Function at 0x14000ebb8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x2230
call fcn.140013900
sub rsp, rax
mov rdi, rsp
mov ecx, 0x88c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2240]
mov rax, qword [0x14004c008]
xor rax, rsp
mov qword [rsp + 0x2220], rax
lea rcx, [rsp + 0x38]
call fcn.14001275c
nop
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x2a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x4d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x700]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x930]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0xb60]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0xd90]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0xfb4], 0x104
lea r9, [rsp + 0xfb4]
lea r8, [rsp + 0xd90]
lea rdx, [0x14003a240]
mov rcx, qword [rsp + 0x2258]
call sub.msi.dll_MsiGetPropertyW
mov dword [rsp + 0xfc4], 0
lea rdx, [0x14003a260]
mov rcx, qword [rsp + 0x2258]
call fcn.140002610
test rax, rax
je 0x14000ecf5
mov dword [rsp + 0xfc4], 1
cmp dword [rsp + 0xfc4], 0
je 0x14000ed1b
lea r8, str.AcroExch
mov edx, 0x104
lea rcx, [rsp + 0x930]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
jmp 0x14000ed35
lea r8, [0x14003a288]
mov edx, 0x104
lea rcx, [rsp + 0x930]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [0x14003a298]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x140038974]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str.HKEY_CLASSES_ROOT.pdf
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rdx, str..msp
mov rcx, qword [rsp + 0x2248]
call fcn.140002610
test rax, rax
je 0x14000eddc
mov rcx, qword [rsp + 0x2250]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
test rax, rax
jbe 0x14000eddc
lea rdx, [0x140038a1c]
lea rcx, str._In_Patch_mode__not_changing_the_value_of_HKCR.pdf
call fcn.140012400
jmp 0x14000ee16
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140038aec]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOT.pdf:
call fcn.140012400
lea rcx, [rsp + 0xd90]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x14000efc5
lea rdx, [0x140038bec]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [rsp + 0xfc4], 0
je 0x14000ee80
lea rdx, str.AcroRd32Info.exe___PDFShell
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21a8], rax
jmp 0x14000ee9d
lea rdx, str.AcrobatInfo.exe___PDFShell
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21a8], rax
lea rdx, str.HKEY_CLASSES_ROOTCLSIDD38406DA_E8AA_484b_B80D_3D3DBDCC2FB2LocalServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140038c6c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000ef31
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140038cb4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDD38406DA_E8AA_484b_B80D_3D3DBDCC2FB2LocalServer32:
call fcn.140012400
lea rdx, str.HKEY_CLASSES_ROOTCLSID98D9A6F1_4696_4B5E_A2E8_36B3F9C1E12CLocalServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140038e7c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000efc5
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140038ebc]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSID98D9A6F1_4696_4B5E_A2E8_36B3F9C1E12CLocalServer32:
call fcn.140012400
lea rax, [rsp + 0xfe0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0xfe0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov rcx, qword [rsp + 0x2258]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x14000f433
lea rcx, [rsp + 0xfe0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x14000f433
lea rdx, [rsp + 0xfe0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.Installer_
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, qword [rsp + 0x2258]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [rsp + 0xfc4], 0
je 0x14000f082
lea rdx, str.PDFFile_8.ico_0
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21b0], rax
jmp 0x14000f09f
lea rdx, str._PDFFile.ico_0
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21b0], rax
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x14003a718]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..acrobatsecuritysettings.1DefaultIcon
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140038edc]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000f1c1
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140038f04]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea r8, [0x14003a790]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0xb60]
call fcn.140012400
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x14003a7a0]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x14003a7c8]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x1400392b4]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str.DefaultIcon
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140038f54]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000f311
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140038f8c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea r8, [0x14003a800]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0xb60]
call fcn.140012400
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x14003a810]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..pdfxml.1DefaultIcon
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140039024]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000f433
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x14003903c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea r8, [0x14003a868]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0xb60]
call fcn.140012400
lea rax, [rsp + 0x1210]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
cmp dword [rsp + 0xfc4], 0
je 0x14000f470
lea rdx, [0x14003a878]
lea rcx, [rsp + 0x1210]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov qword [rsp + 0x21b8], rax
jmp 0x14000f48d
lea rdx, [0x14003a888]
lea rcx, [rsp + 0x1210]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov qword [rsp + 0x21b8], rax
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x14003a898]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..acrobatsecuritysettings.1_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400390bc]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000f5af
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x1400390f4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea r8, [0x14003a908]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.140012400
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x14003a918]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..FDFDoc_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14003918c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000f6d1
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x1400391b4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea r8, [0x14003a960]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.140012400
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x14003a970]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x14003a998]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x1400393c4]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str._shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400394b4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000f821
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x1400396b4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea r8, [0x14003a9c0]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.140012400
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x14003a9d0]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..pdfxml.1_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400397d4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000f943
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x1400397e4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea r8, [0x14003aa18]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.140012400
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x14003aa28]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..RMFFile_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400397fc]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000fa65
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x14003980c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea r8, [0x14003aa70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.140012400
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x14003aa80]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..XDPDoc_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400398a4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000fb87
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x140039904]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea r8, [0x14003aac8]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.140012400
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x14003aad8]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..XFDFDoc_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140039994]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000fca9
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x140039a9c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea r8, str.set:
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.140012400
lea rdx, str.HKEY_CLASSES_ROOTSOFTWAREAdobeAcrobatExe
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x140039ad4]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [rsp + 0xfc4], 0
je 0x14000fd0f
lea rdx, str.ReaderAcroRd32.exe_
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21c0], rax
jmp 0x14000fd2c
lea rdx, str.AcrobatAcrobat.exe_
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21c0], rax
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140039d5c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000fdae
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140039d9c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTSOFTWAREAdobeAcrobatExe:
call fcn.140012400
lea rax, [rsp + 0x1440]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea r8, [0x140039e9c]
mov edx, 0x104
lea rcx, [rsp + 0x1440]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0xd90]
mov edx, 0x104
lea rcx, [rsp + 0x1440]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
cmp dword [rsp + 0xfc4], 0
je 0x14000fe1d
lea r8, str.ReaderAcroRd32.exe___u___1_
mov edx, 0x104
lea rcx, [rsp + 0x1440]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
jmp 0x14000fe37
lea r8, str.AcrobatAcrobat.exe___u___1_
mov edx, 0x104
lea rcx, [rsp + 0x1440]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1440]
lea r8, [0x14003a0e4]
lea rdx, str.HKEY_CLASSES_ROOT_acrobat_shellopencommand
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea rdx, str.HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14003a0f4]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [rsp + 0xfc4], 0
je 0x14000fec5
lea rdx, [0x14003adc0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21c8], rax
jmp 0x14000fee2
lea rdx, [0x14003add0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21c8], rax
lea rdx, str.pdfprevhndlr.dll__101
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14003ae18]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000ff79
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, str.DisplayName
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193_DisplayName_:
call fcn.140012400
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x14000ffb8
lea rdx, [0x14003af10]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21d0], rax
jmp 0x14000ffd5
lea rdx, [0x14003ae48]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21d0], rax
lea rdx, str.pdfprevhndlr.dll
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193InprocServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14003a1fc]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14001007e
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x14003a20c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193InprocServer32:
call fcn.140012400
lea rdx, str.HKEY_CLASSES_ROOTTypeLib41738EEA_442F_477F_92CF_2889BD6CD7E71.00win32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x1400100cf
lea rdx, [0x14003af48]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21d8], rax
jmp 0x1400100ec
lea rdx, [0x14003af58]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21d8], rax
lea rdx, str.AcroBroker.exe
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14003a224]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010183
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x14003a26c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTTypeLib41738EEA_442F_477F_92CF_2889BD6CD7E71.00win32:
call fcn.140012400
lea rdx, str.HKEY_CLASSES_ROOTCLSIDBD57A9B2_4E7D_4892_9107_9F4106472DA4LocalServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14003a284]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [rsp + 0xfc4], 0
je 0x1400101e9
lea rdx, [0x14003b2d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21e0], rax
jmp 0x140010206
lea rdx, [0x14003b2e0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21e0], rax
lea rdx, str.AcroBroker.exe_
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14003a3a4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14001029d
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x14003a6f4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDBD57A9B2_4E7D_4892_9107_9F4106472DA4LocalServer32:
call fcn.140012400
lea rdx, str.HKEY_CLASSES_ROOTCLSID17F2E344_8227_4AA7_A25A_E89424566BBAInprocServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14003a79c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010331
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x14003a7fc]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSID17F2E344_8227_4AA7_A25A_E89424566BBAInprocServer32:
call fcn.140012400
lea rdx, str.HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.00win32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14003a80c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400103c5
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x14003a864]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.00win32:
call fcn.140012400
lea rdx, str.HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.0HELPDIR
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x140010416
lea rdx, [0x14003b538]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21e8], rax
jmp 0x140010433
lea rdx, [0x14003b318]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21e8], rax
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14003a874]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400104b5
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x14003a884]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.0HELPDIR:
call fcn.140012400
lea rdx, str.HKEY_CLASSES_ROOTCLSID12BA069D_0FC6_4577_97C6_5DF634CE6E84InProcServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x140010506
lea rdx, [0x14003b8a0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21f0], rax
jmp 0x140010523
lea rdx, [0x14003b548]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21f0], rax
lea rdx, str.ViewerPS.dll
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14003a894]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400105ba
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x14003a904]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSID12BA069D_0FC6_4577_97C6_5DF634CE6E84InProcServer32:
call fcn.140012400
lea rdx, str.HKEY_CLASSES_ROOTMIMEDatabaseContent_Type_application_pdf
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14003ba00]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14003ba50]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010663
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x14003ba60]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea rdx, [rsp + 0x2a0]
lea rcx, [0x14003ba70]
call fcn.140012400
lea rdx, str.HKEY_CLASSES_ROOTCLSIDB801CA65_A1FC_11D0_85AD_444553540000LocalServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x1400106b4
lea rdx, str.ReaderAcroRd32.exe
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21f8], rax
jmp 0x1400106d1
lea rdx, [0x14003bbc8]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21f8], rax
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14003a914]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010753
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x14003a95c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDB801CA65_A1FC_11D0_85AD_444553540000LocalServer32:
call fcn.140012400
lea rdx, str.HKEY_CLASSES_ROOTCLSIDB801CA65_A1FC_11D0_85AD_444553540000ProgID
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [0x14003bd30]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x14003bd48]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14003a96c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010836
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x14003a9cc]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDBD57A9B2_4E7D_4892_9107_9F4106472DA4ProgID:
call fcn.140012400
lea rdx, str.HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeGoogleChromeNativeMessagingHostscom.adobe.acrobat.chrome_webcapture
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x140010887
lea rdx, str.ReaderBrowserWCChromeExtnmanifest.json
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x2200], rax
jmp 0x1400108a4
lea rdx, [0x14003bf30]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x2200], rax
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14003aa24]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rdx, str.AcrobatBrowserWCChromeExtnmanifest.json
lea rcx, [rsp + 0x4d0]
call fcn.140002610
test rax, rax
je 0x1400108f5
mov byte [rsp + 0x2208], 1
jmp 0x1400108fd
mov byte [rsp + 0x2208], 0
mov al, byte [rsp + 0x2208]
mov byte [rsp + 0x1654], al
movzx eax, byte [rsp + 0x1654]
test eax, eax
je 0x14001092c
lea rcx, [rsp + 0x4d0]
call fcn.140002738
test eax, eax
jne 0x140010aa0
lea rcx, [rsp + 0x2a0]
call fcn.140002738
test eax, eax
je 0x140010a8c
call fcn.140008ca0
mov dword [rsp + 0x1658], eax
cmp dword [rsp + 0xfc4], 0
jne 0x14001096d
call fcn.1400119e4
test eax, eax
jne 0x14001096d
mov dword [rsp + 0x220c], 0
jmp 0x140010978
mov dword [rsp + 0x220c], 1
mov al, byte [rsp + 0x220c]
mov byte [rsp + 0x165c], al
movzx eax, byte [rsp + 0x165c]
test eax, eax
je 0x1400109d1
movzx eax, byte [rsp + 0x165c]
test eax, eax
je 0x140010a34
lea rdx, str.E3AFF032_DE15_45DA_8C24_B74F922C62EC
mov rcx, qword [rsp + 0x2258]
call fcn.140011918
movzx eax, al
test eax, eax
jne 0x1400109d1
cmp dword [rsp + 0x1658], 1
je 0x1400109d1
cmp dword [rsp + 0x1658], 2
jne 0x140010a34
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x14003aa7c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
mov dword [rsp + 0x20], 0
lea r9, str.https:__clients2.google.com_service_update2_crx
lea r8, str.update_url
lea rdx, [0x14003c0c0]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_LOCAL_MACHINESOFTWAREGoogleChromeNativeMessagingHostscom.adobe.acrobat.chrome_webcapture:
call fcn.140012400
jmp 0x140010a8a
movzx eax, byte [rsp + 0x165c]
test eax, eax
je 0x140010a8a
lea rcx, [rsp + 0x4d0]
call fcn.140002738
test eax, eax
jne 0x140010a8a
lea rdx, [0x14003aac4]
lea rcx, str.Ownership:_Deleting_Chrome_Extension_registry_entries
call fcn.140012400
xor r8d, r8d
lea rdx, str.HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeGoogleChromeExtensionsefaidnbmnnnibpcajpcglclefindmkaj
lea rcx, [rsp + 0x38]
call fcn.140012804
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012804
jmp 0x140010aa0
lea rdx, [rsp + 0x2a0]
lea rcx, str.File_does_not_exist:
call fcn.140012400
mov edx, 0x400
lea rcx, [rsp + 0x1670]
call fcn.1400094d0
test eax, eax
jne 0x140010ad3
mov edx, 0x400
lea rcx, [rsp + 0x1670]
call fcn.1400092f0
movzx eax, al
test eax, eax
je 0x140010bae
lea rdx, [0x14003bff8]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x1670]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.SoftwareClassesMIMEDatabaseContent_Type_application_pdf
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.CA8A9780_280D_11CF_A24D_444553540000
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14003c4c0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140012c40
lea rax, [rsp + 0x4d0]
test rax, rax
je 0x140010bae
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010bae
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, str.CLSID
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001316c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTMIMEDatabaseContent_Type_application_pdf
call fcn.140012400
cmp dword [0x14004c4a0], 0
jne 0x140010deb
call fcn.140011ce8
movzx eax, al
test eax, eax
jne 0x140010deb
lea rax, [rsp + 0x1e90]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x1e90]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str..Document.
mov edx, 0x104
lea rcx, [rsp + 0x1e90]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x14003bf24]
mov edx, 0x104
lea rcx, [rsp + 0x1e90]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rax, [0x14003c570]
mov qword [rsp + 0x20c0], rax
lea rax, [0x14003c580]
mov qword [rsp + 0x20c8], rax
lea rax, [0x14003c590]
mov qword [rsp + 0x20d0], rax
lea rax, [0x14003c5c8]
mov qword [rsp + 0x20d8], rax
lea rax, [0x14003c5d8]
mov qword [rsp + 0x20e0], rax
lea rax, [0x14003c5e8]
mov qword [rsp + 0x20e8], rax
lea rax, [0x14003c5f8]
mov qword [rsp + 0x20f0], rax
lea rax, [0x14003c608]
mov qword [rsp + 0x20f8], rax
lea rax, [0x14003c618]
mov qword [rsp + 0x2100], rax
lea rax, [0x14003c630]
mov qword [rsp + 0x2130], rax
lea rax, [0x14003c640]
mov qword [rsp + 0x2138], rax
lea rax, [0x14003c650]
mov qword [rsp + 0x2140], rax
lea rax, [0x14003c688]
mov qword [rsp + 0x2148], rax
lea rax, [0x14003c698]
mov qword [rsp + 0x2150], rax
lea rax, [0x14003c6a8]
mov qword [rsp + 0x2158], rax
lea rax, [0x14003c6b8]
mov qword [rsp + 0x2160], rax
lea rax, [0x14003c6c8]
mov qword [rsp + 0x2168], rax
lea rax, [0x14003c6d8]
mov qword [rsp + 0x2170], rax
lea rax, [0x14003c6f0]
mov qword [rsp + 0x2178], rax
lea rax, [0x14003c700]
mov qword [rsp + 0x2180], rax
lea rax, [0x14003c710]
mov qword [rsp + 0x2188], rax
cmp dword [rsp + 0xfc4], 0
je 0x140010d81
mov qword [rsp + 0x2210], 9
jmp 0x140010d8d
mov qword [rsp + 0x2210], 0xc
mov eax, dword [rsp + 0x2210]
mov dword [rsp + 0x2194], eax
cmp dword [rsp + 0xfc4], 0
je 0x140010db7
lea rax, [rsp + 0x20c0]
mov qword [rsp + 0x2218], rax
jmp 0x140010dc7
lea rax, [rsp + 0x2130]
mov qword [rsp + 0x2218], rax
lea r9, [rsp + 0x1e90]
mov r8d, dword [rsp + 0xfc4]
mov edx, dword [rsp + 0x2194]
mov rcx, qword [rsp + 0x2218]
call fcn.1400072a8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
mov dword [rsp + 0x21a0], 1
lea rcx, [rsp + 0x38]
call fcn.140012790
mov eax, dword [rsp + 0x21a0]
mov edi, eax
mov rcx, rsp
lea rdx, [0x14003fde0]
call fcn.140013450
mov eax, edi
mov rcx, qword [rsp + 0x2220]
xor rcx, rsp
call fcn.140013550
add rsp, 0x2230
pop rdi
ret