Function at 0x428f9a
Capabilities:
Check if file exists
Get common file path
Get file attributes
Link many functions at runtime
Set current directory

Disassembly:
push 0x10
mov eax, 0x4abed0
call fcn.00469698
mov edi, ecx
mov eax, dword [0x516448]
xor ebx, ebx
inc ebx
test eax, eax
jne 0x42918b
test edi, edi
je 0x42918b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ecx, ecx
push 2
pop edx
lea esi, [eax + 0x13]
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044f102
pop ecx
push eax
push esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, dword [edi + 0x68]
sub eax, 0x10
push eax
call fcn.00402d9f
add eax, 0x10
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov ecx, edi
call fcn.004031f2
test eax, eax
mov ecx, str.Acrobat_
mov esi, str.Reader_
cmove esi, ecx
push esi
call fcn.0048520d
pop ecx
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.004025c6
mov edi, dword [ebp - 0x10]
lea eax, [edi - 0x10]
push eax
mov dword [ebp - 0x1c], eax
call fcn.00402d9f
add eax, 0x10
mov dword [ebp - 0x14], eax
mov esi, str.logsession.dll
mov byte [ebp - 4], bl
push esi
call fcn.0048520d
pop ecx
pop ecx
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.004025c6
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4290a1
push ecx
push edi
push str.Agent
mov edx, str.SoftwareAdobeCommonFilesUsage_
mov ecx, SysReAllocString
call fcn.004440ec
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [ebp - 0x18]
push edi
mov dword [0x516448], eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x4290a4
mov edi, dword [ebp - 0x18]
push edi
call fcn.0044f0fd
mov eax, dword [0x516448]
pop ecx
test eax, eax
jne 0x4290cb
lea ecx, [esi - 0x10]
call fcn.00402e64
mov ecx, dword [ebp - 0x1c]
call fcn.00402e64
xor al, al
jmp 0x4291e0
push str.UTInitialize
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.UTOptInGet
push dword [0x516448]
mov dword [0x51644c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.UTSetOptIn
push dword [0x516448]
mov dword [0x516450], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.UTStartSession
push dword [0x516448]
mov dword [0x516454], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.UTLogEvent
push dword [0x516448]
mov dword [0x516458], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.UTNewDataGroup
push dword [0x516448]
mov dword [0x51645c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.UTAddToGroup
push dword [0x516448]
mov dword [0x516460], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.UTCloseSession
push dword [0x516448]
mov dword [0x516464], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esi - 0x10]
mov dword [0x516468], eax
call fcn.00402e64
mov ecx, dword [ebp - 0x1c]
call fcn.00402e64
mov eax, dword [0x516448]
cmp dword [0x516450], 0
je 0x4291ca
cmp dword [0x516454], 0
je 0x4291ca
cmp dword [0x516458], 0
je 0x4291ca
cmp dword [0x51645c], 0
je 0x4291ca
cmp dword [0x516460], 0
je 0x4291ca
cmp dword [0x516464], 0
je 0x4291ca
cmp dword [0x516468], 0
jne 0x4291de
test eax, eax
je 0x4291d5
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [0x516448], 0
xor bl, bl
mov al, bl
call fcn.00469661
ret