Function at 0x453d57
Capabilities:
Get common file path
Terminate process

Disassembly:
push 0x848
mov eax, 0x5ba954
call fcn.005870c4
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x814]
push eax
push ebx
push ebx
push 0x24
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push ebx
push 1
call fcn.0040eb7d
pop ecx
pop ecx
mov dword [ebp - 0x840], eax
mov dword [ebp - 0x838], eax
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x453da5
lea ecx, [ebp - 0x834]
mov dword [eax], ecx
jmp 0x453da7
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x834], eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x828], ebx
mov dword [ebp - 0x824], ebx
mov dword [ebp - 0x820], ebx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x834]
call fcn.0041dd8d
lea eax, [ebp + 8]
call fcn.0040876a
mov eax, dword [ebp - 0x824]
sub eax, dword [ebp - 0x828]
mov ecx, 0x22c
cdq
idiv ecx
mov dword [ebp - 0x81c], ebx
test eax, eax
jbe 0x45406a
mov dword [ebp - 0x850], ebx
mov dword [ebp - 0x84c], ebx
mov dword [ebp - 0x848], ebx
mov dword [ebp - 0x844], ebx
mov byte [ebp - 4], 5
push dword [ebp - 0x81c]
lea esi, [ebp - 0x834]
call fcn.00469207
push dword [eax + 8]
lea ecx, [ebp - 0x850]
call fcn.0041e037
pop ecx
cmp dword [ebp - 0x84c], ebx
je 0x45402c
jbe 0x4540b5
mov eax, dword [ebp - 0x850]
add eax, 0x220
push eax
lea eax, [ebp - 0x818]
push eax
call fcn.00408518
mov byte [ebp - 4], 6
lea eax, [ebp - 0x814]
push eax
push str.SystemRoot
lea eax, [ebp - 0x818]
push eax
call fcn.0040861f
push 0x67ac88
push 0x67ac8c
lea eax, [ebp - 0x818]
push eax
call fcn.0040861f
lea eax, [ebp - 0x818]
call fcn.0040876a
push dword [ebp + 8]
lea eax, [ebp - 0x818]
push eax
call fcn.004085f9
test eax, eax
jne 0x45401d
push 0x67ac98
xor ecx, ecx
lea esi, [ebp - 0x818]
call fcn.004260a9
cmp eax, 0xffffffff
jne 0x45401d
push dword [ebp - 0x81c]
lea esi, [ebp - 0x834]
call fcn.00469207
lea esi, [eax + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esi], eax
je 0x45401d
xor edi, edi
inc edi
cmp dword [0x6c438c], edi
jl 0x453f3b
push dword [ebp - 0x818]
lea eax, [ebp - 0x854]
push eax
call fcn.00474d20
mov byte [ebp - 4], 7
push dword [eax]
push str.PRE_PROC:__s
push 0x67acbc
push edi
call fcn.00538922
add esp, 0x18
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x854]
call fcn.00408418
push dword [ebp - 0x81c]
lea esi, [ebp - 0x834]
call fcn.00469207
push dword [eax + 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x83c], eax
cmp eax, ebx
je 0x45401d
cmp dword [0x6c438c], edi
jl 0x453fa7
push dword [ebp - 0x818]
lea eax, [ebp - 0x838]
push eax
call fcn.00474d20
mov byte [ebp - 4], 8
push dword [eax]
push str.OPEN_PROC:__s
push 0x67acd8
push edi
call fcn.00538922
add esp, 0x18
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x838]
call fcn.00408418
push ebx
push dword [ebp - 0x83c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x6c438c], 1
mov edi, eax
jl 0x454006
push dword [ebp - 0x818]
lea eax, [ebp - 0x840]
push eax
call fcn.00474d20
pop ecx
pop ecx
mov esi, eax
mov byte [ebp - 4], 9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push dword [esi]
push str.POST_PROC:__s___i___i
push str.KillInProcs
push 1
call fcn.00538922
add esp, 0x18
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x840]
call fcn.00408418
push dword [ebp - 0x83c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x818]
call fcn.00408559
mov byte [ebp - 4], 4
cmp dword [ebp - 0x850], ebx
je 0x454044
push dword [ebp - 0x850]
call fcn.00579d62
pop ecx
mov eax, dword [ebp - 0x824]
sub eax, dword [ebp - 0x828]
mov ecx, 0x22c
cdq
idiv ecx
inc dword [ebp - 0x81c]
cmp dword [ebp - 0x81c], eax
jb 0x453dff
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x828], ebx
je 0x454082
push dword [ebp - 0x828]
call fcn.005796d1
pop ecx
mov dword [ebp - 0x828], ebx
mov dword [ebp - 0x824], ebx
mov dword [ebp - 0x820], ebx
mov byte [ebp - 4], bl
lea eax, [ebp - 0x834]
push eax
call fcn.0040955a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00408559
call fcn.00587147
ret
push 0x80070057
call fcn.00402d79
int3