Function at 0x411f50
Capabilities:
Check if file exists
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4efb9c
mov eax, dword fs:[0]
push eax
sub esp, 0x454
mov eax, dword [0x536014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
cmp esi, 0x3f0
jne 0x4120b0
push 9
xor eax, eax
mov dword [ebp - 0x30], 7
push str.pdfreader
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
call fcn.00407340
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push 0xd
xor eax, eax
mov dword [ebp - 0x18], 7
push str.pdf_copy_text
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.00407340
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00447db0
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x411fff
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00407a10
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
cmp eax, 8
jb 0x41202f
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.00407a10
mov ecx, dword [edi + 0x3ec]
push dword [ecx + 0x188]
call dword [sym.imp.soui.dll_public:_class_SOUI::STabPage____thiscall_SOUI::STabCtrl::GetItem_int_]
push 0x50c4ac
lea ecx, [ebp - 0x458]
mov esi, eax
call dword [sym.imp.utilities.dll_public:_void___thiscall_SOUI::TStringT_char__struct_SOUI::char_traits_::constructor_char_const__]
push 0
push 0
lea eax, [ebp - 0x458]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.utilities.dll_public:_static_class_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits____cdecl_SOUI::SStrCpCvt::CvtA2W_class_SOUI::TStringT_char__struct_SOUI::char_traits__const___unsigned_int__unsigned_int_]
add esp, 0xc
mov byte [ebp - 4], 3
mov ecx, esi
push dword [eax]
call fcn.00418450
lea ecx, [ebp - 0x460]
mov esi, eax
call dword [sym.imp.utilities.dll_public:_void___thiscall_SOUI::TStringT_wchar_t__struct_SOUI::wchar_traits_::destructor_void_]
lea ecx, [ebp - 0x458]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.utilities.dll_public:_void___thiscall_SOUI::TStringT_char__struct_SOUI::char_traits_::destructor_void_]
mov ecx, esi
call fcn.0043f120
jmp 0x4128df
cmp esi, 0x3e9
jne 0x41215b
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.Mmenu_previouspage
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 4
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x44]
call fcn.00447db0
mov eax, dword [ebp - 0x30]
cmp eax, 8
jb 0x412101
inc eax
lea ecx, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
call fcn.00407a10
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov word [ebp - 0x44], ax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], 0
cmp eax, 8
jb 0x412131
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.00407a10
mov ecx, dword [edi + 0x3ec]
push dword [ecx + 0x188]
call dword [sym.imp.soui.dll_public:_class_SOUI::STabPage____thiscall_SOUI::STabCtrl::GetItem_int_]
sub esp, 8
mov ecx, eax
call fcn.00416ed0
push 1
mov ecx, eax
call fcn.0043e7d0
jmp 0x4128df
cmp esi, 0x3ea
jne 0x4121d4
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.Mmenu_nextpage
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 6
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x44]
call fcn.00447db0
lea ecx, [ebp - 0x44]
call fcn.004077b0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004077b0
mov ecx, dword [edi + 0x3ec]
push dword [ecx + 0x188]
call dword [sym.imp.soui.dll_public:_class_SOUI::STabPage____thiscall_SOUI::STabCtrl::GetItem_int_]
sub esp, 8
mov ecx, eax
call fcn.00416ed0
push 2
mov ecx, eax
call fcn.0043e7d0
jmp 0x4128df
cmp esi, 0x3eb
jne 0x41224d
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.Mmenu_skiptop
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 8
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x44]
call fcn.00447db0
lea ecx, [ebp - 0x44]
call fcn.004077b0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004077b0
mov ecx, dword [edi + 0x3ec]
push dword [ecx + 0x188]
call dword [sym.imp.soui.dll_public:_class_SOUI::STabPage____thiscall_SOUI::STabCtrl::GetItem_int_]
sub esp, 8
mov ecx, eax
call fcn.00416ed0
push 0
mov ecx, eax
call fcn.0043e7d0
jmp 0x4128df
cmp esi, 0x3ec
jne 0x4122cd
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.Mmenu_filelocation
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0xa
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x44]
call fcn.00447db0
lea ecx, [ebp - 0x44]
call fcn.004077b0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004077b0
mov eax, dword [edi + 0x3ec]
imul eax, dword [eax + 0x188], 0x6c
add eax, dword [edi + 0x3f4]
cmp dword [eax + 0x14], 8
jb 0x4122b7
mov eax, dword [eax]
push ecx
mov ecx, esp
push eax
call fcn.004148c0
call fcn.0045a560
add esp, 4
jmp 0x4128df
cmp esi, 0x3ed
jne 0x4123cd
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.Mmenu_setdefault
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0xc
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x44]
call fcn.00447db0
lea ecx, [ebp - 0x44]
call fcn.004077b0
lea ecx, [ebp - 0x2c]
call fcn.004077b0
push 0x208
lea eax, [ebp - 0x264]
mov dword [ebp - 0x458], 0
push 0
push eax
mov dword [ebp - 0x45c], 1
call fcn.0048acb0
add esp, 0xc
mov dword [ebp - 0x460], 0x208
lea eax, [ebp - 0x458]
push eax
push 0x20019
push 0
push str.SoftWarePhotoViewerInstall
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4128df
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x45c]
push eax
push 0
push 0x50bcfc
push dword [ebp - 0x458]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4123bc
push 0x50c8bc
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
sub esp, 0xc
call fcn.0044d660
add esp, 0xc
push dword [ebp - 0x458]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4128df
cmp esi, 0x3ee
jne 0x412428
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.Mmenu_save
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0xe
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x44]
call fcn.00447db0
lea ecx, [ebp - 0x44]
call fcn.004077b0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004077b0
mov ecx, edi
call fcn.00411dc0
jmp 0x4128df
cmp esi, 0x3f1
jne 0x41243a
call fcn.0040e370
jmp 0x4128df
cmp esi, 0x3f2
jne 0x41244c
call fcn.0040e1e0
jmp 0x4128df
cmp esi, 0x3ef
jne 0x4124a7
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.send_mail
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0x10
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x44]
call fcn.00447db0
lea ecx, [ebp - 0x44]
call fcn.004077b0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004077b0
mov ecx, edi
call fcn.00411850
jmp 0x4128df
cmp esi, 0x2b34
jne 0x4124b9
call fcn.0040e610
jmp 0x4128df
lea eax, [esi - 0x2b35]
cmp eax, 4
ja 0x412518
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.menu_open_recent
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0x12
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x44]
call fcn.00447db0
lea ecx, [ebp - 0x44]
call fcn.004077b0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004077b0
push esi
mov ecx, edi
call fcn.0040e510
jmp 0x4128df
cmp esi, 0x44d
jne 0x412571
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.Cmenu_feedback
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0x14
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x44]
call fcn.00447db0
lea ecx, [ebp - 0x44]
call fcn.004077b0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004077b0
call fcn.00412910
jmp 0x4128df
cmp esi, 0x44e
jne 0x412675
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.Cmenu_officialsite
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0x16
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x44]
call fcn.00447db0
lea ecx, [ebp - 0x44]
call fcn.004077b0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.004077b0
push 0x104
lea eax, [ebp - 0x164]
push 0
push eax
call fcn.0048acb0
add esp, 0xc
mov dword [ebp - 0x45c], 0x104
lea eax, [ebp - 0x45c]
mov edx, 0x1c
mov ecx, str.aHR0cDovL2FiY2thbnR1LmNvbS8
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.0045b5c0
lea ecx, [ebp - 0x164]
add esp, 8
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x412610
sub ecx, edx
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x412628
xor eax, eax
jmp 0x412640
lea eax, [esi + esi]
call fcn.004e33a0
mov ecx, esp
lea edx, [ebp - 0x164]
push 3
push esi
call fcn.0041bcd0
push eax
lea ecx, [ebp - 0x458]
call fcn.004148c0
push 3
push 0
push 0
push dword [ebp - 0x458]
push 0x50c990
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x458]
call fcn.004147e0
jmp 0x4128df
cmp esi, 0x44f
jne 0x412741
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.Cmenu_checkupdate
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0x18
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x44]
call fcn.00447db0
lea ecx, [ebp - 0x44]
call fcn.004077b0
lea ecx, [ebp - 0x2c]
call fcn.004077b0
push 0x208
lea eax, [ebp - 0x264]
push 0
push eax
call fcn.0048acb0
add esp, 0xc
lea eax, [ebp - 0x264]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.Update.exe
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4128df
push 1
push 0
push str._Update0
lea eax, [ebp - 0x264]
push eax
push 0x50c990
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4128df
cmp esi, 0x450
jne 0x412845
push str.pdfreader
lea ecx, [ebp - 0x2c]
call fcn.0040b1f0
push str.Cmenu_about
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0x1a
call fcn.0040b1f0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x44]
call fcn.00447db0
lea ecx, [ebp - 0x44]
call fcn.004077b0
lea ecx, [ebp - 0x2c]
call fcn.004077b0
lea ecx, [ebp - 0x458]
call fcn.00414980
mov dword [ebp - 4], 0x1c
lea edx, [ebp - 0x458]
cmp dword [0x53c784], 8
mov ecx, 0x53c770
cmovae ecx, dword [0x53c770]
call fcn.00459e30
mov eax, dword [ebp - 0x458]
cmp dword [eax - 0xc], 0
jle 0x412808
lea eax, [ebp - 0x458]
mov edx, 0x50ca04
push eax
lea ecx, [ebp - 0x45c]
call fcn.004145b0
add esp, 4
push eax
lea ecx, [ebp - 0x458]
mov byte [ebp - 4], 0x1d
call fcn.00414780
lea ecx, [ebp - 0x45c]
mov byte [ebp - 4], 0x1c
call fcn.004147e0
mov eax, dword [ebp - 0x458]
push eax
lea ecx, [ebp - 0x454]
call fcn.00436b40
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x454]
push dword [edi + 0x25c]
call dword [sym.imp.soui.dll_public_virtual:_int___thiscall_SOUI::SHostDialog::DoModal_struct_HWND____]
lea ecx, [ebp - 0x454]
call fcn.00436c30
lea ecx, [ebp - 0x458]
call fcn.004147e0
jmp 0x4128df
cmp esi, 0x451
jne 0x4128df
mov cl, byte [edi + 0x41c]
test cl, cl
push 3
sete al
push 0
mov byte [edi + 0x41c], al
xor eax, eax
push 0
test cl, cl
push 0
sete al
push 0
add eax, 0xfffffffe
push eax
push dword [edi + 0x25c]
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp byte [edi + 0x41c], 0
mov ecx, 0x50ca08
mov eax, 0x50c410
cmove eax, ecx
lea ecx, [ebp - 0x5c]
push eax
call fcn.0041c860
sub esp, 0x18
mov dword [ebp - 4], 0x1f
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x45c], esp
mov ecx, esp
push eax
call fcn.00409910
sub esp, 0x18
mov byte [ebp - 4], 0x20
mov ecx, esp
push 0x50c40c
call fcn.0041c860
mov byte [ebp - 4], 0x1f
call fcn.00407d50
lea ecx, [ebp - 0x5c]
call fcn.00407770
lea esp, [ebp - 0x46c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00466907
mov esp, ebp
pop ebp
ret 4