Function at 0x464920
Capabilities:
Get common file path
Get startup folder
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62ab85
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x6d45e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x6df404], 0
je 0x464978
cmp esi, 0x6df3f4
je 0x46496e
push 0xffffffffffffffff
push 0
push 0x6df3f4
call fcn.00404890
mov eax, 1
jmp 0x464f7a
push ecx
xorps xmm0, xmm0
mov ecx, esp
push str.rootCIMV2
movdqu xmmword [ebp - 0x200], xmm0
movdqu xmmword [ebp - 0x1f0], xmm0
movq qword [ebp - 0x1e0], xmm0
call fcn.00409a40
lea ecx, [ebp - 0x200]
call fcn.004095e0
mov dword [ebp - method.CWMIQueryCPUID.virtual_0], vtable.CWMIQueryCPUID.0
mov dword [ebp - 0x1dc], 0xf
mov dword [ebp - 0x1e0], 0
mov byte [ebp - 0x1f0], 0
push ecx
mov ecx, esp
mov dword [ebp - 4], 0
push str.Select__from_Win32_Processor
call fcn.00409a40
lea ecx, [ebp - 0x200]
call fcn.004096d0
push ecx
xorps xmm0, xmm0
mov ecx, esp
push str.rootCIMV2
movdqu xmmword [ebp - 0x1c0], xmm0
movdqu xmmword [ebp - 0x1b0], xmm0
movq qword [ebp - 0x1a0], xmm0
call fcn.00409a40
lea ecx, [ebp - 0x1c0]
call fcn.004095e0
mov dword [ebp - method.CWMIQueryDisk.virtual_0], vtable.CWMIQueryDisk.0
mov dword [ebp - 0x19c], 0xf
mov dword [ebp - 0x1a0], 0
mov byte [ebp - 0x1b0], 0
push ecx
mov ecx, esp
mov byte [ebp - 4], 1
push str.SELECT__FROM_Win32_DiskDrive
call fcn.00409a40
lea ecx, [ebp - 0x1c0]
call fcn.004096d0
lea eax, [ebp - 0x1b0]
push eax
lea edx, [ebp - 0x1f0]
lea ecx, [ebp - 0x138]
call fcn.004650a0
add esp, 4
mov byte [ebp - 4], 2
cmp dword [ebp - 0x128], 0
jne 0x464a92
xor esi, esi
jmp 0x464f30
push 4
push 0
lea eax, [ebp - 0x180]
push eax
lea ecx, [ebp - 0x1b0]
call fcn.0040da30
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x180]
cmp dword [ebp - 0x16c], 0x10
mov eax, 4
mov edi, dword [ebp - 0x170]
cmovae ecx, dword [ebp - 0x180]
cmp edi, eax
cmovb eax, edi
push eax
push str.0000
push ecx
call fcn.00406290
add esp, 0xc
test eax, eax
jne 0x464af7
cmp edi, 4
jae 0x464aed
or eax, 0xffffffff
jmp 0x464af5
xor eax, eax
cmp edi, 4
setne al
test eax, eax
sete al
test al, al
je 0x464e97
lea eax, [ebp - 0x118]
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x168]
call fcn.004046e0
push 7
push str.pddbot
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 4
call fcn.00405dc0
push str.machine.ini
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x1d8]
push eax
call fcn.0040bb70
add esp, 8
mov byte [ebp - 4], 5
lea eax, [ebp - 0x168]
lea ecx, [ebp - 0x150]
push eax
call fcn.00465010
push 0
lea eax, [ebp - 0x150]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.005c8d30
add esp, 0xc
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x11c], eax
test ecx, ecx
je 0x464ba7
cmp ecx, 1
je 0x464ba7
mov eax, 1
jmp 0x464ba9
xor eax, eax
test al, al
mov byte [ebp - 4], 5
sete al
cmp dword [ebp - 0x13c], 8
mov byte [ebp - 0x201], al
jb 0x464bd5
push dword [ebp - 0x150]
call fcn.004c41b0
mov al, byte [ebp - 0x201]
add esp, 4
test al, al
je 0x464c10
push ecx
lea eax, [ebp - 0x168]
push eax
lea ecx, [ebp - 0x150]
call fcn.00465010
lea eax, [ebp - 0x150]
mov byte [ebp - 4], 7
push 0
push eax
call fcn.005c8470
add esp, 8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x150]
call fcn.00415d80
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x1d8]
mov ecx, 0x6f5fac
push eax
call fcn.00404890
mov ecx, 0x6f5f88
call fcn.004064c0
push str.machineId
lea ecx, [ebp - 0x21c]
call fcn.004046e0
push 0x69ae8c
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 8
call fcn.004046e0
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0x234]
mov ecx, 0x6f5f88
push eax
lea eax, [ebp - 0x198]
push eax
call fcn.00406bd0
cmp dword [ebp - 0x220], 0x10
jb 0x464c8d
push dword [ebp - 0x234]
call fcn.004c41b0
add esp, 4
mov dword [ebp - 0x220], 0xf
mov dword [ebp - 0x224], 0
mov byte [ebp - 0x234], 0
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x208], 0x10
jb 0x464cc3
push dword [ebp - 0x21c]
call fcn.004c41b0
add esp, 4
cmp dword [ebp - 0x188], 0
mov dword [ebp - 0x208], 0xf
mov dword [ebp - 0x20c], 0
mov byte [ebp - 0x21c], 0
jne 0x464dd9
push 1
mov edx, 0x24
lea ecx, [ebp - 0x150]
call fcn.00414770
add esp, 4
push str.machineId
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 0xd
call fcn.004046e0
push 0x69ae8c
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0xe
call fcn.004046e0
lea eax, [ebp - 0x150]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x234]
mov ecx, 0x6f5f88
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00406d80
lea ecx, [ebp - 0x21c]
call fcn.004047b0
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 0xd
call fcn.004047b0
push 0x698588
lea ecx, [ebp - 0x21c]
call fcn.004046e0
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 0x10
push eax
mov ecx, 0x6f5f88
call fcn.00406a80
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0xd
call fcn.004047b0
cmp dword [ebp - 0x13c], 0x10
lea edx, [ebp - 0x150]
push dword [ebp - 0x140]
cmovae edx, dword [ebp - 0x150]
lea ecx, [ebp - 0x21c]
call fcn.00408830
add esp, 4
mov ecx, 0x6df3f4
push eax
call fcn.0040b3d0
lea ecx, [ebp - 0x21c]
call fcn.004047b0
jmp 0x464e22
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x138]
call fcn.00404890
cmp dword [ebp - 0x124], 0x10
lea edx, [ebp - 0x138]
push dword [ebp - 0x128]
cmovae edx, dword [ebp - 0x138]
lea ecx, [ebp - 0x150]
call fcn.00408830
add esp, 4
mov ecx, 0x6df3f4
push eax
call fcn.0040b3d0
lea ecx, [ebp - 0x150]
call fcn.004047b0
cmp dword [ebp - 0x184], 0x10
jb 0x464e44
push dword [ebp - 0x198]
call fcn.004c41b0
add esp, 4
cmp dword [ebp - 0x1c4], 0x10
mov dword [ebp - 0x184], 0xf
mov dword [ebp - 0x188], 0
mov byte [ebp - 0x198], 0
jb 0x464e76
push dword [ebp - 0x1d8]
call fcn.004c41b0
add esp, 4
mov dword [ebp - 0x1c4], 0xf
mov dword [ebp - 0x1c8], 0
mov byte [ebp - 0x1d8], 0
mov byte [ebp - 4], 3
jmp 0x464eca
cmp dword [ebp - 0x124], 0x10
lea edx, [ebp - 0x138]
push dword [ebp - 0x128]
cmovae edx, dword [ebp - 0x138]
lea ecx, [ebp - 0x168]
call fcn.00408830
add esp, 4
mov ecx, 0x6df3f4
push eax
call fcn.0040b3d0
cmp dword [ebp - 0x154], 0x10
jb 0x464ee1
push dword [ebp - 0x168]
call fcn.004c41b0
add esp, 4
cmp esi, 0x6df3f4
je 0x464ef9
push 0xffffffffffffffff
push 0
push 0x6df3f4
mov ecx, esi
call fcn.00404890
cmp dword [ebp - 0x16c], 0x10
mov esi, 1
jb 0x464f15
push dword [ebp - 0x180]
call fcn.004c41b0
add esp, 4
mov dword [ebp - 0x16c], 0xf
mov dword [ebp - 0x170], 0
mov byte [ebp - 0x180], 0
cmp dword [ebp - 0x124], 0x10
jb 0x464f47
push dword [ebp - 0x138]
call fcn.004c41b0
add esp, 4
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 0x124], 0xf
mov dword [ebp - 0x128], 0
mov byte [ebp - 0x138], 0
call fcn.00409d60
lea ecx, [ebp - 0x200]
call fcn.00409bc0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c392d
mov esp, ebp
pop ebp
ret