Function at 0x561000
Capabilities:
Connect to wmi namespace via wbemlocator
Get common file path
Get disk information
Get mac address on windows
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x738
mov eax, dword [0x5e5e08]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
mov dword [ebp - 0x738], ecx
push 0x200
push 0
mov eax, dword [ebp - 0x738]
push eax
call fcn.004b6500
add esp, 0xc
push 0x200
push 0
mov ecx, dword [ebp - 0x738]
add ecx, 0x200
push ecx
call fcn.004b6500
add esp, 0xc
push 0x200
push 0
mov edx, dword [ebp - 0x738]
add edx, 0x400
push edx
call fcn.004b6500
add esp, 0xc
push 0x200
push 0
mov eax, dword [ebp - 0x738]
add eax, 0x600
push eax
call fcn.004b6500
add esp, 0xc
push 0x200
push 0
mov ecx, dword [ebp - 0x738]
add ecx, 0x800
push ecx
call fcn.004b6500
add esp, 0xc
push 0x200
push 0
mov edx, dword [ebp - 0x738]
add edx, 0xa00
push edx
call fcn.004b6500
add esp, 0xc
push 0x200
push 0
mov eax, dword [ebp - 0x738]
add eax, 0xc00
push eax
call fcn.004b6500
add esp, 0xc
push 0x200
push 0
mov ecx, dword [ebp - 0x738]
add ecx, 0xe00
push ecx
call fcn.004b6500
add esp, 0xc
push 0x200
push 0
mov edx, dword [ebp - 0x738]
add edx, 0x1000
push edx
call fcn.004b6500
add esp, 0xc
push 0x200
push 0
mov eax, dword [ebp - 0x738]
add eax, 0x1200
push eax
call fcn.004b6500
add esp, 0xc
push 0x200
push 0
mov ecx, dword [ebp - 0x738]
add ecx, 0x1400
push ecx
call fcn.004b6500
add esp, 0xc
push 0x200
push 0
mov edx, dword [ebp - 0x738]
add edx, 0x1600
push edx
call fcn.004b6500
add esp, 0xc
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 0x454], eax
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x561a76
mov dword [ebp - 0x45c], 0
lea eax, [ebp - 0x45c]
push eax
push 0x59c80c
push 1
push 0
push 0x59c8dc
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x561a76
mov dword [ebp - 0x460], 0
lea ecx, [ebp - 0x460]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push str.ROOTCIMV2
mov edx, dword [ebp - 0x45c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x45c]
push ecx
mov edx, dword [eax + 0xc]
call edx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x561a62
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
mov eax, dword [ebp - 0x460]
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x561a4e
mov dword [ebp - 0x464], 0
lea ecx, [ebp - 0x464]
push ecx
push 0
push 0x30
push 0x5abe00
push 0x5abe54
mov edx, dword [ebp - 0x460]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x460]
push ecx
mov edx, dword [eax + 0x50]
call edx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x561398
mov dword [ebp - 0x468], 0
mov dword [ebp - 0x46c], 0
lea eax, [ebp - 0x468]
push eax
lea ecx, [ebp - 0x46c]
push ecx
push 1
push 0xffffffffffffffff
mov edx, dword [ebp - 0x464]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x464]
push ecx
mov edx, dword [eax + 0x10]
call edx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x561384
cmp dword [ebp - 0x468], 0
jbe 0x561384
xor eax, eax
mov word [ebp - 0x480], ax
xor ecx, ecx
mov dword [ebp - 0x47e], ecx
mov dword [ebp - 0x47a], ecx
mov dword [ebp - 0x476], ecx
mov word [ebp - 0x472], cx
push 0
push 0
lea edx, [ebp - 0x480]
push edx
push 0
push str.UUID
mov eax, dword [ebp - 0x46c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x46c]
push edx
mov eax, dword [ecx + 0x10]
call eax
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x561370
push 0x100
mov ecx, dword [ebp - 0x478]
push ecx
mov edx, dword [ebp - 0x738]
add edx, 0x600
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0x46c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x46c]
push eax
mov ecx, dword [edx + 8]
call ecx
mov edx, dword [ebp - 0x464]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x464]
push ecx
mov edx, dword [eax + 8]
call edx
lea eax, [ebp - 0x464]
push eax
push 0
push 0x30
push str.SELECT__FROM_Win32_ComputerSystemProduct
push 0x5abebc
mov ecx, dword [ebp - 0x460]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x460]
push eax
mov ecx, dword [edx + 0x50]
call ecx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5614db
mov dword [ebp - 0x484], 0
mov dword [ebp - 0x488], 0
lea edx, [ebp - 0x484]
push edx
lea eax, [ebp - 0x488]
push eax
push 1
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x464]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x464]
push eax
mov ecx, dword [edx + 0x10]
call ecx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5614c7
cmp dword [ebp - 0x484], 0
jbe 0x5614c7
xor edx, edx
mov word [ebp - 0x498], dx
xor eax, eax
mov dword [ebp - 0x496], eax
mov dword [ebp - 0x492], eax
mov dword [ebp - 0x48e], eax
mov word [ebp - 0x48a], ax
push 0
push 0
lea ecx, [ebp - 0x498]
push ecx
push 0
push str.Name
mov edx, dword [ebp - 0x488]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x488]
push ecx
mov edx, dword [eax + 0x10]
call edx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5614b3
push 0x100
mov eax, dword [ebp - 0x490]
push eax
mov ecx, dword [ebp - 0x738]
add ecx, 0x800
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x488]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x488]
push edx
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [ebp - 0x464]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x464]
push eax
mov ecx, dword [edx + 8]
call ecx
lea edx, [ebp - 0x464]
push edx
push 0
push 0x30
push 0x5abed0
push 0x5abf18
mov eax, dword [ebp - 0x460]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x460]
push edx
mov eax, dword [ecx + 0x50]
call eax
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x56161d
mov dword [ebp - 0x49c], 0
mov dword [ebp - 0x4a0], 0
lea ecx, [ebp - 0x49c]
push ecx
lea edx, [ebp - 0x4a0]
push edx
push 1
push 0xffffffffffffffff
mov eax, dword [ebp - 0x464]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x464]
push edx
mov eax, dword [ecx + 0x10]
call eax
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x561609
cmp dword [ebp - 0x49c], 0
jbe 0x561609
xor ecx, ecx
mov word [ebp - 0x4b0], cx
xor edx, edx
mov dword [ebp - 0x4ae], edx
mov dword [ebp - 0x4aa], edx
mov dword [ebp - 0x4a6], edx
mov word [ebp - 0x4a2], dx
push 0
push 0
lea eax, [ebp - 0x4b0]
push eax
push 0
push 0x5abf20
mov ecx, dword [ebp - 0x4a0]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x4a0]
push eax
mov ecx, dword [edx + 0x10]
call ecx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5615f5
push 0x100
mov edx, dword [ebp - 0x4a8]
push edx
mov eax, dword [ebp - 0x738]
add eax, 0xa00
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea ecx, [ebp - 0x4b0]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edx, dword [ebp - 0x4a0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4a0]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x464]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x464]
push edx
mov eax, dword [ecx + 8]
call eax
lea ecx, [ebp - 0x464]
push ecx
push 0
push 0x30
push str.SELECT__FROM_Win32_OperatingSystem
push 0x5abf88
mov edx, dword [ebp - 0x460]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x460]
push ecx
mov edx, dword [eax + 0x50]
call edx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5617c8
mov dword [ebp - 0x4b4], 0
mov dword [ebp - 0x4b8], 0
lea eax, [ebp - 0x4b4]
push eax
lea ecx, [ebp - 0x4b8]
push ecx
push 1
push 0xffffffffffffffff
mov edx, dword [ebp - 0x464]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x464]
push ecx
mov edx, dword [eax + 0x10]
call edx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5617b4
cmp dword [ebp - 0x4b4], 0
jbe 0x5617b4
xor eax, eax
mov word [ebp - 0x4c8], ax
xor ecx, ecx
mov dword [ebp - 0x4c6], ecx
mov dword [ebp - 0x4c2], ecx
mov dword [ebp - 0x4be], ecx
mov word [ebp - 0x4ba], cx
push 0
push 0
lea edx, [ebp - 0x4c8]
push edx
push 0
push 0x5abf90
mov eax, dword [ebp - 0x4b8]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x4b8]
push edx
mov eax, dword [ecx + 0x10]
call eax
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5617a0
push 0x100
mov ecx, dword [ebp - 0x4c0]
push ecx
mov edx, dword [ebp - 0x738]
add edx, 0xc00
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [ebp - 0x4cc], 0
jmp 0x56174a
mov eax, dword [ebp - 0x4cc]
add eax, 1
mov dword [ebp - 0x4cc], eax
mov ecx, dword [ebp - 0x4cc]
mov edx, dword [ebp - 0x738]
movzx eax, word [edx + ecx*2 + 0xc00]
test eax, eax
je 0x561793
mov ecx, dword [ebp - 0x4cc]
mov edx, dword [ebp - 0x738]
movzx eax, word [edx + ecx*2 + 0xc00]
cmp eax, 0x2e
jne 0x561791
xor ecx, ecx
mov edx, dword [ebp - 0x4cc]
mov eax, dword [ebp - 0x738]
mov word [eax + edx*2 + 0xc00], cx
jmp 0x56173b
lea ecx, [ebp - 0x4c8]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edx, dword [ebp - 0x4b8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4b8]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x464]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x464]
push edx
mov eax, dword [ecx + 8]
call eax
lea ecx, [ebp - 0x464]
push ecx
push 0
push 0x30
push 0x5abfa8
push 0x5abfdc
mov edx, dword [ebp - 0x460]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x460]
push ecx
mov edx, dword [eax + 0x50]
call edx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x56190b
mov dword [ebp - 0x4d0], 0
mov dword [ebp - 0x4d4], 0
lea eax, [ebp - 0x4d0]
push eax
lea ecx, [ebp - 0x4d4]
push ecx
push 1
push 0xffffffffffffffff
mov edx, dword [ebp - 0x464]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x464]
push ecx
mov edx, dword [eax + 0x10]
call edx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5618f7
cmp dword [ebp - 0x4d0], 0
jbe 0x5618f7
xor eax, eax
mov word [ebp - 0x4e8], ax
xor ecx, ecx
mov dword [ebp - 0x4e6], ecx
mov dword [ebp - 0x4e2], ecx
mov dword [ebp - 0x4de], ecx
mov word [ebp - 0x4da], cx
push 0
push 0
lea edx, [ebp - 0x4e8]
push edx
push 0
push str.SerialNumber
mov eax, dword [ebp - 0x4d4]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x4d4]
push edx
mov eax, dword [ecx + 0x10]
call eax
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5618e3
push 0x100
mov ecx, dword [ebp - 0x4e0]
push ecx
mov edx, dword [ebp - 0x738]
add edx, 0xe00
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x4e8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x4d4]
push eax
mov ecx, dword [edx + 8]
call ecx
mov edx, dword [ebp - 0x464]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x464]
push ecx
mov edx, dword [eax + 8]
call edx
lea eax, [ebp - 0x464]
push eax
push 0
push 0x30
push str.SELECT__FROM_Win32_BIOS
push 0x5ac034
mov ecx, dword [ebp - 0x460]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x460]
push eax
mov ecx, dword [edx + 0x50]
call ecx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x561a4e
mov dword [ebp - 0x4ec], 0
mov dword [ebp - 0x4f0], 0
lea edx, [ebp - 0x4ec]
push edx
lea eax, [ebp - 0x4f0]
push eax
push 1
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x464]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x464]
push eax
mov ecx, dword [edx + 0x10]
call ecx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x561a3a
cmp dword [ebp - 0x4ec], 0
jbe 0x561a3a
xor edx, edx
mov word [ebp - 0x500], dx
xor eax, eax
mov dword [ebp - 0x4fe], eax
mov dword [ebp - 0x4fa], eax
mov dword [ebp - 0x4f6], eax
mov word [ebp - 0x4f2], ax
push 0
push 0
lea ecx, [ebp - 0x500]
push ecx
push 0
push str.SMBIOSBIOSVersion
mov edx, dword [ebp - 0x4f0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4f0]
push ecx
mov edx, dword [eax + 0x10]
call edx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x561a26
push 0x100
mov eax, dword [ebp - 0x4f8]
push eax
mov ecx, dword [ebp - 0x738]
add ecx, 0x1000
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea edx, [ebp - 0x500]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x4f0]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x4f0]
push edx
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [ebp - 0x464]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x464]
push eax
mov ecx, dword [edx + 8]
call ecx
mov edx, dword [ebp - 0x460]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x460]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x45c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x45c]
push edx
mov eax, dword [ecx + 8]
call eax
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x444], 0
mov eax, 1
xor edx, edx
cpuid
mov dword [ebp - 0x42c], edx
mov dword [ebp - 0x444], eax
mov ecx, dword [ebp - 0x444]
push ecx
mov edx, dword [ebp - 0x42c]
push edx
push str._08X_08X
mov eax, dword [ebp - 0x738]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x504], 0
jmp 0x561add
mov ecx, dword [ebp - 0x504]
add ecx, 1
mov dword [ebp - 0x504], ecx
cmp dword [ebp - 0x504], 0xa
jge 0x561b3d
xor edx, edx
mov word [ebp - 0x708], dx
push 0x1fe
push 0
lea eax, [ebp - 0x706]
push eax
call fcn.004b6500
add esp, 0xc
lea ecx, [ebp - 0x708]
push ecx
mov edx, dword [ebp - 0x504]
push edx
call fcn.00414900
add esp, 8
test eax, eax
je 0x561b3b
lea eax, [ebp - 0x708]
push eax
mov ecx, dword [ebp - 0x738]
add ecx, 0x200
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x561b3d
jmp 0x561ace
mov byte [ebp - 0x440], 0
xor edx, edx
mov dword [ebp - 0x43f], edx
mov byte [ebp - 0x43b], dl
mov dword [ebp - 0x458], 0
lea eax, [ebp - 0x458]
push eax
push 0
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov ecx, dword [ebp - 0x458]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x561c11
lea edx, [ebp - 0x458]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x561c11
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x70c], ecx
jmp 0x561bb3
mov edx, dword [ebp - 0x70c]
mov eax, dword [edx]
mov dword [ebp - 0x70c], eax
cmp dword [ebp - 0x70c], 0
je 0x561c11
mov ecx, dword [ebp - 0x70c]
add ecx, 8
push ecx
call fcn.00414b10
add esp, 4
mov dword [ebp - 0x710], eax
cmp dword [ebp - 0x710], 1
je 0x561be6
cmp dword [ebp - 0x710], 0
jne 0x561c0f
push 6
mov edx, dword [ebp - 0x70c]
add edx, 0x194
push edx
lea eax, [ebp - 0x440]
push eax
call fcn.004bded0
add esp, 0xc
cmp dword [ebp - 0x710], 0
jne 0x561c0f
jmp 0x561c11
jmp 0x561ba5
movzx ecx, byte [ebp - 0x43b]
push ecx
movzx edx, byte [ebp - 0x43c]
push edx
movzx eax, byte [ebp - 0x43d]
push eax
movzx ecx, byte [ebp - 0x43e]
push ecx
movzx edx, byte [ebp - 0x43f]
push edx
movzx eax, byte [ebp - 0x440]
push eax
push str._02X__02X__02X__02X__02X__02X
mov ecx, dword [ebp - 0x738]
add ecx, 0x400
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
mov dword [ebp - 0x448], 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x448]
push edx
push 0
push 0
push 0x5ac0b0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x561caa
mov eax, dword [ebp - 0x448]
push eax
push str._08X
mov ecx, dword [ebp - 0x738]
add ecx, 0x1200
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
xor edx, edx
mov word [ebp - 0x428], dx
push 0x206
push 0
lea eax, [ebp - 0x426]
push eax
call fcn.004b6500
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x220], cx
push 0x206
push 0
lea edx, [ebp - 0x21e]
push edx
call fcn.004b6500
add esp, 0xc
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x44c], 0
lea eax, [ebp - 0x428]
push eax
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x561f22
push 0x5ac0c4
lea ecx, [ebp - 0x428]
push ecx
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x561de8
push 0
push 0
push 3
push 0
push 1
push bind
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x714], eax
cmp dword [ebp - 0x714], 0xffffffff
je 0x561de8
mov dword [ebp - 0x71c], 0
xor ecx, ecx
mov dword [ebp - 0x718], ecx
push 0
push 0
lea edx, [ebp - 0x71c]
push edx
mov eax, dword [ebp - 0x714]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x561ddb
lea ecx, [ebp - 0x71c]
push ecx
call fcn.004146d0
add esp, 4
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x434], edx
mov edx, dword [ebp - 0x714]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.user32.dll
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x561e80
push 0
push 0
push 3
push 0
push 1
push bind
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x720], eax
cmp dword [ebp - 0x720], 0xffffffff
je 0x561e80
mov dword [ebp - 0x728], 0
xor eax, eax
mov dword [ebp - 0x724], eax
push 0
push 0
lea ecx, [ebp - 0x728]
push ecx
mov edx, dword [ebp - 0x720]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x561e73
lea eax, [ebp - 0x728]
push eax
call fcn.004146d0
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0x720]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.notepad.exe
lea edx, [ebp - 0x428]
push edx
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x561f22
push 0
push 0
push 3
push 0
push 1
push bind
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x72c], eax
cmp dword [ebp - 0x72c], 0xffffffff
je 0x561f22
mov dword [ebp - 0x734], 0
xor edx, edx
mov dword [ebp - 0x730], edx
push 0
push 0
lea eax, [ebp - 0x734]
push eax
mov ecx, dword [ebp - 0x72c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x561f15
lea edx, [ebp - 0x734]
push edx
call fcn.004146d0
add esp, 4
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x44c], edx
mov eax, dword [ebp - 0x72c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x44c]
push ecx
mov edx, dword [ebp - 0x450]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x434]
push edx
mov eax, dword [ebp - 0x438]
push eax
push str._llu__llu__llu
push 0x100
mov ecx, dword [ebp - 0x738]
add ecx, 0x1400
push ecx
call fcn.004c28b0
add esp, 0x24
mov eax, dword [ebp - 0x738]
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b645d
mov esp, ebp
pop ebp
ret