Function at 0x40f560
Capabilities:
Check if file exists
Create process on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47edd6
mov eax, dword fs:[0]
push eax
sub esp, 0x4b0
mov eax, dword [0x4ad070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x458], edx
mov eax, ecx
mov dword [ebp - 0x42c], eax
push ecx
push eax
lea ecx, [ebp - 0x448]
call fcn.004159d0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], 1
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x44c], 0
call fcn.00410630
mov dword [ebp - 0x450], eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 1
call fcn.0041bf50
lea edx, [ebp - 0x450]
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.0042daf0
mov byte [ebp - 4], 1
or edi, 0xffffffff
mov edx, dword [ebp - 0x418]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40f61d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x49a018
push str.mpSetup_Cls
call dword [sym.imp.USER32.dll_FindWindowW]
push str._updump
lea ecx, [ebp - 0x418]
call fcn.00407e20
push ecx
mov byte [ebp - 4], 3
mov esi, esp
mov dword [ebp - 0x41c], esi
mov ecx, dword [ebp - 0x418]
lea ecx, [ecx - 0x10]
call fcn.00407fe0
add eax, 0x10
lea ecx, [ebp - 0x448]
mov dword [esi], eax
call fcn.00416410
xor ebx, ebx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x418]
cmp eax, 0xffffffff
mov eax, edi
setne bl
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40f691
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
je 0x40f723
push 0x4994f4
push str.none
push str.crash
call fcn.00428070
add esp, 8
mov ecx, esp
push str._updump
call fcn.00407e20
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x448]
call fcn.004166d0
mov byte [ebp - 4], 4
cmp dword [0x4b34e0], 0
jne 0x40f6f6
push 4
call fcn.004527fe
mov dword [ebp - 0x41c], eax
add esp, 4
mov dword [0x4b34e0], eax
mov dword [eax], vtable.CUploadDumpMgr.0
lea eax, [ebp - 0x418]
push eax
call fcn.00410dc0
mov byte [ebp - 4], 1
mov eax, edi
mov edx, dword [ebp - 0x418]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40f723
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x42c]
lea ecx, [ebp - 0x430]
call fcn.00407e20
mov byte [ebp - 4], 5
push str._cpCallApp
push dword [ebp - 0x430]
call fcn.0045e589
add esp, 8
test eax, eax
je 0x40f766
push str._rgCallApp
push dword [ebp - 0x430]
call fcn.0045e589
add esp, 8
test eax, eax
jne 0x40f7d1
push str._cpCallApp
push dword [ebp - 0x430]
call fcn.0045e589
add esp, 8
mov edx, str.rg_callapp
test eax, eax
mov ecx, str.cp_callapp
cmovne ecx, edx
push ecx
lea ecx, [ebp - 0x418]
call fcn.00407e20
push 0x4994f4
mov byte [ebp - 4], 6
push str.none
push dword [ebp - 0x418]
call fcn.00428070
mov byte [ebp - 4], 5
add esp, 0xc
mov edx, dword [ebp - 0x418]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40f7d1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str._check_update
lea ecx, [ebp - 0x418]
call fcn.00407e20
push ecx
mov byte [ebp - 4], 7
mov esi, esp
mov dword [ebp - 0x41c], esi
mov ecx, dword [ebp - 0x418]
lea ecx, [ecx - 0x10]
call fcn.00407fe0
add eax, 0x10
lea ecx, [ebp - 0x448]
mov dword [esi], eax
call fcn.00416410
xor ebx, ebx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x418]
cmp eax, 0xffffffff
mov eax, edi
setne bl
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40f835
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
je 0x40f8cc
cmp dword [ebp - 0x44c], 0
jne 0x40f8cc
push ecx
mov ecx, esp
mov dword [ebp - 0x428], 0
push str._check_update
call fcn.00407e20
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x448]
call fcn.004166d0
mov byte [ebp - 4], 8
mov eax, dword [0x4b34dc]
test eax, eax
jne 0x40f8a4
push 0xc
call fcn.004527fe
add esp, 4
mov dword [ebp - 0x41c], eax
mov ecx, eax
mov byte [ebp - 4], 9
call fcn.004012f0
mov byte [ebp - 4], 8
mov dword [0x4b34dc], eax
mov ecx, eax
call fcn.00401480
mov byte [ebp - 4], 5
mov eax, edi
mov edx, dword [ebp - 0x42c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40f8cc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov ecx, esp
push str._check_enable_pdf_protect
call fcn.00407e20
lea ecx, [ebp - 0x448]
call fcn.004165d0
test eax, eax
je 0x40f947
push 0x400
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00455270
add esp, 0xc
call fcn.00408ef0
push eax
call fcn.00408c50
push eax
push str.___Check_enable_pdf_protect__d__d___
lea eax, [ebp - 0x414]
push 0x200
push eax
call fcn.0040b8b0
add esp, 0x14
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.00408c50
test eax, eax
je 0x40f947
call fcn.00408ef0
test eax, eax
je 0x40f947
call fcn.0040f4b0
push str._enable_pdf_protect
lea ecx, [ebp - 0x418]
call fcn.00407e20
push ecx
mov byte [ebp - 4], 0xa
mov esi, esp
mov dword [ebp - 0x41c], esi
mov ecx, dword [ebp - 0x418]
lea ecx, [ecx - 0x10]
call fcn.00407fe0
add eax, 0x10
lea ecx, [ebp - 0x448]
mov dword [esi], eax
call fcn.00416410
xor ebx, ebx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x418]
cmp eax, 0xffffffff
mov eax, edi
setne bl
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40f9ab
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
je 0x40f9b6
call fcn.0040f4b0
jmp 0x40f9ed
push ecx
mov ecx, esp
push str._disable_pdf_protect
call fcn.00407e20
lea ecx, [ebp - 0x448]
call fcn.00416540
test eax, eax
je 0x40f9ed
call fcn.00405ac0
call fcn.004295b0
cmp dword [0x4b1534], 0x800
jl 0x40f9ed
call fcn.00440830
push str._install
lea ecx, [ebp - 0x418]
call fcn.00407e20
push ecx
mov byte [ebp - 4], 0xb
mov esi, esp
mov dword [ebp - 0x41c], esi
mov ecx, dword [ebp - 0x418]
lea ecx, [ecx - 0x10]
call fcn.00407fe0
add eax, 0x10
lea ecx, [ebp - 0x448]
mov dword [esi], eax
call fcn.00416410
xor ebx, ebx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x418]
cmp eax, 0xffffffff
mov eax, edi
setne bl
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40fa51
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
jne 0x40fa6d
push ecx
mov ecx, esp
push str._install
call fcn.00407e20
lea ecx, [ebp - 0x448]
call fcn.004165d0
push ecx
mov ecx, esp
push str._update
call fcn.00407e20
lea ecx, [ebp - 0x448]
call fcn.004165d0
push ecx
mov ecx, esp
push str._uninstall
call fcn.00407e20
lea ecx, [ebp - 0x448]
call fcn.004165d0
push 0x49a19c
lea ecx, [ebp - 0x418]
call fcn.00407e20
push ecx
mov byte [ebp - 4], 0xc
mov esi, esp
mov dword [ebp - 0x41c], esi
mov ecx, dword [ebp - 0x418]
lea ecx, [ecx - 0x10]
call fcn.00407fe0
add eax, 0x10
lea ecx, [ebp - 0x448]
mov dword [esi], eax
call fcn.00416410
xor ebx, ebx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x418]
cmp eax, 0xffffffff
mov eax, edi
setne bl
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40fb01
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
je 0x40fb1c
push 0x4994f4
push str.none
push str.server_run
call fcn.00428070
add esp, 0xc
push str._DREP
lea ecx, [ebp - 0x418]
call fcn.00407e20
push ecx
mov byte [ebp - 4], 0xd
mov esi, esp
mov dword [ebp - 0x41c], esi
mov ecx, dword [ebp - 0x418]
lea ecx, [ecx - 0x10]
call fcn.00407fe0
add eax, 0x10
lea ecx, [ebp - 0x448]
mov dword [esi], eax
call fcn.00416410
xor ebx, ebx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x418]
cmp eax, 0xffffffff
mov eax, edi
setne bl
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40fb80
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
je 0x40fbad
cmp dword [0x4b34e4], 0
jne 0x40fba8
push 4
call fcn.004527fe
mov dword [ebp - 0x41c], eax
add esp, 4
mov dword [0x4b34e4], eax
mov dword [eax], vtable.CDeviceEnvMgr.0
call fcn.0040a1f0
push str._SCS
lea ecx, [ebp - 0x418]
call fcn.00407e20
push ecx
mov byte [ebp - 4], 0xe
mov esi, esp
mov dword [ebp - 0x41c], esi
mov ecx, dword [ebp - 0x418]
lea ecx, [ecx - 0x10]
call fcn.00407fe0
add eax, 0x10
lea ecx, [ebp - 0x448]
mov dword [esi], eax
call fcn.00416410
xor ebx, ebx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x418]
cmp eax, 0xffffffff
mov eax, edi
setne bl
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40fc11
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
je 0x40fcce
call fcn.00402750
mov ecx, eax
test ecx, ecx
jne 0x40fc2e
push 0x80004005
call fcn.004027d0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x418]
mov byte [ebp - 4], 0xf
push eax
push ecx
mov ecx, esp
push str._SCS
call fcn.00407e20
lea ecx, [ebp - 0x448]
call fcn.004167c0
mov esi, dword [ebp - 0x418]
push 0x49a1bc
push esi
call fcn.0045e589
add esp, 8
test eax, eax
jne 0x40fc83
push 0x4994f4
push 0x4913c4
jmp 0x40fca6
push 0x49a1c0
push esi
call fcn.0045e589
add esp, 8
push 0x4994f4
test eax, eax
jne 0x40fca1
push str.cancel
jmp 0x40fca6
push 0x491384
push str.server_call_speedup
call fcn.00428070
add esp, 0xc
mov byte [ebp - 4], 5
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40fcce
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - method.CCheckCloudConfigMgr.virtual_0], vtable.CCheckCloudConfigMgr.0
push 0x49a1c4
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 0x10
call fcn.00407e20
push ecx
mov byte [ebp - 4], 0x11
mov esi, esp
mov dword [ebp - 0x41c], esi
mov ecx, dword [ebp - 0x418]
lea ecx, [ecx - 0x10]
call fcn.00407fe0
add eax, 0x10
lea ecx, [ebp - 0x448]
mov dword [esi], eax
call fcn.00416410
xor ebx, ebx
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x418]
cmp eax, 0xffffffff
mov eax, edi
setne bl
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40fd40
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
je 0x40fd89
mov eax, dword [0x4b1048]
mov dword [ebp - 0x428], 0
test eax, eax
jne 0x40fd7b
push 0x48
call fcn.004527fe
add esp, 4
mov dword [ebp - 0x41c], eax
mov ecx, eax
mov byte [ebp - 4], 0x12
call fcn.00409090
mov byte [ebp - 4], 0x10
mov dword [0x4b1048], eax
lea ecx, [ebp - 0x454]
push ecx
mov ecx, eax
call fcn.00409710
push ecx
mov ecx, esp
push str._shellextshow
call fcn.00407e20
lea ecx, [ebp - 0x448]
call fcn.004165d0
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40fe48
push str.XDSpeedup
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x40fdf2
lea ecx, [ebp - 0x424]
mov dword [ebp - 0x424], 0x3e8
push ecx
push 0
push 0x4a
push eax
mov dword [ebp - 0x420], 4
mov dword [ebp - 0x41c], str.test
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40fe48
push ecx
mov edx, str.pdfspeedup.exe
lea ecx, [ebp - 0x418]
call fcn.0041be00
add esp, 4
push dword [ebp - 0x418]
call ebx
test eax, eax
je 0x40fe2b
push 1
push 0
push str._shellextshow
push dword [ebp - 0x418]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x418]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40fe48
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ebp - 0x480], 0
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x468], 0
mov dword [ebp - 0x464], eax
mov dword [ebp - method.CEndSessionMgr.1.virtual_0], vtable.CEndSessionMgr.1.0
mov dword [ebp - method.CEndSessionMgr.virtual_0], vtable.CEndSessionMgr.0
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x13
push str._enableServer
call fcn.00407e20
lea ecx, [ebp - 0x448]
call fcn.004165d0
test eax, eax
je 0x40fec4
lea ecx, [ebp - 0x484]
mov dword [ebp - 0x428], 0
call fcn.0040ac90
lea ecx, [ebp - 0x4b8]
call fcn.00404550
push str._checkActive
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 0x14
call fcn.00407e20
push ecx
mov byte [ebp - 4], 0x15
mov esi, esp
mov dword [ebp - 0x41c], esi
mov ecx, dword [ebp - 0x418]
lea ecx, [ecx - 0x10]
call fcn.00407fe0
add eax, 0x10
lea ecx, [ebp - 0x448]
mov dword [esi], eax
call fcn.00416410
xor ecx, ecx
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x418]
cmp eax, 0xffffffff
mov eax, edi
setne cl
add edx, 0xfffffff0
mov dword [ebp - 0x42c], ecx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40ff43
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x42c]
test ecx, ecx
je 0x40ff5c
lea ecx, [ebp - 0x4b8]
mov dword [ebp - 0x428], 0
call fcn.00404a70
push ecx
mov ecx, esp
push str._launchMainProg
call fcn.00407e20
lea ecx, [ebp - 0x448]
call fcn.004165d0
test eax, eax
jne 0x40ffb4
push ecx
mov ecx, esp
push str._startmenu
call fcn.00407e20
lea ecx, [ebp - 0x448]
call fcn.004165d0
test eax, eax
jne 0x40ffb4
push ecx
mov ecx, esp
push str._taskbar
call fcn.004101f0
lea ecx, [ebp - 0x448]
call fcn.004165d0
test eax, eax
je 0x410098
lea ecx, [ebp - 0x418]
call fcn.0041bf50
push dword [ebp - 0x418]
call ebx
test eax, eax
je 0x410077
push str.Globalmasterpdf_server_event_C33B7EE9753C
push 0
push 2
mov byte [ebp - 4], 0x17
call dword [sym.imp.KERNEL32.dll_OpenEventW]
push str.Globalmasterpdf_server_mapping_C33B7EE9753C
push 0
mov esi, eax
push 2
mov dword [ebp - 0x41c], esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
je 0x41002d
test esi, esi
je 0x41002d
sub esp, 8
lea ecx, [ebp - 0x420]
push dword [ebp - 0x418]
call fcn.0042df50
mov esi, dword [ebp - 0x41c]
mov ebx, dword [ebp - 0x420]
test eax, eax
jns 0x41005f
sub esp, 0x10
mov dword [ebp - 0x41c], 0xffffffff
push dword [ebp - 0x418]
call fcn.00416d80
test eax, eax
jne 0x41005f
push 1
push eax
push eax
push dword [ebp - 0x418]
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x410070
push esi
call eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x410077
push ebx
call eax
mov byte [ebp - 4], 0x14
mov eax, edi
mov edx, dword [ebp - 0x418]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x410098
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x428], 0
je 0x4100a5
xor esi, esi
jmp 0x4100b2
mov ecx, dword [ebp - 0x458]
call fcn.004106a0
mov esi, eax
lea ecx, [ebp - 0x4b8]
call fcn.004046c0
push dword [ebp - 0x480]
mov dword [ebp - method.CEndSessionMgr.1.virtual_0], vtable.CEndSessionMgr.1.0
mov dword [ebp - method.CEndSessionMgr.virtual_0], vtable.CEndSessionMgr.0
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4100ed
push dword [ebp - 0x480]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 0x470]
mov dword [ebp - method.CSingletonBase_class_CEndSessionMgr_.virtual_0], vtable.CSingletonBase_class_CEndSessionMgr_.0
test eax, eax
je 0x410107
push eax
call fcn.004510cf
mov byte [ebp - 4], 1
mov eax, edi
mov edx, dword [ebp - 0x430]
mov dword [ebp - method.CCheckCloudConfigMgr.virtual_0], vtable.CCheckCloudConfigMgr.0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x410132
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x450]
lea ecx, [ebp - 0x450]
push eax
push dword [eax]
lea eax, [ebp - 0x41c]
push eax
call fcn.00410290
push dword [ebp - 0x450]
call fcn.00452308
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov ecx, dword [ebp - 0x444]
test ecx, ecx
je 0x410185
mov edx, dword [ebp - 0x440]
call fcn.0040c1c0
push dword [ebp - 0x444]
call fcn.00457f17
add esp, 4
mov edx, dword [ebp - 0x448]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x4101a0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045230d
mov esp, ebp
pop ebp
ret