Function at 0x40d0f3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413d7f
mov eax, dword fs:[0]
push eax
mov eax, 0x1f9c
call fcn.00411f80
push esi
push edi
push ecx
lea edi, [ebp - 0x1fa8]
mov ecx, 0x7e7
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x43f004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x24]
call fcn.00411152
and dword [ebp - 4], 0
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x444]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x654]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x864]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xa74]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc84]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xe94]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0xea0], 0x104
lea eax, [ebp - 0xea0]
push eax
lea eax, [ebp - 0xe94]
push eax
push str.InstallLocation
push dword [ebp + 0x10]
call sub.msi.dll_MsiGetPropertyW
and dword [ebp - 0xea8], 0
push 0x430144
push dword [ebp + 0x10]
call fcn.00401896
pop ecx
pop ecx
test eax, eax
je 0x40d22a
mov dword [ebp - 0xea8], 1
cmp dword [ebp - 0xea8], 0
je 0x40d258
mov esi, esp
push str.AcroExch
push 0x104
lea eax, [ebp - 0xa74]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
jmp 0x40d27b
mov esi, esp
push str.Acrobat
push 0x104
lea eax, [ebp - 0xa74]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push 0x430174
push 0x104
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push 0x43018c
push 0x104
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push str.HKEY_CLASSES_ROOT.pdf
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
push str..msp
push dword [ebp + 8]
call fcn.00401896
pop ecx
pop ecx
test eax, eax
je 0x40d346
mov esi, esp
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
cmp esi, esp
call fcn.00411cf8
test eax, eax
jbe 0x40d346
push 0x4301d0
push str._In_Patch_mode__not_changing_the_value_of_HKCR.pdf
call fcn.00410dda
pop ecx
pop ecx
jmp 0x40d376
push 0
lea eax, [ebp - 0x444]
push eax
push 0x4301d4
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
lea eax, [ebp - 0x444]
push eax
push 0x430248
call fcn.00410dda
pop ecx
pop ecx
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
jle 0x40d535
mov esi, esp
push 0x430244
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
cmp dword [ebp - 0xea8], 0
je 0x40d3f8
mov esi, esp
push str.AcroRd32Info.exe___PDFShell
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f6c], eax
jmp 0x40d419
mov esi, esp
push str.AcrobatInfo.exe___PDFShell
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f6c], eax
mov esi, esp
push str.HKEY_CLASSES_ROOTCLSIDD38406DA_E8AA_484b_B80D_3D3DBDCC2FB2LocalServer32
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x4302fc
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40d4a7
push 0
lea eax, [ebp - 0x444]
push eax
push 0x43039c
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTCLSIDD38406DA_E8AA_484b_B80D_3D3DBDCC2FB2LocalServer32:
call fcn.00410dda
pop ecx
pop ecx
mov esi, esp
push str.HKEY_CLASSES_ROOTCLSID98D9A6F1_4696_4B5E_A2E8_36B3F9C1E12CLocalServer32
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x4304ec
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40d535
push 0
lea eax, [ebp - 0x444]
push eax
push 0x4304f0
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTCLSID98D9A6F1_4696_4B5E_A2E8_36B3F9C1E12CLocalServer32:
call fcn.00410dda
pop ecx
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x10b4]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x104
lea eax, [ebp - 0x10b4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
jle 0x40da7e
mov esi, esp
lea eax, [ebp - 0x10b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
jle 0x40da7e
mov esi, esp
lea eax, [ebp - 0x10b4]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push str.Installer_
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push dword [ebp + 0x10]
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
cmp dword [ebp - 0xea8], 0
je 0x40d61b
mov esi, esp
push str.PDFFile_8.ico_0
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f70], eax
jmp 0x40d63c
mov esi, esp
push str._PDFFile.ico_0
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f70], eax
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc84]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x430600
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push str..acrobatsecuritysettings.1DefaultIcon
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x430678
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40d790
push 0
lea eax, [ebp - 0x444]
push eax
push 0x43067c
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
mov esi, esp
push 0x430680
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0x234]
push eax
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0xc84]
push eax
call fcn.00410dda
pop ecx
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc84]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x43068c
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push 0x4306b4
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push 0x4306cc
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push str.DefaultIcon
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x4306f0
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40d92a
push 0
lea eax, [ebp - 0x444]
push eax
push 0x4306f4
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
mov esi, esp
push 0x4306f8
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0x234]
push eax
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0xc84]
push eax
call fcn.00410dda
pop ecx
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc84]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x430704
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push str..pdfxml.1DefaultIcon
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x430758
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40da7e
push 0
lea eax, [ebp - 0x444]
push eax
push 0x43075c
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
mov esi, esp
push 0x430760
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0x234]
push eax
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0xc84]
push eax
call fcn.00410dda
pop ecx
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x12c4]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
cmp dword [ebp - 0xea8], 0
je 0x40dac0
mov esi, esp
push 0x43076c
lea eax, [ebp - 0x12c4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f74], eax
jmp 0x40dae1
mov esi, esp
push 0x430778
lea eax, [ebp - 0x12c4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f74], eax
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc84]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x430784
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push str..acrobatsecuritysettings.1_shell
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x4307ac
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40dc35
push 0
lea eax, [ebp - 0x12c4]
push eax
push 0x4307f4
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
mov esi, esp
push 0x4307f8
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0x234]
push eax
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0xc84]
push eax
call fcn.00410dda
pop ecx
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc84]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x430804
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push str..FDFDoc_shell
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x430848
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40dd89
push 0
lea eax, [ebp - 0x12c4]
push eax
push 0x43084c
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
mov esi, esp
push 0x430850
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0x234]
push eax
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0xc84]
push eax
call fcn.00410dda
pop ecx
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc84]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x43085c
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push 0x430884
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push 0x43089c
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push str._shell
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x4308b4
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40df23
push 0
lea eax, [ebp - 0x12c4]
push eax
push 0x4308b8
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
mov esi, esp
push 0x4308bc
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0x234]
push eax
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0xc84]
push eax
call fcn.00410dda
pop ecx
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc84]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x4308c8
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push str..pdfxml.1_shell
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x430910
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40e077
push 0
lea eax, [ebp - 0x12c4]
push eax
push 0x430914
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
mov esi, esp
push 0x430918
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0x234]
push eax
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0xc84]
push eax
call fcn.00410dda
pop ecx
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc84]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x430924
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push str..RMFFile_shell
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x43096c
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40e1cb
push 0
lea eax, [ebp - 0x12c4]
push eax
push 0x430970
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
mov esi, esp
push 0x430974
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0x234]
push eax
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0xc84]
push eax
call fcn.00410dda
pop ecx
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc84]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x430980
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push str..XDPDoc_shell
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x4309c4
