Function at 0x5d0350
Capabilities:
Create process on windows
Create thread
Hide graphical window
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x640548
mov eax, dword fs:[0]
push eax
sub esp, 0x384
mov eax, dword [0x6ccc30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x279]
mov esi, dword [ebp + 0x10]
xor edi, edi
mov dword [ebp - 0x334], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x32c], esi
mov dword [ebp - 0x324], edi
mov dword [ebp - 0x230], edi
call fcn.005d2800
push 7
xor eax, eax
mov dword [ebp - 4], edi
push 0x6551a0
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
call fcn.005d2810
mov ecx, esi
mov byte [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x250], edi
mov dword [ebp - 0x24c], 7
mov word [ebp - 0x260], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5d0401
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x260]
call fcn.005d2810
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.005d2970
mov edx, dword [ebp - 0x24c]
add esp, 8
cmp eax, 0xffffffff
setne byte [0x6cef18]
cmp edx, 8
jb 0x5d0485
mov ecx, dword [ebp - 0x260]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 3
cmp edx, 0x1000
jb 0x5d047b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d2733
push edx
push ecx
call fcn.005d319e
add esp, 8
mov edx, dword [ebp - 0x234]
xor eax, eax
mov word [ebp - 0x260], ax
mov byte [ebp - 4], al
cmp edx, 8
jb 0x5d04d9
mov ecx, dword [ebp - 0x248]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 4
cmp edx, 0x1000
jb 0x5d04cb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d2779
push edx
push ecx
call fcn.005d319e
add esp, 8
mov byte [ebp - 4], 0
xor eax, eax
push 0x6d26b8
mov word [ebp - 0x248], ax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
push 0
call fcn.00404d40
add esp, 8
mov byte [ebp - 0x31d], 1
call fcn.00406c60
mov dword [ebp - 0x330], eax
call fcn.00406c70
cmp eax, 1
jge 0x5d0521
mov byte [ebp - 0x31d], 0
jmp 0x5d05d6
push 8
xor eax, eax
mov dword [ebp - 0x238], 0
push str._dllLoad
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
call fcn.005d2810
mov ecx, esi
mov byte [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x230], 1
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 7
mov word [ebp - 0x260], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5d0580
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x260]
call fcn.005d2810
lea eax, [ebp - 0x248]
mov dword [ebp - 4], 6
push eax
lea eax, [ebp - 0x260]
mov edi, 3
push eax
mov dword [ebp - 0x324], edi
mov dword [ebp - 0x230], edi
call fcn.005d2970
add esp, 8
mov byte [ebp - 0x221], 1
cmp eax, 0xffffffff
jne 0x5d05dd
mov byte [ebp - 0x221], 0
mov eax, dword [ebp - 0x324]
test al, 2
je 0x5d064c
mov edx, dword [ebp - 0x24c]
and eax, 0xfffffffd
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x230], eax
cmp edx, 8
jb 0x5d0643
mov ecx, dword [ebp - 0x260]
lea edx, [edx*2 + 2]
mov eax, ecx
mov dword [ebp - 4], 7
cmp edx, 0x1000
jb 0x5d0633
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d2738
push edx
push ecx
call fcn.005d319e
mov eax, dword [ebp - 0x324]
add esp, 8
xor ecx, ecx
mov word [ebp - 0x260], cx
mov dword [ebp - 4], 0
test al, 1
je 0x5d06b1
mov edx, dword [ebp - 0x234]
and eax, 0xfffffffe
mov dword [ebp - 0x324], eax
cmp edx, 8
jb 0x5d06a8
mov ecx, dword [ebp - 0x248]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 8
cmp edx, 0x1000
jb 0x5d069a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d2779
push edx
push ecx
call fcn.005d319e
add esp, 8
mov byte [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x248], ax
cmp byte [ebp - 0x221], 0
je 0x5d0809
call fcn.005ffa00
push 0x655184
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x330], edi
mov dword [ebp - 0x228], ecx
test esi, esi
je 0x5d0725
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x22c], eax
cmp esi, 0xffffffff
je 0x5d0716
mov edi, esi
mov dword [ebp - 0x330], edi
call fcn.0040e440
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x228], esi
jmp 0x5d071e
xor ecx, ecx
mov dword [ebp - 0x228], ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [ebp - 4], 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.005fae60
add esp, 4
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
xor esi, esi
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x334], esi
test eax, eax
je 0x5d0788
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x22c]
cmp eax, 0xffffffff
je 0x5d077c
mov esi, eax
mov dword [ebp - 0x334], esi
call fcn.0040e440
push dword [ebp - 0x32c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x228]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x5d07c6
cmp eax, 0xffffffff
je 0x5d07c6
test esi, esi
je 0x5d07c6
cmp esi, 0xffffffff
je 0x5d07c6
push 0x1388
push 0
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], edi
push eax
push 2
mov dword [ebp - 0x21c], esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov byte [ebp - 4], 0xb
test esi, esi
je 0x5d07e1
cmp esi, 0xffffffff
je 0x5d07e1
call fcn.0040e440
push esi
call fcn.0040f9e0
add esp, 4
mov eax, dword [ebp - 0x228]
mov byte [ebp - 4], 0xc
test eax, eax
je 0x5d0802
cmp eax, 0xffffffff
je 0x5d0802
call fcn.0040e440
push edi
call fcn.0040f9e0
add esp, 4
xor edi, edi
jmp 0x5d2709
sub esp, 8
mov ecx, 0x65ca6f
mov edx, esp
lea esi, [ecx + 1]
mov dword [edx], 0x65ca6f
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5d0820
sub ecx, esi
lea eax, [ebp - 0x294]
mov dword [edx + 4], ecx
mov ecx, dword [ebp - 0x330]
push eax
call fcn.00408470
push 0x65cafc
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 0xd
call fcn.005d3de0
push 0x65b8f6
lea ecx, [ebp - 0x294]
mov byte [ebp - 0x326], al
call fcn.005d3de0
push 0x65b8e2
lea ecx, [ebp - 0x294]
mov byte [ebp - 0x328], al
call fcn.005d3de0
mov byte [ebp - 0x221], al
call fcn.005d3e70
cmp dword [ebp - 0x284], 0
mov byte [ebp - 0x327], al
je 0x5d08cd
cmp byte [ebp - 0x326], 0
jne 0x5d0904
cmp byte [ebp - 0x328], 0
jne 0x5d0904
cmp byte [ebp - 0x221], 0
jne 0x5d0904
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 0
call fcn.005e8570
mov edi, dword [ebp - 0x330]
jmp 0x5d26fc
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x22c], 4
push eax
push 0x6cef14
push 0
push 0x10
push str.bLTEnableDLLOptimization
push 0x6551f8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x5d09bd
mov dword [0x6cef14], 0
mov edi, dword [ebp - 0x324]
cmp dword [ebp - 0x284], 0
jne 0x5d0b3f
xor eax, eax
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 0x10
push eax
call fcn.00408c60
add esp, 4
test al, al
je 0x5d0aea
cmp dword [ebp - 0x238], 0
je 0x5d0aea
push dword [ebp - 0x32c]
call fcn.005ffd40
add esp, 4
test al, al
je 0x5d0aea
push 0x40100000
call fcn.005d8270
add esp, 4
mov eax, dword [ebp - 0x234]
mov byte [ebp - 4], 0x11
cmp eax, 8
jb 0x5d09ab
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.005d31d0
lea ecx, [ebp - 0x294]
xor edi, edi
call fcn.005e8570
jmp 0x5d2709
cmp dword [0x6cef14], 0
je 0x5d090e
call fcn.00406c60
lea ecx, [ebp - 0x26c]
mov dword [ebp - 0x264], 0
xorps xmm0, xmm0
push ecx
mov ecx, eax
movq qword [ebp - 0x26c], xmm0
call fcn.00429980
mov ecx, dword [ebp - 0x268]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x26c]
sub ecx, esi
imul ecx
mov ecx, 0
sar edx, 2
mov edi, edx
shr edi, 0x1f
add edi, edx
je 0x5d0a36
cmp dword [esi + 0x10], 1
jb 0x5d0a2e
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x5d0a28
mov eax, dword [esi]
cmp word [eax], 0x2f
je 0x5d0a57
inc ecx
add esi, 0x18
cmp ecx, edi
jb 0x5d0a18
lea ecx, [ebp - 0x26c]
call fcn.005d38f0
push 4
call fcn.005d0220
add esp, 4
test eax, eax
je 0x5d0a67
mov dword [eax], 0x5ff690
jmp 0x5d0a69
lea ecx, [ebp - 0x26c]
call fcn.005d38f0
jmp 0x5d090e
xor eax, eax
mov edi, dword [ebp - 0x324]
mov dword [ebp - 0x228], eax
or edi, 0x400
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 0xe
push ecx
push 0
push eax
push 0x5e2160
push 0
push 0
call fcn.005e0413
add esp, 0x18
mov dword [ebp - 0x268], eax
test eax, eax
je 0x5d274a
mov dword [ebp - 0x228], 0
mov ecx, dword [ebp - 0x264]
mov byte [ebp - 4], 0xf
test ecx, ecx
je 0x5d273d
push ecx
push eax
call fcn.005e15ae
add esp, 8
test eax, eax
jne 0x5d2744
xorps xmm0, xmm0
mov byte [ebp - 4], 0xd
movlpd qword [ebp - 0x268], xmm0
jmp 0x5d0914
mov edx, dword [ebp - 0x234]
mov byte [ebp - 4], 0xd
cmp edx, 8
jb 0x5d0b36
mov ecx, dword [ebp - 0x248]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 0x12
cmp edx, 0x1000
jb 0x5d0b28
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d275b
push edx
push ecx
call fcn.005d319e
add esp, 8
mov byte [ebp - 4], 0xd
xor eax, eax
mov word [ebp - 0x248], ax
call fcn.005d3fb0
test al, al
je 0x5d08b3
cmp byte [ebp - 0x31d], 0
je 0x5d0f99
cmp dword [ebp - 0x284], 0
jne 0x5d0b90
push 0x65526c
push 0x655274
call fcn.005d4a80
add esp, 8
test eax, eax
setne al
mov byte [ebp - 0x31d], al
test al, al
je 0x5d0f99
cmp dword [ebp - 0x284], 0
je 0x5d0ba4
push 0x65b8e2
lea ecx, [ebp - 0x294]
call fcn.005d3de0
test al, al
je 0x5d0bae
call fcn.0040c450
mov byte [0x6ceef9], al
cmp byte [ebp - 0x327], 0
je 0x5d0bec
call fcn.00406c70
cmp eax, 3
jl 0x5d0bec
push 0x655064
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x5d0bec
push str.SetProcessDPIAware
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x5d0bec
mov ecx, esi
call dword [0x64689c]
call esi
cmp dword [ebp - 0x284], 0
je 0x5d0f43
push 0x65b8e2
lea ecx, [ebp - 0x294]
call fcn.005d3de0
test al, al
jne 0x5d0f43
cmp dword [0x6d1f8c], 0
jne 0x5d0c31
push 0xc0100010
mov edi, 3
call fcn.005eb520
add esp, 4
jmp 0x5d26ed
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, dword [ebp - 0x32c]
call fcn.005d6d20
cmp byte [ebp - 0x221], 0
mov byte [0x6ceef8], al
jne 0x5d0c5b
cmp byte [ebp - 0x328], 0
je 0x5d0c65
