Function at 0x40916d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1864
call fcn.00411f80
push esi
push edi
lea edi, [ebp - 0x1864]
mov ecx, 0x619
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x43f004]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov byte [ebp - 6], 0
call fcn.004106f9
movzx eax, al
test eax, eax
je 0x4091b4
mov al, byte [ebp - 5]
jmp 0x40950e
push 0x400
lea eax, [ebp - 0x80c]
push eax
call fcn.00407be8
pop ecx
pop ecx
test eax, eax
je 0x40920c
push 0x400
lea eax, [ebp - 0x1014]
push eax
call fcn.00407a1a
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x40920c
mov esi, esp
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40920c
mov byte [ebp - 6], 1
call fcn.004104f2
test eax, eax
jne 0x409221
movzx eax, byte [ebp - 6]
test eax, eax
je 0x4094fb
push 0x208
push 0
lea eax, [ebp - 0x1224]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x1434]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x104
lea eax, [ebp - 0x1434]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp esi, esp
call fcn.00411cf8
cmp eax, 0x104
jb 0x409279
mov al, byte [ebp - 5]
jmp 0x40950e
mov byte [ebp - 0x1439], 0
mov esi, esp
push 0x104
lea eax, [ebp - 0x1434]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr_s]
pop ecx
pop ecx
cmp esi, esp
call fcn.00411cf8
push str.adelrcp.exe
lea eax, [ebp - 0x1434]
push eax
call fcn.00401896
pop ecx
pop ecx
test eax, eax
jne 0x4092c3
mov byte [ebp - 0x1439], 1
mov al, byte [ebp - 5]
jmp 0x40950e
movzx eax, byte [0x43f318]
test eax, eax
je 0x4092d5
mov al, 1
jmp 0x40950e
lea eax, [ebp - 0x1224]
push eax
lea eax, [ebp - 0x1434]
push eax
call fcn.0040f7d6
pop ecx
pop ecx
test eax, eax
jne 0x4092f6
mov al, byte [ebp - 5]
jmp 0x40950e
and dword [ebp - 0x1440], 0
push 0x426420
lea eax, [ebp - 0x1224]
push eax
call fcn.00401896
pop ecx
pop ecx
test eax, eax
je 0x40931e
mov dword [ebp - 0x1440], 1
push 0x104
lea eax, [ebp - 0x1434]
push eax
call fcn.0040f9f2
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x409352
push 0x104
lea eax, [ebp - 0x1434]
push eax
call fcn.0040f9f2
pop ecx
pop ecx
movzx eax, al
test eax, eax
jne 0x40935a
mov al, byte [ebp - 5]
jmp 0x40950e
cmp dword [ebp - 0x1440], 0
je 0x409388
mov esi, esp
push str.ESLAiodlite.dll__CreateReaderUserSettings
push 0x104
lea eax, [ebp - 0x1434]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
jmp 0x4093ab
mov esi, esp
push str.ESLAiod.dll__CreateAcroUserSettings
push 0x104
lea eax, [ebp - 0x1434]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
push 0x208
push 0
lea eax, [ebp - 0x164c]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x104
lea eax, [ebp - 0x164c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp esi, esp
call fcn.00411cf8
cmp eax, 0x104
jb 0x4093eb
mov al, byte [ebp - 5]
jmp 0x40950e
mov esi, esp
push str._rundll32.exe
push 0x104
lea eax, [ebp - 0x164c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x40941a
mov al, byte [ebp - 5]
jmp 0x40950e
push 0x208
push 0
lea eax, [ebp - 0x185c]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, esp
push 0x4264ec
push 0x104
lea eax, [ebp - 0x185c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0x164c]
push eax
push 0x104
lea eax, [ebp - 0x185c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push 0x4264f0
push 0x104
lea eax, [ebp - 0x185c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
lea eax, [ebp - 0x1434]
push eax
push 0x104
lea eax, [ebp - 0x185c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
lea eax, [ebp - 0x185c]
push eax
call fcn.00410830
pop ecx
test eax, eax
je 0x4094da
mov byte [ebp - 0x1861], 1
jmp 0x4094e1
mov byte [ebp - 0x1861], 0
mov al, byte [ebp - 0x1861]
mov byte [ebp - 5], al
movzx eax, byte [ebp - 5]
test eax, eax
je 0x4094f9
mov byte [0x43f318], 1
jmp 0x40950b
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004015cd
pop ecx
pop ecx
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
push edx
mov ecx, ebp
push eax
lea edx, [0x40953d]
call fcn.00411ca2
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00411d30
add esp, 0x1864
cmp ebp, esp
call fcn.00411cf8
leave
ret