Function at 0x4133ed
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a618f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x188
mov dword [ebp - 0x18c], ecx
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 0x430]
add ecx, 1
mov edx, dword [ebp - 0x18c]
mov dword [edx + 0x430], ecx
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 0x430]
push ecx
push 0x10da
push str.Kill___d_No._d_n
call fcn.00401ab0
add esp, 0xc
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x18c]
add ecx, 0x398
call fcn.00416da0
lea eax, [ebp - 0x16c]
push eax
mov ecx, dword [ebp - 0x18c]
add ecx, 0x398
call fcn.004819b0
push eax
lea ecx, [ebp - 0x1c]
call fcn.00441530
and eax, 0xff
test eax, eax
je 0x4135e7
lea ecx, [ebp - 0x1c]
call fcn.004845b0
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
cmp dword [ecx + 0x16c], 0
je 0x4134e2
push 4
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx + 0x16c]
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 0x16c]
mov eax, dword [edx]
call dword [eax + 4]
push eax
push str.Scan_by_killers_lpKiller__GetDescript_4____s_n
call fcn.00401ab0
add esp, 8
mov ecx, dword [ebp - 0x20]
add ecx, 4
push ecx
push 0x4beb10
call fcn.00401ab0
add esp, 8
jmp 0x41350d
mov edx, dword [ebp - 0x20]
add edx, 0x108
push edx
push str.Scan_by_Eng_szVirName___s_n
call fcn.00401ab0
add esp, 8
mov eax, dword [ebp - 0x20]
add eax, 4
push eax
push 0x4beb40
call fcn.00401ab0
add esp, 8
mov ecx, dword [ebp - 0x20]
cmp dword [ecx + 0x16c], 0
je 0x41356d
push 0x4beb54
push 0
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx + 0x16c]
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 0x16c]
mov eax, dword [edx]
call dword [eax + 4]
push eax
call fcn.00402b10
add esp, 8
test eax, eax
jne 0x41356d
mov ecx, dword [ebp - 0x20]
add ecx, 4
push ecx
push str.szFilePath___s_n
call fcn.00401ab0
add esp, 8
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
push eax
push str.nFlag___d_n
call fcn.00401ab0
add esp, 8
jmp 0x4135d1
mov ecx, dword [ebp - 0x20]
cmp dword [ecx], 0x64
jge 0x41359e
mov edx, dword [ebp - 0x20]
add edx, 4
push edx
push str.KillFile_szFilePath___s_n
call fcn.00401ab0
add esp, 8
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
push ecx
push str.KillFile_nFlag________d_n
call fcn.00401ab0
add esp, 8
jmp 0x4135d1
mov edx, dword [ebp - 0x20]
cmp dword [edx + 0x16c], 0
je 0x4135d1
mov eax, dword [ebp - 0x20]
add eax, 4
push eax
push str.szFilePath________s_n
call fcn.00401ab0
add esp, 8
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
push edx
push str.nFlag_____________d_n
call fcn.00401ab0
add esp, 8
push 0
lea eax, [ebp - 0x170]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00416820
jmp 0x413460
mov ecx, dword [ebp - 0x18c]
cmp dword [ecx + 0x3ac], 0
je 0x41369d
push 0x4bebe8
mov edx, dword [ebp - 0x18c]
push edx
call fcn.0040baa6
add esp, 8
cmp dword [0x5425fc], 0
jne 0x41369d
mov dword [0x5425fc], 1
push 0x44
push 0x4bebfc
push 0x4bec00
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 6
jne 0x41369d
lea edx, [ebp - 0x128]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.360akcheck.txt
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [ebp - 0x128]
push ecx
call fcn.00466810
mov ecx, eax
call fcn.00467ea7
test eax, eax
je 0x41369d
lea edx, [ebp - 0x128]
push edx
push str.akcheck
call fcn.00449779
mov ecx, eax
call fcn.0044981f
push 0x4bec44
mov eax, dword [ebp - 0x18c]
push eax
call fcn.0040baa6
add esp, 8
mov ecx, dword [ebp - 0x18c]
cmp dword [ecx + 0x3ac], 0
je 0x413765
push 1
mov ecx, dword [ebp - 0x18c]
call fcn.0041409c
mov dword [ebp - 0x12c], 0
jmp 0x4136ec
mov edx, dword [ebp - 0x12c]
add edx, 1
mov dword [ebp - 0x12c], edx
cmp dword [ebp - 0x12c], 8
jge 0x413765
mov eax, dword [ebp - 0x18c]
add eax, 0x55c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 0x18c]
add ecx, 0x544
call fcn.004325a0
test eax, eax
je 0x413731
mov ecx, dword [ebp - 0x18c]
mov edx, dword [ecx + 0x590]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x413745
mov eax, dword [ebp - 0x18c]
add eax, 0x55c
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x413765
mov ecx, dword [ebp - 0x18c]
add ecx, 0x55c
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4136dd
push 0x4bec5c
mov edx, dword [ebp - 0x18c]
push edx
call fcn.0040baa6
add esp, 8
mov ecx, dword [ebp - 0x18c]
add ecx, 0x398
call fcn.004325a0
test eax, eax
jbe 0x4137f8
mov ecx, dword [ebp - 0x18c]
add ecx, 0x5a4
call fcn.00416d60
mov ecx, dword [ebp - 0x18c]
call fcn.004145f8
mov ecx, dword [ebp - 0x18c]
add ecx, 0x5a4
call fcn.004325a0
test eax, eax
jbe 0x4137e7
mov ecx, dword [ebp - 0x18c]
call fcn.00414edc
cmp eax, 2
jne 0x4137dc
mov ecx, dword [ebp - 0x18c]
call fcn.00414b4a
jmp 0x4137e7
mov ecx, dword [ebp - 0x18c]
call fcn.004148b8
mov ecx, dword [ebp - 0x18c]
add ecx, 0x5a4
call fcn.00416d60
push 0x4bec74
mov eax, dword [ebp - 0x18c]
push eax
call fcn.0040baa6
add esp, 8
mov ecx, dword [ebp - 0x18c]
add ecx, 0x398
call fcn.004325a0
test eax, eax
je 0x413826
call fcn.00440b8f
push 0x4bec90
mov ecx, dword [ebp - 0x18c]
push ecx
call fcn.0040baa6
add esp, 8
mov ecx, dword [ebp - 0x18c]
add ecx, 0x398
call fcn.004325a0
cmp eax, 0xa
jb 0x41385a
mov dword [0x5425f0], 1
mov ecx, dword [ebp - 0x18c]
call fcn.00412d5c
cmp eax, 1
jne 0x413874
mov dword [0x5425f0], 1
push 0x4becac
mov edx, dword [ebp - 0x18c]
push edx
call fcn.0040baa6
add esp, 8
call fcn.00458028
mov ecx, eax
call fcn.00456f13
push 0x4becc8
mov eax, dword [ebp - 0x18c]
push eax
call fcn.0040baa6
add esp, 8
push 0x4bece8
mov ecx, dword [ebp - 0x18c]
push ecx
call fcn.0040baa6
add esp, 8
mov dword [ebp - 0x10], 0
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x18c]
add ecx, 0x398
call fcn.00416da0
lea eax, [ebp - 0x174]
push eax
mov ecx, dword [ebp - 0x18c]
add ecx, 0x398
call fcn.004819b0
push eax
lea ecx, [ebp - 0x18]
call fcn.00441530
and eax, 0xff
test eax, eax
je 0x413bd2
lea ecx, [ebp - 0x18]
call fcn.004845b0
mov dword [ebp - 0x130], eax
push 0x4bed08
mov ecx, dword [ebp - 0x130]
add ecx, 0x108
