Function at 0x4089a0
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x234
call fcn.0043cb70
test al, al
je 0x408cb3
lea eax, [esp + 0x2c]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.00436620
test al, al
je 0x408cae
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, 0x92a9e86d
mov esi, 0xa1396ffb
mov ecx, ebx
shrd esi, edx, cl
mov dword [esp + 0x14], eax
shr edx, cl
test bl, 0x20
je 0x408a01
mov esi, edx
xor edx, edx
mov eax, esi
xor eax, 0xa1396ffb
mov dword [esp], eax
mov dword [esp + 0x10], esi
mov ecx, esi
mov edi, esi
xor ecx, 0x5ec69004
mov dword [esp + 0xc], ecx
and ecx, 0xc9a8831
and eax, 0xf36577ce
or eax, ecx
mov ebp, edx
xor ebp, 0x92a9e86d
mov esi, edx
mov ebx, edx
xor edx, 0x6d561792
mov dword [esp + 0x20], edx
and edx, 0xb02f9af5
mov ecx, ebp
mov dword [esp + 0x1c], ebp
and ecx, 0x4fd0650a
or ecx, edx
xor edi, 0x1004349
xor eax, 0x95acb78
and edi, 0x5c04349
or edi, eax
xor ebx, 0x9008082c
xor ecx, 0x45219349
and ebx, 0xf50e09bc
or ebx, ecx
mov eax, dword [esp]
and eax, 0x5c04349
mov ecx, eax
mov dword [esp + 8], eax
mov edx, ebp
and edx, 0xf50e09bc
mov dword [esp + 0x18], edx
mov eax, ebx
not eax
mov dword [esp + 4], eax
not edx
and edx, eax
mov ebp, edi
and edi, ecx
mov eax, edi
imul edi, edx
not ebp
mov ecx, dword [esp + 8]
not ecx
and ecx, ebp
mul ecx
mov dword [esp + 0x28], eax
add edi, edx
mov edx, dword [esp + 0x18]
and ebx, edx
imul ebx, ecx
add ebx, edi
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 8]
mov edi, eax
and edi, ebp
or ebp, eax
mov ecx, edx
mov eax, dword [esp + 4]
and ecx, eax
or eax, edx
mov ebx, eax
mov eax, ebp
imul ebp, ecx
mul edi
mov dword [esp + 8], eax
add ebp, edx
imul ebx, edi
add ebx, ebp
mov dword [esp + 4], ebx
mov ecx, dword [esp + 0xc]
and ecx, 0xda5abaa8
mov eax, dword [esp]
mov edi, eax
and eax, 0x25a54557
or eax, ecx
mov edx, dword [esp + 0x20]
and edx, 0xfbe3bbd8
mov ecx, dword [esp + 0x1c]
mov ebx, ecx
and ecx, 0x41c4427
or ecx, edx
mov ebp, dword [esp + 0x10]
xor ebp, 0xa0392cb2
xor eax, 0x2065061e
and ebp, 0xfa3fbcb6
or ebp, eax
xor esi, 0x2a1e041
xor ecx, 0xf1124d9b
and esi, 0xaf1f643
or esi, ecx
mov eax, edi
and eax, 0xfa3fbcb6
mov dword [esp + 0x10], eax
and ebx, 0xaf1f643
mov dword [esp + 0xc], ebx
mov edi, ebp
not edi
mov ecx, esi
not ecx
and edi, eax
and ecx, ebx
mov ebx, eax
not ebx
and ebx, ebp
mov eax, ebx
mul edi
mov dword [esp], eax
imul ebx, ecx
add ebx, edx
mov eax, dword [esp + 0xc]
mov ecx, eax
not ecx
and ecx, esi
imul ecx, edi
add ecx, ebx
mov ebx, ebp
mov edx, dword [esp + 0x10]
and ebx, edx
or ebp, edx
mov edx, esi
and edx, eax
or esi, eax
mov eax, ebp
imul ebp, edx
mul ebx
add ebp, edx
imul esi, ebx
add esi, ebp
add eax, dword [esp]
adc esi, ecx
add eax, dword [esp + 0x28]
adc esi, dword [esp + 0x24]
add eax, dword [esp + 8]
adc esi, dword [esp + 4]
mov edi, esi
shr edi, 0x15
xor edi, esi
shld esi, eax, 0xb
xor esi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x408c8a
mov eax, esi
and eax, 0x50deeace
mov dword [esp], eax
mov ebx, edi
and ebx, 0xb7c21bdd
xor eax, 0x50deeace
mov ebp, esi
and ebp, 0xaf211531
mov ecx, edi
and ecx, 0x483de422
imul ecx, eax
mul ebp
mov dword [esp + 4], eax
or esi, 0x50deeace
mov eax, esi
imul esi, ebx
xor ebx, 0xb7c21bdd
imul ebp, ebx
add ebp, edx
mov ebx, dword [esp]
mul ebx
add ebp, ecx
add esi, edx
or edi, 0xb7c21bdd
imul edi, ebx
add edi, esi
add eax, dword [esp + 4]
adc edi, ebp
mov edx, eax
mov ecx, dword [esp + 0x14]
shrd edx, edi, cl
mov ebx, edi
shr ebx, cl
test cl, 0x20
je 0x408c56
mov edx, ebx
xor ebx, ebx
mov ecx, edi
and ecx, 0xf4b96246
mov esi, eax
and esi, 0x1c751670
or edi, 0xf4b96246
or eax, 0x1c751670
or eax, 1
sub esi, eax
sbb ecx, edi
xor esi, edx
xor ecx, ebx
xor ecx, 0xb469db9
xor esi, 0xe38ae98f
mov edi, ecx
or edi, 0x1010101
or esi, 0x1010101
push edi
push esi
call fcn.00409ed0
add esp, 8
test al, al
je 0x408cae
call fcn.0040ce80
call fcn.0040b930
call fcn.0043deb0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]