Function at 0x4480f0
Capabilities:
Get common file path
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cf4c8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x528f34]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x10]
call sym.QQProtectUpd.exe_public:_void___thiscall_CTXStringA::constructor_void_
push 0x104
xor ebx, ebx
push 0x105
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call sym.QQProtectUpd.exe_public:_wchar_t____thiscall_CTXStringW::GetBuffer_int_
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call sym.QQProtectUpd.exe_public:_void___thiscall_CTXStringW::ReleaseBuffer_int_
lea ecx, [ebp - 0x10]
call sym.QQProtectUpd.exe_public:_int___thiscall_CTXStringW::GetLength_void_const
cmp eax, 2
jge 0x4481a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._GetSystemInstalledDiskId__GetWindowsDirectory_failed__err_d
push str.ComputerIDGenerator
push 2
push str._GetSystemInstalledDiskId
push 0x130
push 0x4e40a8
call fcn.00442b40
add esp, 0x1c
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call sym.QQProtectUpd.exe_public:_void___thiscall_CTXStringW::destructor_void_
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x14]
call sym.QQProtectUpd.exe_public:_void___thiscall_CTXStringA::constructor_void_
push 2
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call sym.QQProtectUpd.exe_public:_class_CTXStringW___thiscall_CTXStringW::Left_int_
mov ecx, eax
mov byte [ebp - 4], 2
call sym.QQProtectUpd.exe_public:_wchar_t_const____thiscall_CTXStringW::GetString_void_const
push eax
lea ecx, [ebp - 0x14]
push str.._s
push ecx
call sym.QQProtectUpd.exe_public:_void___cdecl_CTXStringW::Format_wchar_t_const__
add esp, 0xc
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call sym.QQProtectUpd.exe_public:_void___thiscall_CTXStringW::destructor_void_
push ebx
push ebx
push 3
push ebx
push 3
push ebx
lea ecx, [ebp - 0x14]
call sym.QQProtectUpd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x448245
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x10]
call sym.QQProtectUpd.exe_public:_wchar_t_const____thiscall_CTXStringW::GetString_void_const
push eax
push str._GetSystemInstalledDiskId__CreateFile_failed__WinDir_s__err_d
push str.ComputerIDGenerator
push 2
push str._GetSystemInstalledDiskId
push 0x139
push 0x4e40a8
call fcn.00442b40
add esp, 0x20
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call sym.QQProtectUpd.exe_public:_void___thiscall_CTXStringW::destructor_void_
jmp 0x44817e
push ebx
xor eax, eax
lea edx, [ebp - 0x1c]
push edx
push 0xc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push eax
push ebx
push ebx
push 0x2d1080
push esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, ebx
jne 0x44829a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4e4128
push str.ComputerIDGenerator
push 2
push str._GetSystemInstalledDiskId
push 0x142
push 0x4e40a8
call fcn.00442b40
add esp, 0x1c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call sym.QQProtectUpd.exe_public:_void___thiscall_CTXStringW::destructor_void_
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call sym.QQProtectUpd.exe_public:_void___thiscall_CTXStringW::destructor_void_
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret