Function at 0x405140
Capabilities:
Check if file exists
Create directory
Create process on windows
Delete file
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x86c
mov eax, dword [0x42600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x208
lea eax, [ebp - 0x61c]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.004095e0
push esi
lea eax, [ebp - 0x824]
push ebx
push eax
call fcn.004095e0
push esi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.004095e0
push esi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004095e0
add esp, 0x30
lea eax, [ebp - 0x61c]
push eax
push ebx
push ebx
push 0x2b
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x4051c5
push ebx
push eax
mov edx, 0x421398
mov ecx, str.SHGetFolderPath_failed
call fcn.00404298
pop ecx
pop ecx
jmp 0x4054b3
push edi
push ecx
lea eax, [ebp - 0x61c]
mov edi, 0x82
push eax
push ecx
mov edx, edi
lea ecx, [ebp - 0x414]
call fcn.00403b0e
test eax, eax
js 0x405272
mov esi, 0x104
lea ecx, [ebp - 0x414]
push str.AdobeARM1.0AdobeARM.exe
mov edx, esi
call fcn.00403aa0
test eax, eax
jns 0x40520a
push ebx
jmp 0x405329
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40522f
push ebx
push 2
lea edx, [ebp - 0x414]
mov ecx, str.Unable_to_find
jmp 0x4053fd
lea eax, [ebp - 0x824]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x405258
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, 0x421398
mov ecx, str.GetTempPath_failed
jmp 0x4053fd
push ecx
lea eax, [ebp - 0x824]
mov edx, edi
push eax
push ecx
lea ecx, [ebp - 0x20c]
call fcn.00403b0e
test eax, eax
jns 0x405283
push ebx
push eax
mov edx, 0x421398
mov ecx, str.StringCbCopy_failed
jmp 0x4053fd
lea ecx, [ebp - 0x20c]
call fcn.0040452a
push ebx
test eax, eax
jns 0x4052a3
push eax
mov edx, 0x421398
mov ecx, str.AddRandomFileName_failed
jmp 0x4053fd
lea eax, [ebp - 0x82c]
mov dword [ebp - 0x830], 0xc
push eax
push 1
push str.D:P_A_OICI_GA___BA__A_OICI_GA___SY_
mov dword [ebp - 0x828], ebx
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
jne 0x4052e2
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, 0x421398
mov ecx, str.ConvertStringSecurityDescriptorToSecurityDescriptor_failed
jmp 0x4053fd
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x405312
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x414]
mov ecx, str.CreateDirectory_failed:
jmp 0x4053fd
push str.AdobeARM.exe
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.00403aa0
push ebx
test eax, eax
jns 0x405339
push eax
mov edx, 0x421398
mov ecx, str.StringCchCat_failed
jmp 0x4053fd
push 0x80
push 3
push ebx
push 1
push SysReAllocString
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x405374
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x414]
mov ecx, str.Unable_to_open
jmp 0x4053fd
push ecx
lea edx, [ebp - 0x20c]
mov ecx, esi
call fcn.004045e3
pop ecx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
test edi, edi
je 0x405399
push edi
mov ecx, str.Unable_to_copy
jmp 0x4053f7
push 0x80
push 3
push ebx
push 1
push SysReAllocString
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x40548d
push ecx
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.00403c3e
pop ecx
test eax, eax
jne 0x405409
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push 0x357
mov ecx, str.file_not_valid:
lea edx, [ebp - 0x20c]
call fcn.00404298
pop ecx
pop ecx
jmp 0x4054b2
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x86c]
push ebx
push eax
call fcn.004095e0
add esp, 0xc
mov dword [ebp - 0x86c], edi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x868], 0x540
mov dword [ebp - 0x85c], eax
lea eax, [ebp - 0x86c]
mov dword [ebp - 0x850], 5
push eax
mov dword [ebp - 0x858], str._UninstallARM
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x405467
mov edi, str.ShellExecuteEx_succeeded
mov eax, ebx
jmp 0x405488
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
mov esi, ebx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, str.ShellExecuteEx_failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov ecx, edi
jmp 0x405499
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, str.failed_to_lock
push eax
lea edx, [ebp - 0x20c]
call fcn.00404298
pop ecx
pop ecx
test esi, esi
je 0x4054b2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040797f
leave
ret