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40e31f
push 0
lea eax, [ebp - 0x12c4]
push eax
push 0x4309c8
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
mov esi, esp
push 0x4309cc
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0x234]
push eax
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0xc84]
push eax
call fcn.00410dda
pop ecx
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc84]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x4309d8
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push str..XFDFDoc_shell
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x430a20
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40e473
push 0
lea eax, [ebp - 0x12c4]
push eax
push 0x430a24
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
mov esi, esp
push str.set:
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0x234]
push eax
push 0x104
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
lea eax, [ebp - 0x12c4]
push eax
lea eax, [ebp - 0xc84]
push eax
call fcn.00410dda
pop ecx
pop ecx
mov esi, esp
push 0x430a38
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push 0x430a34
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
cmp dword [ebp - 0xea8], 0
je 0x40e4f2
mov esi, esp
push str.ReaderAcroRd32.exe_
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f78], eax
jmp 0x40e513
mov esi, esp
push str.AcrobatAcrobat.exe_
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f78], eax
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x430aec
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40e586
push 0
lea eax, [ebp - 0x444]
push eax
push 0x430af0
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
lea eax, [ebp - 0x444]
push eax
push 0x430af8
call fcn.00410dda
pop ecx
pop ecx
push 0x208
push 0
lea eax, [ebp - 0x14d4]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x430af4
push 0x104
lea eax, [ebp - 0x14d4]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
push 0x104
lea eax, [ebp - 0x14d4]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
cmp dword [ebp - 0xea8], 0
je 0x40e612
mov esi, esp
push str.ReaderAcroRd32.exe____u___1_
push 0x104
lea eax, [ebp - 0x14d4]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
jmp 0x40e635
mov esi, esp
push str.AcrobatAcrobat.exe____u___1_
push 0x104
lea eax, [ebp - 0x14d4]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
push 0
lea eax, [ebp - 0x14d4]
push eax
push 0x430be0
push 0x430be8
lea ecx, [ebp - 0x24]
call fcn.00411a57
mov esi, esp
push str.HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push 0x430be4
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
cmp dword [ebp - 0xea8], 0
je 0x40e6cf
mov esi, esp
push 0x430c44
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f7c], eax
jmp 0x40e6f0
mov esi, esp
push 0x430c54
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f7c], eax
mov esi, esp
push str.pdfprevhndlr.dll__101
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x430d14
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40e77e
push 0
lea eax, [ebp - 0x444]
push eax
push str.DisplayName
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193_DisplayName_:
call fcn.00410dda
pop ecx
pop ecx
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
cmp dword [ebp - 0xea8], 0
je 0x40e7c7
mov esi, esp
push 0x430e08
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f80], eax
jmp 0x40e7e8
mov esi, esp
push 0x430d44
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f80], eax
mov esi, esp
push str.pdfprevhndlr.dll
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push str.HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193InprocServer32
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x430e3c
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40e891
push 0
lea eax, [ebp - 0x444]
push eax
push 0x430edc
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193InprocServer32:
call fcn.00410dda
pop ecx
pop ecx
mov esi, esp
push str.HKEY_CLASSES_ROOTTypeLib41738EEA_442F_477F_92CF_2889BD6CD7E71.00win32
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
cmp dword [ebp - 0xea8], 0
je 0x40e8f5
mov esi, esp
push 0x43102c
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f84], eax
jmp 0x40e916
mov esi, esp
push 0x43103c
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f84], eax
mov esi, esp
push str.AcroBroker.exe
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x431070
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40e9a4
push 0
lea eax, [ebp - 0x444]
push eax
push 0x431074
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTTypeLib41738EEA_442F_477F_92CF_2889BD6CD7E71.00win32:
call fcn.00410dda
pop ecx
pop ecx
mov esi, esp
push str.HKEY_CLASSES_ROOTCLSIDBD57A9B2_4E7D_4892_9107_9F4106472DA4LocalServer32
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push 0x4311c4
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
cmp dword [ebp - 0xea8], 0
je 0x40ea23
mov esi, esp
push 0x4311c8
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f88], eax
jmp 0x40ea44
mov esi, esp
push 0x4311d8
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f88], eax
mov esi, esp
push str.AcroBroker.exe_
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x43120c
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40ead2
push 0
lea eax, [ebp - 0x444]
push eax
push 0x431210
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTCLSIDBD57A9B2_4E7D_4892_9107_9F4106472DA4LocalServer32:
call fcn.00410dda
pop ecx
pop ecx
mov esi, esp
push str.HKEY_CLASSES_ROOTCLSID17F2E344_8227_4AA7_A25A_E89424566BBAInprocServer32
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x431214
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40eb60
push 0
lea eax, [ebp - 0x444]
push eax
push 0x431364
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTCLSID17F2E344_8227_4AA7_A25A_E89424566BBAInprocServer32:
call fcn.00410dda
pop ecx
pop ecx
mov esi, esp
push str.HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.00win32
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x43141c
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40ebee
push 0
lea eax, [ebp - 0x444]
push eax
push 0x4314bc
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.00win32:
call fcn.00410dda
pop ecx
pop ecx
mov esi, esp
push str.HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.0HELPDIR
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
cmp dword [ebp - 0xea8], 0
je 0x40ec52
mov esi, esp
push 0x43160c
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f8c], eax
jmp 0x40ec73
mov esi, esp
push 0x43161c
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f8c], eax
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x431630
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40ece6
push 0
lea eax, [ebp - 0x444]
push eax
push 0x431634
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.0HELPDIR:
call fcn.00410dda
pop ecx
pop ecx
mov esi, esp
push str.HKEY_CLASSES_ROOTCLSID12BA069D_0FC6_4577_97C6_5DF634CE6E84InProcServer32
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
cmp dword [ebp - 0xea8], 0
je 0x40ed4a
mov esi, esp
push str.Reader_
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f90], eax
jmp 0x40ed6b
mov esi, esp
push str.Acrobat_
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f90], eax
mov esi, esp
push str.ViewerPS.dll
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x4317c4
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40edf9
push 0
lea eax, [ebp - 0x444]
push eax
push 0x4317c8
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTCLSID12BA069D_0FC6_4577_97C6_5DF634CE6E84InProcServer32:
call fcn.00410dda
pop ecx
pop ecx
mov esi, esp
push str.HKEY_CLASSES_ROOTMIMEDatabaseContent_Type_application_pdf
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push 0x431910
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x4317cc
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40eea2
push 0
lea eax, [ebp - 0x444]
push eax
push 0x431904
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
lea eax, [ebp - 0x444]
push eax
push 0x431960
call fcn.00410dda
pop ecx
pop ecx
mov esi, esp
push str.HKEY_CLASSES_ROOTCLSIDB801CA65_A1FC_11D0_85AD_444553540000LocalServer32
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
cmp dword [ebp - 0xea8], 0
je 0x40ef06
mov esi, esp
push str.ReaderAcroRd32.exe
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f94], eax
jmp 0x40ef27
mov esi, esp
push 0x431ab4
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f94], eax
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x4319ec
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40ef9a
push 0
lea eax, [ebp - 0x444]
push eax
push 0x431adc
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTCLSIDB801CA65_A1FC_11D0_85AD_444553540000LocalServer32:
call fcn.00410dda
pop ecx
pop ecx
mov esi, esp
push str.HKEY_CLASSES_ROOTCLSIDB801CA65_A1FC_11D0_85AD_444553540000ProgID
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push 0x431c1c
push 0x104
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push 0x431c34
push 0x104
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x431c3c
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40f093
push 0
lea eax, [ebp - 0x444]
push eax
push 0x431c40
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTCLSIDBD57A9B2_4E7D_4892_9107_9F4106472DA4ProgID:
call fcn.00410dda
pop ecx
pop ecx
mov esi, esp
push str.HKEY_LOCAL_MACHINESOFTWAREGoogleChromeNativeMessagingHostscom.adobe.acrobat.chrome_webcapture
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
cmp dword [ebp - 0xea8], 0
je 0x40f0f7
mov esi, esp
push str.ReaderBrowserWCChromeExtnmanifest.json
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f98], eax
jmp 0x40f118
mov esi, esp
push 0x431e08
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f98], eax
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x431c44
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
push str.AcrobatBrowserWCChromeExtnmanifest.json
lea eax, [ebp - 0x654]
push eax
call fcn.00401896
pop ecx
pop ecx
test eax, eax
je 0x40f15a
mov byte [ebp - 0x1f99], 1
jmp 0x40f161
mov byte [ebp - 0x1f99], 0
mov al, byte [ebp - 0x1f99]
mov byte [ebp - 0x14d9], al
movzx eax, byte [ebp - 0x14d9]
test eax, eax
je 0x40f18d
lea eax, [ebp - 0x654]
push eax
call fcn.00401961
pop ecx
test eax, eax
jne 0x40f2c9
lea eax, [ebp - 0x444]
push eax
call fcn.00401961
pop ecx
test eax, eax
je 0x40f2b6
call fcn.004072a6
mov dword [ebp - 0x14e0], eax
cmp dword [ebp - 0xea8], 0
jne 0x40f1c8
call fcn.004103f6
test eax, eax
jne 0x40f1c8
and dword [ebp - 0x1fa0], 0
jmp 0x40f1d2
mov dword [ebp - 0x1fa0], 1
mov al, byte [ebp - 0x1fa0]
mov byte [ebp - 0x14e1], al
movzx eax, byte [ebp - 0x14e1]
test eax, eax
je 0x40f21c
movzx eax, byte [ebp - 0x14e1]
test eax, eax
je 0x40f267
push str.45CF91C1_9080_4F1F_913A_79E790513EF3
push dword [ebp + 0x10]
call fcn.00410336
pop ecx
pop ecx
movzx eax, al
test eax, eax
jne 0x40f21c
cmp dword [ebp - 0x14e0], 1
je 0x40f21c
cmp dword [ebp - 0x14e0], 2
jne 0x40f267
push 0
lea eax, [ebp - 0x444]
push eax
push 0x431e04
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
push 0
push str.https:__clients2.google.com_service_update2_crx
push str.update_url
push 0x431f80
lea ecx, [ebp - 0x24]
call fcn.00411a57
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_LOCAL_MACHINESOFTWAREGoogleChromeNativeMessagingHostscom.adobe.acrobat.chrome_webcapture:
call fcn.00410dda
pop ecx
pop ecx
jmp 0x40f2b4
movzx eax, byte [ebp - 0x14e1]
test eax, eax
je 0x40f2b4
lea eax, [ebp - 0x654]
push eax
call fcn.00401961
pop ecx
test eax, eax
jne 0x40f2b4
push 0x43202c
push str.Ownership:_Deleting_Chrome_Extension_registry_entries
call fcn.00410dda
pop ecx
pop ecx
push 0
push str.HKEY_LOCAL_MACHINESOFTWAREGoogleChromeExtensionsefaidnbmnnnibpcajpcglclefindmkaj
lea ecx, [ebp - 0x24]
call fcn.004111db
push 0
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004111db
jmp 0x40f2c9
lea eax, [ebp - 0x444]
push eax
push str.File_does_not_exist:
call fcn.00410dda
pop ecx
pop ecx
push 0x400
lea eax, [ebp - 0x1ce8]
push eax
call fcn.00407be8
pop ecx
pop ecx
test eax, eax
jne 0x40f2fe
push 0x400
lea eax, [ebp - 0x1ce8]
push eax
call fcn.00407a1a
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x40f3e9
mov esi, esp
push 0x43224c
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0x1ce8]
push eax
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push str.SoftwareClassesMIMEDatabaseContent_Type_application_pdf
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push str.CA8A9780_280D_11CF_A24D_444553540000
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411cf8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x432264
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.0041162d
lea eax, [ebp - 0x654]
test eax, eax
je 0x40f3e9
mov esi, esp
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x654]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40f3e9
push 0
lea eax, [ebp - 0x444]
push eax
push str.CLSID
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411a57
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTMIMEDatabaseContent_Type_application_pdf
call fcn.00410dda
pop ecx
pop ecx
cmp dword [0x43f30c], 0
jne 0x40f5c8
call fcn.004106f9
movzx eax, al
test eax, eax
jne 0x40f5c8
push 0x208
push 0
lea eax, [ebp - 0x1ef8]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x1ef8]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push str..Document.
push 0x104
lea eax, [ebp - 0x1ef8]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push 0x4323ec
push 0x104
lea eax, [ebp - 0x1ef8]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f24], 0x4323f4
mov dword [ebp - 0x1f20], 0x432400
mov dword [ebp - 0x1f1c], 0x432410
mov dword [ebp - 0x1f18], 0x432444
mov dword [ebp - 0x1f14], 0x432450
mov dword [ebp - 0x1f10], 0x43245c
mov dword [ebp - 0x1f0c], 0x432468
mov dword [ebp - 0x1f08], 0x432474
mov dword [ebp - 0x1f04], 0x432480
mov dword [ebp - 0x1f5c], 0x432494
mov dword [ebp - 0x1f58], 0x4324a0
mov dword [ebp - 0x1f54], 0x4324b0
mov dword [ebp - 0x1f50], 0x4324e4
mov dword [ebp - 0x1f4c], 0x4324f0
mov dword [ebp - 0x1f48], 0x4324fc
mov dword [ebp - 0x1f44], 0x432508
mov dword [ebp - 0x1f40], 0x432514
mov dword [ebp - 0x1f3c], 0x432520
mov dword [ebp - 0x1f38], 0x432534
mov dword [ebp - 0x1f34], 0x432540
mov dword [ebp - 0x1f30], 0x43254c
cmp dword [ebp - 0xea8], 0
je 0x40f56e
mov dword [ebp - 0x1fa4], 9
jmp 0x40f578
mov dword [ebp - 0x1fa4], 0xc
mov eax, dword [ebp - 0x1fa4]
mov dword [ebp - 0x1f64], eax
cmp dword [ebp - 0xea8], 0
je 0x40f59b
lea eax, [ebp - 0x1f24]
mov dword [ebp - 0x1fa8], eax
jmp 0x40f5a7
lea eax, [ebp - 0x1f5c]
mov dword [ebp - 0x1fa8], eax
lea eax, [ebp - 0x1ef8]
push eax
push dword [ebp - 0xea8]
push dword [ebp - 0x1f64]
push dword [ebp - 0x1fa8]
call fcn.00405ced
add esp, 0x10
mov esi, esp
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x1f68], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0041117c
mov eax, dword [ebp - 0x1f68]
push edx
mov ecx, ebp
push eax
lea edx, [0x40f637]
call fcn.00411ca2
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411d30
add esp, 0x1fa8
cmp ebp, esp
call fcn.00411cf8
leave
ret 0xc