Function at 0x42d340
Capabilities:
Check os version
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4572df
mov eax, dword fs:[0]
push eax
sub esp, 0x3f8
mov eax, dword [0x477b9c]
xor eax, esp
mov dword [esp + 0x3f4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x477b9c]
xor eax, esp
push eax
lea eax, [esp + 0x40c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x41c]
lea eax, [esp + 0x16c]
xor ebx, ebx
mov dword [esp + 0x14], ebx
push eax
mov dword [esp + 0x170], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x170], 6
jb 0x42d6b6
lea ecx, [esp + 0x200]
push ecx
call fcn.0042d2c0
add esp, 4
test eax, eax
jne 0x42d704
push ebx
push 0xffffffffffffffff
push str.Synchronizer
lea ecx, [esp + 0xfc]
call fcn.0044b840
mov edi, eax
push ebx
push 0xffffffffffffffff
push 0x45f3d8
lea ecx, [esp + 0xcc]
mov dword [esp + 0x420], ebx
call fcn.0044b840
mov ebp, eax
push ebx
push 0xffffffffffffffff
push str.Acrobat
lea ecx, [esp + 0x9c]
mov byte [esp + 0x420], 1
call fcn.0044b840
mov ebx, eax
push 0
push 0xffffffffffffffff
push str.Adobe
lea ecx, [esp + 0x6c]
mov byte [esp + 0x420], 2
call fcn.0044b840
mov dword [esp + 0x14], eax
push 0xffffffffffffffff
lea ecx, [esp + 0x204]
push ecx
lea ecx, [esp + 0x38]
mov byte [esp + 0x41c], 3
call fcn.0044b0a0
movzx edx, word [0x477b18]
push edx
push eax
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x420], 4
call fcn.00418500
mov ecx, dword [esp + 0x20]
push ecx
push eax
lea edx, [esp + 0x14c]
push edx
mov byte [esp + 0x42c], 5
call fcn.00406100
movzx ecx, word [0x477b18]
push ecx
push eax
lea edx, [esp + 0xc8]
push edx
mov byte [esp + 0x438], 6
call fcn.00418500
push ebx
push eax
lea eax, [esp + 0x134]
push eax
mov byte [esp + 0x444], 7
call fcn.00406100
movzx ecx, word [0x477b18]
push ecx
push eax
lea edx, [esp + 0xb0]
push edx
mov byte [esp + 0x450], 8
call fcn.00418500
push ebp
push eax
mov byte [esp + 0x458], 9
lea eax, [esp + 0x164]
push eax
call fcn.00406100
add esp, 0x48
movzx ecx, word [0x477b18]
push ecx
push eax
lea edx, [esp + 0x50]
push edx
mov byte [esp + 0x420], 0xa
call fcn.00418500
push edi
push eax
lea eax, [esp + 0xec]
push eax
mov byte [esp + 0x42c], 0xb
call fcn.00406100
movzx ecx, word [0x477b18]
push ecx
push eax
push esi
mov byte [esp + 0x438], 0xc
call fcn.00418500
mov edx, dword [esp + 0x10c]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x108]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esp + 0x84]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov edx, dword [esp + 0x80]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x164]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esp + 0x160]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov edx, dword [esp + 0xc4]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0xc0]
add esp, 0x40
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esp + 0x11c]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov edx, dword [esp + 0x118]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0xc4]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esp + 0xc0]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov edx, dword [esp + 0x15c]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x158]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esp + 0x44]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov edx, dword [esp + 0x40]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x64]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esp + 0x60]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov edx, dword [esp + 0x9c]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x98]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esp + 0xd4]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov edx, dword [esp + 0xd0]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x10c]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esp + 0x108]
add esp, 0x40
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov edx, dword [esp + 0x104]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x100]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x40c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3f4]
xor ecx, esp
call fcn.00450f60
add esp, 0x404
ret
lea edx, [esp + 0x14]
push edx
push 0x1a
push ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp eax, ebx
jne 0x42d704
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x200]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov edx, dword [esp + 0x14]
mov edi, eax
neg edi
sbb edi, edi
and edi, 0x7fffbffb
push edx
add edi, 0x80004005
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp edi, ebx
je 0x42d3c7
push ebx
push 0xffffffffffffffff
push str.Unable_to_find_user_path
lea ecx, [esp + 0x160]
mov dword [esp + method.RSException.virtual_0], vtable.RSException.0
call fcn.0044b840
push 0x469dd4
lea eax, [esp + 0x154]
push eax
call sub.MSVCR80.dll__CxxThrowException
int3