Function at 0x411640
Capabilities:
Get common file path
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x4d242c
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x5000f4]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5000f4]
xor eax, esp
push eax
lea eax, [esp + 0x26c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x27c]
xor ebx, ebx
push 0x206
lea edx, [esp + 0x62]
xor ecx, ecx
push ebx
push edx
mov dword [esp + 0x44], eax
mov byte [esp + 0x27], bl
mov word [esp + 0x68], cx
call fcn.004ad2a0
add esp, 0xc
lea eax, [esp + 0x5c]
push eax
push ebx
push ebx
push 0x24
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [esp + 0x20]
push ecx
call fcn.00419a60
mov dword [esp + 0x274], ebx
lea ecx, [esp + 0x20]
call fcn.00411510
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x2c]
mov eax, 0x75ded953
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
xor edi, edi
add eax, edx
je 0x411922
xor ebp, ebp
cmp edi, eax
jb 0x4116fc
call fcn.004ab09b
mov edx, dword [esp + 0x2c]
lea esi, [edx + ebp]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esi + 8], eax
je 0x4118fa
push 4
call fcn.004ab619
add esp, 4
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov byte [esp + 0x274], 1
cmp eax, ebx
je 0x411738
lea ecx, [esp + 0x3c]
mov dword [eax], ecx
jmp 0x41173a
xor eax, eax
mov byte [esp + 0x274], bl
mov dword [esp + 0x3c], eax
mov byte [esp + 0x274], 3
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov byte [esp + 0x274], 4
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x2c]
mov eax, 0x75ded953
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x411783
call fcn.004ab09b
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + ebp + 8]
push edx
lea ecx, [esp + 0x40]
call fcn.004115c0
mov ecx, dword [esp + 0x50]
sub ecx, dword [esp + 0x4c]
mov eax, 0xf6603d99
imul ecx
add edx, ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add esp, 4
add eax, edx
je 0x4118e9
cmp eax, ebx
ja 0x4117c2
call fcn.004ab09b
mov eax, dword [esp + 0x48]
add eax, 0x220
push eax
lea ecx, [esp + 0x20]
call fcn.004054b0
mov byte [esp + 0x274], 5
lea ecx, [esp + 0x5c]
push ecx
push 0x4eb430
lea edx, [esp + 0x24]
push edx
call fcn.004170a0
push 0x4eb448
push str.___
lea eax, [esp + 0x24]
push eax
call fcn.004170a0
mov edx, dword [esp + 0x1c]
mov esi, dword [edx - 0xc]
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, esi
or eax, ecx
jge 0x41182b
push esi
lea ecx, [esp + 0x20]
call fcn.0040adf0
mov edx, dword [esp + 0x1c]
lea ecx, [esi + 1]
push ecx
push edx
call fcn.004aad76
add esp, 8
cmp esi, ebx
jl 0x411998
mov eax, dword [esp + 0x1c]
cmp esi, dword [eax - 8]
jg 0x411998
mov ecx, dword [esp + 0x38]
mov dword [eax - 0xc], esi
mov eax, dword [esp + 0x1c]
xor edx, edx
mov word [eax + esi*2], dx
xor eax, eax
cmp ecx, ebx
setne al
cmp eax, ebx
je 0x41198e
push ecx
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004ab78f
add esp, 8
cmp eax, ebx
jne 0x4118d8
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x2c]
mov eax, 0x75ded953
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x4118a1
call fcn.004ab09b
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + ebp + 8]
push edx
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x4118d8
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [esp + 0x1b], 1
mov byte [esp + 0x274], 4
lea ecx, [esp + 0x1c]
call fcn.00405020
mov byte [esp + 0x274], bl
lea eax, [esp + 0x3c]
push eax
call fcn.00426830
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x2c]
mov eax, 0x75ded953
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
add ebp, 0x22c
cmp edi, eax
jb 0x4116fc
mov dword [esp + 0x274], 6
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x41193e
push eax
call fcn.0045a597
add esp, 4
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x274], 0xffffffff
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0045a597
mov al, byte [esp + 0x1f]
add esp, 4
mov ecx, dword [esp + 0x26c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.004aa641
add esp, 0x264
ret
push 0x80004005
call fcn.00401000
push 0x80070057
call fcn.00401000
int3