Function at 0x40538a
Capabilities:
Get common file path
Terminate process

Disassembly:
push 0x240
mov eax, 0x40822b
call fcn.0040785d
mov edi, ecx
push dword [edi + 4]
mov byte [ebp - 0x21b], 0
mov byte [ebp - 0x21a], 0
mov byte [ebp - 0x21c], 0
mov byte [ebp - 0x219], 0
call dword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
test eax, eax
je 0x40568b
xor esi, esi
mov dword [ebp - 0x220], esi
mov dword [ebp - 4], esi
cmp dword [ebp - 0x220], esi
je 0x4053ed
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x220], esi
lea eax, [ebp - 0x220]
push eax
push 1
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x405645
lea eax, [ebp - 0x22c]
push eax
push esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push 1
push dword [ebp - 0x220]
call esi
test eax, eax
jne 0x405645
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x405645
push dword [ebp - 0x22c]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
and dword [ebp - 0x234], 0
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x238], ebx
jne 0x405464
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x234], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x40562f
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x22c]
push ebx
push 1
push dword [ebp - 0x220]
call esi
test eax, eax
je 0x40562f
push dword [ebx]
lea esi, [edi + 0x38]
call fcn.004056d1
test al, al
je 0x4054d9
lea eax, [ebp - 0x224]
push eax
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
je 0x4054d9
push dword [ebp - 0x224]
lea ecx, [edi + 0x3c]
call dword [sym.imp.GrooveUtil.DLL_public:_void___thiscall_GCStr::Set_wchar_t_const__]
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov byte [ebp - 0x21b], 1
lea eax, [ebp - 0x218]
push eax
push 0
push dword [ebp - 0x220]
push 0x801c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
mov ebx, dword [sym.imp.GrooveUtil.DLL_public:_static_class_GCStrRetVal___cdecl_raw_GCStr::ConcatStrings_unsigned_long_int__wchar_t_const___wchar_t_const__]
jl 0x405575
lea eax, [ebp - 0x218]
lea esi, [edi + 0x40]
push eax
mov ecx, esi
call dword [sym.imp.GrooveUtil.DLL_public:_void___thiscall_GCStr::Set_wchar_t_const__]
push dword [esi]
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.GrooveUtil.DLL_public:_static_class_GCStrRetVal___stdcall_raw_GCStr::ToLower_wchar_t_const__]
cmp dword [esi], 0
mov eax, dword [eax]
mov dword [ebp - 0x224], eax
je 0x405535
mov ecx, esi
call dword [sym.imp.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_]
mov eax, dword [ebp - 0x224]
push str.microsoftofficegroove_
push eax
mov dword [esi], eax
lea eax, [ebp - 0x230]
push 2
push eax
call ebx
mov eax, dword [eax]
add esp, 0x10
cmp dword [esi], 0
mov dword [ebp - 0x224], eax
je 0x405566
mov ecx, esi
call dword [sym.imp.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_]
mov eax, dword [ebp - 0x224]
mov dword [esi], eax
mov byte [ebp - 0x21a], 1
push edi
call fcn.0040510d
test eax, eax
jne 0x405586
mov byte [ebp - 0x21c], 1
mov eax, dword [edi + 0x3c]
push 0x40a884
push 0x40a74c
push eax
lea eax, [ebp - 0x230]
push 3
push eax
call ebx
mov eax, dword [eax]
add esp, 0x14
mov dword [ebp - 0x228], eax
mov byte [ebp - 4], 2
push 0
push dword [ebp - 0x228]
lea ecx, [ebp - 0x24c]
push 0x80000003
call dword [sym.imp.GrooveUtil.DLL_public:_void___thiscall_GCRegistryKey::constructor_struct_HKEY_____wchar_t_const___bool_]
mov byte [ebp - 4], 3
push 0xf003f
lea ecx, [ebp - 0x24c]
call dword [sym.imp.GrooveUtil.DLL_public:_long_int___thiscall_GCRegistryKey::Open_unsigned_long_int_]
test eax, eax
jne 0x405600
mov edi, dword [edi + 0x34]
push str.AuditRoot
push edi
lea ecx, [ebp - 0x24c]
call dword [sym.imp.GrooveUtil.DLL_public:_long_int___thiscall_GCRegistryKey::SetValue_wchar_t_const___wchar_t_const__]
test eax, eax
jne 0x405600
mov byte [ebp - 0x219], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24c]
call dword [sym.imp.GrooveUtil.DLL_public_virtual:_void___thiscall_GCRegistryKey::destructor_void_]
mov byte [ebp - 4], 1
cmp dword [ebp - 0x228], 0
je 0x405629
lea ecx, [ebp - 0x228]
call dword [sym.imp.GrooveUtil.DLL_private:_void___thiscall_GCStr::_Release_void_]
mov ebx, dword [ebp - 0x238]
mov byte [ebp - 4], 0
test ebx, ebx
je 0x405645
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [ebp - 0x234], 0
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x40566b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x76
call fcn.0040698f
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x220], 0
je 0x40568b
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x220], 0
xor esi, esi
cmp byte [ebp - 0x21b], 0
je 0x4056b1
cmp byte [ebp - 0x21a], 0
je 0x4056b1
cmp byte [ebp - 0x21c], 0
je 0x4056b1
cmp byte [ebp - 0x219], 0
jne 0x4056c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x4056c0
push 2
pop esi
push 0x77
mov eax, esi
call fcn.0040698f
mov eax, esi
call fcn.004078e0
ret