Function at 0x406140
Capabilities:
Hide graphical window
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51b293
mov eax, dword fs:[0]
push eax
sub esp, 0x350
mov eax, dword [0x579630]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x241]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2dc], eax
mov dword [ebp - 0x224], 0
call fcn.00407530
push 0x57fcbc
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
push 0
call fcn.00407540
add esp, 8
mov byte [ebp - 0x2c5], 1
call fcn.00408d90
movzx ecx, byte [ebp - 0x2c5]
xor edx, edx
cmp eax, 1
cmovl ecx, edx
mov dword [ebp - 0x2d4], ecx
call fcn.004091f0
cmp byte [str.type], 0
mov esi, eax
mov dword [ebp - 0x314], esi
mov dword [ebp - 0x318], 0xf
mov dword [ebp - 0x31c], 0
mov byte [ebp - 0x32c], 0
jne 0x406208
xor ecx, ecx
jmp 0x406219
mov ecx, str.type
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406210
sub ecx, edx
push ecx
push str.type
lea ecx, [ebp - 0x32c]
call fcn.00409210
lea eax, [ebp - 0x32c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x23c]
mov ecx, esi
push eax
call fcn.00409310
cmp dword [ebp - 0x318], 0x10
mov byte [ebp - 4], 3
jb 0x40625e
push dword [ebp - 0x32c]
call fcn.004085be
add esp, 4
cmp byte [str.renderer], 0
mov dword [ebp - 0x318], 0xf
mov dword [ebp - 0x31c], 0
mov byte [ebp - 0x32c], 0
jne 0x406286
xor ecx, ecx
jmp 0x406299
mov ecx, str.renderer
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406290
sub ecx, edx
cmp dword [ebp - 0x228], 0x10
lea edx, [ebp - 0x23c]
mov edi, dword [ebp - 0x22c]
mov esi, ecx
cmovae edx, dword [ebp - 0x23c]
cmp edi, ecx
cmovb esi, edi
test esi, esi
je 0x40631e
mov edi, str.renderer
sub esi, 4
jb 0x4062d9
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x4062de
add edx, 4
add edi, 4
sub esi, 4
jae 0x4062c8
cmp esi, 0xfffffffc
je 0x406312
mov al, byte [edx]
cmp al, byte [edi]
jne 0x40630b
cmp esi, 0xfffffffd
je 0x406312
mov al, byte [edx + 1]
cmp al, byte [edi + 1]
jne 0x40630b
cmp esi, 0xfffffffe
je 0x406312
mov al, byte [edx + 2]
cmp al, byte [edi + 2]
jne 0x40630b
cmp esi, 0xffffffff
je 0x406312
mov al, byte [edx + 3]
cmp al, byte [edi + 3]
je 0x406312
sbb eax, eax
or eax, 1
jmp 0x406314
xor eax, eax
mov edi, dword [ebp - 0x22c]
test eax, eax
jne 0x406330
cmp edi, ecx
jae 0x406327
or eax, 0xffffffff
jmp 0x40632e
xor eax, eax
cmp edi, ecx
setne al
test eax, eax
sete byte [ebp - 0x2c5]
cmp byte [str.compute_only_renderer], 0
jne 0x406344
xor ecx, ecx
jmp 0x406359
mov ecx, str.compute_only_renderer
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406350
sub ecx, edx
cmp dword [ebp - 0x228], 0x10
lea esi, [ebp - 0x23c]
mov edx, ecx
cmovae esi, dword [ebp - 0x23c]
cmp edi, ecx
cmovb edx, edi
test edx, edx
je 0x4063d8
mov edi, str.compute_only_renderer
sub edx, 4
jb 0x406393
mov eax, dword [esi]
cmp eax, dword [edi]
jne 0x406398
add esi, 4
add edi, 4
sub edx, 4
jae 0x406382
cmp edx, 0xfffffffc
je 0x4063cc
mov al, byte [esi]
cmp al, byte [edi]
jne 0x4063c5
cmp edx, 0xfffffffd
je 0x4063cc
mov al, byte [esi + 1]
cmp al, byte [edi + 1]
jne 0x4063c5
cmp edx, 0xfffffffe
je 0x4063cc
mov al, byte [esi + 2]
cmp al, byte [edi + 2]
jne 0x4063c5
cmp edx, 0xffffffff
je 0x4063cc
mov al, byte [esi + 3]
cmp al, byte [edi + 3]
je 0x4063cc
sbb eax, eax
or eax, 1
jmp 0x4063ce
xor eax, eax
mov edi, dword [ebp - 0x22c]
test eax, eax
jne 0x4063ea
cmp edi, ecx
jae 0x4063e1
or eax, 0xffffffff
jmp 0x4063e8
xor eax, eax
cmp edi, ecx
setne al
test eax, eax
sete byte [ebp - 0x2ce]
cmp byte [str.compute_only_broker], 0
jne 0x4063fe
xor esi, esi
jmp 0x40640f
mov esi, str.compute_only_broker
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x406406
sub esi, ecx
cmp dword [ebp - 0x228], 0x10
lea ecx, [ebp - 0x23c]
mov edx, esi
cmovae ecx, dword [ebp - 0x23c]
cmp edi, esi
cmovb edx, edi
test edx, edx
je 0x40648e
mov edi, str.compute_only_broker
sub edx, 4
jb 0x406449
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x40644e
add ecx, 4
add edi, 4
sub edx, 4
jae 0x406438
cmp edx, 0xfffffffc
je 0x406482
mov al, byte [ecx]
cmp al, byte [edi]
jne 0x40647b
cmp edx, 0xfffffffd
je 0x406482
mov al, byte [ecx + 1]
cmp al, byte [edi + 1]
jne 0x40647b
cmp edx, 0xfffffffe
je 0x406482
mov al, byte [ecx + 2]
cmp al, byte [edi + 2]
jne 0x40647b
cmp edx, 0xffffffff
je 0x406482
mov al, byte [ecx + 3]
cmp al, byte [edi + 3]
je 0x406482
sbb eax, eax
or eax, 1
jmp 0x406484
xor eax, eax
test eax, eax
jne 0x4064a0
mov edi, dword [ebp - 0x22c]
cmp edi, esi
jae 0x406497
or eax, 0xffffffff
jmp 0x40649e
xor eax, eax
cmp edi, esi
setne al
test eax, eax
sete byte [ebp - 0x219]
call fcn.00409a50
cmp dword [ebp - 0x22c], 0
mov byte [ebp - 0x2cd], al
je 0x4064fc
cmp byte [ebp - 0x2c5], 0
jne 0x4064fc
cmp byte [ebp - 0x2ce], 0
jne 0x4064fc
cmp byte [ebp - 0x219], 0
jne 0x4064fc
cmp dword [ebp - 0x228], 0x10
mov byte [ebp - 4], 0
jb 0x4064f1
push dword [ebp - 0x23c]
call fcn.004085be
add esp, 4
mov edi, dword [ebp - 0x240]
jmp 0x4074d3
call fcn.00409e90
test al, al
je 0x4064d6
mov eax, dword [ebp - 0x2d4]
test al, al
je 0x40666a
mov edi, dword [ebp - 0x22c]
test edi, edi
jne 0x406540
push 0x52f9b4
push str.Acrobat_Reader
call fcn.0040b910
mov edi, dword [ebp - 0x22c]
add esp, 8
test eax, eax
setne al
mov dword [ebp - 0x2d4], eax
test al, al
je 0x40666a
cmp byte [ebp - 0x2cd], 0
je 0x406582
call fcn.00408d90
cmp eax, 3
jl 0x40657c
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40657c
push str.SetProcessDPIAware
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40657c
call eax
mov edi, dword [ebp - 0x22c]
test edi, edi
je 0x40661a
cmp byte [str.compute_only_broker], 0
jne 0x406597
xor esi, esi
jmp 0x4065a9
mov esi, str.compute_only_broker
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x4065a0
sub esi, ecx
cmp dword [ebp - 0x228], 0x10
lea ecx, [ebp - 0x23c]
mov eax, esi
cmovae ecx, dword [ebp - 0x23c]
cmp edi, esi
cmovb eax, edi
push eax
push str.compute_only_broker
push ecx
call fcn.0040d810
add esp, 0xc
test eax, eax
jne 0x4065e9
cmp edi, esi
jae 0x4065e0
or eax, 0xffffffff
jmp 0x4065e7
xor eax, eax
cmp edi, esi
setne al
test eax, eax
sete al
test al, al
jne 0x40661a
cmp dword [0x57f540], 0
jne 0x406610
push 0xc0100010
mov edi, 3
call fcn.0045b3d0
add esp, 4
jmp 0x4074b8
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
jmp 0x406692
call fcn.0040d610
push 0x530934
push 0x8002
mov byte [0x57dba1], al
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
test edi, edi
je 0x406692
push str.AcroExe_load_done
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov esi, eax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [ebp - 0x248]
push dword [ebp - 0x24c]
push esi
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x406692
push dword [ebp - 0x2dc]
call fcn.0040d540
add esp, 4
test al, al
je 0x406685
mov byte [ebp - 0x2d4], 1
jmp 0x406692
cmp byte [ebp - 0x2d4], 0
je 0x40675a
call fcn.0040d660
cmp byte [ebp - 0x219], 0
mov byte [0x57dba0], al
jne 0x4066ae
cmp byte [ebp - 0x2ce], 0
je 0x4066b8
mov dword [str.acrord32_sbx], 0x530958
call fcn.0040e0a0
mov byte [0x57dbc2], al
test al, al
je 0x40675a
cmp byte [str.renderer], 0
jne 0x4066d7
xor esi, esi
jmp 0x4066e9
mov esi, str.renderer
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x4066e0
sub esi, ecx
cmp dword [ebp - 0x228], 0x10
lea ecx, [ebp - 0x23c]
mov edi, dword [ebp - 0x22c]
mov eax, esi
cmovae ecx, dword [ebp - 0x23c]
cmp edi, esi
cmovb eax, edi
push eax
push str.renderer
push ecx
call fcn.0040d810
add esp, 0xc
test eax, eax
jne 0x40672f
cmp edi, esi
jae 0x406726
or eax, 0xffffffff
jmp 0x40672d
xor eax, eax
cmp edi, esi
setne al
test eax, eax
sete al
test al, al
je 0x40675a
mov eax, dword [0x57dbb4]
test eax, eax
je 0x40675a
push eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test eax, eax
je 0x40675a
mov eax, dword [0x57dbb8]
test eax, eax
je 0x40675a
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov edi, dword [ebp - 0x2dc]
xor eax, eax
mov dword [ebp - 0x2e4], 7
mov dword [ebp - 0x2e8], 0
mov word [ebp - 0x2f8], ax
cmp word [edi], ax
jne 0x406786
xor ecx, ecx
jmp 0x40679f
mov ecx, edi
lea edx, [ecx + 2]
jmp 0x406790
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406790
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x2f8]
call fcn.00407750
mov eax, 1
mov byte [ebp - 4], 4
mov dword [ebp - 0x2cc], eax
lea ecx, [ebp - 0x310]
mov dword [ebp - 0x224], eax
xor eax, eax
push 3
push 0x52e22c
mov dword [ebp - 0x2fc], 7
mov dword [ebp - 0x300], 0
mov word [ebp - 0x310], ax
call fcn.00407750
lea eax, [ebp - 0x310]
mov dword [ebp - 4], 5
push eax
lea eax, [ebp - 0x2f8]
push eax
call fcn.0040b010
add esp, 8
mov byte [ebp - 4], 4
cmp dword [ebp - 0x2fc], 8
mov esi, eax
jb 0x40682a
push dword [ebp - 0x310]
call fcn.004085be
add esp, 4
cmp esi, 0xffffffff
jne 0x406993
xor eax, eax
mov dword [ebp - 0x330], 7
mov dword [ebp - 0x334], 0
mov word [ebp - 0x344], ax
cmp word [edi], ax
jne 0x406859
xor ecx, ecx
jmp 0x40686f
mov ecx, edi
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406860
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x344]
call fcn.00407750
mov eax, 3
mov dword [ebp - 4], 6
mov dword [ebp - 0x2cc], eax
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x344]
push eax
call fcn.0040d880
add esp, 4
test al, al
jne 0x406993
xor eax, eax
mov dword [ebp - 0x348], 7
mov dword [ebp - 0x34c], 0
mov word [ebp - 0x35c], ax
cmp word [edi], ax
jne 0x4068d1
xor ecx, ecx
jmp 0x4068e5
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4068d6
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x35c]
call fcn.00407750
mov eax, 7
mov dword [ebp - 4], 7
mov dword [ebp - 0x2cc], eax
lea ecx, [ebp - 0x310]
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x2fc], eax
xor eax, eax
push 3
push 0x52ea90
mov dword [ebp - 0x300], 0
mov word [ebp - 0x310], ax
call fcn.00407750
lea eax, [ebp - 0x310]
mov dword [ebp - 4], 8
push eax
lea eax, [ebp - 0x35c]
push eax
call fcn.0040b010
add esp, 8
mov byte [ebp - 4], 7
cmp eax, 0xffffffff
setne al
cmp dword [ebp - 0x2fc], 8
mov byte [ebp - 0x2c5], al
jb 0x40697f
push dword [ebp - 0x310]
call fcn.004085be
mov al, byte [ebp - 0x2c5]
add esp, 4
test al, al
jne 0x406993
call fcn.0040dae0
mov byte [ebp - 0x219], 1
test al, al
jne 0x40699a
mov byte [ebp - 0x219], 0
mov eax, dword [ebp - 0x2cc]
test al, 4
je 0x4069e7
and eax, 0xfffffffb
cmp dword [ebp - 0x348], 8
mov dword [ebp - 0x2cc], eax
jb 0x4069ca
push dword [ebp - 0x35c]
call fcn.004085be
mov eax, dword [ebp - 0x2cc]
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x348], 7
mov dword [ebp - 0x34c], 0
mov word [ebp - 0x35c], cx
test al, 2
je 0x406a2e
and eax, 0xfffffffd
cmp dword [ebp - 0x330], 8
mov dword [ebp - 0x2cc], eax
jb 0x406a11
push dword [ebp - 0x344]
call fcn.004085be
mov eax, dword [ebp - 0x2cc]
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x330], 7
mov dword [ebp - 0x334], 0
mov word [ebp - 0x344], cx
mov dword [ebp - 4], 3
test al, 1
je 0x406a59
and eax, 0xfffffffe
cmp dword [ebp - 0x2e4], 8
mov dword [ebp - 0x2cc], eax
jb 0x406a59
push dword [ebp - 0x2f8]
call fcn.004085be
add esp, 4
cmp byte [ebp - 0x219], 0
je 0x406a86
cmp dword [ebp - 0x22c], 0
jne 0x406a86
cmp byte [ebp - 0x2d4], 0
jne 0x406a86
push 0x57db9c
push 0x57db98
call fcn.00458fb0
add esp, 8
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x220]
push eax
push 0x20019
push 0
push str.SoftwareAdobeAdobe_AcrobatDCSecurity
push 0x80000002
mov esi, 1
call edi
test eax, eax
jne 0x406b0e
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x224]
mov dword [ebp - 0x240], 4
push eax
lea eax, [ebp - 0x248]
push eax
push 0
push 0x53077c
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406afa
cmp dword [ebp - 0x224], eax
cmove esi, eax
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x406c12
lea eax, [ebp - 0x224]
xor esi, esi
push eax
push 0x20019
push esi
push 0x530780
push 0x80000002
mov dword [ebp - 0x224], esi
call edi
test eax, eax
jne 0x406b97
lea eax, [ebp - 0x248]
mov dword [ebp - 0x220], esi
push eax
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], esi
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x248], 4
push eax
push esi
push str.bEnableATL7Compat
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406b8b
cmp dword [ebp - 0x220], 4
jne 0x406b8b
mov eax, 1
cmp dword [ebp - 0x240], eax
cmove esi, eax
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x52dac0
call edi
test eax, eax
je 0x406bcd
push str.SetProcessDEPPolicy
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406bcd
xor ecx, ecx
test esi, esi
sete cl
lea ecx, [ecx*2 + 1]
push ecx
call eax
test eax, eax
jne 0x406c12
push 0x52f884
call edi
test eax, eax
je 0x406c12
push str.NtSetInformationProcess
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x406c12
xor ecx, ecx
lea eax, [ebp - 0x248]
test esi, esi
push 4
setne cl
push eax
push 0x22
lea ecx, [ecx*4 + 9]
mov dword [ebp - 0x248], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
cmp byte [ebp - 0x2d4], 0
je 0x406c94
mov edi, dword [ebp - 0x22c]
test edi, edi
je 0x406c94
cmp byte [str.compute_only_broker], 0
jne 0x406c32
xor esi, esi
jmp 0x406c49
mov esi, str.compute_only_broker
lea ecx, [esi + 1]
lea ebx, [ebx]
mov al, byte [esi]
inc esi
test al, al
jne 0x406c40
sub esi, ecx
cmp dword [ebp - 0x228], 0x10
lea ecx, [ebp - 0x23c]
mov eax, esi
cmovae ecx, dword [ebp - 0x23c]
cmp edi, esi
cmovb eax, edi
push eax
push str.compute_only_broker
push ecx
call fcn.0040d810
add esp, 0xc
test eax, eax
jne 0x406c89
cmp edi, esi
jae 0x406c80
or eax, 0xffffffff
jmp 0x406c87
xor eax, eax
cmp edi, esi
setne al
test eax, eax
sete al
test al, al
je 0x406d42
push 1
call fcn.0040db90
add esp, 4
test eax, eax
je 0x406cd7
push 0xc0100010
xor edi, edi
call fcn.0045b3d0
add esp, 4
mov byte [ebp - 4], 0
cmp dword [ebp - 0x228], 0x10
jb 0x406ccc
push dword [ebp - 0x23c]
call fcn.004085be
add esp, 4
mov dword [ebp - 0x22c], edi
jmp 0x4074dd
mov eax, dword [str.AdobeAcrobatSpeedLaunchCmdWnd]
xor esi, esi
mov edi, dword [sym.imp.USER32.dll_SendNotifyMessageW]
mov dword [ebp - 0x248], eax
lea ebx, [ebx]
push 0
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x406d12
push 0
push 0
push 0x10
push eax
call edi
mov eax, dword [ebp - 0x248]
inc esi
cmp esi, 0x14
jb 0x406cf0
mov eax, dword [str.AdobeReaderSpeedLaunchCmdWnd]
xor esi, esi
mov dword [ebp - 0x248], eax
nop
push 0
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x406d42
push 0
push 0
push 0x10
push eax
call edi
mov eax, dword [ebp - 0x248]
inc esi
cmp esi, 0x14
jb 0x406d20
xor edi, edi
mov dword [ebp - 0x224], edi
cmp dword [ebp - 0x22c], edi
jne 0x406d9f
push dword [ebp - 0x2dc]
call fcn.0040dd80
add esp, 4
test al, al
je 0x406d9f
push str.Acrobat_Viewer_Safe_DDE
push 3
push 3
push edi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov edi, eax
mov dword [ebp - 0x224], edi
test edi, edi
je 0x406d9f
push 0x927c0
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x406d9f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov dword [ebp - 0x224], edi
call fcn.0040df00
cmp byte [ebp - 0x2d4], 0
je 0x406f34
cmp byte [0x57dbc2], 0
mov byte [ebp - 0x219], 1
mov dword [ebp - 0x220], 0
je 0x406dda
mov edx, dword [ebp - 0x22c]
test edx, edx
jne 0x406de4
call fcn.0040e6e0
mov edx, dword [ebp - 0x22c]
test edx, edx
je 0x406e58
cmp byte [str.compute_only_broker], 0
jne 0x406df1
xor esi, esi
jmp 0x406e09
mov esi, str.compute_only_broker
lea ecx, [esi + 1]
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x406e00
sub esi, ecx
cmp dword [ebp - 0x228], 0x10
lea ecx, [ebp - 0x23c]
mov eax, esi
cmovae ecx, dword [ebp - 0x23c]
cmp edx, esi
cmovb eax, edx
push eax
push str.compute_only_broker
push ecx
call fcn.0040d810
mov ecx, eax
add esp, 0xc
test ecx, ecx
jne 0x406e51
mov eax, dword [ebp - 0x22c]
cmp eax, esi
jae 0x406e48
or ecx, 0xffffffff
jmp 0x406e4f
xor ecx, ecx
cmp eax, esi
setne cl
test ecx, ecx
sete al
test al, al
je 0x406e5f
mov byte [0x57dba3], 1
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x219]
push eax
push dword [ebp - 0x2e0]
call fcn.0040f060
mov esi, eax
add esp, 0xc
cmp esi, 6
je 0x406e87
cmp esi, 7
jne 0x406ea5
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x219]
push eax
push dword [ebp - 0x2e0]
call fcn.0040f060
add esp, 0xc
mov esi, eax
mov eax, dword [0x57dbac]
test eax, eax
je 0x406ec1
push eax
call fcn.0041d0a7
add esp, 4
mov dword [0x57dbac], 0
test esi, esi
je 0x406f09
cmp dword [ebp - 0x22c], 0
jne 0x406f09
mov byte [ebp - 0x2d4], 0
cmp esi, 5
jne 0x406f34
test edi, edi
je 0x406ef1
push 0
push 1
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call eax
mov edi, dword [ebp - 0x220]
push 0xc0100010
call fcn.0045b3d0
add esp, 4
jmp 0x4074b8
cmp byte [ebp - 0x219], 0
jne 0x406f34
test edi, edi
je 0x406f29
push 0
push 1
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call eax
mov edi, dword [ebp - 0x220]
jmp 0x4074b8
mov byte [0x57dba3], 0
call fcn.0040e310
cmp byte [ebp - 0x2d4], 0
mov byte [ebp - 0x2d5], al
je 0x4071df
cmp byte [str.renderer], 0
jne 0x406f60
xor ecx, ecx
jmp 0x406f71
mov ecx, str.renderer
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406f68
sub ecx, edx
cmp dword [ebp - 0x228], 0x10
lea esi, [ebp - 0x23c]
mov eax, dword [ebp - 0x22c]
mov edx, ecx
cmovae esi, dword [ebp - 0x23c]
cmp eax, ecx
cmovb edx, eax
test edx, edx
je 0x407040
mov dword [ebp - 0x220], str.renderer
sub edx, 4
jb 0x406fd1
lea esp, [esp]
mov edi, dword [ebp - 0x220]
mov eax, dword [esi]
cmp eax, dword [edi]
mov edi, dword [ebp - 0x224]
jne 0x406fd6
add dword [ebp - 0x220], 4
add esi, 4
sub edx, 4
jae 0x406fb0
cmp edx, 0xfffffffc
je 0x407034
mov edi, dword [ebp - 0x220]
mov al, byte [esi]
cmp al, byte [edi]
mov edi, dword [ebp - 0x224]
jne 0x40702d
cmp edx, 0xfffffffd
je 0x407034
mov edi, dword [ebp - 0x220]
mov al, byte [esi + 1]
cmp al, byte [edi + 1]
mov edi, dword [ebp - 0x224]
jne 0x40702d
cmp edx, 0xfffffffe
je 0x407034
mov edi, dword [ebp - 0x220]
mov al, byte [esi + 2]
cmp al, byte [edi + 2]
mov edi, dword [ebp - 0x224]
jne 0x40702d
cmp edx, 0xffffffff
je 0x407034
mov edx, dword [ebp - 0x220]
mov al, byte [esi + 3]
cmp al, byte [edx + 3]
je 0x407034
sbb eax, eax
or eax, 1
jmp 0x407036
xor eax, eax
test eax, eax
jne 0x407056
mov eax, dword [ebp - 0x22c]
cmp eax, ecx
jae 0x407049
or eax, 0xffffffff
jmp 0x407054
xor eax, eax
cmp dword [ebp - 0x22c], ecx
setne al
test eax, eax
sete al
test al, al
je 0x4071ec
push 3
xor eax, eax
mov dword [ebp - 0x2e4], 7
push 0x52e22c
lea ecx, [ebp - 0x2f8]
mov dword [ebp - 0x2e8], 0
mov word [ebp - 0x2f8], ax
call fcn.00407750
mov ecx, dword [ebp - 0x314]
lea eax, [ebp - 0x2f8]
push eax
mov byte [ebp - 4], 9
call fcn.0040a5c0
cmp dword [ebp - 0x2e4], 8
mov byte [ebp - 0x219], al
mov byte [ebp - 4], 3
jb 0x4070cd
push dword [ebp - 0x2f8]
call fcn.004085be
mov al, byte [ebp - 0x219]
add esp, 4
test al, al
je 0x407108
lea eax, [ebp - 0x2f8]
push 0x52e22c
push eax
call fcn.00470320
or dword [ebp - 0x2cc], 8
add esp, 8
mov ecx, eax
push 0xd
push 0
push str.pdfshell_prev
call fcn.0040cdd0
mov byte [ebp - 0x2c5], 1
cmp eax, 0xffffffff
jne 0x40710f
mov byte [ebp - 0x2c5], 0
test byte [ebp - 0x2cc], 8
je 0x40712f
cmp dword [ebp - 0x2e4], 8
jb 0x40712f
push dword [ebp - 0x2f8]
call fcn.004085be
add esp, 4
cmp byte [ebp - 0x219], 0
je 0x407141
cmp byte [ebp - 0x2c5], 0
je 0x407192
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0
push 0
push 0
push 0
push 0xffffc000
push 0xffffc000
push 0x10000000
push 0x52d9b8
push str.EDIT
push 0x80
call fcn.00413d60
cmp byte [ebp - 0x2cd], 0
mov dword [0x57dbb0], eax
jne 0x407192
test eax, eax
je 0x407192
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.004187d0
push 0x40100001
call fcn.0040e6c0
add esp, 4
cmp byte [ebp - 0x2cd], 0
je 0x4071c9
call fcn.0048f390
mov eax, dword [0x57dbb0]
test eax, eax
je 0x4071c9
push 0x8000000
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
cmp byte [0x57dba2], 0
je 0x4071ec
push str.UseSandboxModalWndReparenting
call dword [sym.imp.KERNEL32.dll_AddAtomW]
jmp 0x4071ec
push 0x40100001
call fcn.0040e6c0
add esp, 4
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.AcroRd32.dll
call fcn.0040f1e0
add esp, 0xc
test eax, eax
je 0x40747f
lea eax, [ebp - 0x218]
push eax
call fcn.0040f410
mov esi, eax
mov dword [ebp - 0x2cc], esi
test esi, esi
je 0x40747f
push 0x5c
xor edi, edi
lea eax, [ebp - 0x2a8]
push edi
push eax
call fcn.004f9050
add esp, 0xc
lea ecx, [ebp - 0x2a8]
call fcn.00410920
push dword [ebp - 0x2dc]
mov byte [ebp - 4], 0xa
call fcn.00410a18
add esp, 4
mov dword [ebp - 0x240], eax
cmp byte [ebp - 0x2d4], 0
je 0x40740b
cmp byte [str.compute_only_renderer], 0
lea eax, [ebp - 0x2a8]
xorps xmm0, xmm0
mov dword [ebp - 0x2ac], edi
movdqu xmmword [ebp - 0x2c4], xmm0
mov dword [ebp - 0x2c4], 1
movq qword [ebp - 0x2b4], xmm0
mov dword [ebp - 0x2c0], fcn.004187d0
mov dword [ebp - 0x2bc], eax
jne 0x4072b3
xor ecx, ecx
jmp 0x4072c9
