Function at 0x406b50
Capabilities:
Create process on windows
Create thread
Hide graphical window
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56b5cb
mov eax, dword fs:[0]
push eax
sub esp, 0x3b4
mov eax, dword [0x5edd38]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x24d]
mov esi, dword [ebp + 0x10]
xor edi, edi
mov dword [ebp - 0x348], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x364], eax
mov dword [ebp - 0x310], esi
mov dword [ebp - 0x220], edi
call fcn.00408ba0
push 0x5f409c
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push edi
push edi
call fcn.00408bb0
add esp, 8
mov byte [ebp - 0x33d], 1
call fcn.0040aac0
movzx edx, byte [ebp - 0x33d]
xor ecx, ecx
cmp eax, 1
cmovl edx, ecx
xor eax, eax
mov dword [ebp - 0x344], edx
test dl, dl
je 0x406c9d
push 8
push str._dllLoad
lea ecx, [ebp - 0x280]
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x26c], 7
mov word [ebp - 0x280], ax
call fcn.00408f30
mov ecx, esi
mov byte [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x220], 1
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x238], 7
mov word [ebp - 0x24c], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406c43
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x24c]
call fcn.00408f30
lea eax, [ebp - 0x280]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x24c]
mov edi, 3
push eax
mov dword [ebp - 0x220], edi
call fcn.0040af20
add esp, 8
cmp eax, 0xffffffff
je 0x406c99
mov ecx, edi
mov byte [ebp - 0x33e], 1
mov eax, ecx
jmp 0x406ca4
mov eax, edi
mov ecx, eax
mov byte [ebp - 0x33e], 0
test cl, 2
je 0x406d14
mov edx, dword [ebp - 0x238]
and eax, 0xfffffffd
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x220], eax
cmp edx, 8
jb 0x406d05
mov ecx, dword [ebp - 0x24c]
lea edx, [edx*2 + 2]
mov eax, ecx
mov dword [ebp - 4], 3
cmp edx, 0x1000
jb 0x406cf5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b1b
push edx
push ecx
call fcn.00409f25
mov eax, dword [ebp - 0x33c]
add esp, 8
mov edi, dword [ebp - 0x33c]
xor ecx, ecx
mov word [ebp - 0x24c], cx
mov dword [ebp - 4], 0
test al, 1
je 0x406d7f
mov edx, dword [ebp - 0x26c]
and eax, 0xfffffffe
mov dword [ebp - 0x33c], eax
cmp edx, 8
jb 0x406d70
mov ecx, dword [ebp - 0x280]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 4
cmp edx, 0x1000
jb 0x406d62
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b75
push edx
push ecx
call fcn.00409f25
add esp, 8
mov byte [ebp - 4], 0
mov edi, dword [ebp - 0x33c]
xor eax, eax
mov word [ebp - 0x280], ax
cmp byte [ebp - 0x33e], 0
je 0x406d99
call fcn.0048f7f0
call fcn.0048fd50
xor edi, edi
jmp 0x408af1
call fcn.0040b570
mov ecx, str.type
mov dword [ebp - 0x36c], 0
mov esi, eax
mov dword [ebp - 0x368], 0xf
mov dword [ebp - 0x2ac], esi
mov byte [ebp - 0x37c], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406dd0
sub ecx, edx
push ecx
push str.type
lea ecx, [ebp - 0x37c]
call fcn.0040b580
lea eax, [ebp - 0x37c]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x2a8]
mov ecx, esi
push eax
call fcn.0040b680
lea ecx, [ebp - 0x37c]
mov byte [ebp - 4], 7
call fcn.0040ba20
push str.renderer
lea ecx, [ebp - 0x2a8]
call fcn.0040be60
push str.compute_only_renderer
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 0x33d], al
call fcn.0040be60
push str.compute_only_broker
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 0x33f], al
call fcn.0040be60
mov byte [ebp - 0x335], al
call fcn.0040bef0
cmp dword [ebp - 0x298], 0
mov byte [ebp - 0x33e], al
je 0x406e9d
cmp byte [ebp - 0x33d], 0
jne 0x406ed4
cmp byte [ebp - 0x33f], 0
jne 0x406ed4
cmp byte [ebp - 0x335], 0
jne 0x406ed4
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 0
call fcn.0040ba20
mov edi, dword [ebp - 0x228]
jmp 0x408ae4
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], 4
push eax
push 0x5f2024
push 0
push 0x10
push str.bLTEnableDLLOptimization
push 0x58be00
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x406f87
mov dword [0x5f2024], 0
cmp dword [ebp - 0x298], 0
jne 0x40711c
xor eax, eax
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x254], 7
mov word [ebp - 0x268], ax
lea eax, [ebp - 0x268]
mov byte [ebp - 4], 0xa
push eax
call fcn.0040c320
add esp, 4
test al, al
je 0x4070c7
cmp dword [ebp - 0x258], 0
je 0x4070c7
push dword [ebp - 0x310]
call fcn.0048fb30
add esp, 4
test al, al
je 0x4070c7
push 0x40100000
call fcn.00412780
add esp, 4
mov eax, dword [ebp - 0x254]
mov byte [ebp - 4], 0xb
cmp eax, 8
jb 0x406f75
inc eax
lea ecx, [ebp - 0x268]
push eax
push dword [ebp - 0x268]
call fcn.0040a2e0
lea ecx, [ebp - 0x2a8]
xor edi, edi
call fcn.0040ba20
jmp 0x408af1
cmp dword [0x5f2024], 0
je 0x406ede
call fcn.0040b570
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x22c], 0
xorps xmm0, xmm0
push ecx
mov ecx, eax
movq qword [ebp - 0x234], xmm0
call fcn.0040c060
mov ecx, dword [ebp - 0x230]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x234]
sub ecx, esi
imul ecx
mov ecx, 0
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x284], eax
je 0x40700c
cmp dword [esi + 0x10], 1
jb 0x407004
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x406ff8
mov eax, dword [esi]
cmp word [eax], 0x2f
je 0x407041
mov eax, dword [ebp - 0x284]
inc ecx
add esi, 0x18
cmp ecx, eax
jb 0x406fe8
mov byte [ebp - 0x219], 0
lea ecx, [ebp - 0x234]
call fcn.0042f520
cmp byte [ebp - 0x219], 0
jne 0x406ede
push 4
call fcn.00406a5e
add esp, 4
test eax, eax
je 0x40704a
mov dword [eax], 0x48f4f0
jmp 0x40704c
mov byte [ebp - 0x219], 1
jmp 0x407013
xor eax, eax
mov dword [ebp - 0x284], eax
or edi, 0x400
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 8
push ecx
push 0
push eax
push 0x454a80
push 0
push 0
call fcn.00430ca7
add esp, 0x18
mov dword [ebp - 0x230], eax
test eax, eax
je 0x408b2d
mov dword [ebp - 0x284], 0
mov ecx, dword [ebp - 0x22c]
mov byte [ebp - 4], 9
test ecx, ecx
je 0x408b20
push ecx
push eax
call fcn.0053ba92
add esp, 8
test eax, eax
jne 0x408b27
xorps xmm0, xmm0
mov byte [ebp - 4], 7
movlpd qword [ebp - 0x230], xmm0
jmp 0x406ede
mov edx, dword [ebp - 0x254]
mov byte [ebp - 4], 7
cmp edx, 8
jb 0x407113
mov ecx, dword [ebp - 0x268]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 0xc
cmp edx, 0x1000
jb 0x407105
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b3e
push edx
push ecx
call fcn.00409f25
add esp, 8
mov byte [ebp - 4], 7
xor eax, eax
mov word [ebp - 0x268], ax
call fcn.0040c930
test al, al
je 0x406e83
mov eax, dword [ebp - 0x344]
test al, al
je 0x40755f
cmp dword [ebp - 0x298], 0
jne 0x40715d
push 0x58be74
push 0x58be7c
call fcn.0040e660
add esp, 8
test eax, eax
setne al
mov dword [ebp - 0x344], eax
test al, al
je 0x40755f
cmp dword [ebp - 0x298], 0
je 0x407182
push str.compute_only_broker
lea ecx, [ebp - 0x2a8]
call fcn.0040be60
test al, al
je 0x40718c
call fcn.0040fe50
mov byte [0x5f2014], al
cmp byte [ebp - 0x33e], 0
je 0x4071ca
call fcn.0040aac0
cmp eax, 3
jl 0x4071ca
push 0x58bc7c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4071ca
push str.SetProcessDPIAware
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4071ca
mov ecx, esi
call dword [0x5817c0]
call esi
cmp dword [ebp - 0x298], 0
je 0x407509
push str.compute_only_broker
lea ecx, [ebp - 0x2a8]
call fcn.0040be60
test al, al
jne 0x407509
cmp dword [0x5f39b8], 0
jne 0x40720f
push 0xc0100010
mov edi, 3
call fcn.0047a5c0
add esp, 4
jmp 0x408ad5
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, dword [ebp - 0x310]
call fcn.0040ff30
cmp byte [ebp - 0x335], 0
mov byte [0x5f17f3], al
jne 0x407239
cmp byte [ebp - 0x33f], 0
je 0x407243
mov dword [str.acrord32_sbx], 0x58bec0
call fcn.00410770
mov byte [0x5f17f2], al
test al, al
je 0x407289
push str.renderer
lea ecx, [ebp - 0x2a8]
call fcn.0040be60
test al, al
je 0x407289
mov eax, dword [0x5f2018]
test eax, eax
je 0x407289
push eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
test eax, eax
je 0x407289
mov eax, dword [0x5f201c]
test eax, eax
je 0x407289
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov ecx, esi
mov dword [ebp - 0x350], 0
xor eax, eax
mov dword [ebp - 0x34c], 7
mov word [ebp - 0x360], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4072b0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x360]
call fcn.00408f30
push 3
or edi, 4
mov byte [ebp - 4], 0xe
xor eax, eax
mov dword [ebp - 0x33c], edi
push 0x58bb18
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 7
mov word [ebp - 0x24c], ax
call fcn.00408f30
lea eax, [ebp - 0x24c]
mov dword [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x360]
push eax
call fcn.0040af20
mov edx, dword [ebp - 0x238]
add esp, 8
mov byte [ebp - 4], 0xe
mov esi, eax
cmp edx, 8
jb 0x40737c
mov ecx, dword [ebp - 0x24c]
lea edx, [edx*2 + 2]
mov eax, ecx
mov dword [ebp - 4], 0x10
cmp edx, 0x1000
jb 0x40736e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b61
push edx
push ecx
call fcn.00409f25
add esp, 8
mov byte [ebp - 4], 0xe
xor eax, eax
mov word [ebp - 0x24c], ax
cmp esi, 0xffffffff
jne 0x407a1b
mov esi, dword [ebp - 0x310]
mov ecx, esi
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], 7
mov word [ebp - 0x24c], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4073b0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x24c]
call fcn.00408f30
mov eax, dword [ebp - 0x33c]
lea ecx, [ebp - 0x280]
or eax, 8
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x220], eax
xor eax, eax
push 3
push 0x58bb20
mov byte [ebp - 0x335], 0
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x26c], 7
mov word [ebp - 0x280], ax
call fcn.00408f30
lea eax, [ebp - 0x280]
mov dword [ebp - 4], 0x12
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.0040af20
mov edx, dword [ebp - 0x26c]
add esp, 8
mov byte [ebp - 4], 0x11
mov edi, eax
cmp edx, 8
jb 0x40748c
mov ecx, dword [ebp - 0x280]
lea edx, [edx*2 + 2]
mov eax, ecx
mov dword [ebp - 4], 0x13
cmp edx, 0x1000
jb 0x40747e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b5c
push edx
push ecx
call fcn.00409f25
add esp, 8
mov byte [ebp - 4], 0x11
xor eax, eax
mov word [ebp - 0x280], ax
cmp edi, 0xffffffff
je 0x4079f5
mov esi, dword [ebp - 0x23c]
add edi, 3
cmp esi, edi
jbe 0x4079ea
push 2
push 0x58bb28
lea ecx, [ebp - 0x280]
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x26c], 7
mov word [ebp - 0x280], ax
call fcn.00408f30
xor eax, eax
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x254], 7
mov word [ebp - 0x268], ax
cmp esi, edi
jb 0x408b43
jmp 0x4076a2
push 0x58be9c
push 0x8002
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x228], eax
test eax, eax
je 0x407217
push str.AcroExe_load_done
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov esi, eax
lea eax, [ebp - 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [ebp - 0x284]
push dword [ebp - 0x288]
push esi
push dword [ebp - 0x228]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x407217
mov esi, dword [ebp - 0x310]
xor eax, eax
mov ecx, esi
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x254], 7
mov word [ebp - 0x268], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407587
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x268]
call fcn.00408f30
push 0
push 0x58bc58
lea ecx, [ebp - 0x268]
call fcn.0040fe00
cmp eax, 0xffffffff
lea ecx, [ebp - 0x268]
push 0
push 0x58bc60
setne byte [ebp - 0x219]
call fcn.0040fe00
movzx ecx, byte [ebp - 0x219]
cmp eax, 0xffffffff
mov eax, 1
cmovne ecx, eax
push 0
mov dword [ebp - 0x22c], ecx
lea ecx, [ebp - 0x268]
push 0x58bc68
call fcn.0040fe00
cmp eax, 0xffffffff
je 0x40762c
push 0
push str._act
lea ecx, [ebp - 0x268]
call fcn.0040fe00
mov edx, dword [ebp - 0x22c]
cmp eax, 0xffffffff
movzx ecx, dl
mov eax, 1
cmove ecx, eax
mov byte [ebp - 0x22c], cl
mov edx, dword [ebp - 0x254]
cmp edx, 8
jb 0x407674
mov ecx, dword [ebp - 0x268]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 0xd
cmp edx, 0x1000
jb 0x407666
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b48
push edx
push ecx
call fcn.00409f25
add esp, 8
mov byte [ebp - 4], 7
xor eax, eax
mov word [ebp - 0x268], ax
cmp byte [ebp - 0x22c], al
je 0x407691
mov byte [ebp - 0x344], 1
jmp 0x40721d
cmp byte [ebp - 0x344], al
je 0x407289
jmp 0x40721d
or ecx, 0xffffffff
lea eax, [ebp - 0x24c]
sub esi, edi
cmp esi, 0xffffffff
lfence
cmovb ecx, esi
cmp dword [ebp - 0x238], 8
push ecx
cmovae eax, dword [ebp - 0x24c]
lea ecx, [ebp - 0x268]
lea eax, [eax + edi*2]
push eax
call fcn.00408f30
mov edi, dword [ebp - 0x33c]
lea eax, [ebp - 0x280]
mov edx, dword [ebp - 0x268]
or edi, 0x800
cmp dword [ebp - 0x26c], 8
mov esi, dword [ebp - 0x258]
cmovae eax, dword [ebp - 0x280]
cmp dword [ebp - 0x254], 8
mov dword [ebp - 0x284], eax
lea eax, [ebp - 0x268]
cmovae eax, edx
mov dword [ebp - 0x33c], edi
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x22c], eax
test esi, esi
je 0x407842
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.0053f340
mov eax, dword [ebp - 0x284]
add esp, 0xc
mov edx, dword [ebp - 0x270]
mov ecx, eax
mov dword [ebp - 0x228], 0x100
lea edx, [eax + edx*2]
cmp eax, edx
je 0x40778e
nop word [eax + eax]
movzx eax, word [ecx]
cmp ax, word [ebp - 0x228]
jae 0x4077c0
movzx eax, al
add ecx, 2
mov byte [ebp + eax - 0x110], 1
cmp ecx, edx
jne 0x407770
mov edx, dword [ebp - 0x22c]
lea ecx, [edx + esi*2]
mov esi, edx
cmp edx, ecx
jae 0x40783c
movzx eax, word [esi]
cmp ax, word [ebp - 0x228]
jae 0x407818
cmp byte [ebp + eax - 0x110], 0
je 0x407818
add esi, 2
cmp esi, ecx
jb 0x4077a1
jmp 0x40783c
mov ecx, dword [ebp - 0x22c]
lea eax, [ecx + esi*2]
mov esi, ecx
mov dword [ebp - 0x228], eax
cmp ecx, eax
jae 0x407813
nop word [eax + eax]
mov ecx, dword [ebp - 0x270]
mov eax, dword [ebp - 0x284]
test ecx, ecx
je 0x407800
movzx edx, word [esi]
cmp word [eax], dx
je 0x407808
add eax, 2
sub ecx, 1
jne 0x4077f3
sub esi, dword [ebp - 0x22c]
jmp 0x40781a
add esi, 2
cmp esi, dword [ebp - 0x228]
jb 0x4077e0
or esi, 0xffffffff
jmp 0x40781c
sub esi, edx
sar esi, 1
cmp esi, 0xffffffff
je 0x40783c
push 0
push 0x58bb30
lea ecx, [ebp - 0x268]
call fcn.0040fe00
cmp eax, esi
sete byte [ebp - 0x335]
mov edx, dword [ebp - 0x268]
mov eax, dword [ebp - 0x254]
cmp eax, 8
jb 0x407880
lea ecx, [eax*2 + 2]
mov eax, edx
mov byte [ebp - 4], 0x15
cmp ecx, 0x1000
jb 0x407876
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b4d
push ecx
push edx
call fcn.00409f25
add esp, 8
xor eax, eax
mov dword [ebp - 0x258], 0
mov word [ebp - 0x268], ax
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x254], 7
mov byte [ebp - 4], 0x11
cmp eax, 8
jb 0x4078ec
mov edx, dword [ebp - 0x280]
lea ecx, [eax*2 + 2]
mov eax, edx
mov dword [ebp - 4], 0x16
cmp ecx, 0x1000
jb 0x4078de
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b52
push ecx
push edx
call fcn.00409f25
add esp, 8
mov byte [ebp - 4], 0x11
cmp byte [ebp - 0x335], 0
jne 0x407a1b
mov esi, dword [ebp - 0x310]
mov ecx, esi
mov dword [ebp - 0x258], 0
xor eax, eax
mov dword [ebp - 0x254], 7
mov word [ebp - 0x268], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407921
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x268]
call fcn.00408f30
push 3
or edi, 0x10
mov dword [ebp - 4], 0x17
xor eax, eax
mov dword [ebp - 0x33c], edi
push 0x58bb4c
lea ecx, [ebp - 0x280]
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x26c], 7
mov word [ebp - 0x280], ax
call fcn.00408f30
lea eax, [ebp - 0x280]
mov dword [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.0040af20
mov edx, dword [ebp - 0x26c]
add esp, 8
cmp eax, 0xffffffff
setne al
mov byte [ebp - 0x335], al
cmp edx, 8
jb 0x407a10
mov ecx, dword [ebp - 0x280]
lea edx, [edx*2 + 2]
mov eax, ecx
mov dword [ebp - 4], 0x19
cmp edx, 0x1000
jb 0x407a00
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b57
jmp 0x407a00
mov edi, dword [ebp - 0x33c]
jmp 0x4078f9
mov edi, dword [ebp - 0x33c]
jmp 0x4078ff
push edx
push ecx
call fcn.00409f25
mov al, byte [ebp - 0x335]
add esp, 8
mov byte [ebp - 0x335], 1
test al, al
je 0x407a22
mov byte [ebp - 0x335], 0
mov eax, dword [ebp - 0x33c]
test al, 0x10
je 0x407a88
mov edx, dword [ebp - 0x254]
and eax, 0xffffffef
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x220], eax
cmp edx, 8
jb 0x407a88
mov ecx, dword [ebp - 0x268]
lea edx, [edx*2 + 2]
mov eax, ecx
mov dword [ebp - 4], 0x1a
cmp edx, 0x1000
jb 0x407a78
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b5c
push edx
push ecx
call fcn.00409f25
mov eax, dword [ebp - 0x33c]
add esp, 8
test al, 8
je 0x407ae8
mov edx, dword [ebp - 0x238]
and eax, 0xfffffff7
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x220], eax
cmp edx, 8
jb 0x407ae8
mov ecx, dword [ebp - 0x24c]
lea edx, [edx*2 + 2]
mov eax, ecx
mov dword [ebp - 4], 0x1b
cmp edx, 0x1000
jb 0x407ad8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b61
push edx
push ecx
call fcn.00409f25
mov eax, dword [ebp - 0x33c]
add esp, 8
mov dword [ebp - 4], 7
test al, 4
je 0x407b44
mov edx, dword [ebp - 0x34c]
and eax, 0xfffffffb
mov dword [ebp - 0x33c], eax
cmp edx, 8
jb 0x407b44
mov ecx, dword [ebp - 0x360]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 0x1c
cmp edx, 0x1000
jb 0x407b36
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b75
push edx
push ecx
call fcn.00409f25
add esp, 8
mov byte [ebp - 4], 7
cmp byte [ebp - 0x335], 0
je 0x407b7a
cmp dword [ebp - 0x298], 0
jne 0x407b7a
cmp byte [ebp - 0x344], 0
jne 0x407b7a
call fcn.004100b0
test al, al
je 0x407b7a
push 0x5f1ffc
push 0x5f1ff8
call fcn.004108a0
add esp, 8
lea eax, [ebp - 0x284]
mov esi, 1
push eax
push 0x20019
push 0
push str.SoftwareAdobeAdobe_AcrobatDCSecurity
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407c00
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x22c], 4
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push 0x58c170
push dword [ebp - 0x284]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407bec
cmp dword [ebp - 0x228], eax
cmove esi, eax
push dword [ebp - 0x284]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x407d14
lea eax, [ebp - 0x22c]
xor esi, esi
push eax
push 0x20019
push esi
push 0x58c174
push 0x80000002
mov dword [ebp - 0x22c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407c8e
lea eax, [ebp - 0x220]
mov dword [ebp - 0x228], esi
push eax
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], esi
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x220], 4
push eax
push esi
push str.bEnableATL7Compat
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407c82
cmp dword [ebp - 0x228], 4
jne 0x407c82
cmp dword [ebp - 0x284], 1
mov eax, 1
cmove esi, eax
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x58ba3c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x407cca
push 0x58ba58
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x407cca
mov eax, esi
mov ecx, edi
xor eax, 1
lea eax, [eax*2 + 1]
push eax
call dword [0x5817c0]
call edi
test eax, eax
jne 0x407d14
push 0x58ba6c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x407d14
push 0x58ba80
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x407d14
lea eax, [esi*4 + 9]
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x228]
push 4
push eax
push 0x22
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov ecx, edi
call dword [0x5817c0]
call edi
cmp byte [ebp - 0x344], 0
je 0x407d3f
mov esi, dword [ebp - 0x298]
test esi, esi
je 0x407d3f
push str.compute_only_broker
lea ecx, [ebp - 0x2a8]
call fcn.0040be60
test al, al
je 0x407dc6
push 1
call fcn.00410940
add esp, 4
test eax, eax
je 0x407d61
push 0xc0100010
xor edi, edi
call fcn.0047a5c0
add esp, 4
jmp 0x408ad5
mov edi, dword [str.AdobeAcrobatSpeedLaunchCmdWnd]
xor esi, esi
nop dword [eax]
push 0
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x407d90
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendNotifyMessageW]
inc esi
cmp esi, 0x14
jb 0x407d70
mov edi, dword [str.AdobeReaderSpeedLaunchCmdWnd]
xor esi, esi
nop dword [eax + eax]
push 0
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x407dc0
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendNotifyMessageW]
inc esi
cmp esi, 0x14
jb 0x407da0
mov esi, dword [ebp - 0x298]
xor edi, edi
mov dword [ebp - 0x22c], edi
test esi, esi
jne 0x407e1f
push dword [ebp - 0x310]
call fcn.00410b10
add esp, 4
test al, al
je 0x407e1f
push str.Acrobat_Viewer_Safe_DDE
push 3
push 3
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov edi, eax
mov dword [ebp - 0x22c], edi
test edi, edi
je 0x407e1f
push 0x927c0
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x407e1f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov dword [ebp - 0x22c], edi
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
test eax, eax
je 0x407ea4
push 0
push 1
push 5
call fcn.00410b70
add esp, 0xc
test al, al
je 0x407ea4
push 0
push 0
push 6
call fcn.00410b70
add esp, 0xc
test al, al
jne 0x407ea4
mov dword [ebp - 0x228], 2
call fcn.004a5620
mov dword [ebp - 0x284], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, eax
mov eax, dword [ebp - 0x284]
test eax, eax
je 0x407e8e
push 4
lea ecx, [ebp - 0x228]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
test esi, esi
je 0x407ea4
push 4
lea eax, [ebp - 0x228]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
cmp byte [ebp - 0x344], 0
je 0x408071
cmp byte [0x5f17f2], 0
mov byte [ebp - 0x219], 1
mov dword [ebp - 0x220], 0
je 0x407f7a
cmp dword [ebp - 0x298], 0
jne 0x407f83
push 0x10000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov esi, eax
mov dword [ebp - 0x314], 0
test esi, esi
je 0x407f7a
lea eax, [ebp - 0x314]
mov dword [ebp - 0x228], 0
push eax
push 0
push 7
push 7
push 7
push 7
push 7
push 7
push 7
push 7
lea eax, [ebp - 0x228]
mov word [ebp - 0x224], 0x400
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x407f62
push dword [ebp - 0x314]
lea ecx, [ebp - 0x3c0]
call fcn.004110b0
push 0xd0130
push 3
lea eax, [ebp - 0x3c0]
push eax
push 7
push esi
call fcn.004110d0
add esp, 0x14
mov eax, dword [ebp - 0x314]
test eax, eax
je 0x407f73
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push esi
call dword [sym.imp.USER32.dll_CloseDesktop]
cmp dword [ebp - 0x298], 0
je 0x407f97
push str.compute_only_broker
lea ecx, [ebp - 0x2a8]
call fcn.0040be60
test al, al
je 0x407f9e
mov byte [0x5f2016], 1
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x219]
push eax
push dword [ebp - 0x348]
call fcn.00411200
mov esi, eax
add esp, 0xc
cmp esi, 6
je 0x407fc6
cmp esi, 7
jne 0x407fe4
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x219]
push eax
push dword [ebp - 0x348]
call fcn.00411200
add esp, 0xc
mov esi, eax
mov eax, dword [0x5f2010]
test eax, eax
je 0x408000
push eax
call fcn.0041c2b1
add esp, 4
mov dword [0x5f2010], 0
test esi, esi
je 0x408047
cmp dword [ebp - 0x298], 0
jne 0x408047
mov byte [ebp - 0x344], 0
cmp esi, 5
jne 0x408071
test edi, edi
je 0x40802f
push 0
push 1
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x220]
push 0xc0100010
call fcn.0047a5c0
add esp, 4
jmp 0x408ad5
cmp byte [ebp - 0x219], 0
jne 0x408071
test edi, edi
je 0x408066
push 0
push 1
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x220]
jmp 0x408ad5
mov byte [0x5f2016], 0
call fcn.00412400
cmp byte [ebp - 0x344], 0
mov byte [ebp - 0x340], al
je 0x40849a
push str.renderer
lea ecx, [ebp - 0x2a8]
call fcn.0040be60
test al, al
je 0x4084a7
push 3
xor eax, eax
mov dword [ebp - 0x350], 0
push 0x58bee8
lea ecx, [ebp - 0x360]
mov dword [ebp - 0x34c], 7
mov word [ebp - 0x360], ax
call fcn.00408f30
mov ecx, dword [ebp - 0x2ac]
lea eax, [ebp - 0x360]
push eax
mov byte [ebp - 4], 0x1d
call fcn.0040d150
mov edx, dword [ebp - 0x34c]
mov byte [ebp - 0x335], al
mov byte [ebp - 4], 7
cmp edx, 8
jb 0x408145
mov ecx, dword [ebp - 0x360]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 0x1e
cmp edx, 0x1000
jb 0x408131
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b66
push edx
push ecx
call fcn.00409f25
mov al, byte [ebp - 0x335]
add esp, 8
mov byte [ebp - 4], 7
test al, al
je 0x4081db
lea eax, [ebp - 0x360]
push 0x58bef0
push eax
call fcn.00497e20
or dword [ebp - 0x33c], 0x20
add esp, 8
mov ecx, eax
mov dword [ebp - 0x228], eax
cmp dword [eax + 0x14], 8
jb 0x40817e
mov ecx, dword [eax]
mov dword [ebp - 0x228], ecx
mov eax, dword [eax + 0x10]
cmp eax, 0xd
jb 0x4081db
add eax, 0xfffffff4
lea eax, [ecx + eax*2]
mov dword [ebp - 0x2ac], eax
sub eax, ecx
sar eax, 1
je 0x4081db
cmp word [ecx], 0x70
je 0x4081a8
add ecx, 2
sub eax, 1
jne 0x408198
jmp 0x4081db
mov edx, str.pdfshell_prev
mov edi, ecx
mov esi, 0xd
sub edi, edx
mov ax, word [edx + edi]
cmp ax, word [edx]
jne 0x408231
add edx, 2
sub esi, 1
jne 0x4081b6
sub ecx, dword [ebp - 0x228]
sar ecx, 1
mov byte [ebp - 0x219], 1
cmp ecx, 0xffffffff
jne 0x4081e2
mov byte [ebp - 0x219], 0
mov eax, dword [ebp - 0x33c]
test al, 0x20
je 0x40824d
mov edx, dword [ebp - 0x34c]
and eax, 0xffffffdf
mov dword [ebp - 0x33c], eax
cmp edx, 8
jb 0x40824d
mov ecx, dword [ebp - 0x360]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 0x1f
cmp edx, 0x1000
jb 0x40823f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b6b
jmp 0x40823f
mov eax, dword [ebp - 0x2ac]
add ecx, 2
jmp 0x408192
push edx
push ecx
call fcn.00409f25
add esp, 8
mov byte [ebp - 4], 7
push 7
xor eax, eax
mov dword [ebp - 0x23c], 0
push 0x58bf14
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x238], 7
mov word [ebp - 0x24c], ax
call fcn.00408f30
mov eax, dword [ebp - 0x33c]
mov esi, dword [ebp - 0x310]
or eax, 0x40
mov ecx, esi
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x220], eax
xor eax, eax
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x350], 0
mov dword [ebp - 0x34c], 7
lea edx, [ecx + 2]
mov word [ebp - 0x360], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4082c0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x360]
call fcn.00408f30
mov eax, dword [ebp - 0x33c]
or eax, 0x80
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x360]
push eax
call fcn.0040af20
add esp, 8
cmp eax, 0xffffffff
jne 0x408330
cmp byte [ebp - 0x335], 0
je 0x408327
cmp byte [ebp - 0x219], 0
je 0x408330
mov byte [ebp - 0x335], 1
jmp 0x408337
mov byte [ebp - 0x335], 0
mov eax, dword [ebp - 0x33c]
mov edx, dword [ebp - 0x34c]
and eax, 0xffffff7f
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x220], eax
cmp edx, 8
jb 0x40839b
mov ecx, dword [ebp - 0x360]
lea edx, [edx*2 + 2]
mov eax, ecx
mov dword [ebp - 4], 0x22
cmp edx, 0x1000
jb 0x40838b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b70
push edx
push ecx
call fcn.00409f25
mov eax, dword [ebp - 0x33c]
add esp, 8
mov edx, dword [ebp - 0x238]
and eax, 0xffffffbf
mov dword [ebp - 4], 7
mov dword [ebp - 0x33c], eax
cmp edx, 8
jb 0x4083f3
mov ecx, dword [ebp - 0x24c]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 0x23
cmp edx, 0x1000
jb 0x4083e5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b75
push edx
push ecx
call fcn.00409f25
add esp, 8
mov byte [ebp - 4], 7
cmp byte [ebp - 0x335], 0
je 0x40844d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0
push 0
push 0
push 0
push 0xffffc000
push 0xffffc000
push 0x10000000
push 0x58bc48
push str.EDIT
push 0x80
call fcn.004171a0
cmp byte [ebp - 0x33e], 0
mov dword [0x5f2028], eax
jne 0x40844d
test eax, eax
je 0x40844d
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0041b270
push 0x40100001
call fcn.00412780
add esp, 4
cmp byte [ebp - 0x33e], 0
je 0x408484
call fcn.004b2720
mov eax, dword [0x5f2028]
test eax, eax
je 0x408484
push 0x8000000
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
cmp byte [0x5f2015], 0
je 0x4084a7
push str.UseSandboxModalWndReparenting
call dword [sym.imp.KERNEL32.dll_AddAtomW]
jmp 0x4084a7
push 0x40100001
call fcn.00412780
add esp, 4
push 0x5c
lea eax, [ebp - 0x30c]
mov dword [ebp - 0x284], 0
push 0
push eax
call fcn.0053f340
add esp, 0xc
lea ecx, [ebp - 0x30c]
call fcn.00413b40
cmp byte [ebp - 0x344], 0
mov byte [ebp - 4], 0x24
je 0x4086cf
lea eax, [ebp - 0x30c]
mov dword [ebp - 0x334], 1
push str.compute_only_renderer
lea ecx, [ebp - 0x2a8]
mov dword [ebp - 0x330], fcn.0041b270
mov dword [ebp - 0x32c], eax
call fcn.0040be60
cmp byte [0x5f17f0], 0
movzx eax, al
mov dword [ebp - 0x328], eax
movzx eax, byte [ebp - 0x340]
mov dword [ebp - 0x324], eax
jne 0x408542
cmp byte [0x5f17f1], 0
mov dword [ebp - 0x320], 0
je 0x40854c
mov dword [ebp - 0x320], 1
mov eax, dword [0x5f2028]
mov dword [ebp - 0x31c], eax
call fcn.0040b570
push 0xb
push str.channelType
lea ecx, [ebp - 0x37c]
mov dword [ebp - 0x36c], 0
mov esi, eax
mov dword [ebp - 0x368], 0xf
mov byte [ebp - 0x37c], 0
call fcn.0040b580
lea eax, [ebp - 0x37c]
mov byte [ebp - 4], 0x25
push eax
lea eax, [ebp - 0x24c]
mov ecx, esi
push eax
call fcn.0040b740
lea ecx, [ebp - 0x37c]
mov byte [ebp - 4], 0x27
call fcn.0040ba20
cmp dword [ebp - 0x23c], 0
je 0x40866c
call fcn.004116f6
cmp dword [ebp - 0x238], 8
lea esi, [ebp - 0x24c]
mov edi, eax
lea eax, [ebp - 0x2ac]
cmovae esi, dword [ebp - 0x24c]
push 0xa
push eax
push esi
mov dword [edi], 0
call fcn.00446034
add esp, 0xc
cmp esi, dword [ebp - 0x2ac]
je 0x408b7a
cmp dword [edi], 0x22
je 0x408b84
mov edx, dword [ebp - 0x238]
cmp eax, 1
mov byte [ebp - 4], 0x24
sete al
mov byte [ebp - 0x340], al
cmp edx, 8
jb 0x4086ba
mov ecx, dword [ebp - 0x24c]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 0x28
cmp edx, 0x1000
jb 0x408656
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b8e
push edx
push ecx
call fcn.00409f25
mov al, byte [ebp - 0x340]
add esp, 8
mov byte [ebp - 4], 0x24
jmp 0x4086ba
mov edx, dword [ebp - 0x238]
mov byte [ebp - 4], 0x24
cmp edx, 8
jb 0x4086b8
mov ecx, dword [ebp - 0x24c]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 0x29
cmp edx, 0x1000
jb 0x4086aa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x408b8e
push edx
push ecx
call fcn.00409f25
add esp, 8
mov byte [ebp - 4], 0x24
xor al, al
movzx eax, al
mov dword [ebp - 0x318], eax
lea eax, [ebp - 0x334]
mov dword [ebp - 0x284], eax
push 7
xor eax, eax
mov dword [ebp - 0x270], 0
push str._slMode
lea ecx, [ebp - 0x280]
mov dword [ebp - 0x26c], 7
mov word [ebp - 0x280], ax
call fcn.00408f30
mov eax, dword [ebp - 0x33c]
mov esi, dword [ebp - 0x310]
or eax, 0x100
mov ecx, esi
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x220], eax
xor eax, eax
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 7
lea edx, [ecx + 2]
mov word [ebp - 0x24c], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408741
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x24c]
call fcn.00408f30
mov eax, dword [ebp - 0x33c]
or eax, 0x200
mov dword [ebp - 4], 0x2b
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.0040af20
add esp, 8
cmp eax, 0xffffffff
je 0x4087b1
cmp byte [ebp - 0x344], 0
je 0x4087a8
cmp byte [ebp - 0x33d], 0
je 0x4087b1
mov byte [ebp - 0x33d], 1
jmp 0x4087b8
mov byte [ebp - 0x33d], 0
mov eax, dword [ebp - 0x33c]
and eax, 0xfffffdff
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 4], 0x2c
cmp eax, 8
jb 0x4087ee
inc eax
lea ecx, [ebp - 0x24c]
push eax
push dword [ebp - 0x24c]
call fcn.0040a2e0
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 4], 0x2d
cmp eax, 8
jb 0x408813
inc eax
lea ecx, [ebp - 0x280]
push eax
push dword [ebp - 0x280]
call fcn.0040a2e0
cmp byte [ebp - 0x33d], 0
mov byte [ebp - 4], 0x24
je 0x40891b
cmp byte [ebp - 0x344], 0
je 0x408841
cmp byte [ebp - 0x33f], 0
jne 0x408841
lea ecx, [ebp - 0x30c]
call fcn.0041ccf0
push dword [ebp + 0x14]
push esi
push dword [ebp - 0x364]
push dword [ebp - 0x348]
call fcn.0048bdd0
mov edi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x290]
movlpd qword [ebp - 0x2b0], xmm0
push eax
movups xmmword [ebp - 0x290], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x2b0]
mov dword [ebp - 0x310], 0
push eax
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x408900
lea eax, [ebp - 0x310]
push eax
push 2
push 0
push 0x58bf70
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408900
push 4
lea eax, [ebp - 0x2ac]
push eax
push 4
push 0
push str.iSLExitTimeHighPart
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp - 0x2b0]
push eax
push 4
push 0
push str.iSLExitTimeLowPart
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x30c]
call fcn.00414e40
lea ecx, [ebp - 0x2a8]
call fcn.0040ba20
jmp 0x408af1
mov edi, str.AcroRd32.dll
call fcn.00413c80
test al, al
mov ecx, str.Acrobat.dll
push 0x104
lea eax, [ebp - 0x218]
cmove ecx, edi
push eax
push ecx
call fcn.00413db0
add esp, 0xc
test eax, eax
je 0x408a37
lea eax, [ebp - 0x218]
push eax
call fcn.00413f10
mov dword [ebp - 0x228], eax
test eax, eax
je 0x408a37
cmp byte [ebp - 0x344], 0
je 0x408983
cmp byte [ebp - 0x33f], 0
jne 0x408983
lea ecx, [ebp - 0x30c]
call fcn.0041ccf0
push esi
call fcn.00414bc3
add esp, 4
mov dword [ebp - 0x310], eax
lea ecx, [ebp - 0x228]
call fcn.00414c30
mov esi, dword [ebp - 0x228]
test al, al
jne 0x4089ae
mov edi, 0xff
jmp 0x4089ee
push str.AcroWinMainSandbox
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x4089c7
mov edi, 0xff
jmp 0x4089ee
push dword [ebp - 0x284]
mov ecx, edi
push dword [ebp + 0x14]
push dword [ebp - 0x310]
push dword [ebp - 0x348]
push esi
call dword [0x5817c0]
call edi
mov edi, eax
neg edi
sbb edi, edi
inc edi
push dword [ebp - 0x310]
call fcn.00409f38
add esp, 4
lea ecx, [ebp - 0x30c]
call fcn.00414d50
test esi, esi
je 0x408a12
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp - 0x22c]
test esi, esi
je 0x408aca
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x408aca
cmp byte [ebp - 0x344], 0
jne 0x408aa9
push 0x478f50
push 0x14
push 0x58c018
push str.Acrobat_failed_to_load_its_Core_DLL
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call fcn.00478ee0
add esp, 0x14
cmp eax, 6
jne 0x408aa9
mov ecx, 0x22
lea edi, [ebp - 0x210]
mov esi, str.https:__helpx.adobe.com_acrobat_kb_acrobat_failed_load_core_dll.html
lea eax, [ebp - 0x186]
rep movsd dword es:[edi], dword [esi]
push 0x176
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.0053f340
add esp, 0xc
lea eax, [ebp - 0x210]
push 1
push 0
push 0
push eax
push 0x58c104
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, dword [ebp - 0x22c]
test esi, esi
je 0x408ac5
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0xff
lea ecx, [ebp - 0x30c]
call fcn.00414e40
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 0
call fcn.0040ba20
push 0x40100000
call fcn.00412780
add esp, 4
lea ecx, [ebp - 0x24d]
call fcn.00415340
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401682
mov esp, ebp
pop ebp
ret 0x10
call fcn.0054223b
push 1
call fcn.0053bb42
push eax
call fcn.0053bb15
push 6
mov dword [ebp - 0x22c], 0
call fcn.0053bb42
call fcn.0054223b
call fcn.004790f0
call fcn.0054223b
call fcn.0054223b
call fcn.0054223b
call fcn.0054223b
call fcn.0054223b
call fcn.0054223b
call fcn.0054223b
call fcn.0054223b
call fcn.0054223b
call fcn.0054223b
push str.invalid_stoi_argument
call fcn.0053b6c7
push str.stoi_argument_out_of_range
call fcn.0053b707
call fcn.0054223b
int3