Function at 0x1400102b8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x2230
call fcn.140015da0
sub rsp, rax
lea rdi, [rsp + 0x30]
mov ecx, 0x880
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2240]
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2220], rax
lea rcx, [rsp + 0x38]
call fcn.140014be4
nop
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x2a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x4d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x700]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x930]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0xb60]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0xd90]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0xfb4], 0x104
lea r9, [rsp + 0xfb4]
lea r8, [rsp + 0xd90]
lea rdx, [0x1400441d0]
mov rcx, qword [rsp + 0x2258]
call sub.msi.dll_MsiGetPropertyW
mov dword [rsp + 0xfc4], 0
lea rdx, [0x1400441f0]
mov rcx, qword [rsp + 0x2258]
call fcn.1400048f4
test rax, rax
je 0x1400103f7
mov dword [rsp + 0xfc4], 1
cmp dword [rsp + 0xfc4], 0
je 0x14001041d
lea r8, str.AcroExch
mov edx, 0x104
lea rcx, [rsp + 0x930]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
jmp 0x140010437
lea r8, str.Acrobat
mov edx, 0x104
lea rcx, [rsp + 0x930]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [0x140044228]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x140044240]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str.HKEY_CLASSES_ROOT.pdf
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rdx, str..msp
mov rcx, qword [rsp + 0x2248]
call fcn.1400048f4
test rax, rax
je 0x1400104de
mov rcx, qword [rsp + 0x2250]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
test rax, rax
jbe 0x1400104de
lea rdx, [0x140044284]
lea rcx, str._In_Patch_mode__not_changing_the_value_of_HKCR.pdf
call fcn.140013fc0
jmp 0x140010518
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x1400442fc]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOT.pdf:
call fcn.140013fc0
lea rcx, [rsp + 0xd90]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x1400106c7
lea rdx, [0x140044344]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [rsp + 0xfc4], 0
je 0x140010582
lea rdx, [0x140044348]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21a8], rax
jmp 0x14001059f
lea rdx, str.AcrobatInfo.exe___PDFShell
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21a8], rax
lea rdx, str.HKEY_CLASSES_ROOTCLSIDD38406DA_E8AA_484b_B80D_3D3DBDCC2FB2LocalServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14004445c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010633
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140044460]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDD38406DA_E8AA_484b_B80D_3D3DBDCC2FB2LocalServer32:
call fcn.140013fc0
lea rdx, str.HKEY_CLASSES_ROOTCLSID98D9A6F1_4696_4B5E_A2E8_36B3F9C1E12CLocalServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400445bc]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400106c7
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x1400445c0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSID98D9A6F1_4696_4B5E_A2E8_36B3F9C1E12CLocalServer32:
call fcn.140013fc0
lea rax, [rsp + 0xfe0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0xfe0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov rcx, qword [rsp + 0x2258]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x140010b35
lea rcx, [rsp + 0xfe0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x140010b35
lea rdx, [rsp + 0xfe0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.Installer_
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, qword [rsp + 0x2258]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [rsp + 0xfc4], 0
je 0x140010784
lea rdx, str.PDFFile_8.ico_0
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21b0], rax
jmp 0x1400107a1
lea rdx, str._PDFFile.ico_0
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21b0], rax
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x1400446e0]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..acrobatsecuritysettings.1DefaultIcon
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140044760]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400108c3
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140044764]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea r8, [0x140044768]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0xb60]
call fcn.140013fc0
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x140044778]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x1400447a0]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x1400447b8]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str.DefaultIcon
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400447dc]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010a13
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x1400447e0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea r8, [0x1400447e8]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0xb60]
call fcn.140013fc0
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x1400447f8]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..pdfxml.1DefaultIcon
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14004484c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010b35
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140044850]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea r8, [0x140044858]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0xb60]
call fcn.140013fc0
lea rax, [rsp + 0x1210]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
cmp dword [rsp + 0xfc4], 0
je 0x140010b72
lea rdx, [0x140044868]
lea rcx, [rsp + 0x1210]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov qword [rsp + 0x21b8], rax
jmp 0x140010b8f
lea rdx, [0x140044878]
lea rcx, [rsp + 0x1210]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov qword [rsp + 0x21b8], rax
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x140044888]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..acrobatsecuritysettings.1_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400448f4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010cb1
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x1400448f8]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea r8, [0x140044900]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.140013fc0
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x140044910]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..FDFDoc_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140044954]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010dd3
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x140044958]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea r8, [0x140044960]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.140013fc0
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x140044970]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x140044998]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x1400449b0]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str._shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400449c8]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010f23
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x1400449cc]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea r8, [0x1400449d0]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.140013fc0
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x1400449e0]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..pdfxml.1_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140044a28]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140011045
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x140044a2c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea r8, [0x140044a30]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.140013fc0
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x140044a40]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..RMFFile_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140044a88]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140011167
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x140044a8c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea r8, [0x140044a90]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.140013fc0
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x140044aa0]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..XDPDoc_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140044ae4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140011289
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x140044ae8]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea r8, [0x140044af0]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.140013fc0
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x140044b00]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..XFDFDoc_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140044b48]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400113ab
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x140044b4c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea r8, str.set:
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.140013fc0
lea rdx, str.HKEY_CLASSES_ROOTSOFTWAREAdobeAcrobatExe
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x140044bbc]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [rsp + 0xfc4], 0
je 0x140011411
lea rdx, [0x140044bc0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21c0], rax
jmp 0x14001142e
lea rdx, str.AcrobatAcrobat.exe_
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21c0], rax
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140044c1c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400114b0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140044c20]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTSOFTWAREAdobeAcrobatExe:
call fcn.140013fc0
lea rax, [rsp + 0x1440]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea r8, [0x140044ca0]
mov edx, 0x104
lea rcx, [rsp + 0x1440]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0xd90]
mov edx, 0x104
lea rcx, [rsp + 0x1440]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
cmp dword [rsp + 0xfc4], 0
je 0x14001151f
lea r8, str.ReaderAcroRd32.exe___u___1_
mov edx, 0x104
lea rcx, [rsp + 0x1440]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
jmp 0x140011539
lea r8, str.AcrobatAcrobat.exe___u___1_
mov edx, 0x104
lea rcx, [rsp + 0x1440]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1440]
lea r8, [0x140044d24]
lea rdx, str.HKEY_CLASSES_ROOT_acrobat_shellopencommand
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea rdx, str.HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x140044e10]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [rsp + 0xfc4], 0
je 0x1400115c7
lea rdx, [0x140044e18]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21c8], rax
jmp 0x1400115e4
lea rdx, [0x140044e28]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21c8], rax
lea rdx, str.pdfprevhndlr.dll__101
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140044e70]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14001167b
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, str.DisplayName
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193_DisplayName_:
call fcn.140013fc0
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x1400116ba
lea rdx, [0x140044f50]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21d0], rax
jmp 0x1400116d7
lea rdx, [0x140044f60]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21d0], rax
lea rdx, str.pdfprevhndlr.dll
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193InprocServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14004503c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140011780
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140045040]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193InprocServer32:
call fcn.140013fc0
lea rdx, str.HKEY_CLASSES_ROOTTypeLib41738EEA_442F_477F_92CF_2889BD6CD7E71.00win32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x1400117d1
lea rdx, [0x1400451a0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21d8], rax
jmp 0x1400117ee
lea rdx, [0x1400451b0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21d8], rax
lea rdx, str.AcroBroker.exe
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400451e8]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140011885
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x1400451ec]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTTypeLib41738EEA_442F_477F_92CF_2889BD6CD7E71.00win32:
call fcn.140013fc0
lea rdx, str.HKEY_CLASSES_ROOTCLSIDBD57A9B2_4E7D_4892_9107_9F4106472DA4LocalServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14004533c]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [rsp + 0xfc4], 0
je 0x1400118eb
lea rdx, [0x140045340]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21e0], rax
jmp 0x140011908
lea rdx, [0x140045350]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21e0], rax
lea rdx, str.AcroBroker.exe_
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140045388]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14001199f
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x14004538c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDBD57A9B2_4E7D_4892_9107_9F4106472DA4LocalServer32:
call fcn.140013fc0
lea rdx, str.HKEY_CLASSES_ROOTCLSID17F2E344_8227_4AA7_A25A_E89424566BBAInprocServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400454dc]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140011a33
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x1400454e0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSID17F2E344_8227_4AA7_A25A_E89424566BBAInprocServer32:
call fcn.140013fc0
lea rdx, str.HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.00win32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14004564c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140011ac7
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140045650]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.00win32:
call fcn.140013fc0
lea rdx, str.HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.0HELPDIR
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x140011b18
lea rdx, [0x1400457b0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21e8], rax
jmp 0x140011b35
lea rdx, [0x1400457c0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21e8], rax
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400457d4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140011bb7
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x1400457d8]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.0HELPDIR:
call fcn.140013fc0
lea rdx, str.HKEY_CLASSES_ROOTCLSID12BA069D_0FC6_4577_97C6_5DF634CE6E84InProcServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x140011c08
lea rdx, [0x140045930]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21f0], rax
jmp 0x140011c25
lea rdx, [0x140045940]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21f0], rax
lea rdx, str.ViewerPS.dll
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140045974]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140011cbc
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140045978]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSID12BA069D_0FC6_4577_97C6_5DF634CE6E84InProcServer32:
call fcn.140013fc0
lea rdx, str.HKEY_CLASSES_ROOTMIMEDatabaseContent_Type_application_pdf
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x140045ab0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140045b00]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140011d65
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140045b10]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea rdx, [rsp + 0x2a0]
lea rcx, [0x140045b20]
call fcn.140013fc0
lea rdx, str.HKEY_CLASSES_ROOTCLSIDB801CA65_A1FC_11D0_85AD_444553540000LocalServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x140011db6
lea rdx, str.ReaderAcroRd32.exe
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21f8], rax
jmp 0x140011dd3
lea rdx, [0x140045c78]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21f8], rax
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140045ca0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140011e55
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140045ca4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDB801CA65_A1FC_11D0_85AD_444553540000LocalServer32:
call fcn.140013fc0
lea rdx, str.HKEY_CLASSES_ROOTCLSIDB801CA65_A1FC_11D0_85AD_444553540000ProgID
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [0x140045df0]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x140045e08]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140045e10]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140011f38
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140045e14]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDBD57A9B2_4E7D_4892_9107_9F4106472DA4ProgID:
call fcn.140013fc0
lea rdx, str.HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeGoogleChromeNativeMessagingHostscom.adobe.acrobat.chrome_webcapture