mov dword [str.acrord32_sbx], 0x6552b8
call fcn.005d71d0
mov byte [0x6cef1b], al
test al, al
je 0x5d0cab
push 0x65cafc
lea ecx, [ebp - 0x294]
call fcn.005d3de0
test al, al
je 0x5d0cab
mov eax, dword [0x6cef08]
test eax, eax
je 0x5d0cab
push eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test eax, eax
je 0x5d0cab
mov eax, dword [0x6cef0c]
test eax, eax
je 0x5d0cab
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov ecx, esi
mov dword [ebp - 0x33c], 0
xor eax, eax
mov dword [ebp - 0x338], 7
mov word [ebp - 0x34c], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5d0cd0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x34c]
call fcn.005d2810
push 3
or edi, 4
mov byte [ebp - 4], 0x14
xor eax, eax
mov dword [ebp - 0x324], edi
push 0x654ea4
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 7
mov word [ebp - 0x260], ax
call fcn.005d2810
lea eax, [ebp - 0x260]
mov dword [ebp - 4], 0x15
push eax
lea eax, [ebp - 0x34c]
push eax
call fcn.005d2970
mov edx, dword [ebp - 0x24c]
add esp, 8
mov byte [ebp - 4], 0x14
mov esi, eax
cmp edx, 8
jb 0x5d0d9c
mov ecx, dword [ebp - 0x260]
lea edx, [edx*2 + 2]
mov eax, ecx
mov dword [ebp - 4], 0x16
cmp edx, 0x1000
jb 0x5d0d8e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d2774
push edx
push ecx
call fcn.005d319e
add esp, 8
mov byte [ebp - 4], 0x14
xor eax, eax
mov word [ebp - 0x260], ax
cmp esi, 0xffffffff
jne 0x5d131b
mov esi, dword [ebp - 0x32c]
mov ecx, esi
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], 7
mov word [ebp - 0x278], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5d0dd0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x278]
call fcn.005d2810
mov eax, dword [ebp - 0x324]
lea ecx, [ebp - 0x260]
or eax, 8
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x230], eax
xor eax, eax
push 3
push 0x654f08
mov byte [ebp - 0x221], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 7
mov word [ebp - 0x260], ax
call fcn.005d2810
lea eax, [ebp - 0x260]
mov dword [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.005d2970
mov edx, dword [ebp - 0x24c]
add esp, 8
mov byte [ebp - 4], 0x17
mov ecx, eax
mov dword [ebp - 0x22c], ecx
cmp edx, 8
jb 0x5d0eb8
mov ecx, dword [ebp - 0x260]
lea edx, [edx*2 + 2]
mov eax, ecx
mov dword [ebp - 4], 0x19
cmp edx, 0x1000
jb 0x5d0ea4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d276f
push edx
push ecx
call fcn.005d319e
mov ecx, dword [ebp - 0x22c]
add esp, 8
mov byte [ebp - 4], 0x17
mov edi, dword [ebp - 0x324]
xor eax, eax
mov word [ebp - 0x260], ax
mov eax, edi
cmp ecx, 0xffffffff
je 0x5d1209
mov esi, dword [ebp - 0x268]
lea edi, [ecx + 3]
cmp esi, edi
jbe 0x5d1203
push 2
xor eax, eax
mov dword [ebp - 0x250], 0
push 0x654f10
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x24c], 7
mov word [ebp - 0x260], ax
call fcn.005d2810
xor eax, eax
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
cmp esi, edi
jb 0x5d2760
jmp 0x5d10fb
push str._AcroAppTimer
push 0x8002
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x22c], eax
test eax, eax
je 0x5d0c39
push str.AcroExe_load_done
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov esi, eax
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [ebp - 0x264]
push dword [ebp - 0x268]
push esi
push dword [ebp - 0x22c]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x5d0c39
mov esi, dword [ebp - 0x32c]
xor eax, eax
mov ecx, esi
mov byte [ebp - 0x31e], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5d0fd0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x248]
call fcn.005d2810
push 0
push 0x655040
lea ecx, [ebp - 0x248]
call fcn.005d6c10
movzx ecx, byte [ebp - 0x31e]
cmp eax, 0xffffffff
mov eax, 1
cmovne ecx, eax
push 0
mov dword [ebp - 0x22c], ecx
lea ecx, [ebp - 0x248]
push 0x655048
call fcn.005d6c10
mov ecx, dword [ebp - 0x22c]
cmp eax, 0xffffffff
movzx ecx, cl
mov eax, 1
cmovne ecx, eax
push 0
mov dword [ebp - 0x22c], ecx
lea ecx, [ebp - 0x248]
push 0x655050
call fcn.005d6c10
cmp eax, 0xffffffff
je 0x5d1085
push 0
push str._act
lea ecx, [ebp - 0x248]
call fcn.005d6c10
mov edx, dword [ebp - 0x22c]
cmp eax, 0xffffffff
movzx ecx, dl
mov eax, 1
cmove ecx, eax
mov byte [ebp - 0x22c], cl
mov edx, dword [ebp - 0x234]
cmp edx, 8
jb 0x5d10cd
mov ecx, dword [ebp - 0x248]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 0x13
cmp edx, 0x1000
jb 0x5d10bf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d2765
push edx
push ecx
call fcn.005d319e
add esp, 8
mov byte [ebp - 4], 0xd
xor eax, eax
mov word [ebp - 0x248], ax
cmp byte [ebp - 0x22c], al
je 0x5d10ea
mov byte [ebp - 0x31d], 1
jmp 0x5d0c3f
cmp byte [ebp - 0x31d], al
je 0x5d0cab
jmp 0x5d0c3f
or ecx, 0xffffffff
lea eax, [ebp - 0x278]
sub esi, edi
cmp esi, 0xffffffff
lfence
cmovb ecx, esi
cmp dword [ebp - 0x264], 8
push ecx
cmovae eax, dword [ebp - 0x278]
lea ecx, [ebp - 0x248]
lea eax, [eax + edi*2]
push eax
call fcn.005d2810
mov eax, dword [ebp - 0x324]
lea ecx, [ebp - 0x248]
or eax, 0x800
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x260]
push 0
push eax
call fcn.005d3030
mov esi, eax
cmp esi, 0xffffffff
je 0x5d1180
push 0
push 0x654f18
lea ecx, [ebp - 0x248]
call fcn.005d6c10
cmp eax, esi
sete byte [ebp - 0x221]
mov eax, dword [ebp - 0x234]
mov byte [ebp - 4], 0x1b
cmp eax, 8
jb 0x5d11a2
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.005d31d0
xor eax, eax
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 4], 0x1c
cmp eax, 8
jb 0x5d11e4
inc eax
lea ecx, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
call fcn.005d31d0
xor eax, eax
mov byte [ebp - 4], 0x17
mov word [ebp - 0x260], ax
cmp byte [ebp - 0x221], al
jne 0x5d131b
mov eax, dword [ebp - 0x22c]
mov esi, dword [ebp - 0x32c]
mov ecx, esi
mov dword [ebp - 0x238], 0
mov edi, eax
mov dword [ebp - 0x234], 7
xor eax, eax
mov word [ebp - 0x248], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5d1230
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x248]
call fcn.005d2810
push 3
or edi, 0x10
mov dword [ebp - 4], 0x1d
xor eax, eax
mov dword [ebp - 0x324], edi
push 0x654f34
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 7
mov word [ebp - 0x260], ax
call fcn.005d2810
lea eax, [ebp - 0x260]
mov dword [ebp - 4], 0x1e
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.005d2970
mov edx, dword [ebp - 0x24c]
add esp, 8
cmp eax, 0xffffffff
setne al
mov byte [ebp - 0x31e], al
cmp edx, 8
jb 0x5d1307
mov ecx, dword [ebp - 0x260]
lea edx, [edx*2 + 2]
mov eax, ecx
mov dword [ebp - 4], 0x1f
cmp edx, 0x1000
jb 0x5d12f7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d276a
push edx
push ecx
call fcn.005d319e
mov al, byte [ebp - 0x31e]
add esp, 8
xor ecx, ecx
mov byte [ebp - 0x221], 1
mov word [ebp - 0x260], cx
test al, al
je 0x5d1322
mov byte [ebp - 0x221], 0
mov eax, dword [ebp - 0x324]
test al, 0x10
je 0x5d1391
mov edx, dword [ebp - 0x234]
and eax, 0xffffffef
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x230], eax
cmp edx, 8
jb 0x5d1388
mov ecx, dword [ebp - 0x248]
lea edx, [edx*2 + 2]
mov eax, ecx
mov dword [ebp - 4], 0x20
cmp edx, 0x1000
jb 0x5d1378
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d276f
push edx
push ecx
call fcn.005d319e
mov eax, dword [ebp - 0x324]
add esp, 8
xor ecx, ecx
mov word [ebp - 0x248], cx
test al, 8
je 0x5d13fa
mov edx, dword [ebp - 0x264]
and eax, 0xfffffff7
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x230], eax
cmp edx, 8
jb 0x5d13f1
mov ecx, dword [ebp - 0x278]
lea edx, [edx*2 + 2]
mov eax, ecx
mov dword [ebp - 4], 0x21
cmp edx, 0x1000
jb 0x5d13e1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d2774
push edx
push ecx
call fcn.005d319e
mov eax, dword [ebp - 0x324]
add esp, 8
xor ecx, ecx
mov word [ebp - 0x278], cx
mov dword [ebp - 4], 0xd
test al, 4
je 0x5d145f
mov edx, dword [ebp - 0x338]
and eax, 0xfffffffb
mov dword [ebp - 0x324], eax
cmp edx, 8
jb 0x5d1456
mov ecx, dword [ebp - 0x34c]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 0x22
cmp edx, 0x1000
jb 0x5d1448
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d2779
push edx
push ecx
call fcn.005d319e
add esp, 8
mov byte [ebp - 4], 0xd
xor eax, eax
mov word [ebp - 0x34c], ax
cmp byte [ebp - 0x221], 0
je 0x5d1495
cmp dword [ebp - 0x284], 0
jne 0x5d1495
cmp byte [ebp - 0x31d], 0
jne 0x5d1495
call fcn.005d6e90
test al, al
je 0x5d1495
push 0x6ceeec
push 0x6ceee8
call fcn.005d6f60
add esp, 8
lea eax, [ebp - 0x22c]
push eax
push 0x20019
push 0
push str.SoftwareAdobeAdobe_AcrobatDCSecurity
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5d151e
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x230], 4
push eax
lea eax, [ebp - 0x264]
push eax
push 0
push 0x654e18
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5d1512
cmp dword [ebp - 0x228], eax
jne 0x5d1512
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x5d1632
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x22c]
xor esi, esi
push eax
push 0x20019
push esi
push 0x654e1c
push 0x80000002
mov dword [ebp - 0x22c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5d15ac
lea eax, [ebp - 0x264]
mov dword [ebp - 0x228], esi
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], esi
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x264], 4
push eax
push esi
push str.bEnableATL7Compat
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5d15a0
cmp dword [ebp - 0x228], 4
jne 0x5d15a0
cmp dword [ebp - 0x230], 1
mov eax, 1
cmove esi, eax
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x654eac
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x5d15e8
push 0x654ec8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x5d15e8
mov ecx, esi
xor ecx, 1
lea ecx, [ecx*2 + 1]
push ecx
mov ecx, edi
call dword [0x64689c]
call edi
test eax, eax
jne 0x5d1632
push 0x654edc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x5d1632
push 0x654ef0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x5d1632
push 4
lea eax, [ebp - 0x264]
push eax
lea ecx, [esi*4 + 9]
push 0x22
mov dword [ebp - 0x264], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov ecx, edi
call dword [0x64689c]
call edi
cmp byte [ebp - 0x31d], 0
je 0x5d165d
mov esi, dword [ebp - 0x284]
test esi, esi
je 0x5d165d
push 0x65b8e2
lea ecx, [ebp - 0x294]
call fcn.005d3de0
test al, al
je 0x5d16d6
push 1
call fcn.005d7620
add esp, 4
test eax, eax
je 0x5d167f
push 0xc0100010
xor edi, edi
call fcn.005eb520
add esp, 4
jmp 0x5d26ed
mov edi, dword [str.AdobeAcrobatSpeedLaunchCmdWnd]
xor esi, esi
push 0
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x5d16a7
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendNotifyMessageW]
inc esi
cmp esi, 0x14
jb 0x5d1687
mov edi, dword [str.AdobeReaderSpeedLaunchCmdWnd]
xor esi, esi
nop
push 0
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x5d16d0
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendNotifyMessageW]
inc esi
cmp esi, 0x14
jb 0x5d16b0
mov esi, dword [ebp - 0x284]
xor edi, edi
mov dword [ebp - 0x22c], edi
test esi, esi
jne 0x5d172f
push dword [ebp - 0x32c]
call fcn.005d77a0
add esp, 4
test al, al
je 0x5d172f
push str.Acrobat_Viewer_Safe_DDE
push 3
push 3
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov edi, eax
mov dword [ebp - 0x22c], edi
test edi, edi
je 0x5d172f
push 0x927c0
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x5d172f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov dword [ebp - 0x22c], edi
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
test eax, eax
je 0x5d17b8
push 0
push 1
push 5
call fcn.005d7800
add esp, 0xc
test al, al
je 0x5d17b8
push 0
push 0
push 6
call fcn.005d7800
add esp, 0xc
test al, al
jne 0x5d17b8
mov dword [ebp - 0x228], 2
call fcn.004c19e0
mov dword [ebp - 0x264], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, eax
mov eax, dword [ebp - 0x264]
test eax, eax
je 0x5d17a2
push 4
lea ecx, [ebp - 0x228]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
test esi, esi
je 0x5d17b8
push 4
lea eax, [ebp - 0x228]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
call fcn.00406c60
sub esp, 8
mov ecx, esp
mov dword [ecx], str.channeltype
mov dword [ecx + 4], 0xb
lea ecx, [ebp - 0x248]
push ecx
mov ecx, eax
call fcn.004085c0
cmp dword [ebp - 0x238], 0
mov byte [ebp - 4], 0x23
je 0x5d18e8
call fcn.005d78db
cmp dword [ebp - 0x234], 8
lea esi, [ebp - 0x248]
mov dword [ebp - 0x228], eax
cmovae esi, dword [ebp - 0x248]
mov dword [eax], 0
lea eax, [ebp - 0x264]
push 0xa
push eax
push esi
call fcn.005e0864
add esp, 0xc
mov ecx, eax
cmp esi, dword [ebp - 0x264]
je 0x5d277e
mov eax, dword [ebp - 0x228]
cmp dword [eax], 0x22
je 0x5d27d0
mov edx, dword [ebp - 0x234]
cmp ecx, 2
mov byte [ebp - 4], 0xd
sete al
mov byte [ebp - 0x31e], al
cmp edx, 8
jb 0x5d18a0
mov ecx, dword [ebp - 0x248]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 0x24
cmp edx, 0x1000
jb 0x5d188c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d27da
push edx
push ecx
call fcn.005d319e
mov al, byte [ebp - 0x31e]
add esp, 8
mov byte [ebp - 4], 0xd
xor ecx, ecx
mov word [ebp - 0x248], cx
test al, al
je 0x5d193d
mov eax, dword fs:[0x2c]
mov ecx, dword [0x6d301c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x6cf738]
cmp eax, dword [ecx + 4]
jg 0x5d2788
mov eax, dword [0x6d27f4]
test eax, eax
je 0x5d193d
cmp eax, 0xffffffff
je 0x5d193d
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x5d193d
mov edx, dword [ebp - 0x234]
mov byte [ebp - 4], 0xd
cmp edx, 8
jb 0x5d1934
mov ecx, dword [ebp - 0x248]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 0x25
cmp edx, 0x1000
jb 0x5d1926
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d27da
push edx
push ecx
call fcn.005d319e
add esp, 8
mov byte [ebp - 4], 0xd
xor eax, eax
mov word [ebp - 0x248], ax
cmp byte [ebp - 0x31d], 0
je 0x5d1c83
cmp byte [0x6cef1b], 0
mov byte [ebp - 0x221], 1
mov dword [ebp - 0x228], 0
je 0x5d1a17
cmp dword [ebp - 0x284], 0
jne 0x5d1a20
push 0x10000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov esi, eax
mov dword [ebp - 0x2f4], 0
test esi, esi
je 0x5d1a17
lea eax, [ebp - 0x2f4]
mov dword [ebp - 0x268], 0
push eax
push 0
push 7
push 7
push 7
push 7
push 7
push 7
push 7
push 7
lea eax, [ebp - 0x268]
mov word [ebp - 0x264], 0x400
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x5d19ff
push dword [ebp - 0x2f4]
lea ecx, [ebp - 0x390]
call fcn.0040d3c0
push 0xd0130
push 3
lea eax, [ebp - 0x390]
push eax
push 7
push esi
call fcn.0040d650
add esp, 0x14
mov eax, dword [ebp - 0x2f4]
test eax, eax
je 0x5d1a10
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call dword [sym.imp.USER32.dll_CloseDesktop]
cmp dword [ebp - 0x284], 0
je 0x5d1a34
push 0x65b8e2
lea ecx, [ebp - 0x294]
call fcn.005d3de0
test al, al
je 0x5d1a3b
mov byte [0x6ceefb], 1
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x221]
push eax
push dword [ebp - 0x334]
call fcn.005d78f0
mov esi, eax
add esp, 0xc
cmp esi, 7
je 0x5d1a63
cmp esi, 8
jne 0x5d1a81
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x221]
push eax
push dword [ebp - 0x334]
call fcn.005d78f0
add esp, 0xc
mov esi, eax
mov eax, dword [0x6cef04]
test eax, eax
je 0x5d1a9d
push eax
call fcn.005db8b4
add esp, 4
mov dword [0x6cef04], 0
cmp esi, 1
je 0x5d1c59
cmp dword [ebp - 0x284], 0
jne 0x5d1c59
mov byte [ebp - 0x31d], 0
cmp esi, 6
jne 0x5d1aed
test edi, edi
je 0x5d1ad5
push 0
push 1
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x228]
push 0xc0100010
call fcn.005eb520
add esp, 4
jmp 0x5d26ed
mov byte [0x6ceefb], 0
call fcn.005d8170
mov byte [ebp - 0x31e], al
push 0x40100001
call fcn.005d8270
add esp, 4
push 0x5c
xorps xmm0, xmm0
mov dword [ebp - 0x330], 0
lea eax, [ebp - 0x2f0]
movq qword [ebp - 0x2fc], xmm0
push 0
push eax
movups xmmword [ebp - 0x31c], xmm0
movups xmmword [ebp - 0x30c], xmm0
call fcn.0061e8c0
add esp, 0xc
lea ecx, [ebp - 0x2f0]
call fcn.0040f3c0
cmp byte [ebp - 0x31d], 0
mov byte [ebp - 4], 0x2e
je 0x5d2254
lea eax, [ebp - 0x2f0]
mov dword [ebp - 0x2f8], 0
push 0x65b8f6
lea ecx, [ebp - 0x294]
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x318], fcn.005db780
mov dword [ebp - 0x314], eax
call fcn.005d3de0
cmp byte [0x6cef19], 0
movzx eax, al
mov dword [ebp - 0x310], eax
movzx eax, byte [ebp - 0x31e]
mov dword [ebp - 0x30c], eax
jne 0x5d1bca
cmp byte [0x6cef1a], 0
mov dword [ebp - 0x308], 0
je 0x5d1bd4
mov dword [ebp - 0x308], 1
mov eax, dword [0x6cf720]
mov dword [ebp - 0x304], eax
call fcn.00406c60
sub esp, 8
mov ecx, esp
mov dword [ecx], str.channeltype
mov dword [ecx + 4], 0xb
lea ecx, [ebp - 0x248]
push ecx
mov ecx, eax
call fcn.004085c0
cmp dword [ebp - 0x238], 0
mov byte [ebp - 4], 0x2f
je 0x5d2130
call fcn.005d78db
cmp dword [ebp - 0x234], 8
lea esi, [ebp - 0x248]
mov edi, eax
lea eax, [ebp - 0x264]
cmovae esi, dword [ebp - 0x248]
push 0xa
push eax
push esi
mov dword [edi], 0
call fcn.005e0864
add esp, 0xc
cmp esi, dword [ebp - 0x264]
je 0x5d27df
jmp 0x5d20f1
cmp byte [ebp - 0x221], 0
jne 0x5d1c83
test edi, edi
je 0x5d1c78
push 0
push 1
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x228]
jmp 0x5d26ed
mov byte [0x6ceefb], 0
call fcn.005d8170
cmp byte [ebp - 0x31d], 0
mov byte [ebp - 0x31e], al
je 0x5d1aff
push 0x65cafc
lea ecx, [ebp - 0x294]
call fcn.005d3de0
test al, al
je 0x5d1b0c
push 3
xor eax, eax
mov dword [ebp - 0x33c], 0
push 0x6552e0
lea ecx, [ebp - 0x34c]
mov dword [ebp - 0x338], 7
mov word [ebp - 0x34c], ax
call fcn.005d2810
mov ecx, dword [ebp - 0x330]
lea eax, [ebp - 0x34c]
push eax
mov byte [ebp - 4], 0x27
call fcn.00409a00
mov edx, dword [ebp - 0x338]
mov byte [ebp - 0x221], al
mov byte [ebp - 4], 0xd
cmp edx, 8
jb 0x5d1d57
mov ecx, dword [ebp - 0x34c]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 0x28
cmp edx, 0x1000
jb 0x5d1d43
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d27e9
push edx
push ecx
call fcn.005d319e
mov al, byte [ebp - 0x221]
add esp, 8
mov byte [ebp - 4], 0xd
xor ecx, ecx
mov word [ebp - 0x34c], cx
test al, al
je 0x5d1e08
lea eax, [ebp - 0x34c]
push 0x6552e8
push eax
call fcn.0049eca0
or dword [ebp - 0x324], 0x20
add esp, 8
mov dword [ebp - 0x330], eax
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x5d1d9a
mov eax, dword [eax]
mov dword [ebp - 0x330], eax
cmp ecx, 0xd
jb 0x5d1e08
lfence
lea edi, [eax + ecx*2]
mov esi, eax
nop word [eax + eax]
lea ecx, [edi - 0x18]
mov edx, 0
sub ecx, esi
sar ecx, 1
je 0x5d1dd5
cmp word [esi], 0x70
je 0x5d1dd3
cmp ecx, 1
je 0x5d1dd5
add esi, 2
dec ecx
cmp word [esi], 0x70
jne 0x5d1dc4
mov edx, esi
mov esi, edx
test esi, esi
je 0x5d1e08
push 0xd
push str.pdfshell_prev
push esi
call fcn.005ecb60
add esp, 0xc
test eax, eax
je 0x5d1df4
add esi, 2
jmp 0x5d1db0
sub esi, dword [ebp - 0x330]
sar esi, 1
mov byte [ebp - 0x325], 1
cmp esi, 0xffffffff
jne 0x5d1e0f
mov byte [ebp - 0x325], 0
mov eax, dword [ebp - 0x324]
test al, 0x20
je 0x5d1e48
and eax, 0xffffffdf
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0x338]
mov byte [ebp - 4], 0x29
cmp eax, 8
jb 0x5d1e44
inc eax
lea ecx, [ebp - 0x34c]
push eax
push dword [ebp - 0x34c]
call fcn.005d31d0
mov byte [ebp - 4], 0xd
push 7
xor eax, eax
mov dword [ebp - 0x250], 0
push 0x65530c
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x24c], 7
mov word [ebp - 0x260], ax
call fcn.005d2810
mov eax, dword [ebp - 0x324]
mov esi, dword [ebp - 0x32c]
or eax, 0x40
mov ecx, esi
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x230], eax
xor eax, eax
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0x33c], 0
mov dword [ebp - 0x338], 7
lea edx, [ecx + 2]
mov word [ebp - 0x34c], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5d1ec0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x34c]
call fcn.005d2810
mov eax, dword [ebp - 0x324]
or eax, 0x80
mov dword [ebp - 4], 0x2b
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x34c]
push eax
call fcn.005d2970
add esp, 8
cmp eax, 0xffffffff
jne 0x5d1f30
cmp byte [ebp - 0x221], 0
je 0x5d1f27
cmp byte [ebp - 0x325], 0
je 0x5d1f30
mov byte [ebp - 0x325], 1
jmp 0x5d1f37
mov byte [ebp - 0x325], 0
mov eax, dword [ebp - 0x324]
and eax, 0xffffff7f
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x230], eax
mov ecx, dword [ebp - 0x338]
mov dword [ebp - 4], 0x2c
cmp ecx, 8
jb 0x5d1f7b
lea eax, [ecx + 1]
push eax
push dword [ebp - 0x34c]
lea ecx, [ebp - 0x34c]
call fcn.005d31d0
mov eax, dword [ebp - 0x324]
and eax, 0xffffffbf
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0x24c]
mov byte [ebp - 4], 0x2d
cmp eax, 8
jb 0x5d1fad
inc eax
lea ecx, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
call fcn.005d31d0
cmp byte [ebp - 0x325], 0
mov byte [ebp - 4], 0xd
je 0x5d202a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0
push 0
push 0
push 0
push 0xffffc000
push 0xffffc000
push 0x10000000
push 0x655030
push str.EDIT
push 0x80
call fcn.005db3c0
cmp byte [ebp - 0x327], 0
mov dword [0x6cf720], eax
jne 0x5d202a
test eax, eax
je 0x5d202a
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.005db780
push 0x40100001
call fcn.005d8270
add esp, 4
xor eax, eax
mov dword [ebp - 0x228], eax
jmp 0x5d20d0
call fcn.005db780
push 0x40100001
call fcn.005d8270
add esp, 4
cmp byte [ebp - 0x327], 0
je 0x5d206d
call fcn.004ce870
mov eax, dword [0x6cf720]
test eax, eax
je 0x5d206d
push 0x8000000
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [ebp - 0x228], 0
jmp 0x5d207d
xor eax, eax
mov dword [ebp - 0x228], eax
cmp byte [ebp - 0x327], al
je 0x5d20d0
call fcn.00406c70
mov ecx, dword [ebp - 0x228]
cmp eax, 0xe
mov eax, 1
mov dword [ebp - 0x264], 4
cmovge ecx, eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], ecx
push eax
push 0
push 0x10
push str.bAllowWindowCreationOnBrowser
push str.SoftwareAdobeAcrobat_ReaderDCPrivileged
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov eax, dword [ebp - 0x228]
cmp byte [0x6ceefa], 0
jne 0x5d20e1
test eax, eax
je 0x5d1b0c
push str.UseSandboxModalWndReparenting
call dword [sym.imp.KERNEL32.dll_AddAtomW]
jmp 0x5d1b0c
cmp dword [edi], 0x22
je 0x5d27d0
cmp eax, 1
sete cl
mov byte [ebp - 0x31e], cl
mov eax, dword [ebp - 0x234]
mov byte [ebp - 4], 0x30
cmp eax, 8
jb 0x5d2154
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.005d31d0
mov cl, byte [ebp - 0x31e]
jmp 0x5d2154
mov eax, dword [ebp - 0x234]
mov byte [ebp - 4], 0x31
cmp eax, 8
jb 0x5d2152
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.005d31d0
xor cl, cl
movzx eax, cl
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0x300], eax
call fcn.00406c60
sub esp, 8
mov ecx, esp
mov dword [ecx], str.channeltype
mov dword [ecx + 4], 0xb
lea ecx, [ebp - 0x248]
push ecx
mov ecx, eax
call fcn.004085c0
cmp dword [ebp - 0x238], 0
mov byte [ebp - 4], 0x32
je 0x5d2217
call fcn.005d78db
cmp dword [ebp - 0x234], 8
lea esi, [ebp - 0x248]
mov edi, eax
lea eax, [ebp - 0x264]
cmovae esi, dword [ebp - 0x248]
push 0xa
push eax
push esi
mov dword [edi], 0
call fcn.005e0864
add esp, 0xc
cmp esi, dword [ebp - 0x264]
je 0x5d27ee
cmp dword [edi], 0x22
je 0x5d27d0
cmp eax, 2
sete al
mov byte [ebp - 0x31e], al
mov ecx, dword [ebp - 0x234]
mov byte [ebp - 4], 0x33
cmp ecx, 8
jb 0x5d223b
lea eax, [ecx + 1]
push eax
push dword [ebp - 0x248]
lea ecx, [ebp - 0x248]
call fcn.005d31d0
mov al, byte [ebp - 0x31e]
jmp 0x5d223b
mov eax, dword [ebp - 0x234]
mov byte [ebp - 4], 0x34
cmp eax, 8
jb 0x5d2239
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.005d31d0
xor al, al
movzx eax, al
mov dword [ebp - 0x2fc], eax
lea eax, [ebp - 0x31c]
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0x330], eax
push 7
xor eax, eax
mov dword [ebp - 0x250], 0
push str._slMode
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x24c], 7
mov word [ebp - 0x260], ax
call fcn.005d2810
mov eax, dword [ebp - 0x324]
mov esi, dword [ebp - 0x32c]
or eax, 0x100
mov ecx, esi
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x230], eax
xor eax, eax
mov byte [ebp - 4], 0x35
mov dword [ebp - 0x33c], 0
mov dword [ebp - 0x338], 7
lea edx, [ecx + 2]
mov word [ebp - 0x34c], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5d22c6
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x34c]
call fcn.005d2810
mov eax, dword [ebp - 0x324]
or eax, 0x200
mov dword [ebp - 4], 0x36
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x34c]
push eax
call fcn.005d2970
add esp, 8
cmp eax, 0xffffffff
je 0x5d2336
cmp byte [ebp - 0x31d], 0
je 0x5d232d
cmp byte [ebp - 0x326], 0
je 0x5d2336
mov byte [ebp - 0x326], 1
jmp 0x5d233d
mov byte [ebp - 0x326], 0
mov eax, dword [ebp - 0x324]
and eax, 0xfffffdff
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 4], 0x37
cmp eax, 8
jb 0x5d2373
inc eax
lea ecx, [ebp - 0x34c]
push eax
push dword [ebp - 0x34c]
call fcn.005d31d0
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 4], 0x38
cmp eax, 8
jb 0x5d2398
inc eax
lea ecx, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
call fcn.005d31d0
cmp byte [ebp - 0x326], 0
mov byte [ebp - 4], 0x2e
je 0x5d24a0
cmp byte [ebp - 0x31d], 0
je 0x5d23c6
cmp byte [ebp - 0x328], 0
jne 0x5d23c6
lea ecx, [ebp - 0x2f0]
call fcn.00418970
push dword [ebp + 0x14]
push esi
push dword [ebp - 0x21c]
push dword [ebp - 0x334]
call fcn.005fbbc0
mov edi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x240]
movlpd qword [ebp - 0x268], xmm0
push eax
movups xmmword [ebp - 0x240], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x268]
mov dword [ebp - 0x228], 0
push eax
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x5d2485
lea eax, [ebp - 0x228]
push eax
push 2
push 0
push 0x655408
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5d2485
push 4
lea eax, [ebp - 0x264]
push eax
push 4
push 0
push str.iSLExitTimeHighPart
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp - 0x268]
push eax
push 4
push 0
push str.iSLExitTimeLowPart
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x2f0]
call fcn.004101c0
lea ecx, [ebp - 0x294]
call fcn.005e8570
jmp 0x5d2709
push 1
mov edi, str.AcroRd32.dll
call fcn.005d8480
test al, al
mov ecx, 0x654d98
push 0x104
lea eax, [ebp - 0x218]
cmove ecx, edi
push eax
push ecx
call fcn.005d8570
add esp, 0x10
test eax, eax
je 0x5d24e5
lea eax, [ebp - 0x218]
push eax
call fcn.005d8640
mov dword [ebp - 0x228], eax
test eax, eax
jne 0x5d2553
push 2
call fcn.005d8480
add esp, 4
test al, al
jne 0x5d2505
push 3
call fcn.005d8480
add esp, 4
test al, al
je 0x5d264f
push 0x104
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0061e8c0
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.Acrobat32OL.dll
call fcn.005d8570
add esp, 0x18
test eax, eax
je 0x5d264f
lea eax, [ebp - 0x218]
push eax
call fcn.005d8640
mov dword [ebp - 0x228], eax
test eax, eax
je 0x5d264f
cmp byte [ebp - 0x31d], 0
je 0x5d2570
cmp byte [ebp - 0x328], 0
jne 0x5d2570
lea ecx, [ebp - 0x2f0]
call fcn.00418970
push esi
call fcn.005d8724
add esp, 4
mov dword [ebp - 0x32c], eax
lea ecx, [ebp - 0x228]
call fcn.005d8790
mov esi, dword [ebp - 0x228]
test al, al
jne 0x5d259b
mov edi, 0xff
jmp 0x5d25d9
push str.AcroWinMainSandbox
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x5d25b4
mov edi, 0xff
jmp 0x5d25d9
push dword [ebp - 0x330]
mov ecx, edi
push dword [ebp + 0x14]
push dword [ebp - 0x32c]
push dword [ebp - 0x334]
push esi
call dword [0x64689c]
call edi
neg eax
sbb edi, edi
inc edi
push dword [ebp - 0x32c]
call fcn.005d31b1
add esp, 4
lea ecx, [ebp - 0x2f0]
call fcn.0040ff80
test esi, esi
je 0x5d25fd
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp - 0x22c]
test esi, esi
je 0x5d2619
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2f0]
call fcn.004101c0
mov eax, dword [ebp - 0x280]
mov byte [ebp - 4], 0x39
cmp eax, 0x10
jb 0x5d2646
inc eax
lea ecx, [ebp - 0x294]
push eax
push dword [ebp - 0x294]
call fcn.005f4370
mov byte [ebp - 4], 0
jmp 0x5d26fc
cmp byte [ebp - 0x31d], 0
jne 0x5d26c1
push 0x5e97f0
push 0x14
push 0x6554b0
push str.Acrobat_failed_to_load_its_Core_DLL
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call fcn.005e9780
add esp, 0x14
cmp eax, 6
jne 0x5d26c1
mov ecx, 0x22
lea edi, [ebp - 0x210]
mov esi, str.https:__helpx.adobe.com_acrobat_kb_acrobat_failed_load_core_dll.html
lea eax, [ebp - 0x186]
rep movsd dword es:[edi], dword [esi]
push 0x176
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.0061e8c0
add esp, 0xc
lea eax, [ebp - 0x210]
push 1
push 0
push 0
push eax
push 0x6553fc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, dword [ebp - 0x22c]
test esi, esi
je 0x5d26dd
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2f0]
mov edi, 0xff
call fcn.004101c0
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 0
call fcn.005e8570
push 0x40100000
call fcn.005d8270
add esp, 4
lea ecx, [ebp - 0x279]
call fcn.005d88f0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ce525
mov esp, ebp
pop ebp
ret 0x10
call fcn.006207e0
call fcn.006207e0
push 1
call fcn.00606efa
push eax
call fcn.00606ecd
push 6
mov dword [ebp - 0x264], 0
call fcn.00606efa
call fcn.006207e0
call fcn.005e9a00
call fcn.006207e0
call fcn.006207e0
call fcn.006207e0
call fcn.006207e0
call fcn.006207e0
push 0x64f5b0
call fcn.006068b7
push 0x6cf738
call fcn.005d3d07
add esp, 4
cmp dword [0x6cf738], 0xffffffff
jne 0x5d18d1
mov ecx, 0x6cf730
mov byte [ebp - 4], 0x26
call fcn.005137b0
push 0x6450e0
call fcn.005cf77c
push 0x6cf738
mov byte [ebp - 4], 0xd
call fcn.005d3d59
add esp, 8
jmp 0x5d18d1
push 0x64f5c8
call fcn.006068f7
call fcn.006207e0
push 0x64f5b0
call fcn.006068b7
call fcn.006207e0
push 0x64f5b0
call fcn.006068b7
int3