Function at 0x413398
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4abf3f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x188
mov dword [ebp - 0x18c], ecx
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 0x430]
add ecx, 1
mov edx, dword [ebp - 0x18c]
mov dword [edx + 0x430], ecx
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 0x430]
push ecx
push 0x111a
push str.Kill___d_No._d_n
call fcn.00401ab0
add esp, 0xc
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x18c]
add ecx, 0x398
call fcn.00416c30
lea eax, [ebp - 0x16c]
push eax
mov ecx, dword [ebp - 0x18c]
add ecx, 0x398
call fcn.00416d80
push eax
lea ecx, [ebp - 0x1c]
call fcn.0043b3a0
and eax, 0xff
test eax, eax
je 0x413592
lea ecx, [ebp - 0x1c]
call fcn.00417fc0
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
cmp dword [ecx + 0x16c], 0
je 0x41348d
push 4
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx + 0x16c]
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 0x16c]
mov eax, dword [edx]
call dword [eax + 4]
push eax
push str.Scan_by_killers_lpKiller__GetDescript_4____s_n
call fcn.00401ab0
add esp, 8
mov ecx, dword [ebp - 0x20]
add ecx, 4
push ecx
push 0x4c4b38
call fcn.00401ab0
add esp, 8
jmp 0x4134b8
mov edx, dword [ebp - 0x20]
add edx, 0x108
push edx
push str.Scan_by_Eng_szVirName___s_n
call fcn.00401ab0
add esp, 8
mov eax, dword [ebp - 0x20]
add eax, 4
push eax
push 0x4c4b68
call fcn.00401ab0
add esp, 8
mov ecx, dword [ebp - 0x20]
cmp dword [ecx + 0x16c], 0
je 0x413518
push 0x4c4b7c
push 0
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx + 0x16c]
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 0x16c]
mov eax, dword [edx]
call dword [eax + 4]
push eax
call fcn.00402af0
add esp, 8
test eax, eax
jne 0x413518
mov ecx, dword [ebp - 0x20]
add ecx, 4
push ecx
push str.szFilePath___s_n
call fcn.00401ab0
add esp, 8
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
push eax
push str.nFlag___d_n
call fcn.00401ab0
add esp, 8
jmp 0x41357c
mov ecx, dword [ebp - 0x20]
cmp dword [ecx], 0x64
jge 0x413549
mov edx, dword [ebp - 0x20]
add edx, 4
push edx
push str.KillFile_szFilePath___s_n
call fcn.00401ab0
add esp, 8
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
push ecx
push str.KillFile_nFlag________d_n
call fcn.00401ab0
add esp, 8
jmp 0x41357c
mov edx, dword [ebp - 0x20]
cmp dword [edx + 0x16c], 0
je 0x41357c
mov eax, dword [ebp - 0x20]
add eax, 4
push eax
push str.szFilePath________s_n
call fcn.00401ab0
add esp, 8
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
push edx
push str.nFlag_____________d_n
call fcn.00401ab0
add esp, 8
push 0
lea eax, [ebp - 0x170]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0043b370
jmp 0x41340b
mov ecx, dword [ebp - 0x18c]
cmp dword [ecx + 0x3ac], 0
je 0x413648
push 0x4c4c10
mov edx, dword [ebp - 0x18c]
push edx
call fcn.0040ba43
add esp, 8
cmp dword [0x54b134], 0
jne 0x413648
mov dword [0x54b134], 1
push 0x44
push 0x4c4c24
push 0x4c4c28
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 6
jne 0x413648
lea edx, [ebp - 0x128]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.360akcheck.txt
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [ebp - 0x128]
push ecx
call fcn.0046a930
mov ecx, eax
call fcn.0046bfc7
test eax, eax
je 0x413648
lea edx, [ebp - 0x128]
push edx
push str.akcheck
call fcn.0044d8c9
mov ecx, eax
call fcn.0044d96f
push 0x4c4c6c
mov eax, dword [ebp - 0x18c]
push eax
call fcn.0040ba43
add esp, 8
mov ecx, dword [ebp - 0x18c]
cmp dword [ecx + 0x3ac], 0
je 0x413710
push 1
mov ecx, dword [ebp - 0x18c]
call fcn.00414047
mov dword [ebp - 0x12c], 0
jmp 0x413697
mov edx, dword [ebp - 0x12c]
add edx, 1
mov dword [ebp - 0x12c], edx
cmp dword [ebp - 0x12c], 8
jge 0x413710
mov eax, dword [ebp - 0x18c]
add eax, 0x55c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 0x18c]
add ecx, 0x544
call fcn.00478c30
test eax, eax
je 0x4136dc
mov ecx, dword [ebp - 0x18c]
mov edx, dword [ecx + 0x590]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x4136f0
mov eax, dword [ebp - 0x18c]
add eax, 0x55c
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x413710
mov ecx, dword [ebp - 0x18c]
add ecx, 0x55c
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x413688
push 0x4c4c84
mov edx, dword [ebp - 0x18c]
push edx
call fcn.0040ba43
add esp, 8
mov ecx, dword [ebp - 0x18c]
add ecx, 0x398
call fcn.00478c30
test eax, eax
jbe 0x4137a3
mov ecx, dword [ebp - 0x18c]
add ecx, 0x5a4
call fcn.00416d40
mov ecx, dword [ebp - 0x18c]
call fcn.004145a3
mov ecx, dword [ebp - 0x18c]
add ecx, 0x5a4
call fcn.00478c30
test eax, eax
jbe 0x413792
mov ecx, dword [ebp - 0x18c]
call fcn.00414e87
cmp eax, 2
jne 0x413787
mov ecx, dword [ebp - 0x18c]
call fcn.00414af5
jmp 0x413792
mov ecx, dword [ebp - 0x18c]
call fcn.00414863
mov ecx, dword [ebp - 0x18c]
add ecx, 0x5a4
call fcn.00416d40
push 0x4c4c9c
mov eax, dword [ebp - 0x18c]
push eax
call fcn.0040ba43
add esp, 8
mov ecx, dword [ebp - 0x18c]
add ecx, 0x398
call fcn.00478c30
test eax, eax
je 0x4137d1
call fcn.00444d5a
push 0x4c4cb8
mov ecx, dword [ebp - 0x18c]
push ecx
call fcn.0040ba43
add esp, 8
mov ecx, dword [ebp - 0x18c]
add ecx, 0x398
call fcn.00478c30
cmp eax, 0xa
jb 0x413805
mov dword [0x54b128], 1
mov ecx, dword [ebp - 0x18c]
call fcn.00412d07
cmp eax, 1
jne 0x41381f
mov dword [0x54b128], 1
push 0x4c4cd4
mov edx, dword [ebp - 0x18c]
push edx
call fcn.0040ba43
add esp, 8
call fcn.0045c138
mov ecx, eax
call fcn.0045b023
push 0x4c4cf0
mov eax, dword [ebp - 0x18c]
push eax
call fcn.0040ba43
add esp, 8
push 0x4c4d10
mov ecx, dword [ebp - 0x18c]
push ecx
call fcn.0040ba43
add esp, 8
mov dword [ebp - 0x10], 0
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x18c]
add ecx, 0x398
call fcn.00416c30
lea eax, [ebp - 0x174]
push eax
mov ecx, dword [ebp - 0x18c]
add ecx, 0x398
call fcn.00416d80
push eax
lea ecx, [ebp - 0x18]
call fcn.0043b3a0
and eax, 0xff
test eax, eax
je 0x413b7d
lea ecx, [ebp - 0x18]
call fcn.00417fc0
mov dword [ebp - 0x130], eax
push 0x4c4d30
mov ecx, dword [ebp - 0x130]
add ecx, 0x108
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x4138e5
mov dword [0x54b128], 1
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x32
jge 0x41395e
mov eax, dword [ebp - 0x130]
cmp dword [eax + 0x16c], 0
je 0x41393b
mov ecx, dword [ebp - 0x130]
add ecx, 4
push ecx
push 4
mov edx, dword [ebp - 0x130]
mov ecx, dword [edx + 0x16c]
mov eax, dword [ebp - 0x130]
mov edx, dword [eax + 0x16c]
mov eax, dword [edx]
call dword [eax + 4]
push eax
call fcn.0044d8c9
mov ecx, eax
call fcn.0044dfad
jmp 0x41395e
mov ecx, dword [ebp - 0x130]
add ecx, 4
push ecx
mov edx, dword [ebp - 0x130]
add edx, 0x108
push edx
call fcn.0044d8c9
mov ecx, eax
call fcn.0044dfad
mov eax, dword [ebp - 0x130]
cmp dword [eax + 0x170], 0
jne 0x41398f
mov ecx, dword [ebp - 0x130]
mov dword [ecx], 0xffffff9d
push 0
lea edx, [ebp - 0x178]
push edx
lea ecx, [ebp - 0x18]
call fcn.0043b370
jmp 0x413883
mov eax, dword [ebp - 0x130]
add eax, 4
push eax
push 0x4c4d38
mov ecx, dword [ebp - 0x18c]
push ecx
call fcn.0040ba43
add esp, 0xc
mov edx, dword [ebp - 0x130]
cmp dword [edx], 0
jne 0x4139ce
push 0
lea eax, [ebp - 0x17c]
push eax
lea ecx, [ebp - 0x18]
call fcn.0043b370
jmp 0x413883
mov ecx, dword [ebp - 0x130]
cmp dword [ecx + 0x16c], 0
je 0x413a4b
push 0x4c4d4c
push 0
mov edx, dword [ebp - 0x130]
mov ecx, dword [edx + 0x16c]
mov eax, dword [ebp - 0x130]
mov edx, dword [eax + 0x16c]
mov eax, dword [edx]
call dword [eax + 4]
push eax
call fcn.00402af0
add esp, 8
test eax, eax
jne 0x413a4b
mov ecx, dword [ebp - 0x130]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 0x130]
add eax, 4
push eax
mov ecx, dword [ebp - 0x130]
mov ecx, dword [ecx + 0x16c]
mov edx, dword [ebp - 0x130]
mov eax, dword [edx + 0x16c]
mov edx, dword [eax]
call dword [edx + 0x1c]
mov ecx, dword [ebp - 0x130]
mov dword [ecx], eax
jmp 0x413ae0
mov edx, dword [ebp - 0x130]
cmp dword [edx], 0x64
jge 0x413a81
push 1
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x130]
add edx, 4
push edx
call fcn.004281f0
mov ecx, eax
call fcn.004284a8
mov ecx, dword [ebp - 0x130]
mov dword [ecx], eax
jmp 0x413ae0
mov edx, dword [ebp - 0x130]
cmp dword [edx + 0x16c], 0
je 0x413aca
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x130]
add edx, 4
push edx
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax + 0x16c]
mov edx, dword [ebp - 0x130]
mov eax, dword [edx + 0x16c]
mov edx, dword [eax]
call dword [edx + 0x1c]
mov ecx, dword [ebp - 0x130]
mov dword [ecx], eax
jmp 0x413ae0
push 0
lea edx, [ebp - 0x180]
push edx
lea ecx, [ebp - 0x18]
call fcn.0043b370
jmp 0x413883
mov eax, dword [ebp - 0x130]
cmp dword [eax], 3
jne 0x413b0b
push 0
push 0x4c4d58
push str.ak360Kill
call fcn.0041e8a6
add esp, 0xc
mov dword [0x54b138], 1
jmp 0x413b57
mov ecx, dword [ebp - 0x130]
cmp dword [ecx], 0xfffffffe
jne 0x413b2b
cmp dword [0x54b128], 0
jne 0x413b2b
mov dword [0x54b128], 1
jmp 0x413b57
mov edx, dword [ebp - 0x130]
cmp dword [edx], 0
jg 0x413b57
mov eax, dword [ebp - 0x130]
cmp dword [eax], 0xfffffffe
je 0x413b57
push 0
lea ecx, [ebp - 0x184]
push ecx
lea ecx, [ebp - 0x18]
call fcn.0043b370
jmp 0x413883
mov edx, dword [ebp - 0x18]
push edx
lea eax, [ebp - 0x188]
push eax
mov ecx, dword [ebp - 0x18c]
add ecx, 0x398
call fcn.0047e160
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
jmp 0x413883
mov ecx, dword [ebp - 0x18c]
call fcn.00413ed7
push 0x4c4d6c
mov edx, dword [ebp - 0x18c]
push edx
call fcn.0040ba43
add esp, 8
mov ecx, dword [ebp - 0x18c]
call fcn.00414e87
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jne 0x413ca7
push 0x408
mov ecx, dword [ebp - 0x18c]
add ecx, 0x2d4
call fcn.00402b10
push eax
lea ecx, [ebp - 0x134]
call fcn.00404170
push 1
lea ecx, [ebp - 0x134]
call fcn.00416650
mov eax, dword [ebp - 0x18c]
add eax, 0x2d0
test eax, eax
je 0x413c06
mov ecx, dword [ebp - 0x18c]
add ecx, 0x2d4
mov dword [ebp - 0x190], ecx
jmp 0x413c10
mov dword [ebp - 0x190], 0
push 0x408
mov ecx, dword [ebp - 0x18c]
add ecx, 0x2d4
call fcn.00402b10
push eax
push 0x408
push 0x111
mov ecx, dword [ebp - 0x190]
call fcn.0047e220
push eax
call fcn.00408370
add esp, 0x10
mov edx, dword [ebp - 0x18c]
add edx, 0x2d0
test edx, edx
je 0x413c68
mov eax, dword [ebp - 0x18c]
add eax, 0x2d4
mov dword [ebp - 0x194], eax
jmp 0x413c72
mov dword [ebp - 0x194], 0
push 0x40a
mov ecx, dword [ebp - 0x18c]
add ecx, 0x2d4
call fcn.00402b10
push eax
push 0x40a
push 0x111
mov ecx, dword [ebp - 0x194]
call fcn.0047e220
push eax
call fcn.00408370
add esp, 0x10
cmp dword [0x562c7c], 5
jb 0x413cba
mov dword [0x54b128], 1
cmp dword [0x54b128], 0
je 0x413cd7
push 0
push 0x4c4d8c
push str.ak360Kill_r
call fcn.0041e8a6
add esp, 0xc
cmp dword [0x54b138], 0
jne 0x413cf6
cmp dword [0x54b128], 0
jne 0x413cf6
cmp dword [0x54b12c], 0
je 0x413dd3
call fcn.0047cb16
test eax, eax
je 0x413d1b
push 0x40
push 0x4c4da4
push 0x4c4dac
mov ecx, dword [ebp - 0x18c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x138], 0
cmp dword [0x54b12c], 0
je 0x413d85
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 4]
push ecx
push 0x4c4ddc
push 0x4c4de8
lea ecx, [ebp - 0x164]
call fcn.00418ce0
mov dword [ebp - 4], 0
push 0
mov edx, dword [ebp - 0x18c]
mov eax, dword [edx + 4]
push eax
lea ecx, [ebp - 0x164]
call fcn.004172a0
mov dword [ebp - 0x138], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x164]
call fcn.00418d59
jmp 0x413da7
push 0x44
push 0x4c4e2c
push 0x4c4e30
mov ecx, dword [ebp - 0x18c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 6
je 0x413db9
cmp dword [ebp - 0x138], 1
jne 0x413dd1
push 1
push str.akReboot
call fcn.0044d8c9
mov ecx, eax
call fcn.0044ec8a
call fcn.0043a587
jmp 0x413e04
call fcn.0041ee16
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jl 0x413e04
push 0
push 0
mov eax, dword [ebp - 0x168]
push eax
mov ecx, dword [ebp - 0x18c]
mov edx, dword [ecx + 4]
push edx
call fcn.0041dd0f
add esp, 0x10
call fcn.00430947
test eax, eax
jne 0x413e29
push 1
push 0x43b
mov ecx, dword [ebp - 0x18c]
add ecx, 4
call fcn.00402b10
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret