Function at 0x14000ee58
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x2230
call fcn.140014940
sub rsp, rax
lea rdi, [rsp + 0x30]
mov ecx, 0x880
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2240]
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2220], rax
lea rcx, [rsp + 0x38]
call fcn.140013784
nop
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x2a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x4d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x700]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x930]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0xb60]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0xd90]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0xfb4], 0x104
lea r9, [rsp + 0xfb4]
lea r8, [rsp + 0xd90]
lea rdx, [0x1400421e0]
mov rcx, qword [rsp + 0x2258]
call sub.msi.dll_MsiGetPropertyW
mov dword [rsp + 0xfc4], 0
lea rdx, [0x140042200]
mov rcx, qword [rsp + 0x2258]
call fcn.14000358c
test rax, rax
je 0x14000ef97
mov dword [rsp + 0xfc4], 1
cmp dword [rsp + 0xfc4], 0
je 0x14000efbd
lea r8, str.AcroExch
mov edx, 0x104
lea rcx, [rsp + 0x930]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
jmp 0x14000efd7
lea r8, str.Acrobat
mov edx, 0x104
lea rcx, [rsp + 0x930]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [0x140042238]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x140042250]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str.HKEY_CLASSES_ROOT.pdf
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rdx, str..msp
mov rcx, qword [rsp + 0x2248]
call fcn.14000358c
test rax, rax
je 0x14000f07e
mov rcx, qword [rsp + 0x2250]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
test rax, rax
jbe 0x14000f07e
lea rdx, [0x140042294]
lea rcx, str._In_Patch_mode__not_changing_the_value_of_HKCR.pdf
call fcn.140012b60
jmp 0x14000f0b8
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x14004230c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOT.pdf:
call fcn.140012b60
lea rcx, [rsp + 0xd90]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x14000f267
lea rdx, [0x140042354]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [rsp + 0xfc4], 0
je 0x14000f122
lea rdx, [0x140042358]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21a8], rax
jmp 0x14000f13f
lea rdx, str.AcrobatInfo.exe___PDFShell
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21a8], rax
lea rdx, str.HKEY_CLASSES_ROOTCLSIDD38406DA_E8AA_484b_B80D_3D3DBDCC2FB2LocalServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14004246c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000f1d3
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140042470]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDD38406DA_E8AA_484b_B80D_3D3DBDCC2FB2LocalServer32:
call fcn.140012b60
lea rdx, str.HKEY_CLASSES_ROOTCLSID98D9A6F1_4696_4B5E_A2E8_36B3F9C1E12CLocalServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400425cc]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000f267
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x1400425d0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSID98D9A6F1_4696_4B5E_A2E8_36B3F9C1E12CLocalServer32:
call fcn.140012b60
lea rax, [rsp + 0xfe0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0xfe0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov rcx, qword [rsp + 0x2258]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x14000f6d5
lea rcx, [rsp + 0xfe0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x14000f6d5
lea rdx, [rsp + 0xfe0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.Installer_
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, qword [rsp + 0x2258]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [rsp + 0xfc4], 0
je 0x14000f324
lea rdx, str.PDFFile_8.ico_0
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21b0], rax
jmp 0x14000f341
lea rdx, str._PDFFile.ico_0
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21b0], rax
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x1400426f0]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..acrobatsecuritysettings.1DefaultIcon
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140042770]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000f463
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140042774]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea r8, [0x140042778]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0xb60]
call fcn.140012b60
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x140042788]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x1400427b0]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x1400427c8]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str.DefaultIcon
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400427ec]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000f5b3
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x1400427f0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea r8, [0x1400427f8]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0xb60]
call fcn.140012b60
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x140042808]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..pdfxml.1DefaultIcon
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14004285c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000f6d5
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140042860]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea r8, [0x140042868]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0xb60]
call fcn.140012b60
lea rax, [rsp + 0x1210]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
cmp dword [rsp + 0xfc4], 0
je 0x14000f712
lea rdx, [0x140042878]
lea rcx, [rsp + 0x1210]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov qword [rsp + 0x21b8], rax
jmp 0x14000f72f
lea rdx, [0x140042888]
lea rcx, [rsp + 0x1210]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov qword [rsp + 0x21b8], rax
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x140042898]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..acrobatsecuritysettings.1_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140042904]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000f851
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x140042908]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea r8, [0x140042910]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.140012b60
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x140042920]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..FDFDoc_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140042964]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000f973
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x140042968]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea r8, [0x140042970]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.140012b60
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x140042980]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x1400429a8]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x1400429c0]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str._shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400429d8]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000fac3
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x1400429dc]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea r8, [0x1400429e0]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.140012b60
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x1400429f0]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..pdfxml.1_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140042a38]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000fbe5
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x140042a3c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea r8, [0x140042a40]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.140012b60
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x140042a50]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..RMFFile_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140042a98]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000fd07
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x140042a9c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea r8, [0x140042aa0]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.140012b60
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x140042ab0]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..XDPDoc_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140042af4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000fe29
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x140042af8]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea r8, [0x140042b00]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.140012b60
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x70]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0xb60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea r8, [0x140042b10]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str..XFDFDoc_shell
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140042b58]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000ff4b
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1210]
lea r8, [0x140042b5c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea r8, str.set:
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0xb60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x1210]
lea rcx, [rsp + 0xb60]
call fcn.140012b60
lea rdx, str.HKEY_CLASSES_ROOTSOFTWAREAdobeAcrobatExe
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x140042bcc]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [rsp + 0xfc4], 0
je 0x14000ffb1
lea rdx, [0x140042bd0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21c0], rax
jmp 0x14000ffce
lea rdx, str.AcrobatAcrobat.exe_
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21c0], rax
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140042c2c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010050
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140042c30]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTSOFTWAREAdobeAcrobatExe:
call fcn.140012b60
lea rax, [rsp + 0x1440]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea r8, [0x140042cb0]
mov edx, 0x104
lea rcx, [rsp + 0x1440]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0xd90]
mov edx, 0x104
lea rcx, [rsp + 0x1440]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
cmp dword [rsp + 0xfc4], 0
je 0x1400100bf
lea r8, str.ReaderAcroRd32.exe___u___1_
mov edx, 0x104
lea rcx, [rsp + 0x1440]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
jmp 0x1400100d9
lea r8, str.AcrobatAcrobat.exe___u___1_
mov edx, 0x104
lea rcx, [rsp + 0x1440]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x1440]
lea r8, [0x140042d34]
lea rdx, str.HKEY_CLASSES_ROOT_acrobat_shellopencommand
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea rdx, str.HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x140042e20]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [rsp + 0xfc4], 0
je 0x140010167
lea rdx, [0x140042e28]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21c8], rax
jmp 0x140010184
lea rdx, [0x140042e38]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21c8], rax
lea rdx, str.pdfprevhndlr.dll__101
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140042e80]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14001021b
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, str.DisplayName
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193_DisplayName_:
call fcn.140012b60
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x14001025a
lea rdx, [0x140042f60]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21d0], rax
jmp 0x140010277
lea rdx, [0x140042f70]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21d0], rax
lea rdx, str.pdfprevhndlr.dll
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193InprocServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14004304c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010320
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140043050]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDDC6EFB56_9CFA_464D_8880_44885D7DC193InprocServer32:
call fcn.140012b60
lea rdx, str.HKEY_CLASSES_ROOTTypeLib41738EEA_442F_477F_92CF_2889BD6CD7E71.00win32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x140010371
lea rdx, [0x1400431b0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21d8], rax
jmp 0x14001038e
lea rdx, [0x1400431c0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21d8], rax
lea rdx, str.AcroBroker.exe
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400431f8]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010425
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x1400431fc]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTTypeLib41738EEA_442F_477F_92CF_2889BD6CD7E71.00win32:
call fcn.140012b60
lea rdx, str.HKEY_CLASSES_ROOTCLSIDBD57A9B2_4E7D_4892_9107_9F4106472DA4LocalServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14004334c]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [rsp + 0xfc4], 0
je 0x14001048b
lea rdx, [0x140043350]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21e0], rax
jmp 0x1400104a8
lea rdx, [0x140043360]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21e0], rax
lea rdx, str.AcroBroker.exe_
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140043398]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14001053f
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x14004339c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDBD57A9B2_4E7D_4892_9107_9F4106472DA4LocalServer32:
call fcn.140012b60
lea rdx, str.HKEY_CLASSES_ROOTCLSID17F2E344_8227_4AA7_A25A_E89424566BBAInprocServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400434ec]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400105d3
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x1400434f0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSID17F2E344_8227_4AA7_A25A_E89424566BBAInprocServer32:
call fcn.140012b60
lea rdx, str.HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.00win32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x14004365c]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010667
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140043660]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.00win32:
call fcn.140012b60
lea rdx, str.HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.0HELPDIR
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x1400106b8
lea rdx, [0x1400437c0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21e8], rax
jmp 0x1400106d5
lea rdx, [0x1400437d0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21e8], rax
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400437e4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010757
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x1400437e8]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTTypeLib0F6D3808_7974_4B1A_94C2_3200767EACE81.0HELPDIR:
call fcn.140012b60
lea rdx, str.HKEY_CLASSES_ROOTCLSID12BA069D_0FC6_4577_97C6_5DF634CE6E84InProcServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x1400107a8
lea rdx, [0x140043940]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21f0], rax
jmp 0x1400107c5
lea rdx, [0x140043950]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21f0], rax
lea rdx, str.ViewerPS.dll
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140043984]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14001085c
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140043988]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSID12BA069D_0FC6_4577_97C6_5DF634CE6E84InProcServer32:
call fcn.140012b60
lea rdx, str.HKEY_CLASSES_ROOTMIMEDatabaseContent_Type_application_pdf
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x140043ac0]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140043b10]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010905
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140043b20]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea rdx, [rsp + 0x2a0]
lea rcx, [0x140043b30]
call fcn.140012b60
lea rdx, str.HKEY_CLASSES_ROOTCLSIDB801CA65_A1FC_11D0_85AD_444553540000LocalServer32
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x140010956
lea rdx, str.ReaderAcroRd32.exe
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21f8], rax
jmp 0x140010973
lea rdx, [0x140043c88]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x21f8], rax
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140043cb0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400109f5
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140043cb4]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDB801CA65_A1FC_11D0_85AD_444553540000LocalServer32:
call fcn.140012b60
lea rdx, str.HKEY_CLASSES_ROOTCLSIDB801CA65_A1FC_11D0_85AD_444553540000ProgID
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [0x140043e00]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x140043e18]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140043e20]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010ad8
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140043e24]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTCLSIDBD57A9B2_4E7D_4892_9107_9F4106472DA4ProgID:
call fcn.140012b60
lea rdx, str.HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeGoogleChromeNativeMessagingHostscom.adobe.acrobat.chrome_webcapture
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0xfc4], 0
je 0x140010b29
lea rdx, str.ReaderBrowserWCChromeExtnmanifest.json
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x2200], rax
jmp 0x140010b46
lea rdx, [0x140044010]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x2200], rax
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x140044068]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rdx, str.AcrobatBrowserWCChromeExtnmanifest.json
lea rcx, [rsp + 0x4d0]
call fcn.14000358c
test rax, rax
je 0x140010b97
mov byte [rsp + 0x2208], 1
jmp 0x140010b9f
mov byte [rsp + 0x2208], 0
mov al, byte [rsp + 0x2208]
mov byte [rsp + 0x1654], al
movzx eax, byte [rsp + 0x1654]
test eax, eax
je 0x140010bce
lea rcx, [rsp + 0x4d0]
call fcn.140003958
test eax, eax
jne 0x140010d2e
lea rcx, [rsp + 0x2a0]
call fcn.140003958
test eax, eax
je 0x140010d1a
call fcn.140009908
mov dword [rsp + 0x1658], eax
cmp dword [rsp + 0xfc4], 0
jne 0x140010c0f
call fcn.140011c70
test eax, eax
jne 0x140010c0f
mov dword [rsp + 0x220c], 0
jmp 0x140010c1a
mov dword [rsp + 0x220c], 1
mov al, byte [rsp + 0x220c]
mov byte [rsp + 0x165c], al
movzx eax, byte [rsp + 0x165c]
test eax, eax
je 0x140010c73
movzx eax, byte [rsp + 0x165c]
test eax, eax
je 0x140010cd6
lea rdx, str.E3AFF032_DE15_45DA_8C24_B74F922C62EC
mov rcx, qword [rsp + 0x2258]
call fcn.140011bb8
movzx eax, al
test eax, eax
jne 0x140010c73
cmp dword [rsp + 0x1658], 1
je 0x140010c73
cmp dword [rsp + 0x1658], 2
jne 0x140010cd6
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, [0x140044120]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
mov dword [rsp + 0x20], 0
lea r9, str.https:__clients2.google.com_service_update2_crx
lea r8, str.update_url
lea rdx, str.HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeGoogleChromeExtensionsefaidnbmnnnibpcajpcglclefindmkaj
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_LOCAL_MACHINESOFTWAREGoogleChromeNativeMessagingHostscom.adobe.acrobat.chrome_webcapture:
call fcn.140012b60
jmp 0x140010d18
movzx eax, byte [rsp + 0x165c]
test eax, eax
je 0x140010d18
lea rcx, [rsp + 0x4d0]
call fcn.140003958
test eax, eax
jne 0x140010d18
lea rdx, [0x140044358]
lea rcx, str.Ownership:_Deleting_Chrome_Extension_registry_entries
call fcn.140012b60
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.1400138bc
jmp 0x140010d2e
lea rdx, [rsp + 0x2a0]
lea rcx, str.File_does_not_exist:
call fcn.140012b60
mov edx, 0x400
lea rcx, [rsp + 0x1670]
call fcn.14000a128
test eax, eax
jne 0x140010d61
mov edx, 0x400
lea rcx, [rsp + 0x1670]
call fcn.140009f5c
movzx eax, al
test eax, eax
je 0x140010e3c
lea rdx, [0x140044400]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x1670]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.SoftwareClassesMIMEDatabaseContent_Type_application_pdf
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.CA8A9780_280D_11CF_A24D_444553540000
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x4d0]
lea r8, [0x1400444f0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013e14
lea rax, [rsp + 0x4d0]
test rax, rax
je 0x140010e3c
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140010e3c
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2a0]
lea r8, str.CLSID
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14001432c
lea rdx, [rsp + 0x2a0]
lea rcx, str.___set:_HKEY_CLASSES_ROOTMIMEDatabaseContent_Type_application_pdf
call fcn.140012b60
cmp dword [0x1400584d0], 0
jne 0x140011079
call fcn.140012014
movzx eax, al
test eax, eax
jne 0x140011079
lea rax, [rsp + 0x1e90]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea r8, [rsp + 0x930]
mov edx, 0x104
lea rcx, [rsp + 0x1e90]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, str..Document.
mov edx, 0x104
lea rcx, [rsp + 0x1e90]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x1400445b8]
mov edx, 0x104
lea rcx, [rsp + 0x1e90]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rax, [0x1400445c0]
mov qword [rsp + 0x20c0], rax
lea rax, [0x1400445d0]
mov qword [rsp + 0x20c8], rax
lea rax, [0x1400445e0]
mov qword [rsp + 0x20d0], rax
lea rax, [0x140044618]
mov qword [rsp + 0x20d8], rax
lea rax, [0x140044628]
mov qword [rsp + 0x20e0], rax
lea rax, [0x140044638]
mov qword [rsp + 0x20e8], rax
lea rax, [0x140044648]
mov qword [rsp + 0x20f0], rax
lea rax, [0x140044658]
mov qword [rsp + 0x20f8], rax
lea rax, [0x140044668]
mov qword [rsp + 0x2100], rax
lea rax, [0x140044680]
mov qword [rsp + 0x2130], rax
lea rax, [0x140044690]
mov qword [rsp + 0x2138], rax
lea rax, [0x1400446a0]
mov qword [rsp + 0x2140], rax
lea rax, [0x1400446d8]
mov qword [rsp + 0x2148], rax
lea rax, [0x1400446e8]
mov qword [rsp + 0x2150], rax
lea rax, [0x1400446f8]
mov qword [rsp + 0x2158], rax
lea rax, [0x140044708]
mov qword [rsp + 0x2160], rax
lea rax, [0x140044718]
mov qword [rsp + 0x2168], rax
lea rax, [0x140044728]
mov qword [rsp + 0x2170], rax
lea rax, [0x140044740]
mov qword [rsp + 0x2178], rax
lea rax, [0x140044750]
mov qword [rsp + 0x2180], rax
lea rax, [0x140044760]
mov qword [rsp + 0x2188], rax
cmp dword [rsp + 0xfc4], 0
je 0x14001100f
mov qword [rsp + 0x2210], 9
jmp 0x14001101b
mov qword [rsp + 0x2210], 0xc
mov eax, dword [rsp + 0x2210]
mov dword [rsp + 0x2194], eax
cmp dword [rsp + 0xfc4], 0
je 0x140011045
lea rax, [rsp + 0x20c0]
mov qword [rsp + 0x2218], rax
jmp 0x140011055
lea rax, [rsp + 0x2130]
mov qword [rsp + 0x2218], rax
lea r9, [rsp + 0x1e90]
mov r8d, dword [rsp + 0xfc4]
mov edx, dword [rsp + 0x2194]
mov rcx, qword [rsp + 0x2218]
call fcn.140008040
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
mov dword [rsp + 0x21a0], 1
lea rcx, [rsp + 0x38]
call fcn.1400137b8
mov eax, dword [rsp + 0x21a0]
mov edi, eax
mov rcx, rsp
lea rdx, [0x140047ff0]
call fcn.140014604
mov eax, edi
mov rcx, qword [rsp + 0x2220]
xor rcx, rsp
call fcn.140014710
add rsp, 0x2230
pop rdi
ret