Function at 0x41b6e4
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47786c
mov eax, dword fs:[0]
push eax
sub esp, 0x450
mov eax, dword [0x4bfd60]
xor eax, esp
mov dword [esp + 0x448], eax
push ebx
push esi
push edi
mov eax, dword [0x4bfd60]
xor eax, esp
push eax
lea eax, [esp + 0x460]
mov dword fs:[0], eax
mov esi, 0x105
push esi
xor edi, edi
lea eax, [esp + 0x38]
push edi
push eax
mov ebx, ecx
call fcn.00459cf0
add esp, 0xc
lea eax, [esp + 0x34]
push eax
push edi
push edi
push 0x801c
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
call edi
mov dword [esp + 0x10], eax
test eax, eax
jge 0x41b78d
push str.SHGetFolderPath_CSIDL_LOCAL_APPDATA_failed:
lea ecx, [esp + 0x18]
call fcn.004020a6
and dword [esp + 0x468], 0
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push 1
call fcn.004152d1
mov ecx, dword [esp + 0x20]
add esp, 0xc
mov esi, eax
jmp 0x41bfd3
lea eax, [esp + 0x34]
lea ecx, [ebx + 8]
push eax
mov dword [esp + 0x20], ecx
call fcn.0040211a
push esi
xor esi, esi
lea eax, [esp + 0x248]
push esi
push eax
call fcn.00459cf0
add esp, 0xc
lea eax, [esp + 0x244]
push eax
push esi
push esi
push 0x8023
push esi
call edi
mov edi, eax
cmp edi, esi
jge 0x41b7eb
push str.SHGetFolderPath_CSIDL_COMMON_APPDATA_failed:
lea ecx, [esp + 0x18]
call fcn.004020a6
push edi
xor eax, eax
lea ecx, [esp + 0x18]
inc eax
push ecx
mov dword [esp + 0x470], eax
push eax
jmp 0x41b77a
lea eax, [esp + 0x244]
lea ecx, [ebx + 0xc]
push eax
mov dword [esp + 0x30], ecx
call fcn.0040211a
push 0x4c4860
lea ecx, [esp + 0x2c]
call fcn.004020ea
push 0x2f
lea ecx, [esp + 0x2c]
mov dword [esp + 0x46c], 2
call fcn.0040c420
mov edi, eax
call fcn.0044825c
push eax
lea ecx, [esp + 0x24]
call fcn.0041872d
mov byte [esp + 0x468], 3
cmp edi, 0xffffffff
je 0x41b880
mov eax, dword [esp + 0x28]
mov eax, dword [eax - 0xc]
sub eax, edi
dec eax
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x30]
call fcn.0040c468
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x46c], 4
call fcn.00402573
mov byte [esp + 0x468], 3
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004025d2
call fcn.0044825c
push eax
lea ecx, [esp + 0x28]
call fcn.0041872d
mov edi, 0x4c47ec
mov eax, edi
mov byte [esp + 0x468], 5
call fcn.00405266
test eax, eax
jne 0x41ba05
mov eax, dword [esp + 0x20]
cmp dword [eax - 0xc], esi
jne 0x41b8df
push str.Manifest_URL_is_not_valid
lea ecx, [esp + 0x18]
call fcn.004020a6
push esi
lea eax, [esp + 0x18]
push eax
push 2
mov byte [esp + 0x474], 6
call fcn.004152d1
add esp, 0xc
jmp 0x41bfab
lea eax, [esp + 0x20]
lea ecx, [ebx + 0x18]
push eax
call fcn.00402573
lea esi, [ebx + 0x14]
lea eax, [esp + 0x28]
push eax
mov ecx, esi
mov dword [esp + 0x18], esi
call fcn.00402573
push esi
lea ecx, [esp + 0x28]
call fcn.00402573
push 0x4c485c
mov edi, str.AdobeARM_
lea eax, [esp + 0x1c]
push edi
push eax
call fcn.00401e40
add esp, 0xc
mov esi, 0x48415c
push esi
push eax
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x474], 7
call fcn.0040adb6
add esp, 0xc
mov ecx, dword [esp + 0x1c]
push eax
mov byte [esp + 0x46c], 8
call fcn.00401ec7
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004025d2
mov byte [esp + 0x468], 5
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.004025d2
push 0x4c485c
lea eax, [esp + 0x1c]
push edi
push eax
call fcn.00401e40
add esp, 0xc
push esi
push eax
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x474], 9
call fcn.0040adb6
add esp, 0xc
mov ecx, dword [esp + 0x2c]
push eax
mov byte [esp + 0x46c], 0xa
call fcn.00401ec7
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004025d2
mov byte [esp + 0x468], 5
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.004025d2
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x18]
push eax
call fcn.00401de9
add esp, 0xc
lea esi, [ebx + 4]
push eax
mov ecx, esi
mov byte [esp + 0x46c], 0xb
call fcn.00402573
mov byte [esp + 0x468], 5
mov ecx, dword [esp + 0x10]
jmp 0x41bdc5
push 0x4c4840
lea ecx, [esp + 0x1c]
call fcn.004020ea
mov byte [esp + 0x468], 0xc
call fcn.0044825c
push eax
lea ecx, [esp + 0x34]
call fcn.0041872d
lea eax, [esp + 0x30]
push eax
mov ecx, edi
mov byte [esp + 0x46c], 0xd
call fcn.0043ae18
push dword [esp + 0x30]
call fcn.00459cd7
pop ecx
mov esi, eax
call fcn.00405238
lea ecx, [ebx + 0x18]
test eax, eax
je 0x41bb62
push 0x480858
call fcn.0040211a
cmp esi, 0xa
jge 0x41ba96
push dword [0x4c4840]
mov ecx, dword [esp + 0x20]
mov edi, 0x12d
push edi
call fcn.00422789
push dword [0x4c4840]
mov ecx, dword [esp + 0x38]
push edi
call fcn.00422789
add esp, 0x10
jmp 0x41bb58
lea eax, [esp + 0x18]
push eax
mov edi, str.AdobeARMReader_
lea eax, [esp + 0x14]
push edi
push eax
call fcn.00401e40
add esp, 0xc
mov esi, 0x48415c
push esi
push eax
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x474], 0xe
call fcn.0040adb6
add esp, 0xc
mov ecx, dword [esp + 0x1c]
push eax
mov byte [esp + 0x46c], 0xf
call fcn.00401ec7
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004025d2
mov byte [esp + 0x468], 0xd
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004025d2
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push edi
push eax
call fcn.00401e40
add esp, 0xc
push esi
push eax
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x474], 0x10
call fcn.0040adb6
add esp, 0xc
mov ecx, dword [esp + 0x2c]
push eax
mov byte [esp + 0x46c], 0x11
call fcn.00401ec7
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004025d2
mov byte [esp + 0x468], 0xd
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004025d2
push 0x480858
jmp 0x41bc65
push str.Acrobat
call fcn.0040211a
cmp esi, 0xa
jge 0x41bb9e
push dword [0x4c4840]
mov ecx, dword [esp + 0x20]
mov edi, 0x12c
push edi
call fcn.00422789
push dword [0x4c4840]
mov ecx, dword [esp + 0x38]
push edi
call fcn.00422789
add esp, 0x10
jmp 0x41bc60
lea eax, [esp + 0x18]
push eax
mov edi, str.AdobeARMAcrobat_
lea eax, [esp + 0x14]
push edi
push eax
call fcn.00401e40
add esp, 0xc
mov esi, 0x48415c
push esi
push eax
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x474], 0x12
call fcn.0040adb6
add esp, 0xc
mov ecx, dword [esp + 0x1c]
push eax
mov byte [esp + 0x46c], 0x13
call fcn.00401ec7
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004025d2
mov byte [esp + 0x468], 0xd
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004025d2
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push edi
push eax
call fcn.00401e40
add esp, 0xc
push esi
push eax
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x474], 0x14
call fcn.0040adb6
add esp, 0xc
mov ecx, dword [esp + 0x2c]
push eax
mov byte [esp + 0x46c], 0x15
call fcn.00401ec7
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004025d2
mov byte [esp + 0x468], 0xd
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004025d2
push str.Acrobat
lea ecx, [esp + 0x28]
call fcn.0040211a
mov eax, dword [esp + 0x20]
cmp dword [eax - 0xc], 0
lea esi, [ebx + 0x18]
mov ecx, esi
jne 0x41bcd4
mov eax, dword [esp + 0x30]
push dword [eax - 0xc]
push eax
call fcn.00401f27
push str.Manifest3.msi
mov ecx, esi
call fcn.0040af5f
push esi
lea eax, [esp + 0x14]
push 0x4c46ac
push eax
call fcn.00401de9
add esp, 0xc
lea ecx, [ebx + 0x14]
mov byte [esp + 0x468], 0x16
push eax
mov dword [esp + 0x18], ecx
call fcn.00402573
mov byte [esp + 0x468], 0xd
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004025d2
jmp 0x41bcef
lea eax, [esp + 0x20]
push eax
call fcn.00402573
lea eax, [esp + 0x28]
lea ecx, [ebx + 0x14]
push eax
mov dword [esp + 0x18], ecx
call fcn.00402573
push esi
push dword [esp + 0x20]
lea eax, [esp + 0x18]
push eax
call fcn.00401de9
add esp, 0xc
lea esi, [ebx + 4]
push eax
mov ecx, esi
mov byte [esp + 0x46c], 0x17
call fcn.00402573
mov byte [esp + 0x468], 0xd
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004025d2
push str.UpgradeManifest.msi
push dword [esp + 0x20]
lea eax, [esp + 0x18]
push eax
call fcn.0040adb6
add esp, 0xc
lea ecx, [ebx + 0x10]
push eax
mov byte [esp + 0x46c], 0x18
call fcn.00402573
mov byte [esp + 0x468], 0xd
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004025d2
call fcn.0044825c
push eax
lea ecx, [esp + 0x14]
call fcn.0041872d
lea eax, [esp + 0x10]
push eax
mov ecx, 0x4c47ec
mov byte [esp + 0x46c], 0x19
call fcn.0043af40
mov edi, dword [esp + 0x10]
cmp dword [edi - 0xc], 0
lea eax, [esp + 0x30]
je 0x41bd9b
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x28]
call fcn.00401ec7
lea ecx, [edi - 0x10]
call fcn.004025d2
mov ecx, dword [esp + 0x30]
add ecx, 0xfffffff0
call fcn.004025d2
mov byte [esp + 0x468], 5
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.004025d2
mov edi, 0x4c4c24
mov eax, edi
call fcn.00405301
test eax, eax
je 0x41bed9
call fcn.0044825c
push eax
lea ecx, [esp + 0x1c]
call fcn.0041872d
lea eax, [esp + 0x18]
push eax
push edi
mov byte [esp + 0x470], 0x1a
call fcn.0041a5db
mov edi, dword [esp + 0x18]
cmp dword [edi - 0xc], 0
je 0x41be5b
push str.manifest_path_from_cmd:
lea ecx, [esp + 0x14]
call fcn.004020a6
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push 2
mov byte [esp + 0x478], 0x1b
call fcn.00414e01
mov byte [esp + 0x478], 0x1a
mov ecx, dword [esp + 0x20]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004025d2
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.00402573
jmp 0x41be94
lea eax, [ebx + 0x18]
push eax
push dword [esp + 0x30]
lea eax, [esp + 0x18]
push eax
call fcn.00401de9
add esp, 0xc
push eax
mov ecx, esi
mov byte [esp + 0x46c], 0x1c
call fcn.00402573
mov byte [esp + 0x468], 0x1a
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004025d2
push str.UpgradeManifest.msi
push dword [esp + 0x30]
lea eax, [esp + 0x18]
push eax
call fcn.0040adb6
add esp, 0xc
add ebx, 0x10
push eax
mov ecx, ebx
mov byte [esp + 0x46c], 0x1d
call fcn.00402573
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.004025d2
lea ecx, [edi - 0x10]
mov byte [esp + 0x468], 5
call fcn.004025d2
push dword [esp + 0x14]
lea eax, [esp + 0x28]
push eax
call fcn.0041549b
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov esi, dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
pop ecx
pop ecx
push 0
push eax
push 0
call esi
mov edi, eax
mov ebx, 0xa1
cmp edi, ebx
je 0x41bf7f
cmp edi, 3
je 0x41bf7f
mov edi, dword [esp + 0x2c]
mov eax, dword [edi]
push 0
push eax
push 0
call esi
mov esi, eax
cmp esi, ebx
je 0x41bf50
cmp esi, 3
je 0x41bf50
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.004025d2
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.004025d2
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.004025d2
xor eax, eax
inc eax
jmp 0x41bfdd
push str.SHCreateDirectoryEx___failed:
lea ecx, [esp + 0x14]
call fcn.004020a6
push esi
push edi
lea eax, [esp + 0x18]
push eax
push 1
mov byte [esp + 0x478], 0x1f
call fcn.00414e01
mov ecx, dword [esp + 0x20]
add esp, 0x10
mov esi, eax
jmp 0x41bfaf
push str.SHCreateDirectoryEx___failed:
lea ecx, [esp + 0x18]
call fcn.004020a6
push edi
push dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
push 1
mov byte [esp + 0x478], 0x1e
call fcn.00414e01
add esp, 0x10
mov esi, eax
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.004025d2
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.004025d2
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.004025d2
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.004025d2
mov eax, esi
mov ecx, dword [esp + 0x460]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x448]
xor ecx, esp
call fcn.00458e0e
mov esp, ebp
pop ebp
ret