Function at 0x409cf0
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x230
call fcn.0043b820
test al, al
je 0x409fba
lea eax, [esp + 0x28]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.004350c0
test al, al
je 0x409fb5
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, 0x2a6e7546
mov edx, 0x3f770df2
mov ecx, ebx
shrd edx, ebp, cl
mov dword [esp + 8], edx
shr ebp, cl
mov ch, bl
and ch, 0x20
mov edi, 0xd5918ab9
sar edi, cl
xor edx, edx
mov cl, ch
neg cl
sbb edx, edx
mov esi, 0xc088f20d
mov cl, bl
mov ebx, 0xd5918ab9
shrd esi, ebx, cl
mov dword [esp + 0x14], eax
or edx, edi
test ch, ch
jne 0x409d7d
mov eax, ebp
mov ebp, dword [esp + 8]
jmp 0x409d81
xor eax, eax
mov esi, edi
and esi, 0x3f770df2
and edx, 0x2a6e7546
or edx, 0xd5018228
or esi, 0x4080000d
and ebp, 0xc088f20d
and eax, 0x15918ab9
or ebp, 0x3b2001a2
xor ebp, esi
or eax, 0x28084002
xor eax, edx
mov dword [esp + 0x18], eax
mov esi, ebp
xor esi, 0x7ba001af
mov ecx, eax
xor ecx, 0xfd09c22a
mov edx, esi
and edx, 0xe36a0db0
mov dword [esp + 4], edx
mov edx, ecx
and edx, 0x19742a47
mov dword [esp], edx
mov edx, esi
and edx, 0x1c95f24f
mov dword [esp + 0x10], edx
mov edi, ecx
mov edx, ecx
mov dword [esp + 0x24], ecx
and edi, 0x268bd5b8
mov ebx, edi
mov dword [esp + 0x20], edi
mov dword [esp + 8], ebp
mov ecx, ebp
xor ecx, 0x6735f3e0
mov edi, eax
xor edi, 0x9b821792
sub ecx, esi
sbb edi, edx
add ecx, dword [esp + 0x10]
adc edi, ebx
mov edx, edi
not edx
and edx, dword [esp]
mov ebx, dword [esp + 4]
mov ebp, ebx
not ebp
and ebp, ecx
mov eax, ebp
imul ebp, edx
mov edx, ecx
not edx
and edx, ebx
mov ebx, dword [esp]
not ebx
and ebx, edi
imul ebx, edx
mul edx
mov dword [esp + 0x1c], eax
add ebx, edx
add ebx, ebp
mov edx, ecx
mov eax, dword [esp + 4]
and edx, eax
mov dword [esp + 0xc], edx
or ecx, eax
mov ebp, edi
and ebp, dword [esp]
mov eax, ecx
mul dword [esp + 0xc]
mov dword [esp + 4], eax
or edi, dword [esp]
imul ecx, ebp
add ecx, edx
imul edi, dword [esp + 0xc]
add edi, ecx
mov eax, dword [esp + 8]
and eax, 0x1c95f24f
xor eax, 0x1880000f
or eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
and ebp, 0x268bd5b8
xor ebp, 0x2409c028
or ebp, dword [esp + 0x20]
or esi, 0x1c95f24f
mov ecx, dword [esp + 0x24]
or ecx, 0x668bd5b8
imul ecx, eax
mul esi
add edx, ecx
imul esi, ebp
add esi, edx
add eax, dword [esp + 0x1c]
adc esi, ebx
add eax, dword [esp + 4]
adc esi, edi
mov edi, esi
shr edi, 0x15
xor edi, esi
mov ebx, esi
shld ebx, eax, 0xb
xor ebx, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x409f7e
mov ebp, edi
and ebp, 0xc467e486
mov eax, ebx
and eax, 0x52b03670
mov dword [esp], eax
mov esi, ebx
or esi, 0x52b03670
mov edx, edi
or edx, 0xc467e486
mov ecx, edx
shld ecx, ebx, 1
lea eax, [esi + esi]
not eax
add eax, esi
not ecx
adc ecx, edx
mov edx, dword [esp]
imul ecx, edx
imul ebp, eax
mul edx
mov dword [esp], eax
mov esi, edx
add esi, ebp
add esi, ecx
mov eax, ebx
not eax
mov ebp, edi
not ebp
or ebp, 0x3b981b79
or eax, 0xad4fc98f
add eax, ebx
adc ebp, edi
add eax, 1
adc ebp, 0
or edi, 0x3b981b79
or ebx, 0xad4fc98f
imul ebp, ebx
imul edi, eax
mul ebx
add edx, edi
add edx, ebp
add eax, dword [esp]
adc edx, esi
mov ebx, eax
mov ecx, dword [esp + 0x14]
shrd ebx, edx, cl
mov edi, edx
shr edi, cl
test cl, 0x20
je 0x409f7a
mov ebx, edi
xor edi, edi
xor edi, edx
xor ebx, eax
mov eax, edi
and eax, 0x1010101
mov ecx, ebx
and ecx, 0x1010101
add ebx, 0x1010101
adc edi, 0x1010101
sub ebx, ecx
sbb edi, eax
push edi
push ebx
call fcn.0040b1b0
add esp, 8
test al, al
je 0x409fb5
call fcn.0040e020
call fcn.0040cdd0
call fcn.0043cad0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]