 0x23c]
mov byte [ebp - 4], 0x30
cmp eax, 8
jb 0x408b18
inc eax
lea ecx, [ebp - 0x250]
push eax
push dword [ebp - 0x250]
call fcn.0040a5e0
xor al, al
movzx eax, al
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x348]
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0x22c], eax
push 7
xor eax, eax
mov dword [ebp - 0x264], 0
push str._slMode
lea ecx, [ebp - 0x274]
mov dword [ebp - 0x260], 7
mov word [ebp - 0x274], ax
call fcn.00409db0
mov eax, dword [ebp - 0x350]
mov esi, dword [ebp - 0x358]
or eax, 0x100
mov ecx, esi
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x230], eax
xor eax, eax
mov byte [ebp - 4], 0x31
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 7
lea edx, [ecx + 2]
mov word [ebp - 0x250], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408ba5
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x250]
call fcn.00409db0
mov eax, dword [ebp - 0x350]
or eax, 0x200
mov dword [ebp - 4], 0x32
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.0040c9c0
add esp, 8
cmp eax, 0xffffffff
je 0x408c15
cmp byte [ebp - 0x35c], 0
je 0x408c0c
cmp byte [ebp - 0x351], 0
je 0x408c15
mov byte [ebp - 0x351], 1
jmp 0x408c1c
mov byte [ebp - 0x351], 0
mov eax, dword [ebp - 0x350]
and eax, 0xfffffdff
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 4], 0x33
cmp eax, 8
jb 0x408c52
inc eax
lea ecx, [ebp - 0x250]
push eax
push dword [ebp - 0x250]
call fcn.0040a5e0
mov eax, dword [ebp - 0x260]
mov dword [ebp - 4], 0x34
cmp eax, 8
jb 0x408c77
inc eax
lea ecx, [ebp - 0x274]
push eax
push dword [ebp - 0x274]
call fcn.0040a5e0
cmp byte [ebp - 0x351], 0
mov byte [ebp - 4], 0x2a
je 0x408d7f
cmp byte [ebp - 0x35c], 0
je 0x408ca5
cmp byte [ebp - 0x354], 0
jne 0x408ca5
lea ecx, [ebp - 0x31c]
call fcn.0041fac0
push dword [ebp + 0x14]
push esi
push dword [ebp - 0x21c]
push dword [ebp - 0x360]
call fcn.00490f80
mov edi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x2c0]
movlpd qword [ebp - 0x298], xmm0
push eax
movups xmmword [ebp - 0x2c0], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x298]
mov dword [ebp - 0x234], 0
push eax
lea eax, [ebp - 0x2c0]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x408d64
lea eax, [ebp - 0x234]
push eax
push 2
push 0
push 0x5bcd90
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408d64
push 4
lea eax, [ebp - 0x294]
push eax
push 4
push 0
push str.iSLExitTimeHighPart
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp - 0x298]
push eax
push 4
push 0
push str.iSLExitTimeLowPart
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x31c]
call fcn.00415a30
lea ecx, [ebp - 0x2b0]
call fcn.004138c0
jmp 0x408fea
push 1
mov edi, str.AcroRd32.dll
call fcn.00414dd0
test al, al
mov ecx, str.Acrobat.dll
push 0x104
lea eax, [ebp - 0x218]
cmove ecx, edi
push eax
push ecx
call fcn.00414ee0
add esp, 0x10
test eax, eax
je 0x408dc4
lea eax, [ebp - 0x218]
push eax
call fcn.00415060
mov dword [ebp - 0x234], eax
test eax, eax
jne 0x408e32
push 2
call fcn.00414dd0
add esp, 4
test al, al
jne 0x408de4
push 3
call fcn.00414dd0
add esp, 4
test al, al
je 0x408f30
push 0x104
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0056aed0
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.Acrobat32OL.dll
call fcn.00414ee0
add esp, 0x18
test eax, eax
je 0x408f30
lea eax, [ebp - 0x218]
push eax
call fcn.00415060
mov dword [ebp - 0x234], eax
test eax, eax
je 0x408f30
cmp byte [ebp - 0x35c], 0
je 0x408e4f
cmp byte [ebp - 0x354], 0
jne 0x408e4f
lea ecx, [ebp - 0x31c]
call fcn.0041fac0
push esi
call fcn.00415341
add esp, 4
mov dword [ebp - 0x358], eax
lea ecx, [ebp - 0x234]
call fcn.004153a0
mov esi, dword [ebp - 0x234]
test al, al
jne 0x408e7a
mov edi, 0xff
jmp 0x408eba
push str.AcroWinMainSandbox
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x408e93
mov edi, 0xff
jmp 0x408eba
push dword [ebp - 0x22c]
mov ecx, edi
push dword [ebp + 0x14]
push dword [ebp - 0x358]
push dword [ebp - 0x360]
push esi
call dword [0x5b1854]
call edi
mov edi, eax
neg edi
sbb edi, edi
inc edi
push dword [ebp - 0x358]
call fcn.0040a1b5
add esp, 4
lea ecx, [ebp - 0x31c]
call fcn.00415820
test esi, esi
je 0x408ede
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp - 0x254]
test esi, esi
je 0x408efa
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x31c]
call fcn.00415a30
mov eax, dword [ebp - 0x29c]
mov byte [ebp - 4], 0x35
cmp eax, 0x10
jb 0x408f27
inc eax
lea ecx, [ebp - 0x2b0]
push eax
push dword [ebp - 0x2b0]
call fcn.0042cc20
mov byte [ebp - 4], 0
jmp 0x408fdd
cmp byte [ebp - 0x35c], 0
jne 0x408fa2
push 0x47f510
push 0x14
push 0x5bce38
push str.Acrobat_failed_to_load_its_Core_DLL
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call fcn.0047f4a0
add esp, 0x14
cmp eax, 6
jne 0x408fa2
mov ecx, 0x22
lea edi, [ebp - 0x210]
mov esi, str.https:__helpx.adobe.com_acrobat_kb_acrobat_failed_load_core_dll.html
lea eax, [ebp - 0x186]
rep movsd dword es:[edi], dword [esi]
push 0x176
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.0056aed0
add esp, 0xc
lea eax, [ebp - 0x210]
push 1
push 0
push 0
push eax
push 0x5bcf24
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, dword [ebp - 0x254]
test esi, esi
je 0x408fbe
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x31c]
mov edi, 0xff
call fcn.00415a30
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0
call fcn.004138c0
push 0x40100000
call fcn.00414660
add esp, 4
lea ecx, [ebp - 0x275]
call fcn.00415e30
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004016cd
mov esp, ebp
pop ebp
ret 0x10
call fcn.0056e2db
push 1
call fcn.00550c9a
push eax
call fcn.00550c6d
push 6
mov dword [ebp - 0x254], 0
call fcn.00550c9a
call fcn.0056e2db
call fcn.0047f6b0
call fcn.0056e2db
call fcn.0056e2db
call fcn.0056e2db
call fcn.0056e2db
call fcn.0056e2db
call fcn.0056e2db
call fcn.0056e2db
push str.invalid_stoi_argument
call fcn.00550837
push 0x632488
call fcn.0040b37e
add esp, 4
cmp dword [0x632488], 0xffffffff
jne 0x4081c4
mov ecx, 0x632480
mov byte [ebp - 4], 0x22
call fcn.004eb950
push 0x5af960
call fcn.004060ec
push 0x632488
mov byte [ebp - 4], 9
call fcn.0040b56b
add esp, 8
jmp 0x4081c4
push str.stoi_argument_out_of_range
call fcn.00550877
call fcn.0056e2db
call fcn.0056e2db
call fcn.0056e2db
push str.invalid_stoi_argument
call fcn.00550837
push str.invalid_stoi_argument
call fcn.00550837
int3