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x140011f89
lea rdx, str.ReaderBrowserWCChromeExtnmanifest.json
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x2200], rax
jmp 0x140011fa6
lea rdx, [0x140046000]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x2200], rax
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140046058]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rdx, str.AcrobatBrowserWCChromeExtnmanifest.json
lea rcx, [rsp + 0x4d0]
call fcn.1400048f4
test rax, rax
je 0x140011ff7
mov byte [rsp + 0x2208], 1
jmp 0x140011fff
mov byte [rsp + 0x2208], 0
mov al, byte [rsp + 0x2208]
mov byte [rsp + 0x1654], al
movzx eax, byte [rsp + 0x1654]
test eax, eax
je 0x14001202e
lea rcx, [rsp + 0x4d0]
call fcn.140004e74
test eax, eax
jne 0x14001218e
lea rcx, [rsp + 0x2a0]
call fcn.140004e74
test eax, eax
je 0x14001217a
call fcn.14000ade8
mov dword [rsp + 0x1658], eax
cmp dword [rsp + 0xfc4], 0
jne 0x14001206f
call fcn.1400130d0
test eax, eax
jne 0x14001206f
mov dword [rsp + 0x220c], 0
jmp 0x14001207a
mov dword [rsp + 0x220c], 1
mov al, byte [rsp + 0x220c]
mov byte [rsp + 0x165c], al
movzx eax, byte [rsp + 0x165c]
test eax, eax
je 0x1400120d3
movzx eax, byte [rsp + 0x165c]
test eax, eax
je 0x140012136
lea rdx, str.E3AFF032_DE15_45DA_8C24_B74F922C62EC
mov rcx, qword [rsp + 0x2258]
call fcn.140013018
movzx eax, al
test eax, eax
jne 0x1400120d3
cmp dword [rsp + 0x1658], 1
je 0x1400120d3
cmp dword [rsp + 0x1658], 2
jne 0x140012136
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140046110]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
mov dword [rsp + 0x20], 0
lea r9, str.https:__clients2.google.com_service_update2_crx
lea r8, str.update_url
lea rdx, str.HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeGoogleChromeExtensionsefaidnbmnnnibpcajpcglclefindmkaj
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_LOCAL_MACHINESOFTWAREGoogleChromeNativeMessagingHostscom.adobe.acrobat.chrome_webcapture:
call fcn.140013fc0
jmp 0x140012178
movzx eax, byte [rsp + 0x165c]
test eax, eax
je 0x140012178
lea rcx, [rsp + 0x4d0]
call fcn.140004e74
test eax, eax
jne 0x140012178
lea rdx, [0x140046348]
lea rcx, str.Ownership:_Deleting_Chrome_Extension_registry_entries
call fcn.140013fc0
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140014d1c
jmp 0x14001218e
lea rdx, [rsp + 0x2a0]
lea rcx, str.File_does_not_exist:
call fcn.140013fc0
mov edx, 0x400
lea rcx, [rsp + 0x1670]
call fcn.14000b608
test eax, eax
jne 0x1400121c1
mov edx, 0x400
lea rcx, [rsp + 0x1670]
call fcn.14000b43c
movzx eax, al
test eax, eax
je 0x14001229c
lea rdx, [0x1400463f0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x1670]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.SoftwareClassesMIMEDatabaseContent_Type_application_pdf
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.CA8A9780_280D_11CF_A24D_444553540000
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400464e0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140015274
lea rax, [rsp + 0x4d0]
test rax, rax
je 0x14001229c
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14001229c
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, str.CLSID
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001578c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTMIMEDatabaseContent_Type_application_pdf
call fcn.140013fc0
cmp dword [0x14005a4d0], 0
jne 0x1400124d9
call fcn.140013474
movzx eax, al
test eax, eax
jne 0x1400124d9
lea rax, [rsp + 0x1e90]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x1e90]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str..Document.
mov edx, 0x104
lea rcx, [rsp + 0x1e90]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x1400465a8]
mov edx, 0x104
lea rcx, [rsp + 0x1e90]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rax, [0x1400465b0]
mov qword [rsp + 0x20c0], rax
lea rax, [0x1400465c0]
mov qword [rsp + 0x20c8], rax
lea rax, [0x1400465d0]
mov qword [rsp + 0x20d0], rax
lea rax, [0x140046608]
mov qword [rsp + 0x20d8], rax
lea rax, [0x140046618]
mov qword [rsp + 0x20e0], rax
lea rax, [0x140046628]
mov qword [rsp + 0x20e8], rax
lea rax, [0x140046638]
mov qword [rsp + 0x20f0], rax
lea rax, [0x140046648]
mov qword [rsp + 0x20f8], rax
lea rax, [0x140046658]
mov qword [rsp + 0x2100], rax
lea rax, [0x140046670]
mov qword [rsp + 0x2130], rax
lea rax, [0x140046680]
mov qword [rsp + 0x2138], rax
lea rax, [0x140046690]
mov qword [rsp + 0x2140], rax
lea rax, [0x1400466c8]
mov qword [rsp + 0x2148], rax
lea rax, [0x1400466d8]
mov qword [rsp + 0x2150], rax
lea rax, [0x1400466e8]
mov qword [rsp + 0x2158], rax
lea rax, [0x1400466f8]
mov qword [rsp + 0x2160], rax
lea rax, [0x140046708]
mov qword [rsp + 0x2168], rax
lea rax, [0x140046718]
mov qword [rsp + 0x2170], rax
lea rax, [0x140046730]
mov qword [rsp + 0x2178], rax
lea rax, [0x140046740]
mov qword [rsp + 0x2180], rax
lea rax, [0x140046750]
mov qword [rsp + 0x2188], rax
cmp dword [rsp + 0xfc4], 0
je 0x14001246f
mov qword [rsp + 0x2210], 9
jmp 0x14001247b
mov qword [rsp + 0x2210], 0xc
mov eax, dword [rsp + 0x2210]
mov dword [rsp + 0x2194], eax
cmp dword [rsp + 0xfc4], 0
je 0x1400124a5
lea rax, [rsp + 0x20c0]
mov qword [rsp + 0x2218], rax
jmp 0x1400124b5
lea rax, [rsp + 0x2130]
mov qword [rsp + 0x2218], rax
lea r9, [rsp + 0x1e90]
mov r8d, dword [rsp + 0xfc4]
mov edx, dword [rsp + 0x2194]
mov rcx, qword [rsp + 0x2218]
call fcn.140009520
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
mov dword [rsp + 0x21a0], 1
lea rcx, [rsp + 0x38]
call fcn.140014c18
mov eax, dword [rsp + 0x21a0]
mov edi, eax
mov rcx, rsp
lea rdx, [0x140049fe0]
call fcn.140015a64
mov eax, edi
mov rcx, qword [rsp + 0x2220]
xor rcx, rsp
call fcn.140015b70
add rsp, 0x2230
pop rdi
ret