Function at 0x550b10
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73bc00
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x88c
mov eax, dword [0x857060]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.IsWow64Process
push str.kernel32.dll
mov dword [ebp - 0x834], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x87d0b4], eax
test eax, eax
je 0x550b8e
lea eax, [ebp - 0x834]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x87d0b4]
cmp dword [ebp - 0x834], 0
je 0x551100
cmp dword [0x87e16c], 0
jne 0x551107
push 0x3ff
lea eax, [ebp - 0x818]
push eax
push dword [0x87d0b0]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov dword [ebp - 0x820], 0
lea ecx, [ebp - 0x818]
mov dword [ebp - 0x81c], 7
mov word [ebp - 0x830], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x550be6
sub ecx, edx
lea eax, [ebp - 0x818]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x830]
call fcn.00426d40
lea eax, [ebp - 0x830]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x864]
call fcn.00449230
lea ecx, [ebp - 0x864]
mov byte [ebp - 4], 1
call fcn.0054ec70
lea ecx, [ebp - 0x830]
call fcn.00426ce0
lea eax, [ebp - 0x84c]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x864]
call fcn.0054eef0
lea ecx, [ebp - 0x864]
mov byte [ebp - 4], 4
call fcn.00426ce0
lea eax, [ebp - 0x84c]
push eax
lea ecx, [ebp - 0x87c]
call fcn.00449230
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x830]
push 0x14
xor eax, eax
mov dword [ebp - 0x820], 0
push str.TokenResolverx64.exe
mov dword [ebp - 0x81c], 7
mov word [ebp - 0x830], ax
call fcn.00426d40
lea eax, [ebp - 0x830]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x87c]
call fcn.0054f060
mov esi, eax
cmp dword [esi + 0x14], 8
jb 0x550cc8
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete byte [ebp - 0x87d]
je 0x550cfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x550cfc
cmp dword [esi + 0x14], 8
jb 0x550cee
mov esi, dword [esi]
mov ecx, esi
call fcn.0054e970
mov byte [ebp - 0x87d], 1
lea ecx, [ebp - 0x830]
mov byte [ebp - 4], 5
call fcn.00426ce0
cmp byte [ebp - 0x87d], 0
jne 0x551049
push 9
xor eax, eax
mov dword [ebp - 0x820], 0
push str.resources
lea ecx, [ebp - 0x830]
mov dword [ebp - 0x81c], 7
mov word [ebp - 0x830], ax
call fcn.00426d40
lea eax, [ebp - 0x830]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x84c]
call fcn.0054f060
lea ecx, [ebp - 0x830]
mov byte [ebp - 4], 5
call fcn.00426ce0
push 9
xor eax, eax
mov dword [ebp - 0x820], 0
push str.libraries
lea ecx, [ebp - 0x830]
mov dword [ebp - 0x81c], 7
mov word [ebp - 0x830], ax
call fcn.00426d40
lea eax, [ebp - 0x830]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x84c]
call fcn.0054f060
lea ecx, [ebp - 0x830]
mov byte [ebp - 4], 5
call fcn.00426ce0
push 0x14
xor eax, eax
mov dword [ebp - 0x820], 0
push str.TokenResolverx64.exe
lea ecx, [ebp - 0x830]
mov dword [ebp - 0x81c], 7
mov word [ebp - 0x830], ax
call fcn.00426d40
lea eax, [ebp - 0x830]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x84c]
call fcn.0054f060
lea ecx, [ebp - 0x830]
mov byte [ebp - 4], 5
call fcn.00426ce0
cmp dword [ebp - 0x838], 8
lea eax, [ebp - 0x84c]
cmovae eax, dword [ebp - 0x84c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete cl
mov byte [ebp - 0x87d], cl
je 0x550e6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x550e66
cmp dword [ebp - 0x838], 8
lea ecx, [ebp - 0x84c]
cmovae ecx, dword [ebp - 0x84c]
call fcn.0054e970
jmp 0x55106f
mov cl, byte [ebp - 0x87d]
test cl, cl
jne 0x55106f
xor eax, eax
mov dword [ebp - 0x854], 0
mov dword [ebp - 0x850], 7
mov word [ebp - 0x864], ax
lea edx, [ebp - 0x834]
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x884]
call fcn.0065a6f0
cmp dword [ebp - 0x834], 2
jne 0x550edc
lea ecx, [ebp - 0x864]
call fcn.00650d20
test al, al
je 0x550ed2
push 0x15
push str.Adobe_Desktop_Common
lea ecx, [ebp - 0x864]
call fcn.0044a2e0
mov al, 1
test al, al
je 0x551038
jmp 0x550f34
push 0
push 0x2b
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x551038
lea ecx, [ebp - 0x220]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x550f00
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x864]
call fcn.00426d40
push 0x1b
push str.AdobeAdobe_Desktop_Common
lea ecx, [ebp - 0x864]
call fcn.0044a2e0
push 5
xor eax, eax
mov dword [ebp - 0x820], 0
push str.HDBox
lea ecx, [ebp - 0x830]
mov dword [ebp - 0x81c], 7
mov word [ebp - 0x830], ax
call fcn.00426d40
push ecx
lea edx, [ebp - 0x830]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x864]
call fcn.00651b80
add esp, 4
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x830]
call fcn.00426ce0
push 0x14
xor eax, eax
mov dword [ebp - 0x820], 0
push str.TokenResolverx64.exe
lea ecx, [ebp - 0x830]
mov dword [ebp - 0x81c], 7
mov word [ebp - 0x830], ax
call fcn.00426d40
push ecx
lea edx, [ebp - 0x830]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x864]
call fcn.00651b80
add esp, 4
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x830]
call fcn.00426ce0
lea eax, [ebp - 0x864]
push eax
lea ecx, [ebp - 0x830]
call fcn.00449230
lea ecx, [ebp - 0x830]
mov byte [ebp - 4], 0xd
call fcn.0054ec70
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x830]
cmp dword [ebp - 0x81c], 8
lea ecx, [ebp - 0x84c]
push dword [ebp - 0x820]
cmovae eax, dword [ebp - 0x830]
push eax
call fcn.00426d40
lea ecx, [ebp - 0x830]
call fcn.00426ce0
lea ecx, [ebp - 0x864]
mov byte [ebp - 4], 5
call fcn.00426ce0
jmp 0x55106f
cmp dword [ebp - 0x868], 8
lea eax, [ebp - 0x87c]
push dword [ebp - 0x86c]
cmovae eax, dword [ebp - 0x87c]
lea ecx, [ebp - 0x84c]
push eax
call fcn.00426d40
lea eax, [ebp - 0x84c]
mov edx, 0x79ece0
push eax
lea ecx, [ebp - 0x89c]
call fcn.00457400
add esp, 4
push 1
push 0x79ece0
mov ecx, eax
mov byte [ebp - 4], 0xf
call fcn.0044a2e0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x830], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x820], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
lea ecx, [ebp - 0x89c]
mov byte [ebp - 4], 0x11
call fcn.00426ce0
lea ecx, [ebp - 0x830]
call fcn.0054fd20
lea ecx, [ebp - 0x830]
call fcn.00426ce0
lea ecx, [ebp - 0x87c]
call fcn.00426ce0
lea ecx, [ebp - 0x84c]
call fcn.00426ce0
cmp dword [0x87e16c], 0
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.006d0965
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret