| BugId: | OOBW[0x114]+4 8ab |
| Location: | acrord32.exe!acroform.api+0x48B908 |
| Description: | An Access Violation exception happened at 0x62621000 while attempting to write memory at 0x62621000; 4 bytes beyond a 276/0x114 bytes heap block at 0x62620EE8. This indicates an Out-Of-Bounds (OOB) access bug was triggered. |
| Version: | AcroRd32.exe: 18.11.20040.19174 (x86) AcroForm.api: 18.11.20040.19174 (x86) |
| Security impact: | Potentially exploitable security issue that indicates arbitrary code execution may be possible. |
| Arguments: | ['/n', 'OOBW@0x48B908.pdf'] |
| eax = 0xFFFFFE00 | xmm0 = 0x40EFFF8000000000 |
| ebx = 0x0 | xmm1 = 0x0 |
| ecx = 0xFFFFFE9B | xmm2 = 0x0 |
| edx = 0xFFE9B800 | xmm3 = 0x0 |
| esi = 0x0 | xmm4 = 0x0 |
| edi = 0x0 | xmm5 = 0x0 |
| esp = 0x119CDB4 | xmm6 = 0x402A5A00 |
| ebp = 0x62621008 | xmm7 = 0x3EC05AEB |
| 62620ec8 | *bb bb cd ab | ╗╗═½ | abcdbbbb | // *0=Page heap StartStamp |
| 62620ecc | *00 10 c5 05 | ␀►┼♣ | 05c51000 → ffeeddcc | // *0=Page heap Heap |
| 62620ed0 | *14 01 00 00 | ¶☺␀␀ | 00000114 | // *0=Page heap RequestedSize |
| 62620ed4 | *00 10 00 00 | ␀►␀␀ | 00001000 | // *0=Page heap ActualSize |
| 62620ed8 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620edc | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620ee0 | *2c 0b f6 04 | ,♂÷♦ | 04f60b2c → 04c73c54 | // *0=Page heap StackTrace |
| 62620ee4 | *bb bb ba dc | ╗╗║▄ | dcbabbbb | // *0=Page heap EndStamp |
| 62620ee8 | *04 00 00 00 | ♦␀␀␀ | 00000004 | // *0=Heap block start |
| 62620eec | c4 56 c4 60 | ─V─` | 60c456c4 → 608fbb5d AcroForm!DllUnregisterServer+0x244940 | |
| 62620ef0 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620ef4 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620ef8 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620efc | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f00 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f04 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f08 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f0c | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f10 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f14 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f18 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f1c | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f20 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f24 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f28 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f2c | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f30 | c4 56 c4 60 | ─V─` | 60c456c4 → 608fbb5d AcroForm!DllUnregisterServer+0x244940 | |
| 62620f34 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f38 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f3c | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f40 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f44 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f48 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f4c | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f50 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f54 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f58 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f5c | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f60 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f64 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f68 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f6c | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f70 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f74 | c4 56 c4 60 | ─V─` | 60c456c4 → 608fbb5d AcroForm!DllUnregisterServer+0x244940 | |
