Function at 0x4094cb
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440b58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2a0
push edi
mov dword [ebp - 0x2ac], ecx
mov al, byte [0x454a98]
mov byte [ebp - 0x124], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x123]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea ecx, [ebp - 0x124]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea edx, [ebp - 0x124]
push edx
call fcn.00423280
add esp, 8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x409546
lea eax, [ebp - 0x124]
mov dword [ebp - 0x20], eax
jmp 0x40954f
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp + 8]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x450a9c
mov eax, dword [ebp + 8]
push eax
call fcn.00423920
add esp, 8
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00423920
add esp, 8
push 0x2e
mov eax, dword [ebp + 8]
push eax
call fcn.00423280
add esp, 8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4095aa
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423170
add esp, 4
mov edx, dword [ebp + 8]
add edx, eax
mov dword [ebp - 0x20], edx
push 0x450aa0
lea eax, [ebp - 0x124]
push eax
call fcn.00424722
add esp, 8
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0
jne 0x4095f1
lea ecx, [ebp - 0x124]
push ecx
call fcn.00425367
mov edx, dword [eax]
push edx
push 0x450aa4
call fcn.00419810
add esp, 0xc
or eax, 0xffffffff
jmp 0x409e82
push 2
push 0
mov eax, dword [ebp - 0x298]
push eax
call fcn.00425e43
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40963c
mov ecx, dword [ebp - 0x298]
push ecx
call fcn.00424638
add esp, 4
lea edx, [ebp - 0x124]
push edx
call fcn.00425367
mov eax, dword [eax]
push eax
push 0x450ac8
call fcn.00419810
add esp, 0xc
or eax, 0xffffffff
jmp 0x409e82
mov ecx, dword [ebp - 0x298]
push ecx
call fcn.00425cc0
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x409687
mov edx, dword [ebp - 0x298]
push edx
call fcn.00424638
add esp, 4
lea eax, [ebp - 0x124]
push eax
call fcn.00425367
mov ecx, dword [eax]
push ecx
push 0x450af4
call fcn.00419810
add esp, 0xc
or eax, 0xffffffff
jmp 0x409e82
mov edx, dword [ebp - 0x298]
push edx
call fcn.00425c5c
add esp, 4
push 0
push 0x4e
mov eax, dword [ebp - 0x298]
push eax
call fcn.00425e43
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4096e1
mov ecx, dword [ebp - 0x298]
push ecx
call fcn.00424638
add esp, 4
lea edx, [ebp - 0x124]
push edx
call fcn.00425367
mov eax, dword [eax]
push eax
push 0x450b14
call fcn.00419810
add esp, 0xc
or eax, 0xffffffff
jmp 0x409e82
mov dword [ebp - 0x18c], 0x31
push 0x104
push 0
lea ecx, [ebp - 0x290]
push ecx
call fcn.00424820
add esp, 0xc
mov edx, dword [ebp - 0x298]
push edx
push 1
push 0x103
lea eax, [ebp - 0x290]
push eax
call fcn.00425b45
add esp, 0x10
test eax, eax
ja 0x409755
mov ecx, dword [ebp - 0x298]
push ecx
call fcn.00424638
add esp, 4
lea edx, [ebp - 0x124]
push edx
call fcn.00425367
mov eax, dword [eax]
push eax
push 0x450b40
call fcn.00419810
add esp, 0xc
or eax, 0xffffffff
jmp 0x409e82
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x290]
push ecx
call fcn.00434273
add esp, 4
push str..JAVA
lea edx, [ebp - 0x290]
push edx
call fcn.00424ce0
add esp, 8
test eax, eax
je 0x409793
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 7
push 0x450b78
lea eax, [ebp - 0x290]
push eax
call fcn.00434120
add esp, 0xc
test eax, eax
jne 0x4097f3
mov ecx, dword [ebp - 0x298]
push ecx
call fcn.00424638
add esp, 4
push 0x104
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.00424820
add esp, 0xc
push 0x103
push 0x20
lea eax, [ebp - 0x290]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00434220
add esp, 0x10
mov eax, 1
jmp 0x409e82
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x17c]
push eax
push str._s__lu
lea ecx, [ebp - 0x290]
push ecx
call fcn.00425534
add esp, 0x10
cmp eax, 2
jne 0x409831
movsx edx, byte [ebp - 0x17c]
cmp edx, 0x2e
jne 0x409831
cmp dword [ebp - 0x14], 0
jle 0x409831
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x1c]
jle 0x40985b
mov ecx, dword [ebp - 0x298]
push ecx
call fcn.00424638
add esp, 4
push str.http:__www.emed.cc_ContentDetail_CommonDetail.aspx_type_e6_8b_9b_e6_a0_87_e5_85_ac_e5_91_8aid1089108910891089108910896EBB10894F885C1F
mov edx, dword [ebp + 8]
push edx
call fcn.00423910
add esp, 8
mov eax, 1
jmp 0x409e82
mov dword [ebp - 0x12c], 0xffffffff
movsx eax, byte [ebp - 0x17c]
cmp eax, 0x2e
jne 0x40989a
lea ecx, [ebp - 0x17c]
push ecx
call fcn.00423170
add esp, 4
add eax, 1
push eax
lea edx, [ebp - 0x17b]
push edx
lea eax, [ebp - 0x17c]
push eax
call fcn.00425810
add esp, 0xc
push 0x2e
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423280
add esp, 8
mov dword [ebp - 0x10], eax
push 0x450c14
mov edx, dword [ebp - 0x10]
push edx
call fcn.00423910
add esp, 8
lea eax, [ebp - 0x17c]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00423920
add esp, 8
push 0x450c18
lea edx, [ebp - 0x17c]
push edx
call fcn.004299c0
add esp, 8
test eax, eax
jne 0x4098f1
mov dword [ebp - 0x12c], 0
push 0x450c1c
lea eax, [ebp - 0x17c]
push eax
call fcn.004299c0
add esp, 8
test eax, eax
je 0x409939
push str.HTML
lea ecx, [ebp - 0x17c]
push ecx
call fcn.004299c0
add esp, 8
test eax, eax
je 0x409939
push 0x450c28
lea edx, [ebp - 0x17c]
push edx
call fcn.004299c0
add esp, 8
test eax, eax
jne 0x409943
mov dword [ebp - 0x12c], 1
push 0x450c2c
lea eax, [ebp - 0x17c]
push eax
call fcn.004299c0
add esp, 8
test eax, eax
je 0x40998b
push str.DOCX
lea ecx, [ebp - 0x17c]
push ecx
call fcn.004299c0
add esp, 8
test eax, eax
je 0x40998b
push str.DOCM
lea edx, [ebp - 0x17c]
push edx
call fcn.004299c0
add esp, 8
test eax, eax
jne 0x409995
mov dword [ebp - 0x12c], 2
push 0x450c40
lea eax, [ebp - 0x17c]
push eax
call fcn.004299c0
add esp, 8
test eax, eax
je 0x4099dd
push str.XLSX
lea ecx, [ebp - 0x17c]
push ecx
call fcn.004299c0
add esp, 8
test eax, eax
je 0x4099dd
push str.XLSM
lea edx, [ebp - 0x17c]
push edx
call fcn.004299c0
add esp, 8
test eax, eax
jne 0x4099e7
mov dword [ebp - 0x12c], 3
push 0x450c54
lea eax, [ebp - 0x17c]
push eax
call fcn.004299c0
add esp, 8
test eax, eax
jne 0x409a09
mov dword [ebp - 0x12c], 4
push 0x450c58
lea ecx, [ebp - 0x17c]
push ecx
call fcn.004299c0
add esp, 8
test eax, eax
jne 0x409a2b
mov dword [ebp - 0x12c], 5
push 0x450c5c
lea edx, [ebp - 0x17c]
push edx
call fcn.004299c0
add esp, 8
test eax, eax
jne 0x409a4d
mov dword [ebp - 0x12c], 6
push 0x450c60
lea eax, [ebp - 0x17c]
push eax
call fcn.004299c0
add esp, 8
test eax, eax
jne 0x409a6f
mov dword [ebp - 0x12c], 7
push 0x450c64
lea ecx, [ebp - 0x17c]
push ecx
call fcn.004299c0
add esp, 8
test eax, eax
jne 0x409a91
mov dword [ebp - 0x12c], 8
push 0x450c68
lea edx, [ebp - 0x17c]
push edx
call fcn.004299c0
add esp, 8
test eax, eax
jne 0x409ab3
mov dword [ebp - 0x12c], 9
push 0x450c6c
lea eax, [ebp - 0x17c]
push eax
call fcn.004299c0
add esp, 8
test eax, eax
jne 0x409ad5
mov dword [ebp - 0x12c], 0xa
push 0x450c70
lea ecx, [ebp - 0x17c]
push ecx
call fcn.004299c0
add esp, 8
test eax, eax
jne 0x409af7
mov dword [ebp - 0x12c], 0xb
push str.RMVB
lea edx, [ebp - 0x17c]
push edx
call fcn.004299c0
add esp, 8
test eax, eax
jne 0x409b19
mov dword [ebp - 0x12c], 0xc
push 0x450c7c
lea eax, [ebp - 0x17c]
push eax
call fcn.004299c0
add esp, 8
test eax, eax
jne 0x409b3b
mov dword [ebp - 0x12c], 0xd
push 0x450c80
lea ecx, [ebp - 0x17c]
push ecx
call fcn.004299c0
add esp, 8
test eax, eax
jne 0x409b5d
mov dword [ebp - 0x12c], 0xe
push 0x450c84
lea edx, [ebp - 0x17c]
push edx
call fcn.004299c0
add esp, 8
test eax, eax
jne 0x409b7f
mov dword [ebp - 0x12c], 0xf
push 0x450c88
lea eax, [ebp - 0x17c]
push eax
call fcn.004299c0
add esp, 8
test eax, eax
je 0x409bc7
push 0x450c8c
lea ecx, [ebp - 0x17c]
push ecx
call fcn.004299c0
add esp, 8
test eax, eax
je 0x409bc7
push 0x450c90
lea edx, [ebp - 0x17c]
push edx
call fcn.004299c0
add esp, 8
test eax, eax
jne 0x409bd1
mov dword [ebp - 0x12c], 0x10
cmp dword [ebp - 0x12c], 0xffffffff
jne 0x409c05
mov eax, dword [ebp - 0x298]
push eax
call fcn.00424638
add esp, 4
lea ecx, [ebp - 0x17c]
push ecx
push 0x450c94
call fcn.00419810
add esp, 8
or eax, 0xffffffff
jmp 0x409e82
push 0
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x298]
push eax
call fcn.00425e43
add esp, 0xc
cmp eax, 0xffffffff
jne 0x409c5c
mov ecx, dword [ebp - 0x298]
push ecx
call fcn.00424638
add esp, 4
lea edx, [ebp - 0x124]
push edx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x14]
push eax
call fcn.00425367
mov ecx, dword [eax]
push ecx
push 0x450cb8
call fcn.00419810
add esp, 0x10
or eax, 0xffffffff
jmp 0x409e82
push 0x450ce0
mov edx, dword [ebp + 8]
push edx
call fcn.00424722
add esp, 8
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
jne 0x409ca4
mov eax, dword [ebp - 0x298]
push eax
call fcn.00424638
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
push str._enc0ERROR:
call fcn.00419810
add esp, 8
or eax, 0xffffffff
jmp 0x409e82
mov dword [ebp - 0x294], 0x8000
mov edx, dword [ebp - 0x294]
push edx
lea ecx, [ebp - 0x188]
call fcn.00413440
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x14]
jge 0x409e40
mov ecx, dword [ebp - 0x294]
mov dword [ebp - 0x29c], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x294]
cmp edx, dword [ebp - 0x14]
jle 0x409d00
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x29c], eax
mov ecx, dword [ebp - 0x298]
push ecx
push 1
mov edx, dword [ebp - 0x29c]
push edx
lea ecx, [ebp - 0x188]
call fcn.004136c0
push eax
call fcn.00425b45
add esp, 0x10
test eax, eax
ja 0x409d99
mov eax, dword [ebp - 0x128]
push eax
call fcn.00424638
add esp, 4
mov ecx, dword [ebp - 0x298]
push ecx
call fcn.00424638
add esp, 4
mov edx, dword [ebp + 8]
push edx
call fcn.00433f1c
add esp, 4
lea eax, [ebp - 0x124]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00425367
mov edx, dword [eax]
push edx
push 0x450d04
call fcn.00419810
add esp, 0x10
mov dword [ebp - 0x2a0], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x188]
call fcn.00413510
mov eax, dword [ebp - 0x2a0]
jmp 0x409e82
mov eax, dword [ebp - 0x128]
push eax
push 1
mov ecx, dword [ebp - 0x29c]
push ecx
lea ecx, [ebp - 0x188]
call fcn.004136c0
push eax
call fcn.004256c8
add esp, 0x10
test eax, eax
ja 0x409e2f
mov edx, dword [ebp - 0x128]
push edx
call fcn.00424638
add esp, 4
mov eax, dword [ebp - 0x298]
push eax
call fcn.00424638
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.00433f1c
add esp, 4
lea edx, [ebp - 0x124]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.00425367
mov ecx, dword [eax]
push ecx
push 0x450d3c
call fcn.00419810
add esp, 0x10
mov dword [ebp - 0x2a4], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x188]
call fcn.00413510
mov eax, dword [ebp - 0x2a4]
jmp 0x409e82
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x29c]
mov dword [ebp - 0x18], edx
jmp 0x409cce
mov eax, dword [ebp - 0x128]
push eax
call fcn.00424638
add esp, 4
mov ecx, dword [ebp - 0x298]
push ecx
call fcn.00424638
add esp, 4
mov edx, dword [ebp - 0x12c]
mov dword [ebp - 0x2a8], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x188]
call fcn.00413510
mov eax, dword [ebp - 0x2a8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret 4