Function at 0x42dd61
Capabilities:
Connect to wmi namespace via wbemlocator
Get common file path
Get disk information
Get mac address on windows
Reference wmi statements

Disassembly:
push ebp
lea ebp, [esp - 0x5e8]
sub esp, 0x668
mov eax, dword [0x56f8f4]
xor eax, ebp
mov dword [ebp + 0x5e4], eax
push ebx
push esi
push edi
mov edi, 0x200
push edi
mov esi, ecx
xor ebx, ebx
push ebx
push esi
mov dword [ebp - 0x40], esi
call fcn.004c3b30
push edi
lea eax, [esi + 0x200]
push ebx
push eax
call fcn.004c3b30
push edi
lea eax, [esi + 0x400]
push ebx
push eax
mov dword [ebp - 0x70], eax
call fcn.004c3b30
push edi
lea eax, [esi + 0x600]
push ebx
push eax
call fcn.004c3b30
push edi
lea eax, [esi + 0x800]
push ebx
push eax
call fcn.004c3b30
push edi
lea eax, [esi + 0xa00]
push ebx
push eax
call fcn.004c3b30
add esp, 0x48
push edi
lea eax, [esi + 0xc00]
push ebx
push eax
call fcn.004c3b30
push edi
lea eax, [esi + 0xe00]
push ebx
push eax
call fcn.004c3b30
push edi
lea eax, [esi + 0x1000]
push ebx
push eax
call fcn.004c3b30
push edi
lea eax, [esi + 0x1200]
push ebx
push eax
mov dword [ebp - 0x68], eax
call fcn.004c3b30
push edi
lea eax, [esi + 0x1400]
push ebx
push eax
mov dword [ebp - 0x80], eax
call fcn.004c3b30
push edi
lea eax, [esi + 0x1600]
push ebx
push eax
call fcn.004c3b30
add esp, 0x48
push ebx
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jl 0x42e2cf
lea eax, [ebp - 0x5c]
push eax
push 0x535264
push 1
push ebx
push 0x535334
mov dword [ebp - 0x5c], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x42e2cf
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x44]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.ROOTCIMV2
mov dword [ebp - 0x44], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x42e2c6
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push dword [ebp - 0x44]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jl 0x42e2bd
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x3c]
push edx
push ebx
push 0x30
push str.SELECT__FROM_Win32_ComputerSystemProduct
push 0x5188f8
mov dword [ebp - 0x3c], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
test eax, eax
jl 0x42df5f
mov eax, dword [ebp - 0x3c]
lea edx, [ebp + 0x5e0]
push edx
lea edx, [ebp - 0x38]
push edx
push 1
push 0xffffffffffffffff
mov dword [ebp + 0x5e0], ebx
mov dword [ebp - 0x38], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x42df56
cmp dword [ebp + 0x5e0], ebx
jbe 0x42df56
xor eax, eax
mov word [ebp - 0x54], ax
lea edi, [ebp - 0x52]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
push ebx
stosd dword es:[edi], eax
lea edx, [ebp - 0x54]
push edx
push ebx
stosw word es:[edi], ax
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push str.UUID
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x42df4d
push 0x100
push dword [ebp - 0x4c]
lea eax, [esi + 0x600]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
lea edx, [ebp - 0x3c]
push edx
push ebx
push 0x30
push str.SELECT__FROM_Win32_ComputerSystemProduct
push 0x5188f8
push eax
call dword [ecx + 0x50]
test eax, eax
jl 0x42e006
mov eax, dword [ebp - 0x3c]
lea edx, [ebp + 0x5e0]
push edx
lea edx, [ebp - 0x38]
push edx
push 1
push 0xffffffffffffffff
mov dword [ebp + 0x5e0], ebx
mov dword [ebp - 0x38], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x42dffd
cmp dword [ebp + 0x5e0], ebx
jbe 0x42dffd
xor eax, eax
mov word [ebp - 0x54], ax
lea edi, [ebp - 0x52]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
push ebx
stosd dword es:[edi], eax
lea edx, [ebp - 0x54]
push edx
push ebx
stosw word es:[edi], ax
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push str.Name
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x42dff4
push 0x100
push dword [ebp - 0x4c]
lea eax, [esi + 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
lea edx, [ebp - 0x3c]
push edx
push ebx
push 0x30
push str.SELECT__FROM_Win32_OperatingSystem
push 0x5188f8
push eax
call dword [ecx + 0x50]
test eax, eax
jl 0x42e0ad
mov eax, dword [ebp - 0x3c]
lea edx, [ebp + 0x5e0]
push edx
lea edx, [ebp - 0x38]
push edx
push 1
push 0xffffffffffffffff
mov dword [ebp + 0x5e0], ebx
mov dword [ebp - 0x38], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x42e0a4
cmp dword [ebp + 0x5e0], ebx
jbe 0x42e0a4
xor eax, eax
mov word [ebp - 0x54], ax
lea edi, [ebp - 0x52]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
push ebx
stosd dword es:[edi], eax
lea edx, [ebp - 0x54]
push edx
push ebx
stosw word es:[edi], ax
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push str.SerialNumber
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x42e09b
push 0x100
push dword [ebp - 0x4c]
lea eax, [esi + 0xa00]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
lea edx, [ebp - 0x3c]
push edx
push ebx
push 0x30
push str.SELECT__FROM_Win32_OperatingSystem
push 0x5188f8
push eax
call dword [ecx + 0x50]
test eax, eax
jl 0x42e16f
mov eax, dword [ebp - 0x3c]
lea edx, [ebp + 0x5e0]
push edx
lea edx, [ebp - 0x38]
push edx
push 1
push 0xffffffffffffffff
mov dword [ebp + 0x5e0], ebx
mov dword [ebp - 0x38], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x42e166
cmp dword [ebp + 0x5e0], ebx
jbe 0x42e166
xor eax, eax
mov word [ebp - 0x54], ax
lea edi, [ebp - 0x52]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
push ebx
stosd dword es:[edi], eax
lea edx, [ebp - 0x54]
push edx
push ebx
stosw word es:[edi], ax
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push 0x518860
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x42e15d
push 0x100
push dword [ebp - 0x4c]
lea edi, [esi + 0xc00]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp word [edi], bx
je 0x42e153
mov eax, edi
cmp word [eax], 0x2e
jne 0x42e14a
xor ecx, ecx
mov word [eax], cx
inc edi
inc edi
mov eax, edi
cmp word [edi], bx
jne 0x42e13f
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
lea edx, [ebp - 0x3c]
push edx
push ebx
push 0x30
push str.SELECT__FROM_Win32_BIOS
push 0x5188f8
push eax
call dword [ecx + 0x50]
test eax, eax
jl 0x42e216
mov eax, dword [ebp - 0x3c]
lea edx, [ebp + 0x5e0]
push edx
lea edx, [ebp - 0x38]
push edx
push 1
push 0xffffffffffffffff
mov dword [ebp + 0x5e0], ebx
mov dword [ebp - 0x38], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x42e20d
cmp dword [ebp + 0x5e0], ebx
jbe 0x42e20d
xor eax, eax
mov word [ebp - 0x54], ax
lea edi, [ebp - 0x52]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
push ebx
stosd dword es:[edi], eax
lea edx, [ebp - 0x54]
push edx
push ebx
stosw word es:[edi], ax
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push str.SerialNumber
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x42e204
push 0x100
push dword [ebp - 0x4c]
lea eax, [esi + 0xe00]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
lea edx, [ebp - 0x3c]
push edx
push ebx
push 0x30
push str.SELECT__FROM_Win32_BIOS
push 0x5188f8
push eax
call dword [ecx + 0x50]
test eax, eax
jl 0x42e2bd
mov eax, dword [ebp - 0x3c]
lea edx, [ebp + 0x5e0]
push edx
lea edx, [ebp - 0x38]
push edx
push 1
push 0xffffffffffffffff
mov dword [ebp + 0x5e0], ebx
mov dword [ebp - 0x38], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x42e2b4
cmp dword [ebp + 0x5e0], ebx
jbe 0x42e2b4
xor eax, eax
mov word [ebp - 0x54], ax
lea edi, [ebp - 0x52]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
push ebx
stosd dword es:[edi], eax
lea edx, [ebp - 0x54]
push edx
push ebx
stosw word es:[edi], ax
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push str.SMBIOSBIOSVersion
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x42e2ab
push 0x100
push dword [ebp - 0x4c]
lea eax, [esi + 0x1000]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov eax, 1
xor edx, edx
cpuid
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x78], eax
push dword [ebp - 0x78]
push dword [ebp - 0x7c]
push str._08X_08X
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
xor ebx, ebx
xor edi, edi
xor eax, eax
push 0x1fe
mov word [ebp - 0x34], ax
lea eax, [ebp - 0x32]
push ebx
push eax
call fcn.004c3b30
lea eax, [ebp - 0x34]
push eax
push edi
call fcn.0042dad7
add esp, 0x14
test eax, eax
jne 0x42e32b
inc edi
cmp edi, 0xa
jl 0x42e2fd
jmp 0x42e33c
lea eax, [ebp - 0x34]
push eax
lea eax, [esi + 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
mov byte [ebp + 0x5dc], bl
lea edi, [ebp + 0x5dd]
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x58]
push eax
push ebx
mov dword [ebp - 0x58], ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
push dword [ebp - 0x58]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
cmp edi, ebx
je 0x42e3b5
lea eax, [ebp - 0x58]
push eax
push edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x42e3b5
mov dword [ebp - 0x5c], edi
jmp 0x42e380
mov edi, dword [ebp - 0x5c]
lea eax, [edi + 8]
push eax
call fcn.0042dc36
pop ecx
cmp eax, 1
je 0x42e393
cmp eax, ebx
jne 0x42e3ac
lea esi, [edi + 0x194]
lea edi, [ebp + 0x5dc]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [ebp - 0x40]
cmp eax, ebx
je 0x42e3b5
mov edi, dword [ebp - 0x5c]
mov edi, dword [edi]
mov dword [ebp - 0x5c], edi
cmp edi, ebx
jne 0x42e37d
mov eax, dword [ebp + 0x5e0]
shr eax, 8
movzx eax, al
push eax
movzx eax, byte [ebp + 0x5e0]
push eax
mov eax, dword [ebp + 0x5dc]
shr eax, 0x18
push eax
mov eax, dword [ebp + 0x5dc]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
shr eax, 0x10
movzx eax, al
push eax
mov eax, dword [ebp + 0x5dc]
shr eax, 8
movzx eax, al
push eax
movzx eax, byte [ebp + 0x5dc]
push eax
push str._02X__02X__02X__02X__02X__02X
push dword [ebp - 0x70]
call edi
add esp, 0x20
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
push 0x5187b0
mov dword [ebp - 0x64], ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x42e435
push dword [ebp - 0x64]
push str._08X
push dword [ebp - 0x68]
call edi
add esp, 0xc
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp + 0x1cc], ax
lea eax, [ebp + 0x1ce]
push ebx
push eax
call fcn.004c3b30
xor eax, eax
push edi
mov word [ebp + 0x3d4], ax
lea eax, [ebp + 0x3d6]
push ebx
push eax
call fcn.004c3b30
add esp, 0x18
lea eax, [ebp + 0x1cc]
push eax
push ebx
push ebx
push 0x25
push ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x5c], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x42e610
push 0x518788
lea eax, [ebp + 0x1cc]
push eax
lea eax, [ebp + 0x3d4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x42e513
push ebx
push ebx
push 3
push ebx
push 1
push connect
lea eax, [ebp + 0x3d4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x40], eax
cmp eax, 0xffffffff
je 0x42e513
xor eax, eax
push ebx
mov dword [ebp + 0x5dc], ebx
lea edi, [ebp + 0x5e0]
stosd dword es:[edi], eax
push ebx
lea eax, [ebp + 0x5dc]
push eax
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x42e50a
lea eax, [ebp + 0x5dc]
push eax
call fcn.0042d99b
pop ecx
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], edx
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.user32.dll
lea eax, [ebp + 0x1cc]
push eax
lea eax, [ebp + 0x3d4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x42e592
push ebx
push ebx
push 3
push ebx
push 1
push connect
lea eax, [ebp + 0x3d4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x40], eax
cmp eax, 0xffffffff
je 0x42e592
xor eax, eax
push ebx
mov dword [ebp + 0x5dc], ebx
lea edi, [ebp + 0x5e0]
stosd dword es:[edi], eax
push ebx
lea eax, [ebp + 0x5dc]
push eax
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x42e589
lea eax, [ebp + 0x5dc]
push eax
call fcn.0042d99b
pop ecx
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], edx
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.notepad.exe
lea eax, [ebp + 0x1cc]
push eax
lea eax, [ebp + 0x3d4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x42e610
push ebx
push ebx
push 3
push ebx
push 1
push connect
lea eax, [ebp + 0x3d4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x40], eax
cmp eax, 0xffffffff
je 0x42e610
xor eax, eax
push ebx
mov dword [ebp + 0x5dc], ebx
lea edi, [ebp + 0x5e0]
stosd dword es:[edi], eax
push ebx
lea eax, [ebp + 0x5dc]
push eax
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x42e607
lea eax, [ebp + 0x5dc]
push eax
call fcn.0042d99b
pop ecx
mov ebx, eax
mov dword [ebp - 0x5c], edx
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x5c]
push ebx
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push str._llu__llu__llu
push 0x100
push dword [ebp - 0x80]
call fcn.004c69f8
mov ecx, dword [ebp + 0x5e4]
add esp, 0x24
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c3202
add ebp, 0x5e8
leave
ret