| 62620f78 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f7c | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f80 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f84 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f88 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f8c | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f90 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f94 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f98 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620f9c | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620fa0 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620fa4 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620fa8 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620fac | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620fb0 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620fb4 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620fb8 | c4 56 c4 60 | ─V─` | 60c456c4 → 608fbb5d AcroForm!DllUnregisterServer+0x244940 | |
| 62620fbc | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620fc0 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620fc4 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620fc8 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620fcc | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620fd0 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620fd4 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620fd8 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620fdc | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620fe0 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620fe4 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620fe8 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620fec | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620ff0 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620ff4 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620ff8 | 00 00 00 00 | ␀␀␀␀ | 00000000 | |
| 62620ffc | *d0 d0 d0 d0 | ╨╨╨╨ | d0d0d0d0 | // *0=Heap block end, *0=Page heap allocation end padding |
| 62621000 | -- inaccessible -- | // *0=Access violation, *0=Allocation end | ||
| 62621004 | -- inaccessible -- | |||
| 62621008 | -- inaccessible -- | |||
| 6262100c | -- inaccessible -- | |||
| 62621010 | -- inaccessible -- | |||
| 62621014 | -- inaccessible -- | |||
| 62621018 | -- inaccessible -- | |||
| 6262101c | -- inaccessible -- | |||
| 62621020 | -- inaccessible -- | |||
| 62621024 | -- inaccessible -- | |||
| 62621028 | -- inaccessible -- | |||
| 6262102c | -- inaccessible -- | |||
| 62621030 | -- inaccessible -- | |||
| 62621034 | -- inaccessible -- | |||
| 62621038 | -- inaccessible -- | |||
| 6262103c | -- inaccessible -- | |||
| 62621040 | -- inaccessible -- | |||
| 62621044 | -- inaccessible -- | |||
| 62621048 | -- inaccessible -- | |||
| 6262104c | -- inaccessible -- | |||
| 62621050 | -- inaccessible -- | |||
| 62621054 | -- inaccessible -- | |||
| 62621058 | -- inaccessible -- | |||
| 6262105c | -- inaccessible -- | |||
| 62621060 | -- inaccessible -- | |||
| 62621064 | -- inaccessible -- | |||
| 62621068 | -- inaccessible -- | |||
| 6262106c | -- inaccessible -- | |||
| 62621070 | -- inaccessible -- | |||
| 62621074 | -- inaccessible -- | |||
| 62621078 | -- inaccessible -- | |||
| 6262107c | -- inaccessible -- | |||
| 62621080 | -- inaccessible -- | |||
| 62621084 | -- inaccessible -- | |||
| 62621088 | -- inaccessible -- | |||
| 6262108c | -- inaccessible -- | |||
| 62621090 | -- inaccessible -- | |||
| 62621094 | -- inaccessible -- | |||
| 62621098 | -- inaccessible -- | |||
| 6262109c | -- inaccessible -- | |||
| 626210a0 | -- inaccessible -- | |||
| 626210a4 | -- inaccessible -- | |||
| 626210a8 | -- inaccessible -- | |||
| 626210ac | -- inaccessible -- | |||
| 626210b0 | -- inaccessible -- | |||
| 626210b4 | -- inaccessible -- | |||
| 626210b8 | -- inaccessible -- | |||
| 626210bc | -- inaccessible -- | |||
| 626210c0 | -- inaccessible -- | |||
| 626210c4 | -- inaccessible -- | |||
| 626210c8 | -- inaccessible -- | |||
| 626210cc | -- inaccessible -- | |||
| 626210d0 | -- inaccessible -- | |||
| 626210d4 | -- inaccessible -- | |||
| 626210d8 | -- inaccessible -- | |||
| 626210dc | -- inaccessible -- | |||
| 626210e0 | -- inaccessible -- | |||
| 626210e4 | -- inaccessible -- | |||
| 626210e8 | -- inaccessible -- | |||
| 626210ec | -- inaccessible -- | |||
| 626210f0 | -- inaccessible -- | |||
| 626210f4 | -- inaccessible -- | |||
| 626210f8 | -- inaccessible -- | |||
| 626210fc | -- inaccessible -- | |||
| 62621100 | -- inaccessible -- | |||
| 62621104 | -- inaccessible -- | |||
| 62621108 | -- inaccessible -- | |||
| 6262110c | -- inaccessible -- | |||
| 62621110 | -- inaccessible -- | |||
| 62621114 | -- inaccessible -- | |||
| 62621118 | -- inaccessible -- | |||
| 6262111c | -- inaccessible -- | |||
| 62621120 | -- inaccessible -- | |||
| 62621124 | -- inaccessible -- | |||
| 62621128 | -- inaccessible -- | |||
| 6262112c | -- inaccessible -- | |||
| 62621130 | -- inaccessible -- | |||
| 62621134 | -- inaccessible -- | |||
| 62621138 | -- inaccessible -- | |||
| 6262113c | -- inaccessible -- | |||
| 62621140 | -- inaccessible -- | |||
| 62621144 | -- inaccessible -- | |||
| 62621148 | -- inaccessible -- | |||
| 6262114c | -- inaccessible -- | |||
| 62621150 | -- inaccessible -- | |||
| 62621154 | -- inaccessible -- | |||
| 62621158 | -- inaccessible -- | |||
| 6262115c | -- inaccessible -- | |||
| 62621160 | -- inaccessible -- | |||
| 62621164 | -- inaccessible -- | |||
| 62621168 | -- inaccessible -- | |||
| 6262116c | -- inaccessible -- | |||
| 62621170 | -- inaccessible -- | |||
| 62621174 | -- inaccessible -- | |||
| 62621178 | -- inaccessible -- | |||
| 6262117c | -- inaccessible -- | |||
| 62621180 | -- inaccessible -- | |||
| 62621184 | -- inaccessible -- | |||
| 62621188 | -- inaccessible -- | |||
| 6262118c | -- inaccessible -- | |||
| 62621190 | -- inaccessible -- | |||
| 62621194 | -- inaccessible -- | |||
| 62621198 | -- inaccessible -- | |||
| 6262119c | -- inaccessible -- | |||
| 626211a0 | -- inaccessible -- | |||
| 626211a4 | -- inaccessible -- | |||
| 626211a8 | -- inaccessible -- | |||
| 626211ac | -- inaccessible -- | |||
| 626211b0 | -- inaccessible -- | |||
| 626211b4 | -- inaccessible -- | |||
| 626211b8 | -- inaccessible -- | |||
| 626211bc | -- inaccessible -- | |||
| 626211c0 | -- inaccessible -- | |||
| 626211c4 | -- inaccessible -- | |||
| 626211c8 | -- inaccessible -- | |||
| 626211cc | -- inaccessible -- | |||
| 626211d0 | -- inaccessible -- | |||
| 626211d4 | -- inaccessible -- | |||
| 626211d8 | -- inaccessible -- | |||
| 626211dc | -- inaccessible -- | |||
| 626211e0 | -- inaccessible -- | |||
| 626211e4 | -- inaccessible -- | |||
| 626211e8 | -- inaccessible -- | |||
| 626211ec | -- inaccessible -- | |||
| 626211f0 | -- inaccessible -- | |||
| 626211f4 | -- inaccessible -- | |||
| 626211f8 | -- inaccessible -- | |||
| 626211fc | -- inaccessible -- | |||
| 62621200 | -- inaccessible -- | |||
| 62621204 | -- inaccessible -- | |||
| 62621208 | -- inaccessible -- | |||
| 6262120c | -- inaccessible -- | |||
| 62621210 | -- inaccessible -- | |||
| 62621214 | -- inaccessible -- | |||
| 62621218 | -- inaccessible -- | |||
| 6262121c | -- inaccessible -- | |||
| 62621220 | -- inaccessible -- | |||
| 62621224 | -- inaccessible -- | |||
| 62621228 | -- inaccessible -- | |||
| 6262122c | -- inaccessible -- | |||
| 62621230 | -- inaccessible -- | |||
| 62621234 | -- inaccessible -- | |||
| 62621238 | -- inaccessible -- | |||
| 6262123c | -- inaccessible -- | |||
| 62621240 | -- inaccessible -- | |||
| 62621244 | -- inaccessible -- | |||
| 62621248 | -- inaccessible -- | |||
| 6262124c | -- inaccessible -- | |||
| 62621250 | -- inaccessible -- | |||
| 62621254 | -- inaccessible -- | |||
| 62621258 | -- inaccessible -- | |||
| 6262125c | -- inaccessible -- | |||
| 62621260 | -- inaccessible -- | |||
| 62621264 | -- inaccessible -- | |||
| 62621268 | -- inaccessible -- | |||
| 6262126c | -- inaccessible -- | |||
| 62621270 | -- inaccessible -- | |||
| 62621274 | -- inaccessible -- | |||
| 62621278 | -- inaccessible -- | |||
| 6262127c | -- inaccessible -- | |||
| 62621280 | -- inaccessible -- | |||
| 62621284 | -- inaccessible -- | |||
| 62621288 | -- inaccessible -- | |||
| 6262128c | -- inaccessible -- | |||
| 62621290 | -- inaccessible -- | |||
| 62621294 | -- inaccessible -- | |||
| 62621298 | -- inaccessible -- | |||
| 6262129c | -- inaccessible -- | |||
| 626212a0 | -- inaccessible -- | |||
| 626212a4 | -- inaccessible -- | |||
| 626212a8 | -- inaccessible -- | |||
| 626212ac | -- inaccessible -- | |||
| 626212b0 | -- inaccessible -- | |||
| 626212b4 | -- inaccessible -- | |||
| 626212b8 | -- inaccessible -- | |||
| 626212bc | -- inaccessible -- | |||
| 626212c0 | -- inaccessible -- | |||
| 626212c4 | -- inaccessible -- | |||
| 626212c8 | -- inaccessible -- | |||
| 626212cc | -- inaccessible -- | |||
| 626212d0 | -- inaccessible -- | |||
| 626212d4 | -- inaccessible -- | |||
| 626212d8 | -- inaccessible -- | |||
| 626212dc | -- inaccessible -- | |||
| 626212e0 | -- inaccessible -- | |||
| 626212e4 | -- inaccessible -- | |||
| 626212e8 | -- inaccessible -- | |||
| 626212ec | -- inaccessible -- | |||
| 626212f0 | -- inaccessible -- | |||
| 626212f4 | -- inaccessible -- | |||
| 626212f8 | -- inaccessible -- | |||
| 626212fc | -- inaccessible -- | |||
| 62621300 | -- inaccessible -- | |||
| 62621304 | -- inaccessible -- | |||
| 62621308 | -- inaccessible -- | |||
| 6262130c | -- inaccessible -- | |||
| 62621310 | -- inaccessible -- | |||
| 62621314 | -- inaccessible -- | |||
| 62621318 | -- inaccessible -- | |||
| 6262131c | -- inaccessible -- | |||
| 62621320 | -- inaccessible -- | |||
| 62621324 | -- inaccessible -- | |||
| 62621328 | -- inaccessible -- | |||
| 6262132c | -- inaccessible -- | |||
| 62621330 | -- inaccessible -- | |||
| 62621334 | -- inaccessible -- | |||
| 62621338 | -- inaccessible -- | |||
| 6262133c | -- inaccessible -- | |||
| 62621340 | -- inaccessible -- | |||
| 62621344 | -- inaccessible -- | |||
| 62621348 | -- inaccessible -- | |||
| 6262134c | -- inaccessible -- | |||
| 62621350 | -- inaccessible -- | |||
| 62621354 | -- inaccessible -- | |||
| 62621358 | -- inaccessible -- | |||
| 6262135c | -- inaccessible -- | |||
| 62621360 | -- inaccessible -- | |||
| 62621364 | -- inaccessible -- | |||
| 62621368 | -- inaccessible -- | |||
| 6262136c | -- inaccessible -- | |||
| 62621370 | -- inaccessible -- | |||
| 62621374 | -- inaccessible -- | |||
| 62621378 | -- inaccessible -- | |||
| 6262137c | -- inaccessible -- | |||
| 62621380 | -- inaccessible -- | |||
| 62621384 | -- inaccessible -- | |||
| 62621388 | -- inaccessible -- | |||
| 6262138c | -- inaccessible -- | |||
| 62621390 | -- inaccessible -- | |||
| 62621394 | -- inaccessible -- | |||
| 62621398 | -- inaccessible -- | |||
| 6262139c | -- inaccessible -- | |||
| 626213a0 | -- inaccessible -- | |||
| 626213a4 | -- inaccessible -- | |||
| 626213a8 | -- inaccessible -- | |||
| 626213ac | -- inaccessible -- | |||
| 626213b0 | -- inaccessible -- | |||
| 626213b4 | -- inaccessible -- | |||
| 626213b8 | -- inaccessible -- | |||
| 626213bc | -- inaccessible -- | |||
| 626213c0 | -- inaccessible -- | |||
| 626213c4 | -- inaccessible -- | |||
| 626213c8 | -- inaccessible -- | |||
| 626213cc | -- inaccessible -- | |||
| 626213d0 | -- inaccessible -- | |||
| 626213d4 | -- inaccessible -- | |||
| 608fb836 | 83c10c | add ecx,0Ch |
| 608fb839 | 89442420 | mov dword ptr [esp+20h],eax |
| 608fb83d | 894c241c | mov dword ptr [esp+1Ch],ecx |
| 608fb841 | 8b50a0 | mov edx,dword ptr [eax-60h] |
| 608fb844 | 8b70e0 | mov esi,dword ptr [eax-20h] |
| 608fb847 | 8b8860ffffff | mov ecx,dword ptr [eax-0A0h] |
| 608fb84d | 8b18 | mov ebx,dword ptr [eax] |
| 608fb84f | 8b4020 | mov eax,dword ptr [eax+20h] |
| 608fb852 | 8d2c32 | lea ebp,[edx+esi] |
| 608fb855 | 2bf2 | sub esi,edx |
| 608fb857 | 896c242c | mov dword ptr [esp+2Ch],ebp |
| 608fb85b | 8d2c08 | lea ebp,[eax+ecx] |
| 608fb85e | 2bc8 | sub ecx,eax |
| 608fb860 | 6bf922 | imul edi,ecx,22h |
| 608fb863 | 6bce53 | imul ecx,esi,53h |
| 608fb866 | 8b742420 | mov esi,dword ptr [esp+20h] |
| 608fb86a | 896c2430 | mov dword ptr [esp+30h],ebp |
| 608fb86e | 2b6c242c | sub ebp,dword ptr [esp+2Ch] |
| 608fb872 | c1ff06 | sar edi,6 |
| 608fb875 | 8b8640ffffff | mov eax,dword ptr [esi-0C0h] |
| 608fb87b | 89442410 | mov dword ptr [esp+10h],eax |
| 608fb87f | 8b56c0 | mov edx,dword ptr [esi-40h] |
| 608fb882 | c1f906 | sar ecx,6 |
| 608fb885 | 6bed2d | imul ebp,ebp,2Dh |
| 608fb888 | 8d0439 | lea eax,[ecx+edi] |
| 608fb88b | 6bc02d | imul eax,eax,2Dh |
| 608fb88e | c1fd06 | sar ebp,6 |
| 608fb891 | c1f806 | sar eax,6 |
| 608fb894 | 89442414 | mov dword ptr [esp+14h],eax |
| 608fb898 | 8b4680 | mov eax,dword ptr [esi-80h] |
| 608fb89b | 2bc3 | sub eax,ebx |
| 608fb89d | 8b5c2414 | mov ebx,dword ptr [esp+14h] |
| 608fb8a1 | 2bd9 | sub ebx,ecx |
| 608fb8a3 | 6bf02d | imul esi,eax,2Dh |
| 608fb8a6 | 03df | add ebx,edi |
| 608fb8a8 | 8b7c2410 | mov edi,dword ptr [esp+10h] |
| 608fb8ac | 8d8f00080800 | lea ecx,[edi+80800h] |
| 608fb8b2 | c1fe06 | sar esi,6 |
| 608fb8b5 | 2bfa | sub edi,edx |
| 608fb8b7 | 03ca | add ecx,edx |
| 608fb8b9 | 8b542420 | mov edx,dword ptr [esp+20h] |
| 608fb8bd | 81c700080800 | add edi,80800h |
| 608fb8c3 | 8b02 | mov eax,dword ptr [edx] |
| 608fb8c5 | 03c6 | add eax,esi |
| 608fb8c7 | 034280 | add eax,dword ptr [edx-80h] |
| 608fb8ca | 8d1408 | lea edx,[eax+ecx] |
| 608fb8cd | 2bc8 | sub ecx,eax |
| 608fb8cf | 89542418 | mov dword ptr [esp+18h],edx |
| 608fb8d3 | 8d1437 | lea edx,[edi+esi] |
| 608fb8d6 | 8b442418 | mov eax,dword ptr [esp+18h] |
| 608fb8da | 2bfe | sub edi,esi |
| 608fb8dc | 8b742414 | mov esi,dword ptr [esp+14h] |
| 608fb8e0 | 897c2410 | mov dword ptr [esp+10h],edi |
| 608fb8e4 | 03f5 | add esi,ebp |
| 608fb8e6 | 8d3c2b | lea edi,[ebx+ebp] |
| 608fb8e9 | 89542424 | mov dword ptr [esp+24h],edx |
| 608fb8ed | 035c2430 | add ebx,dword ptr [esp+30h] |
| 608fb8f1 | 035c242c | add ebx,dword ptr [esp+2Ch] |
| 608fb8f5 | 03c3 | add eax,ebx |
| 608fb8f7 | 894c2428 | mov dword ptr [esp+28h],ecx |
| 608fb8fb | c1f80c | sar eax,0Ch |
| 608fb8fe | 50 | push eax |
| 608fb8ff | e840320000 | call AcroForm!DllUnregisterServer+0x247927 (608feb44) |
| 608fb904 | 8b6c2420 | mov ebp,dword ptr [esp+20h] |
| 608fb908 | 8845f8 | mov byte ptr [ebp-8],al // current instruction |
| 608fb90b | 8b442428 | mov eax,dword ptr [esp+28h] |
| 608fb90f | 03c7 | add eax,edi |
| 608fb911 | c1f80c | sar eax,0Ch |
| 608fb914 | 50 | push eax |
| 608fb915 | e82a320000 | call AcroForm!DllUnregisterServer+0x247927 (608feb44) |
| 608fb91a | 884500 | mov byte ptr [ebp],al |
| 608fb91d | 8b442418 | mov eax,dword ptr [esp+18h] |
| 608fb921 | 03c6 | add eax,esi |
| 608fb923 | c1f80c | sar eax,0Ch |
| 608fb926 | 50 | push eax |
| 608fb927 | e818320000 | call AcroForm!DllUnregisterServer+0x247927 (608feb44) |
| 608fb92c | 884508 | mov byte ptr [ebp+8],al |
| 608fb92f | 8b442420 | mov eax,dword ptr [esp+20h] |
| 608fb933 | 8b6c2434 | mov ebp,dword ptr [esp+34h] |
| 608fb937 | 03c5 | add eax,ebp |
| 608fb939 | c1f80c | sar eax,0Ch |
| 608fb93c | 50 | push eax |
| 608fb93d | e802320000 | call AcroForm!DllUnregisterServer+0x247927 (608feb44) |
| 608fb942 | 8b4c242c | mov ecx,dword ptr [esp+2Ch] |
| 608fb946 | 2b6c2424 | sub ebp,dword ptr [esp+24h] |
| 608fb94a | c1fd0c | sar ebp,0Ch |
| 608fb94d | 55 | push ebp |
| 608fb94e | 884110 | mov byte ptr [ecx+10h],al |
| 608fb951 | e8ee310000 | call AcroForm!DllUnregisterServer+0x247927 (608feb44) |
| 608fb956 | 8b6c2430 | mov ebp,dword ptr [esp+30h] |
| 608fb95a | 884518 | mov byte ptr [ebp+18h],al |
| 608fb95d | 8b442424 | mov eax,dword ptr [esp+24h] |
| 608fb961 | 2bc6 | sub eax,esi |
| 608fb963 | c1f80c | sar eax,0Ch |
| 608fb966 | 50 | push eax |
| 608fb967 | e8d8310000 | call AcroForm!DllUnregisterServer+0x247927 (608feb44) |
| 608fb96c | 884520 | mov byte ptr [ebp+20h],al |
| 608fb96f | 8b44243c | mov eax,dword ptr [esp+3Ch] |
| 608fb973 | 2bc7 | sub eax,edi |
| 608fb975 | c1f80c | sar eax,0Ch |
| 608fb978 | 50 | push eax |
| 608fb979 | e8c6310000 | call AcroForm!DllUnregisterServer+0x247927 (608feb44) |
| 608fb97e | 884528 | mov byte ptr [ebp+28h],al |
| 608fb981 | 8b442434 | mov eax,dword ptr [esp+34h] |
| 608fb985 | 2bc3 | sub eax,ebx |
| 608fb987 | c1f80c | sar eax,0Ch |
| 608fb98a | 50 | push eax |
| 608fb98b | e8b4310000 | call AcroForm!DllUnregisterServer+0x247927 (608feb44) |
| 608fb990 | 884530 | mov byte ptr [ebp+30h],al |
| 608fb993 | 83c420 | add esp,20h |
| 608fb996 | 8b442420 | mov eax,dword ptr [esp+20h] |
| 608fb99a | 83c004 | add eax,4 |
| 608fb99d | 45 | inc ebp |
| 608fb99e | ff4c2438 | dec dword ptr [esp+38h] |
| Image path | AcroRd32.exe |
| Image name | AcroRd32.exe |
| Timestamp | Fri May 11 00:19:40 2018 (5AF4C57C) |
| CheckSum | 0022F148 |
| ImageSize | 00230000 |
| File version | 18.11.20040.19174 |
| Product version | 18.11.20040.19174 |
| File flags | 0 (Mask 3F) |
| File OS | 50004 CE Win32 |
| File type | 1.0 App |
| File date | 00000000.00000000 |
| Translations | 0409.04e4 |
| CompanyName | Adobe Systems Incorporated |
| ProductName | Adobe Acrobat Reader DC |
| OriginalFilename | AcroRd32.exe |
| ProductVersion | 18.11.20040.281318 |
| FileVersion | 18.11.20040.281318 |
| FileDescription | Adobe Acrobat Reader DC |
| LegalCopyright | Copyright 1984-2017 Adobe Systems Incorporated and its licensors. All rights reserved. |
| Loaded symbol image file | c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm.api |
| Image path | c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm.api |
| Image name | AcroForm.api |
| Timestamp | Fri May 11 00:09:31 2018 (5AF4C31B) |
| CheckSum | 00000000 |
| ImageSize | 00CFB000 |
| File version | 18.11.20040.19174 |
| Product version | 18.11.20040.19174 |
| File flags | 0 (Mask 3F) |
| File OS | 4 Unknown Win32 |
| File type | 2.0 Dll |
| File date | 00000000.00000000 |
| Translations | 0409.04b0 |
| CompanyName | Adobe Systems Incorporated |
| ProductName | Adobe Acrobat Forms |
| InternalName | AcroForm |
| OriginalFilename | AcroForm.api |
| ProductVersion | 18.11.20040.281318 |
| FileVersion | 18.11.20040.281318 |
| FileDescription | Adobe Acrobat Forms Plug-In |
| LegalCopyright | Copyright 1984-2017 Adobe Systems Incorporated and its licensors. All rights reserved. |
| LegalTrademarks | Adobe, Acrobat and the Acrobat logo are trademarks of Adobe Systems Incorporated which may be registered in certain jurisdictions. |
| Comments | The Acrobat Forms plug-in allows users to create dynamic electronic forms for fill-in and transmittal. |