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x41393a
mov dword [0x5425f0], 1
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x32
jge 0x4139b3
mov eax, dword [ebp - 0x130]
cmp dword [eax + 0x16c], 0
je 0x413990
mov ecx, dword [ebp - 0x130]
add ecx, 4
push ecx
push 4
mov edx, dword [ebp - 0x130]
mov ecx, dword [edx + 0x16c]
mov eax, dword [ebp - 0x130]
mov edx, dword [eax + 0x16c]
mov eax, dword [edx]
call dword [eax + 4]
push eax
call fcn.00449779
mov ecx, eax
call fcn.00449e5d
jmp 0x4139b3
mov ecx, dword [ebp - 0x130]
add ecx, 4
push ecx
mov edx, dword [ebp - 0x130]
add edx, 0x108
push edx
call fcn.00449779
mov ecx, eax
call fcn.00449e5d
mov eax, dword [ebp - 0x130]
cmp dword [eax + 0x170], 0
jne 0x4139e4
mov ecx, dword [ebp - 0x130]
mov dword [ecx], 0xffffff9d
push 0
lea edx, [ebp - 0x178]
push edx
lea ecx, [ebp - 0x18]
call fcn.00416820
jmp 0x4138d8
mov eax, dword [ebp - 0x130]
add eax, 4
push eax
push 0x4bed10
mov ecx, dword [ebp - 0x18c]
push ecx
call fcn.0040baa6
add esp, 0xc
mov edx, dword [ebp - 0x130]
cmp dword [edx], 0
jne 0x413a23
push 0
lea eax, [ebp - 0x17c]
push eax
lea ecx, [ebp - 0x18]
call fcn.00416820
jmp 0x4138d8
mov ecx, dword [ebp - 0x130]
cmp dword [ecx + 0x16c], 0
je 0x413aa0
push 0x4bed24
push 0
mov edx, dword [ebp - 0x130]
mov ecx, dword [edx + 0x16c]
mov eax, dword [ebp - 0x130]
mov edx, dword [eax + 0x16c]
mov eax, dword [edx]
call dword [eax + 4]
push eax
call fcn.00402b10
add esp, 8
test eax, eax
jne 0x413aa0
mov ecx, dword [ebp - 0x130]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 0x130]
add eax, 4
push eax
mov ecx, dword [ebp - 0x130]
mov ecx, dword [ecx + 0x16c]
mov edx, dword [ebp - 0x130]
mov eax, dword [edx + 0x16c]
mov edx, dword [eax]
call dword [edx + 0x1c]
mov ecx, dword [ebp - 0x130]
mov dword [ecx], eax
jmp 0x413b35
mov edx, dword [ebp - 0x130]
cmp dword [edx], 0x64
jge 0x413ad6
push 1
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x130]
add edx, 4
push edx
call fcn.00423e80
mov ecx, eax
call fcn.00424138
mov ecx, dword [ebp - 0x130]
mov dword [ecx], eax
jmp 0x413b35
mov edx, dword [ebp - 0x130]
cmp dword [edx + 0x16c], 0
je 0x413b1f
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x130]
add edx, 4
push edx
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax + 0x16c]
mov edx, dword [ebp - 0x130]
mov eax, dword [edx + 0x16c]
mov edx, dword [eax]
call dword [edx + 0x1c]
mov ecx, dword [ebp - 0x130]
mov dword [ecx], eax
jmp 0x413b35
push 0
lea edx, [ebp - 0x180]
push edx
lea ecx, [ebp - 0x18]
call fcn.00416820
jmp 0x4138d8
mov eax, dword [ebp - 0x130]
cmp dword [eax], 3
jne 0x413b60
push 0
push 0x4bed30
push str.ak360Kill
call fcn.0041a576
add esp, 0xc
mov dword [0x542600], 1
jmp 0x413bac
mov ecx, dword [ebp - 0x130]
cmp dword [ecx], 0xfffffffe
jne 0x413b80
cmp dword [0x5425f0], 0
jne 0x413b80
mov dword [0x5425f0], 1
jmp 0x413bac
mov edx, dword [ebp - 0x130]
cmp dword [edx], 0
jg 0x413bac
mov eax, dword [ebp - 0x130]
cmp dword [eax], 0xfffffffe
je 0x413bac
push 0
lea ecx, [ebp - 0x184]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00416820
jmp 0x4138d8
mov edx, dword [ebp - 0x18]
push edx
lea eax, [ebp - 0x188]
push eax
mov ecx, dword [ebp - 0x18c]
add ecx, 0x398
call fcn.0045cb30
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
jmp 0x4138d8
mov ecx, dword [ebp - 0x18c]
call fcn.00413f2c
push 0x4bed44
mov edx, dword [ebp - 0x18c]
push edx
call fcn.0040baa6
add esp, 8
mov ecx, dword [ebp - 0x18c]
call fcn.00414edc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jne 0x413cfc
push 0x408
mov ecx, dword [ebp - 0x18c]
add ecx, 0x2d4
call fcn.00402b30
push eax
lea ecx, [ebp - 0x134]
call fcn.004041c0
push 1
lea ecx, [ebp - 0x134]
call fcn.00416690
mov eax, dword [ebp - 0x18c]
add eax, 0x2d0
test eax, eax
je 0x413c5b
mov ecx, dword [ebp - 0x18c]
add ecx, 0x2d4
mov dword [ebp - 0x190], ecx
jmp 0x413c65
mov dword [ebp - 0x190], 0
push 0x408
mov ecx, dword [ebp - 0x18c]
add ecx, 0x2d4
call fcn.00402b30
push eax
push 0x408
push 0x111
mov ecx, dword [ebp - 0x190]
call fcn.00441560
push eax
call fcn.00408400
add esp, 0x10
mov edx, dword [ebp - 0x18c]
add edx, 0x2d0
test edx, edx
je 0x413cbd
mov eax, dword [ebp - 0x18c]
add eax, 0x2d4
mov dword [ebp - 0x194], eax
jmp 0x413cc7
mov dword [ebp - 0x194], 0
push 0x40a
mov ecx, dword [ebp - 0x18c]
add ecx, 0x2d4
call fcn.00402b30
push eax
push 0x40a
push 0x111
mov ecx, dword [ebp - 0x194]
call fcn.00441560
push eax
call fcn.00408400
add esp, 0x10
cmp dword [0x55a144], 5
jb 0x413d0f
mov dword [0x5425f0], 1
cmp dword [0x5425f0], 0
je 0x413d2c
push 0
push 0x4bed64
push str.ak360Kill_r
call fcn.0041a576
add esp, 0xc
cmp dword [0x542600], 0
jne 0x413d4b
cmp dword [0x5425f0], 0
jne 0x413d4b
cmp dword [0x5425f4], 0
je 0x413e28
call fcn.00478b6b
test eax, eax
je 0x413d70
push 0x40
push 0x4bed7c
push 0x4bed84
mov ecx, dword [ebp - 0x18c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x138], 0
cmp dword [0x5425f4], 0
je 0x413dda
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 4]
push ecx
push 0x4bedb4
push 0x4bedc0
lea ecx, [ebp - 0x164]
call fcn.00418c20
mov dword [ebp - 4], 0
push 0
mov edx, dword [ebp - 0x18c]
mov eax, dword [edx + 4]
push eax
lea ecx, [ebp - 0x164]
call fcn.004172b0
mov dword [ebp - 0x138], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x164]
call fcn.00418c99
jmp 0x413dfc
push 0x44
push 0x4bee04
push 0x4bee08
mov ecx, dword [ebp - 0x18c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 6
je 0x413e0e
cmp dword [ebp - 0x138], 1
jne 0x413e26
push 1
push str.akReboot
call fcn.00449779
mov ecx, eax
call fcn.0044ab3a
call fcn.004366e7
jmp 0x413e59
call fcn.0041aae6
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jl 0x413e59
push 0
push 0
mov eax, dword [ebp - 0x168]
push eax
mov ecx, dword [ebp - 0x18c]
mov edx, dword [ecx + 4]
push edx
call fcn.004199e8
add esp, 0x10
call fcn.0042c5d7
test eax, eax
jne 0x413e7e
push 1
push 0x43b
mov ecx, dword [ebp - 0x18c]
add ecx, 4
call fcn.00402b30
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret