Function at 0x45343a
Capabilities:
Get common file path
Get program files directory
Get startup folder

Disassembly:
push 0x244
mov eax, 0x4ce4cd
call fcn.004ae269
call fcn.0048aa29
push eax
lea ecx, [ebp - 0x228]
call fcn.00402840
xor esi, esi
push str.IsWow64Process
mov dword [ebp - 4], esi
push 0x524814
mov dword [ebp - 0x214], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5652e8], eax
cmp eax, esi
je 0x453499
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x5652e8]
lea eax, [ebp - 0x210]
push eax
push esi
push esi
cmp dword [ebp - 0x214], esi
je 0x4535dd
push 0x2a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.rightbackup.exe
lea ecx, [ebp - 0x218]
call fcn.0040c6fa
mov edi, eax
mov esi, 0x531b14
push esi
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 1
call fcn.0040c6fa
mov ebx, eax
push str.right_backup
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 2
call fcn.0040c6fa
mov dword [ebp - 0x214], eax
push esi
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 3
call fcn.0040c6fa
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
mov byte [ebp - 4], 4
call fcn.0040c5f2
mov byte [ebp - 4], 5
push dword [ebp - 0x214]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.00402163
push ebx
push eax
lea eax, [ebp - 0x234]
push eax
mov byte [ebp - 4], 6
call fcn.00402163
push edi
push eax
lea eax, [ebp - 0x22c]
push eax
mov byte [ebp - 4], 7
call fcn.00402163
add esp, 0x30
push eax
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 8
call fcn.0040262c
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp - 0x234]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp - 0x230]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp - 0x238]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp - 0x218]
jmp 0x453707
push 0x26
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.rightbackup.exe
lea ecx, [ebp - 0x214]
call fcn.0040c6fa
mov edi, eax
mov esi, 0x531b14
push esi
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 9
call fcn.0040c6fa
mov ebx, eax
push str.right_backup
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 0xa
call fcn.0040c6fa
mov dword [ebp - 0x218], eax
push esi
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0xb
call fcn.0040c6fa
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
mov byte [ebp - 4], 0xc
call fcn.0040c5f2
mov byte [ebp - 4], 0xd
push dword [ebp - 0x218]
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.00402163
push ebx
push eax
lea eax, [ebp - 0x220]
push eax
mov byte [ebp - 4], 0xe
call fcn.00402163
push edi
push eax
lea eax, [ebp - 0x224]
push eax
mov byte [ebp - 4], 0xf
call fcn.00402163
add esp, 0x30
push eax
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0x10
call fcn.0040262c
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp - 0x238]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp - 0x230]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp - 0x234]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp - 0x214]
add ecx, 0xfffffff0
call fcn.00402883
lea eax, [ebp - 0x218]
push eax
lea esi, [ebp - 0x250]
mov dword [ebp - 0x218], VariantCopyInd
call fcn.0040ab14
push 1
push str.software_systweak_right_backup
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 0x11
call fcn.0040ab30
call fcn.0040ab8e
mov ecx, dword [ebp - 0x248]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.00402883
call fcn.004ae2ec
ret