Function at 0x411510
Capabilities:
Get common file path
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x4d199c
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x4ff0f4]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ff0f4]
xor eax, esp
push eax
lea eax, [esp + 0x26c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x27c]
xor ebx, ebx
push 0x206
lea edx, [esp + 0x62]
xor ecx, ecx
push ebx
push edx
mov dword [esp + 0x44], eax
mov byte [esp + 0x27], bl
mov word [esp + 0x68], cx
call fcn.004ac890
add esp, 0xc
lea eax, [esp + 0x5c]
push eax
push ebx
push ebx
push 0x24
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [esp + 0x20]
push ecx
call fcn.00417760
mov dword [esp + 0x274], ebx
lea ecx, [esp + 0x20]
call fcn.004113e0
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x2c]
mov eax, 0x75ded953
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
xor edi, edi
add eax, edx
je 0x4117f2
xor ebp, ebp
cmp edi, eax
jb 0x4115cc
call fcn.004aa693
mov edx, dword [esp + 0x2c]
lea esi, [edx + ebp]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esi + 8], eax
je 0x4117ca
push 4
call fcn.004aac11
add esp, 4
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov byte [esp + 0x274], 1
cmp eax, ebx
je 0x411608
lea ecx, [esp + 0x3c]
mov dword [eax], ecx
jmp 0x41160a
xor eax, eax
mov byte [esp + 0x274], bl
mov dword [esp + 0x3c], eax
mov byte [esp + 0x274], 3
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov byte [esp + 0x274], 4
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x2c]
mov eax, 0x75ded953
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x411653
call fcn.004aa693
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + ebp + 8]
push edx
lea ecx, [esp + 0x40]
call fcn.00411490
mov ecx, dword [esp + 0x50]
sub ecx, dword [esp + 0x4c]
mov eax, 0xf6603d99
imul ecx
add edx, ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add esp, 4
add eax, edx
je 0x4117b9
cmp eax, ebx
ja 0x411692
call fcn.004aa693
mov eax, dword [esp + 0x48]
add eax, 0x220
push eax
lea ecx, [esp + 0x20]
call fcn.00405480
mov byte [esp + 0x274], 5
lea ecx, [esp + 0x5c]
push ecx
push 0x4ea410
lea edx, [esp + 0x24]
push edx
call fcn.00416d30
push 0x4ea428
push str.___
lea eax, [esp + 0x24]
push eax
call fcn.00416d30
mov edx, dword [esp + 0x1c]
mov esi, dword [edx - 0xc]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x4116fb
push esi
lea ecx, [esp + 0x20]
call fcn.0040aaf0
mov edx, dword [esp + 0x1c]
lea ecx, [esi + 1]
push ecx
push edx
call fcn.004aa36e
add esp, 8
cmp esi, ebx
jl 0x411868
mov eax, dword [esp + 0x1c]
cmp esi, dword [eax - 8]
jg 0x411868
mov ecx, dword [esp + 0x38]
mov dword [eax - 0xc], esi
mov eax, dword [esp + 0x1c]
xor edx, edx
mov word [eax + esi*2], dx
xor eax, eax
cmp ecx, ebx
setne al
cmp eax, ebx
je 0x41185e
push ecx
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004aad87
add esp, 8
cmp eax, ebx
jne 0x4117a8
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x2c]
mov eax, 0x75ded953
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x411771
call fcn.004aa693
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + ebp + 8]
push edx
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x4117a8
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [esp + 0x1b], 1
mov byte [esp + 0x274], 4
lea ecx, [esp + 0x1c]
call fcn.00404f30
mov byte [esp + 0x274], bl
lea eax, [esp + 0x3c]
push eax
call fcn.00417be0
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x2c]
mov eax, 0x75ded953
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
add ebp, 0x22c
cmp edi, eax
jb 0x4115cc
mov dword [esp + 0x274], 6
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x41180e
push eax
call fcn.004a9c11
add esp, 4
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x274], 0xffffffff
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004a9c11
mov al, byte [esp + 0x1f]
add esp, 4
mov ecx, dword [esp + 0x26c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.004a9c1c
add esp, 0x264
ret
push 0x80004005
call fcn.00401000
push 0x80070057
call fcn.00401000
int3