Function at 0x40d0f3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41398f
mov eax, dword fs:[0]
push eax
mov eax, 0x1f94
call fcn.00411e40
push esi
push edi
push ecx
lea edi, [ebp - 0x1fa0]
mov ecx, 0x7e5
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x43b004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x24]
call fcn.00411016
and dword [ebp - 4], 0
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x444]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x654]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x864]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xa74]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc84]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xe94]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0xea0], 0x104
lea eax, [ebp - 0xea0]
push eax
lea eax, [ebp - 0xe94]
push eax
push 0x42d6f4
push dword [ebp + 0x10]
call sub.msi.dll_MsiGetPropertyW
and dword [ebp - 0xea8], 0
push 0x42d714
push dword [ebp + 0x10]
call fcn.00401896
pop ecx
pop ecx
test eax, eax
je 0x40d22a
mov dword [ebp - 0xea8], 1
cmp dword [ebp - 0xea8], 0
je 0x40d258
mov esi, esp
push str.AcroExch
push 0x104
lea eax, [ebp - 0xa74]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
jmp 0x40d27b
mov esi, esp
push str.Acrobat
push 0x104
lea eax, [ebp - 0xa74]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xa74]
push eax
push 0x104
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push 0x42d744
push 0x104
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push 0x42d75c
push 0x104
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push str.HKEY_CLASSES_ROOT.pdf
push 0x104
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
push str..msp
push dword [ebp + 8]
call fcn.00401896
pop ecx
pop ecx
test eax, eax
je 0x40d346
mov esi, esp
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
cmp esi, esp
call fcn.00411bb8
test eax, eax
jbe 0x40d346
push 0x42d7a0
push str._In_Patch_mode__not_changing_the_value_of_HKCR.pdf
call fcn.00410c9e
pop ecx
pop ecx
jmp 0x40d376
push 0
lea eax, [ebp - 0x444]
push eax
push 0x42d7a4
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
lea eax, [ebp - 0x444]
push eax
push 0x42d818
call fcn.00410c9e
pop ecx
pop ecx
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
jle 0x40d535
mov esi, esp
push 0x42d814
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0xe94]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
cmp dword [ebp - 0xea8], 0
je 0x40d3f8
mov esi, esp
push str.AcroRd32Info.exe___PDFShell
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f68], eax
jmp 0x40d419
mov esi, esp
push str.AcrobatInfo.exe___PDFShell
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.00411bb8
mov dword [ebp - 0x1f68], eax
mov esi, esp
push str.HKEY_CLASSES_ROOTCLSIDD38406DA_E8AA_484b_B80D_3D3DBDCC2FB2LocalServer32
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42d8cc
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40d4a7
push 0
lea eax, [ebp - 0x444]
push eax
push 0x42d96c
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTCLSIDD38406DA_E8AA_484b_B80D_3D3DBDCC2FB2LocalServer32:
call fcn.00410c9e
pop ecx
pop ecx
mov esi, esp
push str.HKEY_CLASSES_ROOTCLSID98D9A6F1_4696_4B5E_A2E8_36B3F9C1E12CLocalServer32
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, esp
call fcn.00411bb8
push 0x105
push 0
lea eax, [ebp - 0x654]
push eax
push 0x42dabc
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.004114ed
mov esi, esp
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40d535
push 0
lea eax, [ebp - 0x444]
push eax
push 0x42dac0
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x24]
call fcn.00411917
lea eax, [ebp - 0x444]
push eax
push str.___set:_HKEY_CLASSES_ROOTCLSID98D9A6F1_4696_4B5E_A2E8_36B3F9C1E12CLocalServer32:
call fcn.00410c9e
pop ecx
pop ecx
push 0x208
push 0
invalid
invalid
dec esp