Function at 0x411dd0
Capabilities:
Check if file exists
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ec934
mov eax, dword fs:[0]
push eax
sub esp, 0x454
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4126b1
mov esi, dword [ebp + 0xc]
cmp esi, 0x3f0
jne 0x411eb6
push str.pdfreader
lea ecx, [ebp - 0x44]
call fcn.0040b1f0
push str.pdf_copy_text
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.0040b1f0
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.004451a0
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x411e5e
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00407a10
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
cmp eax, 8
jb 0x411e8e
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.00407a10
mov ecx, dword [edi + 0x3ec]
push dword [ecx + 0x188]
call dword [sym.imp.soui.dll_public:_class_SOUI::STabPage____thiscall_SOUI::STabCtrl::GetItem_int_]
sub esp, 8
mov ecx, eax
call fcn.00416ba0
mov ecx, eax
call fcn.0043c700
jmp 0x4126c5
cmp esi, 0x3e9
jne 0x411f2f
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.Mmenu_previouspage
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 2
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
call fcn.004451a0
lea ecx, [ebp - 0x44]
call fcn.004077b0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004077b0
mov ecx, dword [edi + 0x3ec]
push dword [ecx + 0x188]
call dword [sym.imp.soui.dll_public:_class_SOUI::STabPage____thiscall_SOUI::STabCtrl::GetItem_int_]
sub esp, 8
mov ecx, eax
call fcn.00416ba0
push 1
mov ecx, eax
call fcn.0043bda0
jmp 0x4126c5
cmp esi, 0x3ea
jne 0x411fa8
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.Mmenu_nextpage
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 4
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x44]
call fcn.004451a0
lea ecx, [ebp - 0x44]
call fcn.004077b0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004077b0
mov ecx, dword [edi + 0x3ec]
push dword [ecx + 0x188]
call dword [sym.imp.soui.dll_public:_class_SOUI::STabPage____thiscall_SOUI::STabCtrl::GetItem_int_]
sub esp, 8
mov ecx, eax
call fcn.00416ba0
push 2
mov ecx, eax
call fcn.0043bda0
jmp 0x4126c5
cmp esi, 0x3eb
jne 0x412021
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.Mmenu_skiptop
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 6
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x44]
call fcn.004451a0
lea ecx, [ebp - 0x44]
call fcn.004077b0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004077b0
mov ecx, dword [edi + 0x3ec]
push dword [ecx + 0x188]
call dword [sym.imp.soui.dll_public:_class_SOUI::STabPage____thiscall_SOUI::STabCtrl::GetItem_int_]
sub esp, 8
mov ecx, eax
call fcn.00416ba0
push 0
mov ecx, eax
call fcn.0043bda0
jmp 0x4126c5
cmp esi, 0x3ec
jne 0x41209e
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.Mmenu_filelocation
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 8
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x44]
call fcn.004451a0
lea ecx, [ebp - 0x44]
call fcn.004077b0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004077b0
mov eax, dword [edi + 0x3ec]
imul eax, dword [eax + 0x188], 0x6c
add eax, dword [edi + 0x3f4]
cmp dword [eax + 0x14], 8
jb 0x41208b
mov eax, dword [eax]
push ecx
mov ecx, esp
push eax
call fcn.004145e0
call fcn.00457360
jmp 0x4126c2
cmp esi, 0x3ed
jne 0x41219e
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.Mmenu_setdefault
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0xa
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x44]
call fcn.004451a0
lea ecx, [ebp - 0x44]
call fcn.004077b0
lea ecx, [ebp - 0x2c]
call fcn.004077b0
push 0x208
lea eax, [ebp - 0x264]
mov dword [ebp - 0x458], 0
push 0
push eax
mov dword [ebp - 0x45c], 1
call fcn.00487ab0
add esp, 0xc
mov dword [ebp - 0x460], 0x208
lea eax, [ebp - 0x458]
push eax
push 0x20019
push 0
push str.SoftWarePhotoViewerInstall
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4126c5
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x45c]
push eax
push 0
push 0x508cfc
push dword [ebp - 0x458]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41218d
push 0x5098dc
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
sub esp, 0xc
call fcn.0044a970
add esp, 0xc
push dword [ebp - 0x458]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4126c5
cmp esi, 0x3ee
jne 0x4121f9
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.Mmenu_save
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0xc
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x44]
call fcn.004451a0
lea ecx, [ebp - 0x44]
call fcn.004077b0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004077b0
mov ecx, edi
call fcn.00411c40
jmp 0x4126c5
cmp esi, 0x3f1
jne 0x41220b
call fcn.0040e470
jmp 0x4126c5
cmp esi, 0x3f2
jne 0x41221d
call fcn.0040e2e0
jmp 0x4126c5
cmp esi, 0x3ef
jne 0x412278
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.send_mail
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0xe
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x44]
call fcn.004451a0
lea ecx, [ebp - 0x44]
call fcn.004077b0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004077b0
mov ecx, edi
call fcn.004116d0
jmp 0x4126c5
cmp esi, 0x2b34
jne 0x41228a
call fcn.0040e710
jmp 0x4126c5
lea eax, [esi - 0x2b35]
cmp eax, 4
ja 0x4122e9
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.menu_open_recent
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0x10
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x44]
call fcn.004451a0
lea ecx, [ebp - 0x44]
call fcn.004077b0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004077b0
push esi
mov ecx, edi
call fcn.0040e610
jmp 0x4126c5
cmp esi, 0x44d
jne 0x412342
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.Cmenu_feedback
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0x12
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x44]
call fcn.004451a0
lea ecx, [ebp - 0x44]
call fcn.004077b0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004077b0
call fcn.004126f0
jmp 0x4126c5
cmp esi, 0x44e
jne 0x412445
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.Cmenu_officialsite
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0x14
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x44]
call fcn.004451a0
lea ecx, [ebp - 0x44]
call fcn.004077b0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004077b0
push 0x104
lea eax, [ebp - 0x164]
push 0
push eax
call fcn.00487ab0
add esp, 0xc
mov dword [ebp - 0x45c], 0x104
lea eax, [ebp - 0x45c]
mov edx, 0x1c
mov ecx, str.aHR0cDovL2FiY2thbnR1LmNvbS8
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.004583c0
lea ecx, [ebp - 0x164]
add esp, 8
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4123e0
sub ecx, edx
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x4123f8
xor eax, eax
jmp 0x412410
lea eax, [esi + esi]
call fcn.004e0180
mov ecx, esp
lea edx, [ebp - 0x164]
push 3
push esi
call fcn.0041b8d0
push eax
lea ecx, [ebp - 0x458]
call fcn.004145e0
push 3
push 0
push 0
push dword [ebp - 0x458]
push 0x5099b0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x458]
call fcn.00414500
jmp 0x4126c5
cmp esi, 0x44f
jne 0x412511
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.Cmenu_checkupdate
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0x16
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x44]
call fcn.004451a0
lea ecx, [ebp - 0x44]
call fcn.004077b0
lea ecx, [ebp - 0x2c]
call fcn.004077b0
push 0x208
lea eax, [ebp - 0x264]
push 0
push eax
call fcn.00487ab0
add esp, 0xc
lea eax, [ebp - 0x264]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.Update.exe
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4126c5
push 1
push 0
push str._Update0
lea eax, [ebp - 0x264]
push eax
push 0x5099b0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4126c5
cmp esi, 0x450
jne 0x412615
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.Cmenu_about
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0x18
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x44]
call fcn.004451a0
lea ecx, [ebp - 0x44]
call fcn.004077b0
lea ecx, [ebp - 0x2c]
call fcn.004077b0
lea ecx, [ebp - 0x458]
call fcn.004146a0
mov dword [ebp - 4], 0x1a
lea edx, [ebp - 0x458]
cmp dword [0x539664], 8
mov ecx, 0x539650
cmovae ecx, dword [0x539650]
call fcn.00456c80
mov eax, dword [ebp - 0x458]
cmp dword [eax - 0xc], 0
jle 0x4125d8
lea eax, [ebp - 0x458]
mov edx, 0x509a24
push eax
lea ecx, [ebp - 0x45c]
call fcn.004142d0
add esp, 4
push eax
lea ecx, [ebp - 0x458]
mov byte [ebp - 4], 0x1b
call fcn.004144a0
lea ecx, [ebp - 0x45c]
mov byte [ebp - 4], 0x1a
call fcn.00414500
mov eax, dword [ebp - 0x458]
push eax
lea ecx, [ebp - 0x454]
call fcn.00434160
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x454]
push dword [edi + 0x25c]
call dword [sym.imp.soui.dll_public_virtual:_int___thiscall_SOUI::SHostDialog::DoModal_struct_HWND____]
lea ecx, [ebp - 0x454]
call fcn.00434250
lea ecx, [ebp - 0x458]
call fcn.00414500
jmp 0x4126c5
cmp esi, 0x451
jne 0x4126c5
mov cl, byte [edi + 0x41c]
test cl, cl
push 3
sete al
push 0
mov byte [edi + 0x41c], al
xor eax, eax
push 0
test cl, cl
push 0
sete al
push 0
add eax, 0xfffffffe
push eax
push dword [edi + 0x25c]
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp byte [edi + 0x41c], 0
mov ecx, 0x509a28
mov eax, 0x509410
cmove eax, ecx
lea ecx, [ebp - 0x5c]
push eax
call fcn.0041c390
sub esp, 0x18
mov dword [ebp - 4], 0x1d
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x45c], esp
mov ecx, esp
push eax
call fcn.00409910
sub esp, 0x18
mov byte [ebp - 4], 0x1e
mov ecx, esp
push 0x50940c
call fcn.0041c390
mov byte [ebp - 4], 0x1d
call fcn.00407d50
lea ecx, [ebp - 0x5c]
call fcn.00407770
jmp 0x4126c5
cmp eax, 0x300
jne 0x4126c5
push str.text_change
call fcn.0041bf60
add esp, 4
lea esp, [ebp - 0x46c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046370d
mov esp, ebp
pop ebp
ret 0xc