Function at 0x41c7e3
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x280
mov eax, 0x478568
call fcn.0045bedd
push 0x105
xor esi, esi
lea eax, [ebp - 0x220]
mov edi, ecx
push esi
push eax
mov dword [ebp - 0x224], edi
call fcn.00459cf0
add esp, 0xc
xor eax, eax
cmp byte [ebp + 8], al
lea ecx, [ebp - 0x220]
sete al
push ecx
push esi
push esi
dec eax
and eax, 7
add eax, 0x801c
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x41c841
xor eax, eax
call fcn.0045bf60
ret 4
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x244]
call fcn.004020a6
push str.AdobeARM
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x230]
push eax
mov dword [ebp - 4], esi
call fcn.0040adb6
add esp, 0xc
push ebx
lea eax, [ebp - 0x230]
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.0041cc76
mov dword [ebp - 0x23c], eax
cmp eax, esi
jne 0x41cc6b
mov edi, 0x4c47ec
mov eax, edi
call fcn.00405266
test eax, eax
je 0x41c90f
call fcn.00405238
test eax, eax
mov eax, str.AdobeReader
jne 0x41c8b5
mov eax, str.AdobeAcrobat
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.0040adb6
add esp, 0xc
push eax
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.00402573
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x23c]
add ecx, 0xfffffff0
call fcn.004025d2
mov ecx, dword [ebp - 0x224]
push ebx
lea eax, [ebp - 0x230]
push eax
call fcn.0041cc76
mov dword [ebp - 0x23c], eax
cmp eax, esi
jne 0x41cc6b
call fcn.0044825c
push eax
lea ecx, [ebp - 0x234]
call fcn.0041872d
mov byte [ebp - 4], 3
call fcn.0044825c
push eax
lea ecx, [ebp - 0x238]
call fcn.0041872d
mov byte [ebp - 4], 4
call fcn.0044825c
push eax
lea ecx, [ebp - 0x240]
call fcn.0041872d
mov byte [ebp - 4], 5
call fcn.0044825c
push eax
lea ecx, [ebp - 0x248]
call fcn.0041872d
mov dword [ebp - 0x24c], esi
mov dword [ebp - method.CManifest.virtual_0], vtable.CManifest.0
mov dword [ebp - 0x250], esi
lea ecx, [ebp - 0x24c]
push ecx
lea ecx, [ebp - 0x248]
push ecx
lea ecx, [ebp - 0x240]
push ecx
lea ecx, [ebp - 0x238]
push ecx
mov byte [ebp - 4], 7
mov eax, dword [ebx]
lea ecx, [ebp - 0x234]
add eax, 4
push ecx
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.0042dfc0
cmp eax, esi
jne 0x41cc28
push dword [ebp - 0x24c]
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x28c]
push eax
call fcn.00438580
lea eax, [ebp - 0x28c]
mov byte [ebp - 4], 8
push str.will_attempt_to_find_valid_payload:
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0x228], eax
call fcn.004020a6
push esi
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x22c]
push eax
push 2
pop edi
push edi
mov byte [ebp - 4], 9
call fcn.00414e01
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x22c]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004025d2
push str.size:
lea ecx, [ebp - 0x22c]
call fcn.004020a6
mov byte [ebp - 4], 0xa
push dword [ebp - 0x24c]
lea esi, [ebp - 0x22c]
push edi
call fcn.004153a2
pop ecx
pop ecx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
call fcn.004025d2
push str.AdobeARM
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.0040adb6
add esp, 0xc
push eax
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0xb
call fcn.00402573
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
call fcn.004025d2
mov ecx, dword [ebp - 0x224]
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0041cc76
lea ecx, [ebp - 0x224]
test eax, eax
je 0x41cbef
push str.found_valid_payload:
call fcn.004020a6
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x228]
push 0
add eax, 8
push eax
lea eax, [ebp - 0x224]
push eax
push edi
call fcn.00414e01
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x224]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004025d2
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebx]
add eax, 4
push eax
add ecx, 4
call fcn.00402573
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebx]
add eax, 8
push eax
add ecx, 8
call fcn.00402573
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebx]
add eax, 0xc
push eax
add ecx, 0xc
call fcn.00402573
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebx]
add eax, 0x10
push eax
add ecx, 0x10
call fcn.00402573
mov ecx, dword [ebp - 0x228]
mov ecx, dword [ecx + 0x14]
mov eax, dword [ebx]
mov dword [eax + 0x14], ecx
mov ecx, dword [ebp - 0x228]
mov ecx, dword [ecx + 0x1c]
mov eax, dword [ebx]
mov dword [eax + 0x1c], ecx
lea ecx, [ebp - 0x28c]
call fcn.004386c6
lea ecx, [ebp - 0x254]
call fcn.0042a7ad
mov ecx, dword [ebp - 0x248]
add ecx, 0xfffffff0
call fcn.004025d2
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.004025d2
mov ecx, dword [ebp - 0x238]
add ecx, 0xfffffff0
call fcn.004025d2
mov ecx, dword [ebp - 0x234]
add ecx, 0xfffffff0
call fcn.004025d2
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x230]
add ecx, 0xfffffff0
call fcn.004025d2
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.004025d2
mov eax, esi
jmp 0x41c839
push str.alternative_payload_not_found
call fcn.004020a6
push 0
lea eax, [ebp - 0x224]
push eax
push edi
mov byte [ebp - 4], 0xd
call fcn.004152d1
mov ecx, dword [ebp - 0x224]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004025d2
lea ecx, [ebp - 0x28c]
call fcn.004386c6
lea ecx, [ebp - 0x254]
call fcn.0042a7ad
mov ecx, dword [ebp - 0x248]
add ecx, 0xfffffff0
call fcn.004025d2
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
call fcn.004025d2
mov ecx, dword [ebp - 0x238]
add ecx, 0xfffffff0
call fcn.004025d2
mov ecx, dword [ebp - 0x234]
add ecx, 0xfffffff0
call fcn.004025d2
mov esi, dword [ebp - 0x23c]
jmp 0x41cbcc