Function at 0x2b85f6c
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6b8
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x20], ecx
xor ebx, ebx
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x2b85fa0
mov eax, 0xc0000001
jmp 0x2b8618c
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x6b4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [ebp - 0x6b4]
push 0x2b878c4
push eax
call esi
push str.winver.exe
lea eax, [ebp - 0x6b4]
push eax
call esi
lea eax, [ebp - 0x1c]
push eax
sub esp, 0x10
lea eax, [ebp - 0x2a4]
lea edx, [ebp - 0x6b4]
push eax
push ecx
push ebx
mov ecx, edx
call fcn.02b85cae
add esp, 0x20
test al, al
jne 0x2b86004
mov edi, 0xc0000001
jmp 0x2b8617b
push ebx
mov ebx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
push 4
push eax
push 0x1e
push ebx
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov edi, eax
test edi, edi
jns 0x2b86039
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
jmp 0x2b8617b
push dword [ebp - 8]
push ebx
call dword [sym.imp.ntdll.dll_NtRemoveProcessDebug]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x6b4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x2b878c4
lea eax, [ebp - 0x6b4]
push eax
call esi
push str.computerdefaults.exe
lea eax, [ebp - 0x6b4]
push eax
call esi
push 0x10
pop ecx
lea eax, [ebp - 0x1c]
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x2b86094
push 0x60
pop ecx
lea eax, [ebp - 0x84]
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x2b860a6
lea eax, [ebp - 0x1c]
push eax
sub esp, 0x10
lea eax, [ebp - 0x2a4]
lea edx, [ebp - 0x6b4]
push eax
push ecx
push 1
mov ecx, edx
call fcn.02b85cae
add esp, 0x20
test al, al
je 0x2b85ffa
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_DbgUiSetThreadDebugObject]
jmp 0x2b86104
cmp dword [ebp - 0x84], 3
jne 0x2b860f3
mov esi, dword [ebp - 0x74]
test esi, esi
jne 0x2b86119
push 0x10002
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
push 0xffffffffffffffff
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
test eax, eax
jne 0x2b860e3
jmp 0x2b8617b
xor eax, eax
push eax
push eax
push 0x1fffff
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push esi
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
mov edi, eax
test edi, edi
js 0x2b8614e
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
call fcn.02b85e06
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
push 0
call dword [sym.imp.ntdll.dll_DbgUiSetThreadDebugObject]
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
and dword [ebp - 8], 0
push esi
call ebx
push dword [ebp - 0x18]
call ebx
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x1c]
call ebx
cmp dword [ebp - 8], 0
je 0x2b8618a
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret