Function at 0x404e21
Capabilities:
Check if file exists
Create process on windows
Get common file path
Get file attributes

Disassembly:
push 0xa70
mov eax, 0x41a4e6
call fcn.004198ce
mov esi, edx
mov edi, ecx
lea ecx, [ebp - 0xa3c]
call fcn.00406644
xor ebx, ebx
lea eax, [ebp - 0x628]
push 0x208
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004095f0
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004095f0
add esp, 0x18
lea eax, [ebp - 0x628]
push eax
push ebx
push ebx
push 0x2b
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push ecx
test eax, eax
jns 0x404e99
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
mov edx, 0x421398
mov ecx, str.SHGetFolderPath_failed
jmp 0x4050d2
lea eax, [ebp - 0x628]
mov edx, 0x82
push eax
push ecx
lea ecx, [ebp - 0x218]
call fcn.00403b0e
test eax, eax
jns 0x404ec7
push ecx
push eax
push ecx
mov edx, 0x421398
mov ecx, str.StringCbCopy_failed
jmp 0x4050d2
push str.AdobeARM1.0AdobeARMHelper.exe
mov edx, 0x104
lea ecx, [ebp - 0x218]
call fcn.00403aa0
test eax, eax
jns 0x404ef2
push ecx
push eax
push ecx
mov edx, 0x421398
mov ecx, str.StringCchCat_failed
jmp 0x4050d2
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x404f18
push ecx
push 2
push ecx
lea edx, [ebp - 0x218]
mov ecx, str.Unable_to_find:
jmp 0x4050d2
push esi
call fcn.0040b62e
pop ecx
test eax, eax
je 0x4050ef
lea eax, [ebp - 0xa40]
push eax
call fcn.0040d319
pop ecx
test eax, eax
je 0x404f65
push ebx
push ebx
mov edx, 0x421398
mov ecx, str.The_r_s_function_failed_
call fcn.00404298
push ebx
call fcn.0040d3e4
push eax
call fcn.0040cdd3
add esp, 0x10
call fcn.0040cdb2
mov dword [ebp - 0xa40], eax
jmp 0x404f6b
mov eax, dword [ebp - 0xa40]
push eax
call fcn.0040d27e
mov esi, eax
mov dword [esp], 0x208
lea eax, [ebp - 0x830]
mov dword [ebp - 0xa40], esi
push ebx
push eax
call fcn.004095f0
push 0xa
push 0x104
lea eax, [ebp - 0x830]
push eax
push esi
call fcn.0040cf82
push 0x208
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.004095f0
add esp, 0x24
lea eax, [ebp - 0x628]
mov edx, 0x82
push eax
push ecx
lea ecx, [ebp - 0x420]
call fcn.00403b0e
test eax, eax
jns 0x404fdd
lea edx, [ebp - 0x628]
jmp 0x4050ca
mov esi, 0x104
lea ecx, [ebp - 0x420]
push str.AdobeARM1.0Temp_
mov edx, esi
call fcn.00403aa0
test eax, eax
jns 0x405002
mov edx, str.Temp
jmp 0x4050ca
lea eax, [ebp - 0x830]
mov edx, esi
push eax
lea ecx, [ebp - 0x420]
call fcn.00403aa0
test eax, eax
jns 0x405025
lea edx, [ebp - 0x830]
jmp 0x4050ca
push ebx
lea eax, [ebp - 0x420]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
cmp eax, 0xa1
je 0x4050df
cmp eax, 3
je 0x4050df
push str.AdobeARMHelper.exe
mov edx, esi
lea ecx, [ebp - 0x420]
call fcn.00403aa0
test eax, eax
jns 0x405065
mov edx, str.AdobeARMHelper.exe
jmp 0x4050ca
push ebx
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x405094
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
lea edx, [ebp - 0x420]
mov ecx, str.Failed_to_copy:
jmp 0x4050d2
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004095f0
pop ecx
pop ecx
lea eax, [ebp - 0x420]
mov edx, 0x82
push eax
push ecx
lea ecx, [ebp - 0x218]
call fcn.00403b0e
test eax, eax
jns 0x4050ef
lea edx, [ebp - 0x420]
push ecx
push eax
push ecx
mov ecx, str.create_sRandPath_failed:
call fcn.00404823
add esp, 0xc
jmp 0x4051ea
push ecx
push eax
push ecx
lea edx, [ebp - 0x420]
mov ecx, str.Failed_to_create_random_folder:
jmp 0x4050d2
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xa40], esi
mov byte [ebp - 4], 1
push ecx
test esi, esi
je 0x4051ca
lea ecx, [ebp - 0x218]
call fcn.0040449c
pop ecx
test eax, eax
je 0x405152
push ecx
push eax
push ecx
lea edx, [ebp - 0x218]
mov ecx, str.Service_workflow_failed__file_not_valid:
call fcn.00404823
add esp, 0xc
jmp 0x4051e3
push 0x3c
pop ebx
push ebx
lea eax, [ebp - 0xa7c]
push 0
push eax
call fcn.004095f0
add esp, 0xc
mov dword [ebp - 0xa7c], ebx
lea eax, [ebp - 0x218]
mov dword [ebp - 0xa78], 0x540
mov dword [ebp - 0xa6c], eax
lea eax, [ebp - 0xa7c]
mov dword [ebp - 0xa60], 5
push eax
mov dword [ebp - 0xa68], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4051b8
push 1
push 0
mov edx, edi
mov ecx, str.ShellExecuteEx_succeeded
call fcn.00404298
pop ecx
pop ecx
jmp 0x4051df
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
mov edx, edi
mov ecx, str.ShellExecuteEx_failed
jmp 0x4051d7
push eax
push ecx
lea edx, [ebp - 0x218]
mov ecx, str.Unable_to_lock_for_validation
call fcn.00404823
add esp, 0xc
test esi, esi
je 0x4051ea
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00419878
ret