Function at 0x408ba0
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x228
call fcn.0043c240
test al, al
je 0x408dd9
lea eax, [esp + 0x20]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.00435ef0
test al, al
je 0x408dd4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, 0x9ab55e11
mov edi, 0x8c2f8c8a
mov ecx, ebx
shrd edi, edx, cl
shr edx, cl
mov dword [esp + 0x10], eax
mov esi, 0x8c2f8c8a
xor ebp, ebp
test bl, 0x20
jne 0x408c08
mov ecx, edi
jmp 0x408c0c
mov ecx, edx
xor edx, edx
mov dword [esp], edx
add esi, 0xfffffffe
mov edi, 0
adc edi, 0x9ab55e10
and edi, edx
and esi, ecx
mov dword [esp + 4], ecx
mov ebx, ecx
and ebx, 2
or ecx, 0xfffffffd
add ecx, 1
adc ebp, 0xffffffff
mov eax, esi
xor eax, 0xfffffffe
mov edx, ecx
imul edx, edi
mov dword [esp + 0xc], edx
not edi
mul ebx
mov dword [esp + 8], eax
imul edi, ebx
or edx, edi
mov ebx, edx
mov eax, ecx
mul esi
mov edi, eax
add edx, dword [esp + 0xc]
imul ebp, esi
add ebp, edx
add edi, dword [esp + 8]
adc ebp, ebx
add edi, dword [esp + 4]
adc ebp, dword [esp]
add edi, 0x8c2f8c8a
adc ebp, 0x9ab55e11
mov edx, edi
and edx, 0x3c5b0895
mov ecx, ebp
and ecx, 0xb6357ddf
mov dword [esp + 8], ecx
mov eax, edi
and eax, 0xc3a4f76a
xor ecx, 0xb6357ddf
mov esi, eax
mov ebx, eax
xor esi, 0xc3a4f76a
imul ecx, edx
mov eax, esi
mul edx
mov dword [esp + 0xc], eax
mov eax, ebp
and eax, 0x49ca8220
imul eax, esi
add edx, eax
add edx, ecx
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 8]
mov ecx, edx
not ecx
mov eax, ebx
mov dword [esp + 0x14], ebx
mov esi, ebx
not esi
mov dword [esp], esi
add edi, 0xc3a4f76a
adc ebp, 0xb6357ddf
add edi, 1
adc ebp, 0
mov ebx, edi
add ebx, esi
mov dword [esp + 4], ebx
mov esi, ebp
adc esi, ecx
mov dword [esp + 0x18], esi
and ecx, esi
mov esi, dword [esp]
and esi, ebx
mov dword [esp], esi
mov ebx, eax
sub ebx, edi
mov edi, edx
sbb edi, ebp
and edi, edx
and ebx, eax
mov eax, ebx
mul esi
mov ebp, eax
mov esi, edx
imul edi, dword [esp]
imul ecx, ebx
add esi, ecx
add esi, edi
mov edx, dword [esp + 0x18]
mov ecx, edx
mov eax, dword [esp + 8]
and ecx, eax
or edx, eax
mov ebx, edx
mov eax, dword [esp + 4]
mov edi, eax
mov edx, dword [esp + 0x14]
and edi, edx
or eax, edx
mov dword [esp + 4], eax
mul edi
imul ebx, edi
imul ecx, dword [esp + 4]
add edx, ecx
add edx, ebx
add ebp, dword [esp + 0xc]
adc esi, dword [esp + 0x1c]
add ebp, eax
adc esi, edx
mov ebx, esi
shr ebx, 0x15
xor ebx, esi
shld esi, ebp, 0xb
xor esi, ebp
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x408db0
mov ecx, 0x14ae1
mov eax, esi
mul ecx
imul edi, ebx, 0x14ae1
add edi, edx
mov esi, eax
mov ecx, dword [esp + 0x10]
shrd esi, edi, cl
mov ebx, edi
shr ebx, cl
test cl, 0x20
je 0x408d9a
mov esi, ebx
xor ebx, ebx
mov ecx, esi
and ecx, eax
mov edx, ebx
and edx, edi
add esi, eax
adc ebx, edi
shld edx, ecx, 1
add ecx, ecx
sub esi, ecx
sbb ebx, edx
or ebx, 0x1010101
or esi, 0x1010101
push ebx
push esi
call fcn.00409f70
add esp, 8
test al, al
je 0x408dd4
call fcn.0040cd90
call fcn.0040b7a0
call fcn.0043d3f0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]