Function at 0x409eb0
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x224
call fcn.0043c050
test al, al
je 0x40a191
lea eax, [esp + 0x1c]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.00435b60
test al, al
je 0x40a18c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, 0xa5386614
mov ebp, 0xf77de2e9
mov ecx, ebx
shrd ebp, edi, cl
mov dword [esp + 0x18], eax
shr edi, cl
test bl, 0x20
je 0x409f11
mov ebp, edi
xor edi, edi
mov ecx, ebp
xor ecx, 0xf77de2e9
mov esi, ecx
not esi
mov eax, edi
xor eax, 0xa5386614
mov dword [esp], eax
and edi, 0x56e051f
mov edx, edi
xor edx, 0x5280414
and esi, 0x5c694529
mov eax, esi
imul esi, edx
mov ebx, dword [esp]
not ebx
and ebp, 0xa396bad6
mov edx, ebp
xor edx, 0xa314a2c0
and ebx, 0xfa91fae0
imul ebx, edx
mul edx
mov dword [esp + 0x10], eax
add ebx, edx
add ebx, esi
mov dword [esp + 8], ebx
xor ebp, 0x5ceb5d3f
xor edi, 0xfad7fbeb
add ebp, ecx
mov esi, dword [esp]
adc edi, esi
add ebp, 1
adc edi, 0
or ecx, 0x5c694529
or esi, 0xfa91fae0
mov dword [esp], esi
mov edx, edi
not edx
and edx, esi
mov ebx, ecx
not ebx
mov dword [esp + 4], ebp
and ebx, ebp
mov eax, ebx
imul ebx, edx
mov esi, ebp
not esi
and esi, ecx
mov ebp, dword [esp]
not ebp
mul esi
and ebp, edi
imul ebp, esi
mov esi, eax
add ebp, edx
add ebp, ebx
mov ebx, edi
mov eax, dword [esp]
and ebx, eax
or eax, edi
mov dword [esp], eax
mov eax, dword [esp + 4]
mov edi, eax
and edi, ecx
or ecx, eax
mov eax, ecx
mul edi
imul ecx, ebx
add ecx, edx
mov edx, dword [esp]
imul edx, edi
add edx, ecx
add esi, dword [esp + 0x10]
adc ebp, dword [esp + 8]
add esi, eax
adc ebp, edx
mov eax, ebp
shld eax, esi, 0xb
mov edx, ebp
shr edx, 0x15
mov edi, ebp
shld edi, esi, 1
lea ecx, [esi + esi]
not edi
not ecx
add ecx, esi
adc edi, ebp
and edi, 0x883cb45d
and ebp, 0x77c34ba2
or ebp, edi
xor ebp, edx
and ecx, 0xe68ded9e
and esi, 0x19721261
or esi, ecx
xor esi, eax
mov ebx, ebp
xor ebx, 0x883cb45d
mov edi, esi
xor edi, 0xe68ded9e
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x40a168
and esi, 0xca227e00
and ebp, 0x4a083739
mov edx, ebp
xor edx, 0xf7f7cbe6
mov eax, esi
xor eax, 0x3dff93ff
add eax, edi
adc edx, ebx
mov ecx, edi
not ecx
add eax, 1
adc edx, 0
mov dword [esp + 0xc], edx
and ecx, 0xca227e00
mov dword [esp + 0x14], edi
or edi, 0x35dd81ff
mov dword [esp], ebx
mov ebx, dword [esp]
or ebx, 0xb5f7c8c6
and ebx, edx
mov dword [esp + 4], eax
and edi, eax
mov dword [esp + 8], edi
not eax
and eax, ecx
imul ebx, eax
mul edi
mov dword [esp + 0x10], eax
add edx, ebx
mov eax, dword [esp]
not eax
and eax, 0x4a083739
mov edi, dword [esp + 0xc]
mov ebx, edi
not ebx
and ebx, eax
imul ebx, dword [esp + 8]
add ebx, edx
mov dword [esp + 8], ebx
mov ebx, eax
mov edx, edi
and ebx, edi
mov edi, ebx
or eax, edx
mov dword [esp + 0xc], eax
mov ebx, ecx
mov eax, dword [esp + 4]
and ebx, eax
or ecx, eax
mov eax, ecx
mul ebx
mov dword [esp + 4], eax
imul ecx, edi
add ecx, edx
mov eax, dword [esp + 0xc]
imul eax, ebx
mov ebx, dword [esp]
add eax, ecx
mov ecx, eax
xor esi, 0xc2006c00
mov edi, dword [esp + 0x14]
or edi, 0xca227e00
mov eax, edi
mul esi
xor ebp, 0x8083419
imul edi, ebp
add edi, edx
or ebx, 0x4a083739
imul ebx, esi
add ebx, edi
add eax, dword [esp + 0x10]
adc ebx, dword [esp + 8]
add eax, dword [esp + 4]
adc ebx, ecx
mov edi, eax
mov ecx, dword [esp + 0x18]
shrd edi, ebx, cl
mov edx, ebx
shr edx, cl
test cl, 0x20
je 0x40a150
mov edi, edx
xor edx, edx
mov ecx, edi
and ecx, eax
mov esi, edx
and esi, ebx
add edi, eax
adc edx, ebx
shld esi, ecx, 1
add ecx, ecx
sub edi, ecx
sbb edx, esi
mov ebx, edx
or ebx, 0x1010101
or edi, 0x1010101
push ebx
push edi
call fcn.0040b2d0
add esp, 8
test al, al
je 0x40a18c
call fcn.0040e390
call fcn.0040cff0
call fcn.0043dad0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]