Function at 0x40916d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1864
call fcn.00411e40
push esi
push edi
lea edi, [ebp - 0x1864]
mov ecx, 0x619
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x43b004]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov byte [ebp - 6], 0
call fcn.004105bd
movzx eax, al
test eax, eax
je 0x4091b4
mov al, byte [ebp - 5]
jmp 0x40950e
push 0x400
lea eax, [ebp - 0x80c]
push eax
call fcn.00407be8
pop ecx
pop ecx
test eax, eax
je 0x40920c
push 0x400
lea eax, [ebp - 0x1014]
push eax
call fcn.00407a1a
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x40920c
mov esi, esp
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40920c
mov byte [ebp - 6], 1
call fcn.004103b6
test eax, eax
jne 0x409221
movzx eax, byte [ebp - 6]
test eax, eax
je 0x4094fb
push 0x208
push 0
lea eax, [ebp - 0x1224]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x1434]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x104
lea eax, [ebp - 0x1434]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp esi, esp
call fcn.00411bb8
cmp eax, 0x104
jb 0x409279
mov al, byte [ebp - 5]
jmp 0x40950e
mov byte [ebp - 0x1439], 0
mov esi, esp
push 0x104
lea eax, [ebp - 0x1434]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr_s]
pop ecx
pop ecx
cmp esi, esp
call fcn.00411bb8
push str.adelrcp.exe
lea eax, [ebp - 0x1434]
push eax
call fcn.00401896
pop ecx
pop ecx
test eax, eax
jne 0x4092c3
mov byte [ebp - 0x1439], 1
mov al, byte [ebp - 5]
jmp 0x40950e
movzx eax, byte [0x43b308]
test eax, eax
je 0x4092d5
mov al, 1
jmp 0x40950e
lea eax, [ebp - 0x1224]
push eax
lea eax, [ebp - 0x1434]
push eax
call fcn.0040f7a2
pop ecx
pop ecx
test eax, eax
jne 0x4092f6
mov al, byte [ebp - 5]
jmp 0x40950e
and dword [ebp - 0x1440], 0
push 0x423988
lea eax, [ebp - 0x1224]
push eax
call fcn.00401896
pop ecx
pop ecx
test eax, eax
je 0x40931e
mov dword [ebp - 0x1440], 1
push 0x104
lea eax, [ebp - 0x1434]
push eax
call fcn.0040f9b2
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x409352
push 0x104
lea eax, [ebp - 0x1434]
push eax
call fcn.0040f9b2
pop ecx
pop ecx
movzx eax, al
test eax, eax
jne 0x40935a
mov al, byte [ebp - 5]
jmp 0x40950e
cmp dword [ebp - 0x1440], 0
je 0x409388
mov esi, esp
push str.ESLAiodlite.dll__CreateReaderUserSettings
push 0x104
lea eax, [ebp - 0x1434]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
jmp 0x4093ab
mov esi, esp
push str.ESLAiod.dll__CreateAcroUserSettings
push 0x104
lea eax, [ebp - 0x1434]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
push 0x208
push 0
lea eax, [ebp - 0x164c]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x104
lea eax, [ebp - 0x164c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp esi, esp
call fcn.00411bb8
cmp eax, 0x104
jb 0x4093eb
mov al, byte [ebp - 5]
jmp 0x40950e
mov esi, esp
push str._rundll32.exe
push 0x104
lea eax, [ebp - 0x164c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
test eax, eax
je 0x40941a
mov al, byte [ebp - 5]
jmp 0x40950e
push 0x208
push 0
lea eax, [ebp - 0x185c]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x423a54
push 0x104
lea eax, [ebp - 0x185c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0x164c]
push eax
push 0x104
lea eax, [ebp - 0x185c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
push 0x423a58
push 0x104
lea eax, [ebp - 0x185c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
mov esi, esp
lea eax, [ebp - 0x1434]
push eax
push 0x104
lea eax, [ebp - 0x185c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411bb8
lea eax, [ebp - 0x185c]
push eax
call fcn.004106f4
pop ecx
test eax, eax
je 0x4094da
mov byte [ebp - 0x1861], 1
jmp 0x4094e1
mov byte [ebp - 0x1861], 0
mov al, byte [ebp - 0x1861]
mov byte [ebp - 5], al
movzx eax, byte [ebp - 5]
test eax, eax
je 0x4094f9
mov byte [0x43b308], 1
jmp 0x40950b
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004015cd
pop ecx
pop ecx
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
push edx
mov ecx, ebp
push eax
lea edx, [0x40953d]
call fcn.00411b62
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00411bf0
add esp, 0x1864
cmp ebp, esp
call fcn.00411bb8
leave
ret