mov ecx, str.compute_only_renderer
lea edx, [ecx + 1]
jmp 0x4072c0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4072c0
sub ecx, edx
cmp dword [ebp - 0x228], 0x10
lea edi, [ebp - 0x23c]
mov eax, dword [ebp - 0x22c]
mov edx, ecx
cmovae edi, dword [ebp - 0x23c]
cmp eax, ecx
cmovb edx, eax
test edx, edx
je 0x407391
mov dword [ebp - 0x220], str.compute_only_renderer
sub edx, 4
jb 0x407322
mov esi, dword [ebp - 0x220]
mov eax, dword [edi]
cmp eax, dword [esi]
mov esi, dword [ebp - 0x2cc]
jne 0x407327
add dword [ebp - 0x220], 4
add edi, 4
sub edx, 4
jae 0x407301
cmp edx, 0xfffffffc
je 0x407385
mov esi, dword [ebp - 0x220]
mov al, byte [edi]
cmp al, byte [esi]
mov esi, dword [ebp - 0x2cc]
jne 0x40737e
cmp edx, 0xfffffffd
je 0x407385
mov esi, dword [ebp - 0x220]
mov al, byte [edi + 1]
cmp al, byte [esi + 1]
mov esi, dword [ebp - 0x2cc]
jne 0x40737e
cmp edx, 0xfffffffe
je 0x407385
mov esi, dword [ebp - 0x220]
mov al, byte [edi + 2]
cmp al, byte [esi + 2]
mov esi, dword [ebp - 0x2cc]
jne 0x40737e
cmp edx, 0xffffffff
je 0x407385
mov edx, dword [ebp - 0x220]
mov al, byte [edi + 3]
cmp al, byte [edx + 3]
je 0x407385
sbb eax, eax
or eax, 1
jmp 0x407387
xor eax, eax
test eax, eax
jne 0x4073a7
mov eax, dword [ebp - 0x22c]
cmp eax, ecx
jae 0x40739a
or eax, 0xffffffff
jmp 0x4073a5
xor eax, eax
cmp dword [ebp - 0x22c], ecx
setne al
test eax, eax
sete al
lea edi, [ebp - 0x2c4]
xor ecx, ecx
test al, al
movzx eax, byte [ebp - 0x2d5]
setne cl
mov dword [ebp - 0x2b4], eax
cmp byte [ebp - 0x2ce], 0
mov eax, dword [0x57dbb0]
mov dword [ebp - 0x2b8], ecx
movzx ecx, byte [0x57dbc0]
mov dword [ebp - 0x2b0], ecx
mov dword [ebp - 0x2ac], eax
jne 0x4073f8
lea ecx, [ebp - 0x2a8]
call fcn.0041e080
jmp 0x40740b
xor eax, eax
cmp byte [0x57dbc1], al
sete al
or ecx, eax
mov dword [ebp - 0x2b0], ecx
push str.AcroWinMainSandbox
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x407422
mov edi, 0xff
jmp 0x40743c
push edi
push dword [ebp + 0x14]
push dword [ebp - 0x240]
push dword [ebp - 0x2e0]
push esi
call eax
mov edi, eax
neg edi
sbb edi, edi
inc edi
push dword [ebp - 0x240]
call fcn.004039d2
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp - 0x224]
test esi, esi
je 0x40746e
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 3
call fcn.00410ba0
jmp 0x4074b8
cmp byte [ebp - 0x2d4], 0
jne 0x40749c
push 0
push str.Fatal_Error
push str.Acrobat_failed_to_load_its_Core_DLL
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
test edi, edi
je 0x4074b3
push 0
push 1
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call eax
mov edi, 0xff
cmp dword [ebp - 0x228], 0x10
mov byte [ebp - 4], 0
jb 0x4074d3
push dword [ebp - 0x23c]
call fcn.004085be
add esp, 4
mov dword [ebp - 0x22c], 0
push 0x40100000
mov byte [ebp - 0x23c], 0
mov dword [ebp - 0x228], 0xf
call fcn.0040e6c0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x241]
call fcn.004115b0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401590
mov esp, ebp
pop ebp
ret 0x10