Function at 0x452da1
Capabilities:
Get common file path
Terminate process

Disassembly:
push 0x848
mov eax, 0x5b3c54
call fcn.00580bb4
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x814]
push eax
push ebx
push ebx
push 0x24
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push ebx
push 1
call fcn.0040eabb
pop ecx
pop ecx
mov dword [ebp - 0x840], eax
mov dword [ebp - 0x838], eax
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x452def
lea ecx, [ebp - 0x834]
mov dword [eax], ecx
jmp 0x452df1
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x834], eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x828], ebx
mov dword [ebp - 0x824], ebx
mov dword [ebp - 0x820], ebx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x834]
call fcn.0041dec4
lea eax, [ebp + 8]
call fcn.0040877f
mov eax, dword [ebp - 0x824]
sub eax, dword [ebp - 0x828]
mov ecx, 0x22c
cdq
idiv ecx
mov dword [ebp - 0x81c], ebx
test eax, eax
jbe 0x4530b4
mov dword [ebp - 0x850], ebx
mov dword [ebp - 0x84c], ebx
mov dword [ebp - 0x848], ebx
mov dword [ebp - 0x844], ebx
mov byte [ebp - 4], 5
push dword [ebp - 0x81c]
lea esi, [ebp - 0x834]
call fcn.00466950
push dword [eax + 8]
lea ecx, [ebp - 0x850]
call fcn.0041e16e
pop ecx
cmp dword [ebp - 0x84c], ebx
je 0x453076
jbe 0x4530ff
mov eax, dword [ebp - 0x850]
add eax, 0x220
push eax
lea eax, [ebp - 0x818]
push eax
call fcn.0040852d
mov byte [ebp - 4], 6
lea eax, [ebp - 0x814]
push eax
push str.SystemRoot
lea eax, [ebp - 0x818]
push eax
call fcn.00408634
push 0x6735dc
push 0x6735e0
lea eax, [ebp - 0x818]
push eax
call fcn.00408634
lea eax, [ebp - 0x818]
call fcn.0040877f
push dword [ebp + 8]
lea eax, [ebp - 0x818]
push eax
call fcn.0040860e
test eax, eax
jne 0x453067
push 0x6735ec
xor ecx, ecx
lea esi, [ebp - 0x818]
call fcn.00426092
cmp eax, 0xffffffff
jne 0x453067
push dword [ebp - 0x81c]
lea esi, [ebp - 0x834]
call fcn.00466950
lea esi, [eax + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esi], eax
je 0x453067
xor edi, edi
inc edi
cmp dword [0x6bc38c], edi
jl 0x452f85
push dword [ebp - 0x818]
lea eax, [ebp - 0x854]
push eax
call fcn.00470110
mov byte [ebp - 4], 7
push dword [eax]
push str.PRE_PROC:__s
push 0x673610
push edi
call fcn.00532652
add esp, 0x18
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x854]
call fcn.0040842d
push dword [ebp - 0x81c]
lea esi, [ebp - 0x834]
call fcn.00466950
push dword [eax + 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x83c], eax
cmp eax, ebx
je 0x453067
cmp dword [0x6bc38c], edi
jl 0x452ff1
push dword [ebp - 0x818]
lea eax, [ebp - 0x838]
push eax
call fcn.00470110
mov byte [ebp - 4], 8
push dword [eax]
push str.OPEN_PROC:__s
push 0x67362c
push edi
call fcn.00532652
add esp, 0x18
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x838]
call fcn.0040842d
push ebx
push dword [ebp - 0x83c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x6bc38c], 1
mov edi, eax
jl 0x453050
push dword [ebp - 0x818]
lea eax, [ebp - 0x840]
push eax
call fcn.00470110
pop ecx
pop ecx
mov esi, eax
mov byte [ebp - 4], 9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push dword [esi]
push str.POST_PROC:__s___i___i
push str.KillInProcs
push 1
call fcn.00532652
add esp, 0x18
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x840]
call fcn.0040842d
push dword [ebp - 0x83c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x818]
call fcn.0040856e
mov byte [ebp - 4], 4
cmp dword [ebp - 0x850], ebx
je 0x45308e
push dword [ebp - 0x850]
call fcn.00573a92
pop ecx
mov eax, dword [ebp - 0x824]
sub eax, dword [ebp - 0x828]
mov ecx, 0x22c
cdq
idiv ecx
inc dword [ebp - 0x81c]
cmp dword [ebp - 0x81c], eax
jb 0x452e49
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x828], ebx
je 0x4530cc
push dword [ebp - 0x828]
call fcn.00573401
pop ecx
mov dword [ebp - 0x828], ebx
mov dword [ebp - 0x824], ebx
mov dword [ebp - 0x820], ebx
mov byte [ebp - 4], bl
lea eax, [ebp - 0x834]
push eax
call fcn.0044ea56
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040856e
call fcn.00580c37
ret
push 0x80070057
call fcn.00402d73
int3