Function at 0x588800
Capabilities:
Get common file path
Get system information on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x6a0
mov qword [rsp + 0x118], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rdx, qword [rsp + 0x6b0]
mov qword [0x00865fd0], rdx
lea rdx, [0x007986b0]
xor ecx, ecx
call fcn.006aa3c4
xor edx, edx
lea ecx, [rdx + 2]
call fcn.006aa3c4
test rax, rax
je 0x5888b9
lea r8, [rsp + 0x6b0]
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.004021a8
nop
lea rcx, [0x0085e7c0]
cmp rax, rcx
je 0x588885
mov r8, qword [rax + 0x20]
mov rdx, qword [rax + 0x28]
call fcn.0040289c
nop
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
cmp rcx, rax
je 0x5888b9
test rcx, rcx
je 0x5888b9
mov rdx, qword [rsp + 0x30]
sub rdx, rcx
mov edi, 0x100
cmp rdx, rdi
jbe 0x5888b2
call fcn.006a4944
jmp 0x5888be
call fcn.006a3610
jmp 0x5888be
mov edi, 0x100
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x270]
mov dword [0x008655f8], edx
and dword [rsp + 0x30], 0
xor eax, eax
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x3c], eax
xor ecx, ecx
cpuid
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x3c], edx
cmp eax, 1
jl 0x58892e
mov eax, 1
xor ecx, ecx
cpuid
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x38], ecx
shr edx, 0x1a
and dl, 1
mov byte [0x008655fc], dl
xor ecx, ecx
call fcn.006a5720
mov dword [0x00865610], eax
lea rcx, [0x00865614]
mov edx, 0x26f
mov dword [0x0085ad54], 0x270
mov eax, dword [rcx - 4]
imul eax, eax, 0x10dcd
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x588951
mov r8d, 0x104
lea rdx, [rsp + 0x490]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r8, [rsp + 0x6b0]
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x200]
call fcn.004023b4
nop
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x120]
call fcn.00402190
nop
mov r8b, 0x5c
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.0046621c
nop
lea rax, [rsp + 0x120]
mov rcx, qword [rsp + 0x148]
cmp rcx, rax
je 0x5889fb
test rcx, rcx
je 0x5889fb
mov rdx, qword [rsp + 0x120]
sub rdx, rcx
cmp rdx, rdi
jbe 0x5889f5
call fcn.006a4944
jmp 0x5889fb
call fcn.006a3610
nop
lea rax, [rsp + 0x200]
mov rcx, qword [rsp + 0x248]
cmp rcx, rax
je 0x588a38
test rcx, rcx
je 0x588a38
mov rax, qword [rsp + 0x200]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, rdi
jbe 0x588a33
call fcn.006a4944
jmp 0x588a38
call fcn.006a3610
lea r8, str.Settings_
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x30]
call fcn.00402658
nop
lea rbx, [0x0085e958]
cmp rax, rbx
je 0x588a6f
mov r8, qword [rax + 0x20]
mov rdx, qword [rax + 0x28]
mov rcx, rbx
call fcn.0040289c
nop
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
cmp rcx, rax
je 0x588a9c
test rcx, rcx
je 0x588a9c
mov rdx, qword [rsp + 0x30]
sub rdx, rcx
cmp rdx, rdi
jbe 0x588a97
call fcn.006a4944
jmp 0x588a9c
call fcn.006a3610
mov r8, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0xd8]
lea rcx, [0x0085e988]
call fcn.0040289c
nop
lea rcx, [rsp + 0x150]
call fcn.004d1360
nop
lea r8, str.dcppboot.xml
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x80]
call fcn.00402658
nop
mov r9d, 1
mov r8d, 0x80000000
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.005944d4
nop
lea rdx, [rsp + 0xe0]
mov rcx, rax
call fcn.005954d8
nop
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.005f51d4
nop
lea rax, [rsp + 0xe0]
mov rcx, qword [rsp + 0x108]
cmp rcx, rax
je 0x588b57
test rcx, rcx
je 0x588b57
mov rdx, qword [rsp + 0xe0]
sub rdx, rcx
cmp rdx, rdi
jbe 0x588b51
call fcn.006a4944
jmp 0x588b57
call fcn.006a3610
nop
lea rax, [0x007955b8]
mov qword [rsp + 0x30], rax
lea rax, [0x007955c8]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
call fcn.0059492c
lea r11, [0x007955f8]
mov qword [rsp + 0x38], r11
lea rax, [0x007955e8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0xa8]
cmp rcx, rax
je 0x588bc7
test rcx, rcx
je 0x588bc7
mov rdx, qword [rsp + 0x80]
sub rdx, rcx
cmp rdx, rdi
jbe 0x588bc2
call fcn.006a4944
jmp 0x588bc7
call fcn.006a3610
lea rcx, [rsp + 0x150]
call fcn.004d11d4
mov rax, qword [rsp + 0x1f0]
mov rax, qword [rax]
mov qword [rsp + 0x1e8], rax
mov rax, qword [rax]
mov qword [rsp + 0x1f0], rax
mov byte [rsp + 0x1f8], 0
lea r8, [rsp + 0x6b0]
lea rdx, str.ConfigPath
lea rcx, [rsp + 0x30]
call fcn.004021a8
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x150]
call fcn.005f40f0
mov sil, al
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
cmp rcx, rax
je 0x588c55
test rcx, rcx
je 0x588c55
mov rdx, qword [rsp + 0x30]
sub rdx, rcx
cmp rdx, rdi
jbe 0x588c50
call fcn.006a4944
jmp 0x588c55
call fcn.006a3610
test sil, sil
je 0x588ee3
lea rax, [rsp + 0x6b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x6b0]
lea r8, [rsp + 0x6b0]
xor edx, edx
lea rcx, [rsp + 0xe0]
call fcn.00415c3c
nop
lea rax, [rsp + 0x280]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHFOLDER.dll_SHGetFolderPathW]
lea r8, [rsp + 0x6b0]
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x30]
call fcn.004023b4
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x80]
call fcn.00402190
mov rsi, rax
lea rdx, str.APPDATA
lea rcx, [rsp + 0xe0]
call fcn.005407dc
cmp rsi, rax
je 0x588d04
mov r8, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x28]
mov rcx, rax
call fcn.0040289c
nop
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0xa8]
cmp rcx, rax
je 0x588d3b
test rcx, rcx
je 0x588d3b
mov rdx, qword [rsp + 0x80]
sub rdx, rcx
cmp rdx, rdi
jbe 0x588d35
call fcn.006a4944
jmp 0x588d3b
call fcn.006a3610
nop
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
cmp rcx, rax
je 0x588d6f
test rcx, rcx
je 0x588d6f
mov rax, qword [rsp + 0x30]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, rdi
jbe 0x588d6a
call fcn.006a4944
jmp 0x588d6f
call fcn.006a3610
lea rax, [rsp + 0x280]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
xor ecx, ecx
call qword [sym.imp.SHFOLDER.dll_SHGetFolderPathW]
lea r8, [rsp + 0x6b0]
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x30]
call fcn.004023b4
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x80]
call fcn.00402190
mov rsi, rax
lea rdx, str.PERSONAL
lea rcx, [rsp + 0xe0]
call fcn.005407dc
cmp rsi, rax
je 0x588de8
mov r8, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x28]
mov rcx, rax
call fcn.0040289c
nop
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0xa8]
cmp rcx, rax
je 0x588e1f
test rcx, rcx
je 0x588e1f
mov rdx, qword [rsp + 0x80]
sub rdx, rcx
cmp rdx, rdi
jbe 0x588e19
call fcn.006a4944
jmp 0x588e1f
call fcn.006a3610
nop
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
cmp rcx, rax
je 0x588e53
test rcx, rcx
je 0x588e53
mov rax, qword [rsp + 0x30]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, rdi
jbe 0x588e4e
call fcn.006a4944
jmp 0x588e53
call fcn.006a3610
lea rcx, [rsp + 0x150]
call fcn.004d11d4
mov rax, qword [rsp + 0x1f0]
mov rdx, qword [rax]
add rdx, 0x60
xor r9d, r9d
lea r8, [rsp + 0xe0]
lea rcx, [rsp + 0x80]
call fcn.0058b150
nop
cmp rax, rbx
je 0x588e9e
mov r8, qword [rax + 0x20]
mov rdx, qword [rax + 0x28]
mov rcx, rbx
call fcn.0040289c
nop
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0xa8]
cmp rcx, rax
je 0x588ed5
test rcx, rcx
je 0x588ed5
mov rdx, qword [rsp + 0x80]
sub rdx, rcx
cmp rdx, rdi
jbe 0x588ecf
call fcn.006a4944
jmp 0x588ed5
call fcn.006a3610
nop
lea rcx, [rsp + 0xe0]
call fcn.00415b98
nop
lea rcx, [rsp + 0x150]
call fcn.004d126c
nop
jmp 0x588eff
mov rax, qword [0x0085e978]
mov rcx, qword [0x0085e980]
sub rax, rcx
cmp rax, 2
jbe 0x588f26
cmp byte [rcx + 1], 0x3a
je 0x588f8b
cmp byte [rcx], 0x2f
je 0x588f8b
cmp byte [rcx], 0x5c
je 0x588f8b
mov r8, rbx
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x80]
call fcn.00402448
nop
cmp rax, rbx
je 0x588f55
mov r8, qword [rax + 0x20]
mov rdx, qword [rax + 0x28]
mov rcx, rbx
call fcn.0040289c
nop
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0xa8]
cmp rcx, rax
je 0x588f8b
test rcx, rcx
je 0x588f8b
mov rdx, qword [rsp + 0x80]
sub rdx, rcx
cmp rdx, rdi
jbe 0x588f86
call fcn.006a4944
jmp 0x588f8b
call fcn.006a3610
mov rdx, rbx
lea rcx, [rsp + 0xe0]
call fcn.004029b4
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.0058904c
nop
cmp rax, rbx
je 0x588fc2
mov r8, qword [rax + 0x20]
mov rdx, qword [rax + 0x28]
mov rcx, rbx
call fcn.0040289c
nop
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0xa8]
cmp rcx, rax
je 0x588ff8
test rcx, rcx
je 0x588ff8
mov rdx, qword [rsp + 0x80]
sub rdx, rcx
cmp rdx, rdi
jbe 0x588ff3
call fcn.006a4944
jmp 0x588ff8
call fcn.006a3610
mov rcx, rbx
call fcn.00595338
nop
lea rax, [rsp + 0xb0]
mov rcx, qword [rsp + 0xd8]
cmp rcx, rax
je 0x589037
test rcx, rcx
je 0x589037
mov rdx, qword [rsp + 0xb0]
sub rdx, rcx
cmp rdx, rdi
jbe 0x589032
call fcn.006a4944
jmp 0x589037
call fcn.006a3610
lea r11, [rsp + 0x6a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret