Function at 0x40510d
Capabilities:
Check if file exists
Create directory
Create process on windows
Delete file
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x86c
mov eax, dword [0x42600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x208
lea eax, [ebp - 0x61c]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.004094e0
push esi
lea eax, [ebp - 0x824]
push ebx
push eax
call fcn.004094e0
push esi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.004094e0
push esi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004094e0
add esp, 0x30
lea eax, [ebp - 0x61c]
push eax
push ebx
push ebx
push 0x2b
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x405192
push ebx
push eax
mov edx, 0x421398
mov ecx, str.SHGetFolderPath_failed
call fcn.0040461f
pop ecx
pop ecx
jmp 0x405480
push edi
push ecx
lea eax, [ebp - 0x61c]
mov edi, 0x82
push eax
push ecx
mov edx, edi
lea ecx, [ebp - 0x414]
call fcn.00403b0e
test eax, eax
js 0x40523f
mov esi, 0x104
lea ecx, [ebp - 0x414]
push str.AdobeARM1.0AdobeARM.exe
mov edx, esi
call fcn.00403aa0
test eax, eax
jns 0x4051d7
push ebx
jmp 0x4052f6
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4051fc
push ebx
push 2
lea edx, [ebp - 0x414]
mov ecx, str.Unable_to_find
jmp 0x4053ca
lea eax, [ebp - 0x824]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x405225
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, 0x421398
mov ecx, str.GetTempPath_failed
jmp 0x4053ca
push ecx
lea eax, [ebp - 0x824]
mov edx, edi
push eax
push ecx
lea ecx, [ebp - 0x20c]
call fcn.00403b0e
test eax, eax
jns 0x405250
push ebx
push eax
mov edx, 0x421398
mov ecx, str.StringCbCopy_failed
jmp 0x4053ca
lea ecx, [ebp - 0x20c]
call fcn.00404326
push ebx
test eax, eax
jns 0x405270
push eax
mov edx, 0x421398
mov ecx, str.AddRandomFileName_failed
jmp 0x4053ca
lea eax, [ebp - 0x82c]
mov dword [ebp - 0x830], 0xc
push eax
push 1
push str.D:P_A_OICI_GA___BA__A_OICI_GA___SY_
mov dword [ebp - 0x828], ebx
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
jne 0x4052af
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, 0x421398
mov ecx, str.ConvertStringSecurityDescriptorToSecurityDescriptor_failed
jmp 0x4053ca
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4052df
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x414]
mov ecx, str.CreateDirectory_failed:
jmp 0x4053ca
push str.AdobeARM.exe
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.00403aa0
push ebx
test eax, eax
jns 0x405306
push eax
mov edx, 0x421398
mov ecx, str.StringCchCat_failed
jmp 0x4053ca
push 0x80
push 3
push ebx
push 1
push SysReAllocString
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x405341
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x414]
mov ecx, str.Unable_to_open
jmp 0x4053ca
push ecx
lea edx, [ebp - 0x20c]
mov ecx, esi
call fcn.004043df
pop ecx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
test edi, edi
je 0x405366
push edi
mov ecx, str.Unable_to_copy
jmp 0x4053c4
push 0x80
push 3
push ebx
push 1
push SysReAllocString
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x40545a
push ecx
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.00403c3e
pop ecx
test eax, eax
jne 0x4053d6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push 0x357
mov ecx, str.file_not_valid:
lea edx, [ebp - 0x20c]
call fcn.0040461f
pop ecx
pop ecx
jmp 0x40547f
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x86c]
push ebx
push eax
call fcn.004094e0
add esp, 0xc
mov dword [ebp - 0x86c], edi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x868], 0x540
mov dword [ebp - 0x85c], eax
lea eax, [ebp - 0x86c]
mov dword [ebp - 0x850], 5
push eax
mov dword [ebp - 0x858], str._UninstallARM
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x405434
mov edi, str.ShellExecuteEx_succeeded
mov eax, ebx
jmp 0x405455
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
mov esi, ebx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, str.ShellExecuteEx_failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov ecx, edi
jmp 0x405466
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, str.failed_to_lock
push eax
lea edx, [ebp - 0x20c]
call fcn.0040461f
pop ecx
pop ecx
test esi, esi
je 0x40547f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040787a
leave
ret