Function at 0x412f49
Capabilities:
Copy file
Delete file
Delete registry key
Delete registry value
Get file attributes
Persist via app paths registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8f8
push ebx
push esi
push edi
push 0x4e
call fcn.0045d9d1
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x2e0]
xor ebx, ebx
mov dword [esp], str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsAcrobat.exe
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
call fcn.0044bec0
pop ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop ecx
lea eax, [ebp - 4]
push eax
push 0x20019
lea eax, [ebp - 0x2e0]
push ebx
mov edi, reloc.CoolType.dll_Ordinal_2
push eax
push edi
mov dword [ebp - 0x18], 1
call esi
cmp eax, ebx
jne 0x412ffb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
lea eax, [ebp - 0x8f8]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x412fe2
lea eax, [ebp - 0x8f8]
push ebx
push eax
call fcn.0044d624
pop ecx
cmp eax, 0xffffffff
pop ecx
jne 0x412fe9
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], ebx
je 0x413086
lea eax, [ebp - 0x2e0]
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsAcroRd32.exe
push eax
call fcn.0044bec0
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
push 0x20019
lea eax, [ebp - 0x2e0]
push ebx
push eax
push edi
call esi
cmp eax, ebx
jne 0x41307e
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
lea eax, [ebp - 0x8f8]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x413062
lea eax, [ebp - 0x8f8]
push ebx
push eax
call fcn.0044d624
pop ecx
cmp eax, 0xffffffff
pop ecx
jne 0x413069
mov dword [ebp - 8], 2
push dword [ebp - 4]
mov dword [ebp - 0x18], 2
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], ebx
je 0x413086
xor ax, ax
jmp 0x413a08
lea eax, [ebp - 0xa8]
push str.SOFTWARENetscapeNetscape_Navigator
push eax
call fcn.0044bec0
pop ecx
lea eax, [ebp - 4]
pop ecx
mov byte [ebp - 0x15c], bl
push eax
push 0x20019
lea eax, [ebp - 0xa8]
push ebx
push eax
push edi
mov byte [ebp - 0x4e8], bl
mov byte [ebp - 0x260], bl
call esi
test eax, eax
jne 0x4131aa
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push str.CurrentVersion
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x413158
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x128]
push str._s_sMain
push eax
call fcn.0044d2a5
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
push 0x20019
lea eax, [ebp - 0x128]
push ebx
push eax
push edi
call esi
test eax, eax
jne 0x413158
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push str.Plugins_Directory
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x260], bl
je 0x4131aa
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
jne 0x4131a4
lea eax, [ebp - 0x260]
push str.nppdf32.dll
push eax
lea eax, [ebp - 0x4e8]
push 0x676d64
push eax
mov dword [ebp - 0x1c], 1
call fcn.0044d2a5
add esp, 0x10
jmp 0x4131aa
mov byte [ebp - 0x260], bl
lea eax, [ebp - 0xa8]
push str.SOFTWARENetscapeNetscape_NavigatorMain
push eax
call fcn.0044bec0
pop ecx
lea eax, [ebp - 4]
pop ecx
mov byte [ebp - 0x3e4], bl
push eax
push 0x20019
lea eax, [ebp - 0xa8]
push ebx
push eax
push Ordinal_3
mov byte [ebp - 0x7f4], bl
call esi
test eax, eax
jne 0x41328b
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
lea eax, [ebp - 0x7f4]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push str.Install_Directory
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x7f4], bl
je 0x41328b
lea eax, [ebp - 0x7f4]
push str.ProgramPlugins
push eax
call fcn.0044bed0
lea eax, [ebp - 0x7f4]
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.0044c3b0
add esp, 0x10
test eax, eax
je 0x413285
lea eax, [ebp - 0x7f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
jne 0x413285
lea eax, [ebp - 0x7f4]
push str.nppdf32.dll
push eax
lea eax, [ebp - 0x3e4]
push 0x676d64
push eax
mov dword [ebp - 0x20], 1
call fcn.0044d2a5
add esp, 0x10
jmp 0x41328b
mov byte [ebp - 0x7f4], bl
lea eax, [ebp - 4]
mov byte [ebp - 0x5ec], bl
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIExplore.exe
push edi
mov byte [ebp - 0x6f0], bl
call esi
test eax, eax
jne 0x413346
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
lea eax, [ebp - 0x6f0]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], ebx
jne 0x413340
lea eax, [ebp - 0x6f0]
push 0x5c
push eax
call fcn.0044e160
pop ecx
cmp eax, ebx
pop ecx
je 0x413340
mov byte [eax], bl
lea eax, [ebp - 0x6f0]
push str.Plugins
push eax
call fcn.0044bed0
pop ecx
lea eax, [ebp - 0x6f0]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
jne 0x413340
lea eax, [ebp - 0x6f0]
push str.nppdf32.dll
push eax
lea eax, [ebp - 0x5ec]
push 0x676d64
push eax
call fcn.0044d2a5
add esp, 0x10
jmp 0x413346
mov byte [ebp - 0x6f0], bl
lea eax, [ebp - 0xa8]
push str.MIMEDatabaseContent_Type_application_pdf
push eax
call fcn.0044bec0
cmp dword [ebp - 0xc], ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], ebx
jne 0x413693
cmp byte [ebp - 0x4e8], bl
je 0x4133c8
lea eax, [ebp - 0x4e8]
push ebx
push eax
call fcn.0044d624
pop ecx
cmp eax, 0xffffffff
pop ecx
je 0x4133c8
lea eax, [ebp - 0x4e8]
push 2
push eax
call fcn.0044d624
pop ecx
cmp eax, 0xffffffff
pop ecx
jne 0x4133a5
cmp dword [0x6b799c], 0xd
jne 0x4133c1
cmp word [ebp + 8], bx
jmp 0x4133bf
cmp word [ebp + 8], bx
jne 0x4139df
lea eax, [ebp - 0x4e8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test ax, ax
jne 0x4133c8
mov dword [ebp - 0xc], 1
cmp byte [ebp - 0x3e4], bl
je 0x41342b
lea eax, [ebp - 0x3e4]
push ebx
push eax
call fcn.0044d624
pop ecx
cmp eax, 0xffffffff
pop ecx
je 0x41342b
lea eax, [ebp - 0x3e4]
push 2
push eax
call fcn.0044d624
pop ecx
cmp eax, 0xffffffff
pop ecx
jne 0x413408
cmp dword [0x6b799c], 0xd
jne 0x413424
cmp word [ebp + 8], bx
jmp 0x413422
cmp word [ebp + 8], bx
jne 0x4139df
lea eax, [ebp - 0x3e4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test ax, ax
jne 0x41342b
mov dword [ebp - 0xc], 1
cmp byte [ebp - 0x5ec], bl
je 0x41348e
lea eax, [ebp - 0x5ec]
push ebx
push eax
call fcn.0044d624
pop ecx
cmp eax, 0xffffffff
pop ecx
je 0x41348e
lea eax, [ebp - 0x5ec]
push 2
push eax
call fcn.0044d624
pop ecx
cmp eax, 0xffffffff
pop ecx
jne 0x41346b
cmp dword [0x6b799c], 0xd
jne 0x413487
cmp word [ebp + 8], bx
jmp 0x413485
cmp word [ebp + 8], bx
jne 0x4139df
lea eax, [ebp - 0x5ec]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test ax, ax
jne 0x41348e
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], ebx
je 0x4134a7
push ebx
push ebx
push 0xef28
call fcn.0040fb61
add esp, 0xc
jmp 0x413955
cmp word [ebp + 8], bx
lea eax, [ebp - 4]
push eax
push 0x20006
lea eax, [ebp - 0xa8]
push ebx
push eax
push Ordinal_3
je 0x4135b0
call esi
test eax, eax
jne 0x4134f9
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 0x28]
push ebx
push eax
push ebx
push str.CLSID
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4139df
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xa8]
push str.SOFTWAREMicrosoftInternet_ExplorerPluginsMIME_application_pdf
push eax
call fcn.0044bec0
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
push 0x20019
lea eax, [ebp - 0xa8]
push ebx
push eax
push edi
call esi
push dword [ebp - 4]
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], ebx
je 0x4139df
lea eax, [ebp - 0xa8]
push str.SOFTWAREMicrosoftInternet_ExplorerPluginsExtension.pdf
push eax
call fcn.0044bec0
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
push 0x20019
lea eax, [ebp - 0xa8]
push ebx
push eax
push edi
call esi
push dword [ebp - 4]
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], ebx
je 0x4139df
lea eax, [ebp - 0xa8]
push str.SOFTWAREMicrosoftCode_Store_DatabaseDistribution_UnitsCA8A9780_280D_11CF_A24D_444553540000
push eax
call fcn.0044bec0
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
push 0x20019
lea eax, [ebp - 0xa8]
push ebx
push eax
push edi
call esi
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x413955
jmp 0x4139df
call esi
test eax, eax
jne 0x4135cd
push str.CLSID
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xa8]
push str.SOFTWAREMicrosoftInternet_ExplorerPluginsMIME
push eax
call fcn.0044bec0
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
push 0x20006
lea eax, [ebp - 0xa8]
push ebx
push eax
push edi
call esi
test eax, eax
jne 0x41360f
push str.application_pdf
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xa8]
push str.SOFTWAREMicrosoftInternet_ExplorerPluginsExtension
push eax
call fcn.0044bec0
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
push 0x20006
lea eax, [ebp - 0xa8]
push ebx
push eax
push edi
call esi
test eax, eax
jne 0x413651
push str..pdf
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xa8]
push str.SOFTWAREMicrosoftCode_Store_DatabaseDistribution_Units
push eax
call fcn.0044bec0
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
push 0x20006
lea eax, [ebp - 0xa8]
push ebx
push eax
push edi
call esi
test eax, eax
jne 0x413955
push str.CA8A9780_280D_11CF_A24D_444553540000
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x41394c
cmp byte [ebp - 0x4e8], bl
jne 0x4136af
cmp byte [ebp - 0x3e4], bl
jne 0x4136af
cmp byte [ebp - 0x5ec], bl
je 0x413875
lea eax, [ebp - 4]
mov byte [ebp - 0x260], bl
push eax
push 0x20019
lea eax, [ebp - 0x2e0]
push ebx
push eax
push edi
call esi
test eax, eax
jne 0x413736
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push str.Path
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x260]
push eax
call fcn.0044c440
test eax, eax
pop ecx
je 0x413736
mov cl, byte [ebp - 0x260]
xor eax, eax
cmp cl, bl
je 0x413875
cmp cl, 0x3b
je 0x41372f
mov cl, byte [ebp + eax - 0x25f]
inc eax
cmp cl, bl
jne 0x41371c
jmp 0x413736
mov byte [ebp + eax - 0x260], bl
cmp byte [ebp - 0x260], bl
je 0x413875
lea eax, [ebp - 0x260]
push str.nppdf32.dll
push eax
lea eax, [ebp - 0x128]
push str._sBrowser_s
push eax
call fcn.0044d2a5
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 0x10
cmp byte [ebp - 0x4e8], bl
je 0x4137bc
lea eax, [ebp - 0x4e8]
push ebx
push eax
call fcn.0044d624
pop ecx
cmp eax, 0xffffffff
pop ecx
jne 0x4137bc
cmp dword [0x6b799c], 2
jne 0x413798
cmp word [ebp + 8], bx
je 0x41379e
jmp 0x4139df
cmp word [ebp + 8], bx
jne 0x4137bc
lea eax, [ebp - 0x4e8]
push 1
push eax
lea eax, [ebp - 0x128]
push eax
call edi
test ax, ax
jne 0x4137bc
mov dword [ebp - 0xc], 1
cmp byte [ebp - 0x3e4], bl
je 0x413810
lea eax, [ebp - 0x3e4]
push ebx
push eax
call fcn.0044d624
pop ecx
cmp eax, 0xffffffff
pop ecx
jne 0x413810
cmp dword [0x6b799c], 2
jne 0x4137ec
cmp word [ebp + 8], bx
je 0x4137f2
jmp 0x4139df
cmp word [ebp + 8], bx
jne 0x413810
lea eax, [ebp - 0x3e4]
push 1
push eax
lea eax, [ebp - 0x128]
push eax
call edi
test ax, ax
jne 0x413810
mov dword [ebp - 0xc], 1
cmp byte [ebp - 0x5ec], bl
je 0x413864
lea eax, [ebp - 0x5ec]
push ebx
push eax
call fcn.0044d624
pop ecx
cmp eax, 0xffffffff
pop ecx
jne 0x413864
cmp dword [0x6b799c], 2
jne 0x413840
cmp word [ebp + 8], bx
je 0x413846
jmp 0x4139df
cmp word [ebp + 8], bx
jne 0x413864
lea eax, [ebp - 0x5ec]
push 1
push eax
lea eax, [ebp - 0x128]
push eax
call edi
test ax, ax
jne 0x413864
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], ebx
je 0x413875
push ebx
push ebx
push 0xef29
jmp 0x41349a
cmp word [ebp + 8], bx
lea eax, [ebp - 4]
push eax
je 0x4138ee
push 0x20019
lea eax, [ebp - 0xa8]
push ebx
push eax
push Ordinal_3
call esi
test eax, eax
jne 0x4139df
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x80
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push str.CLSID
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4139df
push dword [0x676084]
lea eax, [ebp - 0x128]
push eax
call fcn.0044c3b0
pop ecx
test eax, eax
pop ecx
je 0x413955
jmp 0x4139df
mov edi, 0x20006
lea eax, [ebp - 0xa8]
push edi
push ebx
push eax
push Ordinal_3
call esi
cmp eax, ebx
je 0x413927
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push edi
push ebx
push ebx
lea eax, [ebp - 0xa8]
push ebx
push eax
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x413955
push dword [0x676084]
call fcn.0044c440
pop ecx
inc eax
push eax
push dword [0x676084]
push 1
push ebx
push str.CLSID
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x20], bx
jne 0x413961
cmp word [ebp - 0x1c], bx
je 0x4139a3
lea eax, [ebp - 0x8f8]
push eax
push 0x676b18
push str.application_vnd.fdf
push dword [ebp + 8]
call fcn.00413c6a
add esp, 0x10
test ax, ax
jne 0x4139df
lea eax, [ebp - 0x8f8]
push eax
push str.xfdf
push str.application_vnd.adobe.xfdf
push dword [ebp + 8]
call fcn.00413c6a
add esp, 0x10
test ax, ax
jne 0x4139df
push str.AcroExch.FDFDoc
push dword [ebp + 8]
call fcn.00414017
pop ecx
test ax, ax
pop ecx
jne 0x4139df
push str.AcroExch.XFDFDoc
push dword [ebp + 8]
call fcn.00414017
pop ecx
test ax, ax
pop ecx
jne 0x4139df
cmp word [ebp + 8], bx
je 0x4139e5
push dword [ebp - 0x18]
call fcn.00413a0d
test ax, ax
pop ecx
je 0x413a04
mov ax, 1
jmp 0x413a08
lea eax, [ebp - 0x8f8]
push eax
push dword [ebp - 0x18]
call fcn.00413b6d
pop ecx
pop ecx
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ax, word [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret