Function at 0x4bbf5a
Capabilities:
Get common file path
Get disk size
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x688
mov eax, dword [0x5438cc]
push ebx
push esi
push edi
mov edi, 0x5438cc
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
push 0
mov dword [ebp - 8], eax
call dword [sym.imp.MSVCR80.dll__time64]
pop ecx
push eax
call dword [sym.imp.MSVCR80.dll_srand]
pop ecx
call dword [sym.imp.MSVCR80.dll_rand]
push eax
push str._05ld
lea ecx, [ebp - 8]
call fcn.0040a313
pop ecx
pop ecx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov ebx, 0x103
push ebx
lea eax, [ebp - 0x47b]
push 0
push eax
mov byte [ebp - 0x47c], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x10
lea eax, [ebp - 0x20]
push eax
push 0x4da4cc
call sub.MSVCR80.dll_memcmp
add esp, 0xc
test eax, eax
je 0x4bc02a
movzx eax, byte [ebp - 0x11]
push eax
movzx eax, byte [ebp - 0x12]
push eax
movzx eax, byte [ebp - 0x13]
push eax
movzx eax, byte [ebp - 0x14]
push eax
movzx eax, byte [ebp - 0x15]
push eax
movzx eax, byte [ebp - 0x16]
push eax
movzx eax, byte [ebp - 0x17]
push eax
movzx eax, byte [ebp - 0x18]
push eax
movzx eax, word [ebp - 0x1a]
push eax
movzx eax, word [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 0x47c]
push str._08lX_04X_04x_02X_02X_02X_02X_02X_02X_02X_02X
push eax
call fcn.004bc4e6
add esp, 0x34
lea eax, [ebp - 0x47c]
push eax
lea esi, [ebp - 0x164]
call fcn.00429668
push dword [eax]
lea eax, [ebp - 8]
push eax
call fcn.00407371
lea eax, [ebp - 0x160]
cmp dword [ebp - 0x164], eax
je 0x4bc062
push dword [ebp - 0x164]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [0x5438cc]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
movzx eax, word [ebp - 0x2e]
push eax
movzx eax, word [ebp - 0x24]
push eax
movzx eax, word [ebp - 0x28]
push eax
movzx eax, word [ebp - 0x30]
push eax
movzx eax, word [ebp - 0x2a]
push eax
movzx eax, word [ebp - 0x26]
push eax
movzx eax, word [ebp - 0x22]
push eax
lea eax, [ebp - 0x10]
push str._03d_02d_02d_04d_02d_02d_02d
push eax
call fcn.0042a016
mov eax, dword [ebp - 0x10]
add esp, 0x24
push dword [eax - 0xc]
push eax
lea eax, [ebp - 8]
call fcn.004246f5
push ebx
lea eax, [ebp - 0x373]
push 0
push eax
mov byte [ebp - 0x374], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x374]
mov ebx, 0x104
push eax
mov dword [ebp - 0x40], ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 7
xor eax, eax
mov byte [ebp - 0x60], 0
pop ecx
lea edi, [ebp - 0x5f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x374]
push eax
call sub.MSVCR80.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.004bcf98
mov edi, dword [ebp + 8]
add esp, 0xc
mov ecx, 0x5438cc
mov esi, edi
call fcn.0040121e
xor esi, esi
mov dword [ebp - 0xc], esi
mov eax, dword [ebp - 0xc]
movzx eax, byte [ebp + eax - 0x60]
push eax
push str._02x
mov ecx, edi
call fcn.0040a313
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x10
pop ecx
pop ecx
jl 0x4bc137
mov eax, dword [edi]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 8]
call fcn.004246f5
push 0x206
lea eax, [ebp - 0x682]
push esi
push eax
mov word [ebp - 0x684], si
call sub.MSVCR80.dll_memset
add esp, 0xc
push ebx
lea eax, [ebp - 0x684]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov dword [ebp - 0x3c], esi
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
lea eax, [ebp - 0x3c]
push eax
push esi
push esi
lea eax, [ebp - 0x684]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push dword [ebp - 0x3c]
lea ecx, [ebp - 8]
push str._010lu
call fcn.0040a313
push 0x103
lea eax, [ebp - 0x26b]
push esi
push eax
mov byte [ebp - 0x26c], 0
call sub.MSVCR80.dll_memset
mov edi, dword [ebp - 8]
add esp, 0x14
push edi
lea esi, [ebp - 0xe4]
call fcn.0042c014
push dword [eax]
lea eax, [ebp - 0x26c]
push ebx
push eax
call dword [sym.imp.MSVCR80.dll_strcpy_s]
lea eax, [ebp - 0xe0]
add esp, 0xc
cmp dword [ebp - 0xe4], eax
je 0x4bc214
push dword [ebp - 0xe4]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
lea eax, [ebp - 0x26c]
push eax
call sub.MSVCR80.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.004bcf98
mov esi, dword [ebp + 8]
add esp, 0xc
call fcn.00401314
xor ebx, ebx
movzx eax, byte [ebp + ebx - 0x60]
push eax
push str._02x
mov ecx, esi
call fcn.0040a313
inc ebx
cmp ebx, 0x10
pop ecx
pop ecx
jl 0x4bc23f
mov eax, dword [esi]
push ecx
sub eax, 0x10
mov ebx, esp
call fcn.0042a0e1
add eax, 0x10
push ecx
mov dword [ebx], eax
mov eax, esp
push str.idex
call fcn.004014ce
call fcn.004bc421
push ecx
mov eax, esp
push 0x513864
call fcn.004014ce
push ecx
mov eax, esp
push str.idno
call fcn.004014ce
call fcn.004bc421
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401239
lea eax, [edi - 0x10]
call fcn.00401239
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4