My very general plan if something like this happens near me:
1) If escape is an option, I would get out of the building as quickly as possible, by whatever route seemed safest and most do-able, including exits marked "alarm will sound" or "employees only." Once outside, I would get in my car and drive away. I would not stand around outside the building with the crowd waiting to see what happened next, because flying bullets don't respect police tape.
2) If I could not get out of the area, I would find a small, controllable area where I could hunker down -- a bathroom with a door, a changing room, a supply closet, a break room. I would shove anything up against the door that I could, then I would train my gun on the door and await events.
3) On my way to either type of safety, I would push - shove - grab - pull as many people to safety with me as I could, waking up the ones that were frozen, but I would not stop to argue or plead. Exception: family members. I would do whatever it took to get a family member to safety, and I would not leave someone I love behind.
4) If, on my way to safety, I saw the bad guy as he was in the very act of killing innocent others -- which means and if, only if, I could see and clearly identify that he was in fact the bad guy, and not a plainclothes or off-duty officer or a good citizen who was shooting the real bad guy -- and if I reasonably believed I could take that shot without endangering others (more than they were already in danger) then I would take the shot. Otherwise, I would not.
But it's far more likely I'd be among those who flee the scene or hid in a closet, because I'm not going to go looking for the killer. I will do what it takes to save myself, my family, and those immediately around me, but running toward danger is above my pay grade.
My personal website: Cornered Cat