Function at 0x5bbf50
Capabilities:
Connect to wmi namespace via wbemlocator
Get common file path
Get disk information
Get mac address on windows
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x738
mov eax, dword [0x66a8c4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
mov dword [ebp - 0x738], ecx
push 0x200
push 0
mov eax, dword [ebp - 0x738]
push eax
call fcn.00591690
add esp, 0xc
push 0x200
push 0
mov ecx, dword [ebp - 0x738]
add ecx, 0x200
push ecx
call fcn.00591690
add esp, 0xc
push 0x200
push 0
mov edx, dword [ebp - 0x738]
add edx, 0x400
push edx
call fcn.00591690
add esp, 0xc
push 0x200
push 0
mov eax, dword [ebp - 0x738]
add eax, 0x600
push eax
call fcn.00591690
add esp, 0xc
push 0x200
push 0
mov ecx, dword [ebp - 0x738]
add ecx, 0x800
push ecx
call fcn.00591690
add esp, 0xc
push 0x200
push 0
mov edx, dword [ebp - 0x738]
add edx, 0xa00
push edx
call fcn.00591690
add esp, 0xc
push 0x200
push 0
mov eax, dword [ebp - 0x738]
add eax, 0xc00
push eax
call fcn.00591690
add esp, 0xc
push 0x200
push 0
mov ecx, dword [ebp - 0x738]
add ecx, 0xe00
push ecx
call fcn.00591690
add esp, 0xc
push 0x200
push 0
mov edx, dword [ebp - 0x738]
add edx, 0x1000
push edx
call fcn.00591690
add esp, 0xc
push 0x200
push 0
mov eax, dword [ebp - 0x738]
add eax, 0x1200
push eax
call fcn.00591690
add esp, 0xc
push 0x200
push 0
mov ecx, dword [ebp - 0x738]
add ecx, 0x1400
push ecx
call fcn.00591690
add esp, 0xc
push 0x200
push 0
mov edx, dword [ebp - 0x738]
add edx, 0x1600
push edx
call fcn.00591690
add esp, 0xc
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 0x454], eax
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5bc9c6
mov dword [ebp - 0x45c], 0
lea eax, [ebp - 0x45c]
push eax
push 0x5fb9e8
push 1
push 0
push 0x5fbab8
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5bc9c6
mov dword [ebp - 0x460], 0
lea ecx, [ebp - 0x460]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push str.ROOTCIMV2
mov edx, dword [ebp - 0x45c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x45c]
push ecx
mov edx, dword [eax + 0xc]
call edx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5bc9b2
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
mov eax, dword [ebp - 0x460]
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5bc99e
mov dword [ebp - 0x464], 0
lea ecx, [ebp - 0x464]
push ecx
push 0
push 0x30
push 0x6014d8
push 0x60152c
mov edx, dword [ebp - 0x460]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x460]
push ecx
mov edx, dword [eax + 0x50]
call edx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5bc2e8
mov dword [ebp - 0x468], 0
mov dword [ebp - 0x46c], 0
lea eax, [ebp - 0x468]
push eax
lea ecx, [ebp - 0x46c]
push ecx
push 1
push 0xffffffffffffffff
mov edx, dword [ebp - 0x464]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x464]
push ecx
mov edx, dword [eax + 0x10]
call edx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5bc2d4
cmp dword [ebp - 0x468], 0
jbe 0x5bc2d4
xor eax, eax
mov word [ebp - 0x480], ax
xor ecx, ecx
mov dword [ebp - 0x47e], ecx
mov dword [ebp - 0x47a], ecx
mov dword [ebp - 0x476], ecx
mov word [ebp - 0x472], cx
push 0
push 0
lea edx, [ebp - 0x480]
push edx
push 0
push str.UUID
mov eax, dword [ebp - 0x46c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x46c]
push edx
mov eax, dword [ecx + 0x10]
call eax
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5bc2c0
push 0x100
mov ecx, dword [ebp - 0x478]
push ecx
mov edx, dword [ebp - 0x738]
add edx, 0x600
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0x46c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x46c]
push eax
mov ecx, dword [edx + 8]
call ecx
mov edx, dword [ebp - 0x464]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x464]
push ecx
mov edx, dword [eax + 8]
call edx
lea eax, [ebp - 0x464]
push eax
push 0
push 0x30
push str.SELECT__FROM_Win32_ComputerSystemProduct
push 0x601594
mov ecx, dword [ebp - 0x460]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x460]
push eax
mov ecx, dword [edx + 0x50]
call ecx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5bc42b
mov dword [ebp - 0x484], 0
mov dword [ebp - 0x488], 0
lea edx, [ebp - 0x484]
push edx
lea eax, [ebp - 0x488]
push eax
push 1
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x464]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x464]
push eax
mov ecx, dword [edx + 0x10]
call ecx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5bc417
cmp dword [ebp - 0x484], 0
jbe 0x5bc417
xor edx, edx
mov word [ebp - 0x498], dx
xor eax, eax
mov dword [ebp - 0x496], eax
mov dword [ebp - 0x492], eax
mov dword [ebp - 0x48e], eax
mov word [ebp - 0x48a], ax
push 0
push 0
lea ecx, [ebp - 0x498]
push ecx
push 0
push str.Name
mov edx, dword [ebp - 0x488]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x488]
push ecx
mov edx, dword [eax + 0x10]
call edx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5bc403
push 0x100
mov eax, dword [ebp - 0x490]
push eax
mov ecx, dword [ebp - 0x738]
add ecx, 0x800
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea edx, [ebp - 0x498]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x488]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x488]
push edx
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [ebp - 0x464]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x464]
push eax
mov ecx, dword [edx + 8]
call ecx
lea edx, [ebp - 0x464]
push edx
push 0
push 0x30
push 0x6015a8
push 0x6015f0
mov eax, dword [ebp - 0x460]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x460]
push edx
mov eax, dword [ecx + 0x50]
call eax
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5bc56d
mov dword [ebp - 0x49c], 0
mov dword [ebp - 0x4a0], 0
lea ecx, [ebp - 0x49c]
push ecx
lea edx, [ebp - 0x4a0]
push edx
push 1
push 0xffffffffffffffff
mov eax, dword [ebp - 0x464]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x464]
push edx
mov eax, dword [ecx + 0x10]
call eax
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5bc559
cmp dword [ebp - 0x49c], 0
jbe 0x5bc559
xor ecx, ecx
mov word [ebp - 0x4b0], cx
xor edx, edx
mov dword [ebp - 0x4ae], edx
mov dword [ebp - 0x4aa], edx
mov dword [ebp - 0x4a6], edx
mov word [ebp - 0x4a2], dx
push 0
push 0
lea eax, [ebp - 0x4b0]
push eax
push 0
push 0x6015f8
mov ecx, dword [ebp - 0x4a0]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x4a0]
push eax
mov ecx, dword [edx + 0x10]
call ecx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5bc545
push 0x100
mov edx, dword [ebp - 0x4a8]
push edx
mov eax, dword [ebp - 0x738]
add eax, 0xa00
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea ecx, [ebp - 0x4b0]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edx, dword [ebp - 0x4a0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4a0]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x464]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x464]
push edx
mov eax, dword [ecx + 8]
call eax
lea ecx, [ebp - 0x464]
push ecx
push 0
push 0x30
push str.SELECT__FROM_Win32_OperatingSystem
push 0x601660
mov edx, dword [ebp - 0x460]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x460]
push ecx
mov edx, dword [eax + 0x50]
call edx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5bc718
mov dword [ebp - 0x4b4], 0
mov dword [ebp - 0x4b8], 0
lea eax, [ebp - 0x4b4]
push eax
lea ecx, [ebp - 0x4b8]
push ecx
push 1
push 0xffffffffffffffff
mov edx, dword [ebp - 0x464]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x464]
push ecx
mov edx, dword [eax + 0x10]
call edx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5bc704
cmp dword [ebp - 0x4b4], 0
jbe 0x5bc704
xor eax, eax
mov word [ebp - 0x4c8], ax
xor ecx, ecx
mov dword [ebp - 0x4c6], ecx
mov dword [ebp - 0x4c2], ecx
mov dword [ebp - 0x4be], ecx
mov word [ebp - 0x4ba], cx
push 0
push 0
lea edx, [ebp - 0x4c8]
push edx
push 0
push 0x601668
mov eax, dword [ebp - 0x4b8]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x4b8]
push edx
mov eax, dword [ecx + 0x10]
call eax
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5bc6f0
push 0x100
mov ecx, dword [ebp - 0x4c0]
push ecx
mov edx, dword [ebp - 0x738]
add edx, 0xc00
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [ebp - 0x4cc], 0
jmp 0x5bc69a
mov eax, dword [ebp - 0x4cc]
add eax, 1
mov dword [ebp - 0x4cc], eax
mov ecx, dword [ebp - 0x4cc]
mov edx, dword [ebp - 0x738]
movzx eax, word [edx + ecx*2 + 0xc00]
test eax, eax
je 0x5bc6e3
mov ecx, dword [ebp - 0x4cc]
mov edx, dword [ebp - 0x738]
movzx eax, word [edx + ecx*2 + 0xc00]
cmp eax, 0x2e
jne 0x5bc6e1
xor ecx, ecx
mov edx, dword [ebp - 0x4cc]
mov eax, dword [ebp - 0x738]
mov word [eax + edx*2 + 0xc00], cx
jmp 0x5bc68b
lea ecx, [ebp - 0x4c8]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edx, dword [ebp - 0x4b8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4b8]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x464]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x464]
push edx
mov eax, dword [ecx + 8]
call eax
lea ecx, [ebp - 0x464]
push ecx
push 0
push 0x30
push 0x601680
push 0x6016b4
mov edx, dword [ebp - 0x460]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x460]
push ecx
mov edx, dword [eax + 0x50]
call edx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5bc85b
mov dword [ebp - 0x4d0], 0
mov dword [ebp - 0x4d4], 0
lea eax, [ebp - 0x4d0]
push eax
lea ecx, [ebp - 0x4d4]
push ecx
push 1
push 0xffffffffffffffff
mov edx, dword [ebp - 0x464]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x464]
push ecx
mov edx, dword [eax + 0x10]
call edx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5bc847
cmp dword [ebp - 0x4d0], 0
jbe 0x5bc847
xor eax, eax
mov word [ebp - 0x4e8], ax
xor ecx, ecx
mov dword [ebp - 0x4e6], ecx
mov dword [ebp - 0x4e2], ecx
mov dword [ebp - 0x4de], ecx
mov word [ebp - 0x4da], cx
push 0
push 0
lea edx, [ebp - 0x4e8]
push edx
push 0
push str.SerialNumber
mov eax, dword [ebp - 0x4d4]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x4d4]
push edx
mov eax, dword [ecx + 0x10]
call eax
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5bc833
push 0x100
mov ecx, dword [ebp - 0x4e0]
push ecx
mov edx, dword [ebp - 0x738]
add edx, 0xe00
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x4e8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x4d4]
push eax
mov ecx, dword [edx + 8]
call ecx
mov edx, dword [ebp - 0x464]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x464]
push ecx
mov edx, dword [eax + 8]
call edx
lea eax, [ebp - 0x464]
push eax
push 0
push 0x30
push str.SELECT__FROM_Win32_BIOS
push 0x60170c
mov ecx, dword [ebp - 0x460]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x460]
push eax
mov ecx, dword [edx + 0x50]
call ecx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5bc99e
mov dword [ebp - 0x4ec], 0
mov dword [ebp - 0x4f0], 0
lea edx, [ebp - 0x4ec]
push edx
lea eax, [ebp - 0x4f0]
push eax
push 1
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x464]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x464]
push eax
mov ecx, dword [edx + 0x10]
call ecx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5bc98a
cmp dword [ebp - 0x4ec], 0
jbe 0x5bc98a
xor edx, edx
mov word [ebp - 0x500], dx
xor eax, eax
mov dword [ebp - 0x4fe], eax
mov dword [ebp - 0x4fa], eax
mov dword [ebp - 0x4f6], eax
mov word [ebp - 0x4f2], ax
push 0
push 0
lea ecx, [ebp - 0x500]
push ecx
push 0
push str.SMBIOSBIOSVersion
mov edx, dword [ebp - 0x4f0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4f0]
push ecx
mov edx, dword [eax + 0x10]
call edx
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5bc976
push 0x100
mov eax, dword [ebp - 0x4f8]
push eax
mov ecx, dword [ebp - 0x738]
add ecx, 0x1000
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea edx, [ebp - 0x500]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x4f0]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x4f0]
push edx
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [ebp - 0x464]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x464]
push eax
mov ecx, dword [edx + 8]
call ecx
mov edx, dword [ebp - 0x460]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x460]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x45c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x45c]
push edx
mov eax, dword [ecx + 8]
call eax
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x444], 0
mov eax, 1
xor edx, edx
cpuid
mov dword [ebp - 0x42c], edx
mov dword [ebp - 0x444], eax
mov ecx, dword [ebp - 0x444]
push ecx
mov edx, dword [ebp - 0x42c]
push edx
push str._08X_08X
mov eax, dword [ebp - 0x738]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov dword [ebp - 0x504], 0
jmp 0x5bca2d
mov ecx, dword [ebp - 0x504]
add ecx, 1
mov dword [ebp - 0x504], ecx
cmp dword [ebp - 0x504], 0xa
jge 0x5bca8d
xor edx, edx
mov word [ebp - 0x708], dx
push 0x1fe
push 0
lea eax, [ebp - 0x706]
push eax
call fcn.00591690
add esp, 0xc
lea ecx, [ebp - 0x708]
push ecx
mov edx, dword [ebp - 0x504]
push edx
call fcn.0040e830
add esp, 8
test eax, eax
je 0x5bca8b
lea eax, [ebp - 0x708]
push eax
mov ecx, dword [ebp - 0x738]
add ecx, 0x200
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x5bca8d
jmp 0x5bca1e
mov byte [ebp - 0x440], 0
xor edx, edx
mov dword [ebp - 0x43f], edx
mov byte [ebp - 0x43b], dl
mov dword [ebp - 0x458], 0
lea eax, [ebp - 0x458]
push eax
push 0
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov ecx, dword [ebp - 0x458]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5bcb61
lea edx, [ebp - 0x458]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x5bcb61
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x70c], ecx
jmp 0x5bcb03
mov edx, dword [ebp - 0x70c]
mov eax, dword [edx]
mov dword [ebp - 0x70c], eax
cmp dword [ebp - 0x70c], 0
je 0x5bcb61
mov ecx, dword [ebp - 0x70c]
add ecx, 8
push ecx
call fcn.0040ea40
add esp, 4
mov dword [ebp - 0x710], eax
cmp dword [ebp - 0x710], 1
je 0x5bcb36
cmp dword [ebp - 0x710], 0
jne 0x5bcb5f
push 6
mov edx, dword [ebp - 0x70c]
add edx, 0x194
push edx
lea eax, [ebp - 0x440]
push eax
call fcn.00596f90
add esp, 0xc
cmp dword [ebp - 0x710], 0
jne 0x5bcb5f
jmp 0x5bcb61
jmp 0x5bcaf5
movzx ecx, byte [ebp - 0x43b]
push ecx
movzx edx, byte [ebp - 0x43c]
push edx
movzx eax, byte [ebp - 0x43d]
push eax
movzx ecx, byte [ebp - 0x43e]
push ecx
movzx edx, byte [ebp - 0x43f]
push edx
movzx eax, byte [ebp - 0x440]
push eax
push str._02X__02X__02X__02X__02X__02X
mov ecx, dword [ebp - 0x738]
add ecx, 0x400
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
mov dword [ebp - 0x448], 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x448]
push edx
push 0
push 0
push 0x601788
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x5bcbfa
mov eax, dword [ebp - 0x448]
push eax
push str._08X
mov ecx, dword [ebp - 0x738]
add ecx, 0x1200
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
xor edx, edx
mov word [ebp - 0x428], dx
push 0x206
push 0
lea eax, [ebp - 0x426]
push eax
call fcn.00591690
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x220], cx
push 0x206
push 0
lea edx, [ebp - 0x21e]
push edx
call fcn.00591690
add esp, 0xc
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x44c], 0
lea eax, [ebp - 0x428]
push eax
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
jl 0x5bce72
push str.kernel32.dll
lea ecx, [ebp - 0x428]
push ecx
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x5bcd38
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x714], eax
cmp dword [ebp - 0x714], 0xffffffff
je 0x5bcd38
mov dword [ebp - 0x71c], 0
xor ecx, ecx
mov dword [ebp - 0x718], ecx
push 0
push 0
lea edx, [ebp - 0x71c]
push edx
mov eax, dword [ebp - 0x714]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x5bcd2b
lea ecx, [ebp - 0x71c]
push ecx
call fcn.0040e600
add esp, 4
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x434], edx
mov edx, dword [ebp - 0x714]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.user32.dll
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x5bcdd0
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x720], eax
cmp dword [ebp - 0x720], 0xffffffff
je 0x5bcdd0
mov dword [ebp - 0x728], 0
xor eax, eax
mov dword [ebp - 0x724], eax
push 0
push 0
lea ecx, [ebp - 0x728]
push ecx
mov edx, dword [ebp - 0x720]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x5bcdc3
lea eax, [ebp - 0x728]
push eax
call fcn.0040e600
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0x720]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.notepad.exe
lea edx, [ebp - 0x428]
push edx
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x5bce72
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x72c], eax
cmp dword [ebp - 0x72c], 0xffffffff
je 0x5bce72
mov dword [ebp - 0x734], 0
xor edx, edx
mov dword [ebp - 0x730], edx
push 0
push 0
lea eax, [ebp - 0x734]
push eax
mov ecx, dword [ebp - 0x72c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x5bce65
lea edx, [ebp - 0x734]
push edx
call fcn.0040e600
add esp, 4
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x44c], edx
mov eax, dword [ebp - 0x72c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x44c]
push ecx
mov edx, dword [ebp - 0x450]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x434]
push edx
mov eax, dword [ebp - 0x438]
push eax
push str._llu__llu__llu
push 0x100
mov ecx, dword [ebp - 0x738]
add ecx, 0x1400
push ecx
call fcn.0059a154
add esp, 0x24
mov eax, dword [ebp - 0x738]
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00590c4b
mov esp, ebp
pop ebp
ret