Function at 0x40d3cf
Capabilities:
Get common file path
Terminate process

Disassembly:
push 0x250
mov eax, 0x4af63a
call fcn.0048bca4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x258], eax
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
mov byte [ebp - 0x219], bl
call fcn.00489de0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push 0x24
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push ebx
push 1
call fcn.004123a2
pop ecx
pop ecx
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x254], eax
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x40d446
lea ecx, [ebp - 0x238]
mov dword [eax], ecx
jmp 0x40d448
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x238], eax
mov dword [ebp - 4], 2
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x238]
call fcn.0040d1ff
mov eax, dword [ebp - 0x228]
sub eax, dword [ebp - 0x22c]
mov ecx, 0x22c
cdq
idiv ecx
xor edi, edi
test eax, eax
jbe 0x40d652
push edi
lea esi, [ebp - 0x238]
call fcn.00410287
lea esi, [eax + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esi], eax
je 0x40d635
push ebx
push 1
call fcn.004123a2
pop ecx
pop ecx
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x25c], eax
mov byte [ebp - 4], 4
cmp eax, ebx
je 0x40d4e0
lea ecx, [ebp - 0x250]
mov dword [eax], ecx
jmp 0x40d4e2
xor eax, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x250], eax
mov byte [ebp - 4], 6
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x23c], ebx
mov byte [ebp - 4], 7
push edi
lea esi, [ebp - 0x238]
call fcn.00410287
push dword [eax + 8]
lea esi, [ebp - 0x250]
call fcn.0040d2ff
mov eax, dword [ebp - 0x240]
sub eax, dword [ebp - 0x244]
pop ecx
cdq
mov ecx, 0x428
idiv ecx
cmp eax, ebx
je 0x40d5fb
ja 0x40d544
call fcn.00488376
mov eax, dword [ebp - 0x244]
add eax, 0x220
push eax
lea ecx, [ebp - 0x220]
call fcn.00403c71
mov byte [ebp - 4], 8
lea eax, [ebp - 0x218]
push eax
push str.SystemRoot
lea eax, [ebp - 0x220]
push eax
call fcn.0040f199
push 0x4c2cb8
push str.___
lea eax, [ebp - 0x220]
push eax
call fcn.0040f199
lea ecx, [ebp - 0x220]
call fcn.00403d35
push dword [ebp - 0x258]
lea ecx, [ebp - 0x220]
call fcn.0040a3b9
test eax, eax
jne 0x40d5ec
push edi
lea esi, [ebp - 0x238]
call fcn.00410287
push dword [eax + 8]
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x40d5ec
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 0x219], 1
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x220]
call fcn.00403910
mov byte [ebp - 4], 9
cmp dword [ebp - 0x244], ebx
je 0x40d613
push dword [ebp - 0x244]
call fcn.004876dd
pop ecx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x23c], ebx
mov byte [ebp - 4], 3
lea eax, [ebp - 0x250]
push eax
call fcn.0040497f
mov eax, dword [ebp - 0x228]
sub eax, dword [ebp - 0x22c]
mov ecx, 0x22c
cdq
idiv ecx
inc edi
cmp edi, eax
jb 0x40d49b
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0x22c], ebx
je 0x40d66d
push dword [ebp - 0x22c]
call fcn.004876dd
pop ecx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x238]
push eax
call fcn.0040497f
mov al, byte [ebp - 0x219]
call fcn.0048bd27
ret